如何用Python无界面自动以管理员身份执行CMD命令并传入账号密码

问题背景 #

需要用Python实现无界面自动化流程，以管理员身份执行指定CMD命令。当前使用ctypes.windll.shell32.ShellExecuteW触发提权时，会弹出账号密码输入框，无法自动填充；尝试subprocess模块无法实现提权或与UAC弹窗交互。

解决方案：使用CreateProcessWithLogonW API直接提权执行 #

ShellExecuteW的runas依赖UAC弹窗，无法自动处理账号密码。改用Windows API CreateProcessWithLogonW，可以直接传入管理员账号、密码创建高权限进程，全程无界面。

实现代码

import ctypes
from ctypes import wintypes

# 定义Windows API所需的结构和函数
advapi32 = ctypes.WinDLL('advapi32', use_last_error=True)
kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)

class STARTUPINFO(ctypes.Structure):
    _fields_ = [
        ("cb", wintypes.DWORD),
        ("lpReserved", wintypes.LPWSTR),
        ("lpDesktop", wintypes.LPWSTR),
        ("lpTitle", wintypes.LPWSTR),
        ("dwX", wintypes.DWORD),
        ("dwY", wintypes.DWORD),
        ("dwXSize", wintypes.DWORD),
        ("dwYSize", wintypes.DWORD),
        ("dwXCountChars", wintypes.DWORD),
        ("dwYCountChars", wintypes.DWORD),
        ("dwFillAttribute", wintypes.DWORD),
        ("dwFlags", wintypes.DWORD),
        ("wShowWindow", wintypes.WORD),
        ("cbReserved2", wintypes.WORD),
        ("lpReserved2", wintypes.LPBYTE),
        ("hStdInput", wintypes.HANDLE),
        ("hStdOutput", wintypes.HANDLE),
        ("hStdError", wintypes.HANDLE),
    ]

class PROCESS_INFORMATION(ctypes.Structure):
    _fields_ = [
        ("hProcess", wintypes.HANDLE),
        ("hThread", wintypes.HANDLE),
        ("dwProcessId", wintypes.DWORD),
        ("dwThreadId", wintypes.DWORD),
    ]

# 配置API参数
LOGON_WITH_PROFILE = 0x00000001
CREATE_NO_WINDOW = 0x08000000

advapi32.CreateProcessWithLogonW.restype = wintypes.BOOL
advapi32.CreateProcessWithLogonW.argtypes = [
    wintypes.LPCWSTR, wintypes.LPCWSTR, wintypes.LPCWSTR,
    wintypes.DWORD, wintypes.LPCWSTR, wintypes.LPCWSTR,
    wintypes.DWORD, wintypes.LPCVOID, wintypes.LPCWSTR,
    ctypes.POINTER(STARTUPINFO), ctypes.POINTER(PROCESS_INFORMATION)
]

def run_as_admin(username, password, domain, command):
    si = STARTUPINFO()
    si.cb = ctypes.sizeof(STARTUPINFO)
    si.wShowWindow = 0  # 隐藏窗口
    si.dwFlags = 0x00000001  # 启用窗口显示设置
    pi = PROCESS_INFORMATION()
    
    # 拼接CMD命令行，/c执行后关闭窗口，/k保持窗口（调试用）
    cmd_line = f'cmd.exe /c {command}'
    
    success = advapi32.CreateProcessWithLogonW(
        username, domain, password,
        LOGON_WITH_PROFILE, None, cmd_line,
        CREATE_NO_WINDOW, None, None,
        ctypes.byref(si), ctypes.byref(pi)
    )
    
    if not success:
        raise ctypes.WinError(ctypes.get_last_error())
    
    # 释放系统句柄
    kernel32.CloseHandle(pi.hProcess)
    kernel32.CloseHandle(pi.hThread)

# 调用示例
if __name__ == "__main__":
    # 替换为你的管理员账号信息
    admin_user = u"Administrator"
    admin_pwd = u"你的管理员密码"
    domain_name = u""  # 本地账号留空，域账号填写域名
    target_command = u"pysv_checkout -l common -b -ru"
    
    try:
        run_as_admin(admin_user, admin_pwd, domain_name, target_command)
        print("命令执行成功")
    except Exception as e:
        print(f"执行失败: {str(e)}")

关键说明 #

1. 绕过UAC弹窗：CreateProcessWithLogonW直接以指定管理员身份启动进程，无需触发UAC验证，适合无界面自动化场景。
2. 无界面设置：CREATE_NO_WINDOW标志确保CMD进程在后台运行，不会弹出窗口。
3. 密码安全：避免硬编码密码，建议从加密存储（如配置文件、密钥管理服务）中读取。
4. 域环境适配：如果是域账号，需正确填写domain_name参数；本地账号留空即可。

为什么之前的方法不可行 #

• ShellExecuteW的runas触发的UAC弹窗是系统级安全机制，运行在高权限会话中，普通进程无法跨会话自动填充账号密码。
• subprocess模块默认以当前用户权限启动进程，没有提权能力；即使调用runas命令，同样会触发UAC弹窗，无法自动处理。

内容的提问来源于stack exchange，提问作者Aruna Kumari