Runas code

[Lordmathos]

hi all im trying to create a script for users to run to allow them to install an important update onto their computers.

The users have had all privilages removed.

Im not very good at scripting so I need the script to run a specific file as administrator with the username and password already entered

 

[dm4ever]

If you have administrative rights on the machines, then you can execute it with your credentials or as "system" using psexec.

http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/PsExec.mspx

 

[JadeKnight]

I you could tell me some more about you're environment and what you're going to deply, I might point you in another direction. Runas form a script exposes one important security issue, user/pass in clear text. The solution dm4ever provides, remedies this issue a bit, because the utility he suggest you to use is actually launched by you.

Since you are running best practice, and removed all users privileges I assume you have a couple of tools to support this scenario. If you provide me with some basics, I might give you a hint on an alternativ way of deploying it.

Some important info :
Domain or not? If domain, higher than NT4.0?
What kind of security update, Microsoft or 3rd party?
Update format exe or msi? If exe, can it be deployed silent?
Client computer OS?

 

[Lordmathos]

Basically i am trying to roll out an update for office 2003. (we dont use automatic updates or wsus yet but are looking into it) The users have very basic rights and I would like to roll out the update via a link for them to install themselves.

The users dont have the rights to install the update so i was looking at creating a script with a temporary username and password in it with admin rights or an alternative method of distribution.

We have about 150 computers spread throught the country so it is not possible to visit them all.

 

[mrmovie]

if its an msi i am sure you can start it with admin rights from the command line, thats one of the big shouts about why msi's rule

 

[Lordmathos]

unfortunately its an exe

 

[mrmovie]

do you have an installation service? sms or the such like

 

[Lordmathos]

no unfortunately not. all we have is server 2003 and xp sp2 clients

 

[mrmovie]

i know it doesnt help you for now and the pxsec or WMI connection is prob you best bet, perhaps JadeKnight has some good steering..but in the long run i would try and get an installation service on the client which has elevated priv, not sure if RIS has this and is free??

 

[Rick998]

Four suggestions:

1) Microsoft's own Script Encoder (see

http://www.microsoft.com/downloads/...-C447-4873-B1B0-21F0626A6329&displaylang=en).

Just be aware that VBE scripts encoded with it can be easily decoded.

2) RunAsUser - a utility from a Tek-Tips contributor - Greg Palmer - that can encrypt VBS scripts (see

http://www.palmersoft.co.uk/main.asp?content=runasuser).

3) AutoIt - a basic scripting language that can be used to create 'RunAs' scripts then compile them into executables (see

http://www.autoitscript.com/autoit3/).

4) AutoHotkey - another basic scripting language that can be used to create 'RunAs' scripts then compile them into executables (see

http://www.autohotkey.com/).

I've used them all to create scripts that use RunAs.

Hope this helps...

 

[monsterjta]

In the time it would take to come up with a solution to deploy an update for Office, you could have a WSUS server up and running. It's an easy rollout. Shouldn't take more than a couple hours to install, configure, figure it out and have all computers reporting to it.

Hope This Helps,

Good Luck!