this hack involves using the windows shell to gain access to the admin desktop. It is actually quite simple to do and is about the same in usefullness as the--SU command running linux/unix. To do so all you need is the admin password for a local or a domain wide account.
first enter the command line by executing a shell command or is you are like me and have replaced the process explorer (task manager with another program like CMD) then hit the secure attention sequence.
C:\%USERPROFILE%\ > taskkill /f /IM:explorer.exe
you should have killed the desktop application, now your background should just be showing.
now enter the all mighty su command from the command line prompt that you have created in the process.
C:\%USERPROFILE%\ > runass /env /profile /user:<administrator account> "<program name"
change the administrator accoutn and the program name to the appropriate user format using Machine/User or account@FQDN. for the sake of simplicity i will use admin.
C:\USERPROFILE%\ > runas /env /profile /user:admin@somedomain.com "explorer.exe"
once you hit the return or enter key you screen should feeze stdin and ask for a password enter your password and behold your process has joined the ranks of administrative process with all full privlages and other things avaliable to you. Go ahead run that regedit scriplet to do your non-evil bidding and enjoy the fact that you also have access to your documents that you need.
by Æleen Frisch
04/26/2001
runas: Run a Command as a Different User
Best system administrative practices call for running commands as Administrator only when it is absolutely necessary and using an unprivileged user account the rest of the time. Under Windows NT, this was not possible. With Windows 2000, however, it is easy to accomplish via the runas command. This command allows you to run a specified command as a different user by providing the proper password.
One of the most convenient ways to use this is to create a separate command window for Administrator while logged in as your normal user, as in this example:
C:\> runas /user:administrator@ahania.com cmd
Enter password for administrator@ahania.com: **********
Attempting to start "cmd" as user
"administrator@ahania.com"...
runas prompts you for the required password and then starts another command shell in a new window. Note that you must provide the fully qualified username of the desired user account when running this command in a Windows 2000 domain.
Unix folks will see similarities to the Unix su command.