JSI Tip 3286. Problems with the RunAs command after applying Windows 2000 SP1?

After you install Service Pack 1 on Windows 2000, the RunAS command may not function properly.

When you type runas /? at a CMD prompt, the following is displayed:

RUNAS USAGE:RUNAS [/profile] [/env] [/netonly] /user: program   /profile        if the user's profile needs to be loaded   /env            to use current environment instead of user's.   /netonly        use if the credentials specified are for remote access only.   /user            should be in form USER@DOMAIN or DOMAINUSER   program         command line for EXE.  See below for examplesExamples:> runas /profile /user:mymachineadministrator cmd> runas /profile /env /user:mydomainadmin "mmc %windir%system32dsa.msc"> runas /env /user:[email protected] "notepad "my file.txt""NOTE:  Enter user's password only when prompted.NOTE:  USER@DOMAIN is not compatible with /netonly.

The format of the /user: entries are:

If you use the UPN, the program starts, but you receive:

Microsoft Visual C++ Runtime LibraryRuntime Error!Program "path to executable"abnormal program termination.

If you use the syntax on a standalone computer, the same error occurs.

If you use the syntax on a domain member or domain controller, you receive:

RUNAS ERROR: Unable to run - "command"1326: Logon failure: unknown user name or bad password.

You may also experience these problems with MMC.EXE and Ntbackup.exe.

Occasionally, when the RunAS command tries to convert the UserName syntax to the Security Principal UserName syntax, it errors, failing to grant desktop access to the user.

The solution is to always use the Security Principal UserName syntax, forgoing the UPN and UserName syntax, until the problem is fixed in a future Service Pack.

NOTE: See tip 2548 The Windows 2000 Runas utility.