# Runas

{% tabs %}
{% tab title="Invoke-RunasCs" %}
[`Invoke-RunasCs`](https://github.com/antonioCoco/RunasCs) works the same as `runas` but it does not need GUI access:

{% code overflow="wrap" %}

```powershell
> Import-Module .\Invoke-RunasCs.ps1
> Invoke-RunasCs -Username x7331 -Password Pass123! -Command "whoami"
```

{% endcode %}
{% endtab %}

{% tab title="runas" %}
[`runas`](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771525\(v=ws.11\)) can be used to run a program as a different user, but it requires GUI access as it pops up a password prompt:

```powershell
> runas /user:backupadmin cmd
Enter the password for backupadmin:
Attempting to start cmd as user "CLIENTWK220\backupadmin" ...
```

{% endtab %}
{% endtabs %}

If we try to use `runas` as a newly-created user it won't work, because **the user has to logged in at least once** for the following reasons:

* **User profile is not created yet:** when we create a new user and add them to the `Administrators` group, Windows does not create a user profile for that user until the first login. Some privileges (especially file access and UAC-related permissions) rely on the presence of a user profile in `C:\Users\<user>`.
* **Group membership changes require a re-login:** even though the user was added to the `Administrators` group, it wasn’t immediately effective for existing sessions. Windows applies group membership changes only at login—so logging in once ensures the system recognizes the new user as an `administrator`.
* **Access tokens are not updated:** when a user logs in, Windows creates an access token containing their group memberships and privileges. If the new user was created mid-session, existing tokens wouldn’t reflect the new privileges until that user logs in.
