Elevating priviledges within a script on Windows 2008

[garion42]

Is there some way to elevate priviledges within a script? (batch, powershell, perl doesn't matter)

Our goal is to allow users to start and stop services. We would like to be able to run a script using type of remote job execution. We downloaded the subinacl.exe and can start it remotely with the correct parameters. However, it fails with

"WARNING :Unable to set SeSecurityPrivilege privilege. This privilege may be required."

If I start a command line with elevated privileges and run the command it works fine.

Since we are dealing with dozens of machines and several services (with more to come), we would like some way to automate this process.

Any suggestions?

 

[TonHu]

How about adding this privilege to the user, or specifically created group (to easily add users), using the policy editor? PowerUser used to be a good privilege-level for this...

 

[garion42]

Sorry. I forgot to mention that these are all standalone machine so we can't use the group policy editor.

 

[BobbyCam]

you would use the following from a cmd line:

C:\>runas /user:<localmachinename>\administrator cmd

or for a domain

c:\>runas /user:<DomainName>\<AdministratorAccountName> cmd

 

[garion42]

runas asks for a password, no matter which user or option I try. Is there anyway to give the password on the command line?

 

[58sniper]

The problem with specifying credentials in a script is that scripts are typically readily viewable in a text editor like notepad. So you leave yourself open to the elevated account being compromised.

Do you have your Tek-Tips.com Swag? I've got mine!

Stop by the new Tek-Tips group at LinkedIn.