Elevated Permissions

[ALLM]

Okay, I have a VBScript which is just modifying a registry key. I want this to run at logon throug an Active Directory Logon Script. Users are not local admins on the workstation so I need to figure out how to have this VBS run as a local admin. Can anyone help me with this please?

Thanks!

 

[mrmovie]

you said 'i want to run at logon though an ad logon script', and you state that the users dont have rights to that registry key....i think you have answered your question? if you really want to kick it off from the logon script then you need to elevate the priv, doing that in a script will lead you to have passwords or user accounts with eval rights in plain text...or at least lead you to need to solve that security foo'pa.

group policy? or grant the users rights to that registry key?

 

[ALLM]

That part I'm aware of, so my apologies for not stating that. I would like this script to run with elevated privs without having to have the user/pass written in the script.

Thanks for pointing out my mistake.

 

[mrmovie]

logonscript = user priv

so, if you still want to control things from logonscript then you could:

+ grant the users the rights to the registry area and therefore they can update it, if you feel you need to update on a per user basis then that sort of implies the users should have rights to it?
+ stuff your script into an MSI and get this to run with elevated rights?
+ is group policy an option?

 

[ALLM]

I actually just ran this as a computer startup script in an AD GPO and that runs as the local system account. So no need for the script mods.

Thanks.