#189613 - 2008-09-11 07:47 PM
New Runnas.exe question
|
Thom
Fresh Scripter
Registered: 2005-11-30
Posts: 39
|
Well I worked around my problem, by copying the file to the local drive and running ad local admin.. my question now is, one of the parameters of the exe is /quiet so it will run with out anyone knowing. the Runnas command does not seem to do this.. any thoughts?
here is the current routine.
IF INGROUP("Psinstall")
$Powershell = ReadValue('HKLM\SOFTWARE\Microsoft\PowerShell\1\','Install')
If $Powershell <> 1
$local="%systemroot%\temp"
$server="@lserver\netlogon\bats\WindowsXP-KB926139-v2-x86-ENU.exe"
copy $server $local
$Winpath = $local + '\WindowsXP-KB926139-v2-x86-ENU.exe /quiet'
$runaspath="@lserver\netlogon\runnas.exe"
SHELL $runaspath + ' /user:' + @wksta + '\Administrator ' + $winpath + ' /pass:********'
Endif
Endif
Edited by Allen (2008-09-11 10:04 PM)
Edit Reason: Masked Password in script
_________________________
You'll never know, unless you ask.
|
|
Top
|
|
|
|
|
#189615 - 2008-09-11 08:31 PM
Re: New Runnas.exe question
[Re: Thom]
|
Glenn Barnas
KiX Supporter
Registered: 2003-01-28
Posts: 4402
Loc: New Jersey
|
Did you really intend to publish your local admin password?
This is SO easy if you treat it as an admin task, instead of trying to do it during the login.
The login process reads the registry and notifies a central system that an update is needed (see the script vault for ideas).
When the central server gets the notification, it simply copies a small batch file to the workstation, and creates a scheduled task with no triggers, supplying an appropriate admin account. It then issues a Run Now command for the task. The tcLib function library can do all of this.
The batch file maps a drive to a share where the install file is and then invokes the install process. It runs hidden and silent. Of course, your install script must be an unattended process, but that seems to be what you're after, anyway.
All of this runs with admin rights to the client. The time that elapsed between the login script requesting the update, and the update being triggered will be a few seconds (depending on the cycle time of the central service). No wacky procedures to give users elevated rights, no potential security exposures.
I use this general process to allow our Operations staff to deploy web updates to servers that they have no user access to. They (instead of a login script) use a GUI to generate the request file on a server, which then performs the deployment using specific credentials. It's simple, effective, and reliable.. not to mention secure.
Glenn
_________________________
Actually I am a Rocket Scientist! 
|
|
Top
|
|
|
|
|
#189616 - 2008-09-11 08:52 PM
Re: New Runnas.exe question
[Re: Glenn Barnas]
|
Thom
Fresh Scripter
Registered: 2005-11-30
Posts: 39
|
Glenn
I have seen your website.. your a little above me on this. As you can see by my name, I am a fresh scripter.. Do I want to give the local password, no. I want to avoid that. Should I be using a Global Policy, for this, I am not sure.. With what I need to install, I just found out that I need to see if .net is installed or not 1st. so I need to do it in a script.. What you are proposing sound sort of Global Policy like.. I am not asking for you or anyone to do the work, but in this case I need a little more direction.. You may read this and say but I gave you direction.. I am more of an a. do this. b. do this c. do this type guy..
Thanks.
_________________________
You'll never know, unless you ask.
|
|
Top
|
|
|
|
|
#189624 - 2008-09-11 10:25 PM
Re: New Runnas.exe question
[Re: Thom]
|
Witto
MM club member
Registered: 2004-09-29
Posts: 1828
Loc: Belgium
|
You can also use computer startup scripts to install software. The computer startup script is run by the system account. You can give your computer accounts Read access to network shares where the install packages are stored. Have a look at Group Policy Computer Startup Software Installation Script. Your users should just restart their computers. I use this script from time to time for small installations.
|
|
Top
|
|
|
|
|
#189625 - 2008-09-11 10:31 PM
Re: New Runnas.exe question
[Re: Witto]
|
Thom
Fresh Scripter
Registered: 2005-11-30
Posts: 39
|
NTDOC
I am trying to install Powershell on quite a few differnet machine. I was hoping to have this install done as part of my regular logon script.. Once it is installed (after a few weeks) I would get rid of the script. I have the script working, but I want it to run in /quiet mode. But the Runnas exe is not handling that.
Thom
_________________________
You'll never know, unless you ask.
|
|
Top
|
|
|
|
|
#189626 - 2008-09-11 10:35 PM
Re: New Runnas.exe question
[Re: Thom]
|
Glenn Barnas
KiX Supporter
Registered: 2003-01-28
Posts: 4402
Loc: New Jersey
|
Thom,
Start simple:
Create a share (or use an existing one) and put the software and install script there.
Create a "request" folder in the share where everyone has write access
In you login script, place the following code:
IF InGroup("Psinstall")
If Not ReadValue('HKLM\SOFTWARE\Microsoft\PowerShell\1\','Install')
$ = WriteProfileString('\\server\share\request\' + @WKSTA + '.ini, 'REQUEST', 'POWERSHELL', @WKSTA)
EndIf
EndIf
This creates an INI file in the share\request folder any time powershell is needed but not present. The section is called REQUEST, and the value is POWERSHELL. The data is the workstation name, but could be anything at all - it's usually unimportant. I used the workstation name as a convenience, so I don't have to strip the workstation name from the file name later.
Now, if someone logs in and is in the PSInstall group, and doesn't have the install registry key, it will create/update the request for that workstation by creating a small INI file on the server.
That's the first half of the process... Now you need the server side of things.
Create a script that loops forever, sleeps for 10 seconds, and looks in that folder for files by calling FileProcess. (FileProcess was stolen from LogProcess, from the Script Vault).
While 1
FileProcess()
Sleep 10
Loop
For each file found, read the REQUEST section (use EnumINI UDF) and get a list of values in that section. EnumINI will return an array of values if you call EnumINI($INIFile, 'REQUEST'). You'll only have one value now (POWERSHELL), but this give you flexibility for the future.
For Each Value in the array of values, you'll call a function that creates the install process.
For now, just print "Want to install POWERSHELL on $Computer" ?
Function FileProcess()
$_Src = '\\server\share\request\'
$_File = Dir($_Src + '*.ini') ; read the first dir entry
While Not @ERROR ; loop until no more are left
$_Requests = EnumINI($_Src + $_File, 'REQUEST')
For Each $_Request in $_Requests
$_Target = ReadProfileString($_Src + $_File, 'REQUEST', $_Request)
DoInstall($_Request, $_Target) ; call a func to schedule the install on the target
; Del $_Src + $_File
Next
$_File = Dir()
Loop
Function DoInstall($What, $Where)
'Need to install ' $What ' on computer ' $Where ?
EndFunction
At first, just run the monitor script interactively somewhere. Go log in to a computer that needs powershell. You should see the file appear, and then every 10 seconds a message on the other computer that an install is needed. Kill the monitor script, uncomment the Del line, and re-run. You should now only see one message, and the file should be deleted.
Next, you need to flesh out the DoInstall function. Ideally, you'll have an INI file with one section for each possible WHAT. It should provide the share path, batch file name, and install args. For now, stay simple, doing ..
- Copy an install.bat file to "\\$WHERE\C$\Temp"
- Use tcLib to create a task. This is right from the tcLib ReadMe file
- Use tcLib functions to run the task. It will auto-delete when done
; Initialize the library
tcInit()
; Create a simple, daily task, defining the APPlication and PaRaMeters
tcDefineTask('APP=C:\temp\install.bat PRM=-t -v')
; Set the Delete When Done flag
tcDefineTask('DWD=1')
; Set the event credentials
tcDefineTask('USR=fred PWD=FredPass')
; Create the event on the target computer
$ = tcSetEvent($WHERE, $WHAT + ' Install')
; Run the new task right now
$ = tcExecute($WHERE, $WHAT + ' Install')
You need to take this and clean it up, declare args, add comments, etc... but it should work just fine. Refer to the "Running Kix as a Service" article in the Vault for more details.
Finally.. Don't initially code for process, code for concept & logic. Don't actually do thnigs, just echo messages indicating what you want to do. When that all looks right, replace the messages with actual code to do that part of the job.
Let me know when you're ready for another nudge. Post what you have and we'll polish it. This gets asked often enough to be added to the vault, too.
Glenn
_________________________
Actually I am a Rocket Scientist!
|
|
Top
|
|
|
|
Moderator: Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart
|
0 registered
and 2220 anonymous users online.
|
|
|
