Windows DNS console (DNSMgmt.msc) - Run as other Domain users

Question

I have a requirement to manage multiple domains from one terminal server. The reason for this is to revoke domain admin rights from users, and have domain controller tools run from a terminal server, but for multiple domains, thus avoiding the need to log on to domain controllers.

I have had some success with this. Using the runas command, I have been able to run AD users and computers, and AD sites and services for multiple domains using a shortcut e.g C:\Windows\System32\runas.exe /netonly /user:DEV\username "mmc %SystemRoot%\system32\dsa.msc /domain=ukdev.uk.domain.com"

The DNS console is not working though. I can run that as C:\Windows\System32\runas.exe /netonly /user:TEST\username "mmc %SystemRoot%\system32\dnsmgmt.msc"

Once run, if I select the DNS server on the other domain by inputting the ip address to connect to,I get an access denied message. The servers are using windows 2008 R2.

Has anyone had any success running the DNS console in the context of another domain user? I am running as a domain admin in the target domain.

Answer 1

I was able to do this, but fair warning, it consists of some very hacky stuff.

Basically, I would get "Access Denied" unless I was able to elevate privileges within the context of the other Domain user.

So, I broke this down into the steps required:

1. Get CMD open in the context of DOMAIN\User2
2. Elevate privileges to Administrator within the context of DOMAIN\User2
3. Open CMD with elevated privileges for DOMAIN\User2
4. Run DNSMGMT.MSC (opening as an Add-in from MMC at this step also fails)

With that in mind, this is the command I now use as DOMAIN\User1:

runas /user:DOMAIN\User2 /savecred "powershell -c start-process -FilePath cmd.exe -verb runAs -ArgumentList ""/c"",""dnsmgmt.msc"""

This command does the 4 steps all wrapped into 1. This obviously requires that you have powershell installed & available as a command.

PC is running Windows 10. You can skip the elevation of privileges if you disable "EnableLUA" in the registry, but this generally hoses Windows 10 so I don't recommend it.