AT and ROUTE command permissions

[rocketbabe]

I have an application support person who needs to routinely change scheduled tasks and add ip routes as his environment changes. He is currently a member of the groups Users and Power Users.

When he goes to a command prompt and types "at" he gets a message "Access is Denied". When he types "route add" and fills in all the required IP information, he gets "Network Access is denied".

I have tried adding Power Users with Full Control to both of these commands individually as well as giving Power Users Full Control over System32 which is where these commands live. Same results.

Does anyone know how I can give this guy permission to run at and route commands without making him an Administrator?

---RocketBabe

 

[mickyjune26]

Can you change the permissions on the at.exe file?
WINNT\system32\at.exe

 

[rocketbabe]

Yes, I tried giving him Full Control to both at.exe and route.exe --- still didn't work. Then I removed those permissions and gave him Full control of winnt\system32 just to see if that would work --- he still gets access denied.

 

[mickyjune26]

Here's another way.
Task Scheduler allows a user to run a command at a different privelage level. Maybe you can get AT and ROUTE to run under Task Scheduler. Or create a batch file to run AT or ROUTE and run the batch file with Task Scheduler.

 

[rocketbabe]

That's a good idea. Let me try that and I'll get back to you.
Thanks!

 

[david902]

copy AT and ROUTE to his home directory and change ownership of the files to him.

..\winnt\system32 should not have the AT and ROUTE commands in it, they should be moved to another location, check out some simple NT/2000 Server Hardening Guides. The recommend moving alot of files in ..\winnt\system32 to another directory and changing permissions to increase security.