9

I want to write Windows usernames in a csv file. I wrote this script in Linux, connected to Win10 PC via krdc and RDP protocol. I shared my Linux drive over that remote desktop app with Win10 and then I ran this scipt from that shared disk in Win10.

If I do this via command prompt as administrator it runs as expected. However, if I run it as a normal user and UAC is confirmed as Yes, the output file is not created.

How to run this script as a normal user, answering yes to UAC and having that file writen in my mounted drive over rdp protocol in krdc remote app where Win10 sees that drive as \\TSCLIENT?

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

import ctypes
import sys
import subprocess


def is_admin():
    try:
        return ctypes.windll.shell32.IsUserAnAdmin()
    except:
        return False

if is_admin():
    subprocess.call(['wmic', '/output:usracc.txt', 'useraccount', 'list', 'full', '/format:csv'])
else:
    # Re-run the program with admin rights
    ctypes.windll.shell32.ShellExecuteW(None, "runas", sys.executable, __file__, None, 1)
Hrvoje T
  • 2,003
  • 3
  • 20
  • 32
  • /INTERACTIVE:OFF ? – dani herrera Apr 03 '18 at 21:47
  • @danihp It's not only about `wmic`, it's about every scrypt which needs evelation. However, I think I found what was wrong. I use Kubuntu for writing and Win10 for testing. I use Win10 with `krdc` remote application from Kubuntu. I mount my Kubuntu hard-drive in Win10. Win10 sees this drive as `\\TSCLIENT`. When I run my scrypt as admin in cmd prompt everything is ok. When I run it as normal user with UAC on `\\TSCLIENT` mounted drive, the script doesn't run as elevated when answering `Yes` to UAC. After that I copied my scrypt localy on Win10 PC, run it as normal user with UAC and it worked. – Hrvoje T Apr 04 '18 at 05:41
  • Is this Win10 bug or normal behavior I don't know. Sometimes, when I try to open cmd console as admin in this mounted location eg. `U:` drive, it puts me in `C:\Windows\system32` saying `The system cannot find the drive specified.`, but doing the same thing as normal user I can open console on remote location. – Hrvoje T Apr 04 '18 at 05:49
  • There is not much difference between run as Administrator and normal user (if the administrator has not opened that directory or service to valid users). Running as an administrator does not give you any special authority. If you have a given right, it asks if you are sure to use it. I don't understand how to connect to a Linux machine with a remote Desktop (I think this is the new mode, only ROOT can access virtual directories). – dsgdfg Apr 06 '18 at 12:08

1 Answers1

2

If you want to do this with out having administrator privileges you can:

import os
import csv

userList = os.popen("net user").read().split()[5:-4]

outFile = open("userList.csv", 'w')
with outFile:
    fileWriter = csv.writer(outFile)

for user in userList:
    print(user)
    fileWriter.writerow([user])

That code will give you a file "userList.csv" with all the users without being an administrator

Ricardo
  • 691
  • 5
  • 13
  • Thank you, but I need to elevate this script so I can use the solution with other scripts too, which can't work without UAC elevation. I saw too late after asking the question, that this is rdp mount disk and UAC issue. Localy everything works as expected. – Hrvoje T Apr 10 '18 at 06:47
  • This guy here did something pretty similar @sundar_ima [here](https://stackoverflow.com/questions/19672352/how-to-run-python-script-with-elevated-privilege-on-windows) – Ricardo Apr 10 '18 at 19:01