"su - user" has existed for at least 30 years.

Oh, right, Windows. Using Windows as a counter point to any argument on best practices is silly. But even then, as your domain admin, I can reset your password, login as you and then reset a new temporary password for you. I have done this and would never ask a user for their password. Even on windows.

...which wipes out access to my OS-level encrypted files, thank you very much dear admin

Which, again, is another reason not to use windows...

True, but, I think the most-used software isn't a "bad" example to use in an argument.

I think it is when that most-used software is notoriously insecure. Certainly when used as a standalone argument. But hey, minor point :-)

1. I wrote service as in service provided on the web, not software. I'm sure online office (360, live, or whatever the name is this week) support has the ability to get to your documents though.

2. There's runas.

3. There's lots of examples of software that allows you to use the system remotely. Some of them have signatures in the virus databases, some don't.

> I'm sure online office (360, live, or whatever the name is this week) support has the ability to get to your documents though.

I have an admin account for an Office365 subscription, I can absolutely NOT impersonate a user. From what I know, Microsoft can not either.

Runas doesn't let me "see the error the user has"

You're assuming that admin account has the same or more privileges as a local MS's support account. Is there a reason for that?

Well, you assumed a lot of stuff in your post, too..

But yes. Microsoft will actually reset your password, or ask you for it, to troubleshoot O365 problems. Very standard.

runas.exe: http://technet.microsoft.com/en-us/library/bb490994.aspx

(I know there's software for this) but that doesn't let me use the environment as the user. Lots of times, things are profile related.