Setacl and Kix32 - KiXtart.org - official site

You are not logged in. [Log In] KiXtart.org website » Forums » KiXtart » Basic Scripting » Setacl and Kix32

Page 1 of 2

1

Topic Options

#136763 - 2005-03-30 04:20 PM Setacl and Kix32
voskewarez voskewarez Fresh Scripter Registered: 2005-03-30 Posts: 10	Hi there, quick question (i hope) I try to change rights on the registry (HKEY_Local_machine/software) I have a working batch file which works fine.... The machines are windows xp, but kix32 wont execute the line in the script, access denied. It starts with Shell "cmd /c .... ". What can i do ?? If you need more details....please ask...
Top

#136764 - 2005-03-30 04:33 PM Re: Setacl and Kix32
Les Les KiX Master Registered: 2001-06-11 Posts: 12734 Loc: fortfrances.on.ca	Need more details. _________________________ Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.
Top

#136765 - 2005-03-30 05:17 PM Re: Setacl and Kix32
voskewarez voskewarez Fresh Scripter Registered: 2005-03-30 Posts: 10	Ok, i will try to explain. With setacl you can change rights on registry keys. We have a program which needs changings in the registry, but the user has no rights. I found out that setacl works fine for us to do these things. So far so good. If we run it in a batch file, with an admin account, it works, it changes the rights on the key. But.....and here it comes If i use this "command line" in kixtart (dont know which version, not at work right now), it gives me an access denied. So i assume kixtart does not have sufficient rights on an Windows XP machine. The line in kixtart.kix starts with: SHELL "CMD.EXE /C \\server\\netlogon\setacl.exe MACHINE\SOFTWARE\CLASSES ... BLA BLA" Hope this info is enough ??
Top

#136766 - 2005-03-30 05:34 PM Re: Setacl and Kix32
Les Les KiX Master Registered: 2001-06-11 Posts: 12734 Loc: fortfrances.on.ca	If the BATch file works for a user with admin rights then so too should the KiX script that SHELLs to the same command provided the user running the script also has admin rights. Why would you expect KiX to work any different than the BATch file with regard to rights? _________________________ Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.
Top

#136767 - 2005-03-30 05:40 PM Re: Setacl and Kix32
voskewarez voskewarez Fresh Scripter Registered: 2005-03-30 Posts: 10	Thats why i post here...cause i dont know... But we always user kix with windows nt clients, now with xp clients it does not work the way we want.....cause kix has admin rights....right ??
Top

#136768 - 2005-03-30 06:01 PM Re: Setacl and Kix32
Mart Mart KiX Supporter Registered: 2002-03-27 Posts: 4673 Loc: The Netherlands	Kix does not have any privileges other then the logged on user has. It runs under the currently logged on user and therefore has the same privileges as the user. I’ve seen some topics about kix as a service. A service can have any type of account to run on so admin privileges are available. Have a look here: http://www.kixtart.org/ubbthreads/showflat.php?Cat=&Board=UBB4&Number=81553 And privileges on NT and XP registry keys are not the same by default. Edited by R2D2 (2005-03-30 06:02 PM) _________________________ Mart - Chuck Norris once sold ebay to ebay on ebay.
Top

#136769 - 2005-03-30 06:24 PM Re: Setacl and Kix32
Les Les KiX Master Registered: 2001-06-11 Posts: 12734 Loc: fortfrances.on.ca	If you have Active Directory you can apply registry perms by GPO. _________________________ Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.
Top

#136770 - 2005-03-30 08:02 PM Re: Setacl and Kix32
voskewarez voskewarez Fresh Scripter Registered: 2005-03-30 Posts: 10	No...it's a WIndows NT domain..... so no gpo's I will have a look at that link you gave me.... IS it possible to "run" something with a username / pass inserted in the kixscript? So that that line in mentioned runs with an admin account? That would also do the trick..... Edited by voskewarez (2005-03-30 08:09 PM)
Top

#136771 - 2005-03-30 08:10 PM Re: Setacl and Kix32
Mart Mart KiX Supporter Registered: 2002-03-27 Posts: 4673 Loc: The Netherlands	Think you'll like it. I’d use it if it was not that my trusty but old NT4 domain only has 16 days before being scrapped and replaced by Win2K3 so we can finally start using GPO's Best of luck. _________________________ Mart - Chuck Norris once sold ebay to ebay on ebay.
Top

#136772 - 2005-03-30 08:14 PM Re: Setacl and Kix32
voskewarez voskewarez Fresh Scripter Registered: 2005-03-30 Posts: 10	This is an old domain....our "normal" domain is all W2k3 ...
Top

#136773 - 2005-03-30 08:15 PM Re: Setacl and Kix32
Mart Mart KiX Supporter Registered: 2002-03-27 Posts: 4673 Loc: The Netherlands	Quote: Is it possible to "run" something with a username / pass inserted in the kixscript? So that that line in mentioned runs with an admin account? That would also do the trick..... That would indeed do the trick. But, there is no real secure way to include the logon en pass in a script. User have read access to the scripts an therefore will be able to see the password. This is a BIG security risk, try to avoid it as much as possible by using the task scheduler or running kix as a service or something like it. Passwords are “unreadable” this way, much more secure. _________________________ Mart - Chuck Norris once sold ebay to ebay on ebay.
Top

#136774 - 2005-03-30 08:16 PM Re: Setacl and Kix32
voskewarez voskewarez Fresh Scripter Registered: 2005-03-30 Posts: 10	I know....but we need to do a lot of machines .... so kix is al lot better... besides....a user can't use network browsing thats all taken away ... lol So.if it would do the trick....how do i set it up?
Top

#136775 - 2005-03-30 09:30 PM Re: Setacl and Kix32
Mart Mart KiX Supporter Registered: 2002-03-27 Posts: 4673 Loc: The Netherlands	Lots of options. Below a link to the How to topic about installing stuff with other privs then the currently logged on user. http://www.kixtart.org/ubbthreads/showflat.php?Cat=0&Number=81559&an=0&page=1#81559 Like I said it's definitely not best or even good practice to include a logon and pass in a script. If there is absolutely no other way thenat least create a special account for it so changing the password if (or should I say when) it gets out has as least as possible impact on other network services. Because in the end it most likely will get out in the open and when it does you’re f<censored>d. Edited by R2D2 (2005-03-30 09:31 PM) _________________________ Mart - Chuck Norris once sold ebay to ebay on ebay.
Top

#136776 - 2005-03-30 09:48 PM Re: Setacl and Kix32
voskewarez voskewarez Fresh Scripter Registered: 2005-03-30 Posts: 10	It's only for the new systems... so if they all work correctly, we kill that piece of script. And of course it will be a new account...
Top

#136777 - 2005-03-30 09:57 PM Re: Setacl and Kix32
Mart Mart KiX Supporter Registered: 2002-03-27 Posts: 4673 Loc: The Netherlands	There is something called KixCrypt going round on this board and there are make exe options in some editors like ASE http://www.kixscripts.com/editor/features.asp. This will make it at least not as readable to users as just plain text. To be honest I used a logon and pass is a script once or twice (just called a flame party on myself ), just needed a quick and dirty solution for one time use. _________________________ Mart - Chuck Norris once sold ebay to ebay on ebay.
Top

#136778 - 2005-03-30 10:01 PM Re: Setacl and Kix32
voskewarez voskewarez Fresh Scripter Registered: 2005-03-30 Posts: 10	Yes... i know it is not safe, but hey....who hasn't done this once or twice And this is an old domain, users who have really no clue what a network is. Besides, users aren't able to browse to the netlogon cause it's blocked So....no worry;s But....how do i do it with a username/pass in the kix script....
Top

#136779 - 2005-03-30 10:28 PM Re: Setacl and Kix32
Mart Mart KiX Supporter Registered: 2002-03-27 Posts: 4673 Loc: The Netherlands	Bryce (one of the members) has done some work on the use of SU. Sample scripts can be found on his website at: http://kix.isorg.com/ I took a browse thru the tree and found it here. _________________________ Mart - Chuck Norris once sold ebay to ebay on ebay.
Top

#136780 - 2005-03-31 01:28 AM Re: Setacl and Kix32
Allen Allen KiX Supporter Registered: 2003-04-19 Posts: 4572 Loc: USA	I with Les on this one, if you can do it at the command prompt, there is no reason you can't do it from within kix. Would you mind posting the command line you are using and maybe we can help you from that direction. _________________________ (... better days ahead)
Top

#136781 - 2005-03-31 01:35 AM Re: Setacl and Kix32
Les Les KiX Master Registered: 2001-06-11 Posts: 12734 Loc: fortfrances.on.ca	Allen, You need to read between the lines. The BATch only works if the user has admin rights. voskewarez was under the impression that KiX ran with elevated rights. voskewarez, Could you not run a central admin script instead to do this? _________________________ Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.
Top

#136782 - 2005-03-31 01:40 AM Re: Setacl and Kix32
Allen Allen KiX Supporter Registered: 2003-04-19 Posts: 4572 Loc: USA	You're right Les, Sorry. _________________________ (... better days ahead)
Top

Page 1 of 2

1

Previous Topic

Previous Topic View All Topics

View All Topics

Index Next Topic

Next Topic

Moderator: Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart

Hop to:

Shout Box

Who's Online

0 registered and 583 anonymous users online.

Newest Members

Viginette, ManuvdWielNL, Sir_Barrington, batdk82, StuTheCoder
17888 Registered Users

Generated in 0.054 seconds in which 0.013 seconds were spent on a total of 12 queries. Zlib compression enabled.

click tracking