Tuesday, April 19, 2005

Branding Explorer running as admin account.

You know by now, that you should not be running as local administrator. Instead you should use runas, when administrative permissions are needed.
Running different programs, often does not pose problems, simply start the program – but running stuff involving Explorer does. My favorite way of using Explorer is by using Internet Explorer. I do a “%programfiles%\Internet Explorer\Iexplore.exe” and enter c:\temp or whatever in the address bar.
The next problem is to keep track of whether an Explorer windows is privileged or not. I would like to brand the windows, so it is clear which mode I’m in. I tried to change window colors and themes, but they all seem to be global. Finally, I came up with Internet Explorer branding. If you change “HKCU\software\Microsoft\Internet Explorer\Main\Window Title”, the text will appear on the title bar. There is just one problem – if you start iexplore with a file system path argument, the branding does not appear. Note that all command lines are bulleted so wrapping does not confused you. The command –


will have the branding. This –

  • "%programfiles%\Internet Explorer\Iexplore.exe" c:\temp
will not.
Can this be overcome? Yes. Use an html file that redirects to the file system path. In this way iexplore starts with html and uses the branding.
I have wrapped it all up in this bat file, which I call exp.bat –


  • set url=%1
  • reg add "hkcu\software\microsoft\internet explorer\main" /v "Window Title" /d "%userdomain%\%username%" /f
  • set html=%temp%\explorer-redirect.htm
  • echo ^<html^>^<head^>^<meta equiv="REFRESH" content="0; URL=file:%url%"^>^</head^>^</html^> > %html%
  • start "" "%programfiles%\Internet Explorer\Iexplore.exe" %html%
Use it this way -
  • Exp c:\temp

1 comment:

Roger said...

Hey there. Just found your blog and as luck would have it, I was toying around with this the other day;
the branding is a neat idea.

That's a clever batch you've made and while this may or may not be a moot point, here's what I do from cmd.exe:

--> start iexplore about:blank

That's a local 'file' that still gets the branding. from there, type c:\ or any local path to retain branding.

when I want to run under different credentials I do this from cmd.exe:

--> runsas /user:account cmd

and then after entering the password I use the above trick in the new cmd box to get my elevated-privelage Explorer window.

Hope this helps!