How to find out who runs the runas application?

Question

background:

My organization has an application that we use for some critical functions, but it only works best when it is run as a specific user.

The reason for this is that the application saves most of its configuration as a local user session, and therefore it becomes a multi-user nightmare, which means that we had to duplicate a lot of work.

We assigned the user to run the application and found a solution by setting the runas desktop shortcut. The problem is that we found that the application cannot be started anymore as soon as at the same time. It allows only 1 launch instance for each user.

The quick access code that I use for the application:

C:\Windows\System32\runas.exe /user:mydomain\runas_user /savecreds "C:\Program Files\MyApp\MyApp.exe"

As such, I was trying to determine how I can see who is currently using the runas application, so I can get them to close it gracefully. The task manager only shows “runas_user” in the User Name, but I suppose there should be some way to determine who started it or which user session is looking at it.

Question:

Is there any way to find out (preferably using powershell or another script) that is currently running the application?

Answer 1

Windows . Windows 2008+ - 4624 () 4625 (). , , .

PDF sans.org( 10). , , , "3.7 NewCredentials":

RunAs /netonly Windows / logon type 9. RunAs /netonly , , , Windows , , RunAs . /netonly Windows 2

PowerShell:

$recentSecLog = 
Get-EventLog -LogName Security -Newest 1000 | Where {$_.EventID -match "4624|4625"}

$recentSecLog | Where {$_.message -match "Logon\sType:\s+9"}