Run (File Manager) as TrustedInstaller

Discussion in 'Scripting' started by freddie-o, Oct 25, 2021.

  1. freddie-o

    freddie-o MDL Expert

    Jul 29, 2009
    1,147
    1,535
    60
    #1 freddie-o, Oct 25, 2021
    Last edited: Jun 23, 2022 at 10:38
    This can be useful in a scenario where we need to copy, delete, rename, move, change or modify System, Read-only or Locked files and folders

    * Copying, deleting, renaming, moving, changing or modifying System files and folders can cause your operating system to not operate correctly -- or worse -- stop functioning altogether! Use only if you know what you are doing!
    * This toggle batch script kills explorer.exe and runs Total Commander as TrustedInstaller (using PowerRun to elevate)
    * Terminating explorer.exe lessens restrictions and gives more access to files and folders
    * I use Total Commander for my File Manager. Just replace "TOTALCMD64.EXE" in the script with your preferred File Manager
    * Explorer.exe will automatically restart as soon as you exit your File Manager



    Download
    PowerRun (Credits to @wtarkan)
    Total Commander



    Script
    Total Commander as TI.cmd
    Code:
    @echo off
    SETLOCAL EnableExtensions
    set EXE=TOTALCMD64.EXE
    taskkill /f /im explorer*
    "%~dp0PowerRun_x64.exe" /SW:0 "%EXE%"
    :LOOP
    timeout /t 3 /nobreak
    FOR /F %%x IN ('tasklist /FI "IMAGENAME eq %EXE%"') DO IF %%x == %EXE% goto LOOP
    start "" explorer.exe
    endlocal &exit
    

    Total Commander as TI.png


     
  2. Dark Dinosaur

    Dark Dinosaur X Æ A-12

    Feb 2, 2011
    1,434
    1,551
    60
    #2 Dark Dinosaur, Oct 25, 2021
    Last edited: Oct 25, 2021
    Count !2! Problems
    1) explorer sometimes restart itself after killing it :p
    2) start explorer In windows 11 under TrustedInstaller privileges, sometimes fails
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. freddie-o

    freddie-o MDL Expert

    Jul 29, 2009
    1,147
    1,535
    60
    #4 freddie-o, Oct 25, 2021
    Last edited: Nov 1, 2021
    (OP)
    Here's another script that adds a Registry key to keep Explorer from restarting

    Explorer doesn't restart properly on a regular user account in Windows 11 when modifying the registry
     
  4. acer-5100

    acer-5100 MDL Addicted

    Dec 8, 2018
    876
    580
    30
    Just use xyexplorer free and launch it using nsudo (or similar tool) via a shortcut like


    C:\XY\NSudoLG64.exe -U:T -P:E ".\xy.exe"

    No need to kill explorer or other complications
     
  5. freddie-o

    freddie-o MDL Expert

    Jul 29, 2009
    1,147
    1,535
    60
    If you're not going to kill Explorer why not just use Run Explorer as TI
    No need for a 3rd party File manager
    After using all the TrustedInstaller apps I can get my hands on, PowerRun is still the most reliable and dependable
    XYplorer is a trialware
    Whatever works for you
     
  6. acer-5100

    acer-5100 MDL Addicted

    Dec 8, 2018
    876
    580
    30
    nsudo is simple portable and works, then there are a number of alternatives, but given nsudo never failed since i use it I never felt the need to use a reinvented wheel


    First: YX is a really great FM with an huge amount of handy features that explorer can only dream of (folder size calculation just to pick one from a long list)

    Second: given explorer is not just a FM but also the main shell, running it as TI can lead to a number of unexpected behaviors which I prefer to avoid.


    I specified XY explorer free for a reason. Just google for it.

    Whatever you can use whatever FM you like, Explorer++ for example, which is tiny and well maintained.
     
  7. Dark Dinosaur

    Dark Dinosaur X Æ A-12

    Feb 2, 2011
    1,434
    1,551
    60
    I can't recommend old version from 2016 :D
    Code:
    Below you can still download the last version of XYplorerFree, ver 17.40.0100, released 26-Nov-2016.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  8. acer-5100

    acer-5100 MDL Addicted

    Dec 8, 2018
    876
    580
    30
    Yeah any sw which isn't released yesterday will surely melt your PC :D

    [​IMG]
     
  9. zbigniew59

    zbigniew59 MDL Senior Member

    May 14, 2016
    269
    107
    10
    This scrypt doesn't work for me -
    - [​IMG]


    - [​IMG]
    -
    [​IMG]
     
  10. zbigniew59

    zbigniew59 MDL Senior Member

    May 14, 2016
    269
    107
    10
    Now it works, thanks
     
  11. AveYo

    AveYo MDL Expert

    Feb 10, 2009
    1,703
    4,968
    60
    I use this script (no external tools needed) in my totalcmd folder (and a menu entry for it)
    Code:
    @echo off & if "%PROCESSOR_ARCHITECTURE%"=="AMD64" ( set "A64=64" ) else set "A64="
    taskkill /im tcmouse%A64%.exe /im totalcmd%A64%.exe >nul
    call :RunAsTI "%~dp0totalcmd%A64%.exe" &exit/b
    
    #:RunAsTI snippet to run as TI/System, with innovative HKCU load, ownership privileges, high priority, and explorer support  
    set ^ #=& set "0=%~f0"& set 1=%*& powershell -c iex(([io.file]::ReadAllText($env:0)-split'#\:RunAsTI .*')[1])& exit /b
    function RunAsTI ($cmd,$arg) { $id='RunAsTI'; $key="Registry::HKU\$(((whoami /user)-split' ')[-1])\Volatile Environment"; $code=@'
     $I=[int32]; $M=$I.module.gettype("System.Runtime.Interop`Services.Mar`shal"); $P=$I.module.gettype("System.Int`Ptr"); $S=[string]
     $D=@(); $T=@(); $DM=[AppDomain]::CurrentDomain."DefineDynami`cAssembly"(1,1)."DefineDynami`cModule"(1); $Z=[uintptr]::size
     0..5|% {$D += $DM."Defin`eType"("AveYo_$_",1179913,[ValueType])}; $D += [uintptr]; 4..6|% {$D += $D[$_]."MakeByR`efType"()}
     $F='kernel','advapi','advapi', ($S,$S,$I,$I,$I,$I,$I,$S,$D[7],$D[8]), ([uintptr],$S,$I,$I,$D[9]),([uintptr],$S,$I,$I,[byte[]],$I)
     0..2|% {$9=$D[0]."DefinePInvok`eMethod"(('CreateProcess','RegOpenKeyEx','RegSetValueEx')[$_],$F[$_]+'32',8214,1,$S,$F[$_+3],1,4)}
     $DF=($P,$I,$P),($I,$I,$I,$I,$P,$D[1]),($I,$S,$S,$S,$I,$I,$I,$I,$I,$I,$I,$I,[int16],[int16],$P,$P,$P,$P),($D[3],$P),($P,$P,$I,$I)
     1..5|% {$k=$_; $n=1; $DF[$_-1]|% {$9=$D[$k]."Defin`eField"('f' + $n++, $_, 6)}}; 0..5|% {$T += $D[$_]."Creat`eType"()}
     0..5|% {nv "A$_" ([Activator]::CreateInstance($T[$_])) -fo}; function F ($1,$2) {$T[0]."G`etMethod"($1).invoke(0,$2)}; $As=$false   
     $TI=(whoami /groups)-like'*1-16-16384*'; $Inter='Interactive User'; if (!$cmd) {$cmd='::{20D04FE0-3AEA-1069-A2D8-08002B30309D}'}
     if (!$TI) {'TrustedInstaller','lsass','winlogon'|% {if (!$As) {$9=sc.exe start $_; $As=@(get-process -name $_ -ea 0|% {$_})[0]}}
     function M ($1,$2,$3) {$M."G`etMethod"($1,[type[]]$2).invoke(0,$3)}; $H=@(); $Z,(4*$Z+16)|% {$H += M "AllocHG`lobal" $I $_}
     M "WriteInt`Ptr" ($P,$P) ($H[0],$As.Handle); $A1.f1=131072; $A1.f2=$Z; $A1.f3=$H[0]; $A2.f1=1; $A2.f2=1; $A2.f3=1; $A2.f4=1
     $A2.f6=$A1; $A3.f1=10*$Z+32; $A4.f1=$A3; $A4.f2=$H[1]; M "StructureTo`Ptr" ($D[2],$P,[boolean]) (($A2 -as $D[2]),$A4.f2,$false)
     $Run=@($null, "powershell -win 1 -nop -c iex `$env:R; # $id", 0, 0, 0, 0x0E080600, 0, $null, ($A4 -as $T[4]), ($A5 -as $T[5]))
     F 'CreateProcess' $Run; return}; $env:R=''; rp $key $id -force; $priv=[diagnostics.process]."GetM`ember"('SetPrivilege',42)[0]   
     'SeSecurityPrivilege','SeTakeOwnershipPrivilege','SeBackupPrivilege','SeRestorePrivilege' |% {$priv.Invoke($null, @("$_",2))}
     $HKU=[uintptr][uint32]2147483651; $NT='S-1-5-18'; $reg=($HKU,$NT,8,2,($HKU -as $D[9])); F 'RegOpenKeyEx' $reg; $LNK=$reg[4]
     function L ($1,$2,$3) {sp 'HKLM:\Software\Classes\AppID\{CDCBCFCA-3CDC-436f-A4E2-0E02075250C2}' 'RunAs' $3 -force -ea 0
      $b=[Text.Encoding]::Unicode.GetBytes("\Registry\User\$1"); F 'RegSetValueEx' @($2,'SymbolicLinkValue',0,6,[byte[]]$b,$b.Length)}
     L ($key-split'\\')[1] $LNK ''; $R=[diagnostics.process]::start($cmd,$arg); if ($R) {$R.PriorityClass='High'; $R.WaitForExit()}
     do {sleep 7} while((gwmi win32_process -filter 'name="explorer.exe"'|? {$_.getownersid().sid -eq $NT})); L '.Default' $LNK $Inter
    '@; $V='';'cmd','arg','id','key'|%{$V+="`n`$$_='$($(gv $_ -val)-replace"'","''")';"}; sp $key $id $($V,$code) -type 7 -force -ea 0
     start powershell -args "-win 1 -nop -c `n$V `$env:R=(gi `$key -ea 0).getvalue(`$id)-join''; iex `$env:R" -verb runas
    }; $A=($env:1-split'"([^"]+)"|([^ ]+)',2).Trim(' "'); RunAsTI $A[1] $A[2]; #:RunAsTI lean & mean snippet by AveYo, 2022.01.15
    
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...