Registered: 1999-09-09
Posts: 1264
Loc: The Netherlands
SECURE INSTALLING STUFF USING RUNAS WITHOUT CONSOLE
The following shows an imho secure way of installing stuff on W2k and up using the RUNAS command, without the console prompting for a password.
PROCEDURE
1. Copy/Paste the codes and make the four files 2. Make sure the requirements are met (place all files in one folder) 3. Start the MAKEEXE_SANUR.cmd command file 4. Run the KASAI_SANUR_STARTER.kix script to see a messagebox displaying the admin-user and it's privileges
[ 29. September 2003, 21:04: Message edited by: MightyR1 ]
_________________________
Greetz, Patrick Rutten
- We'll either find a way or make one... - Knowledge is power; knowing how to find it is more powerful... - Problems don't exist; they are challenges...
#76649 - 2003-09-1204:34 PMRe: ADMIN install using Runas like SU... Scripted without console!!!
AnonymousAnonymous
Unregistered
MightyR1, I checked it out.....geez its so long. I'm looking to have the lines of code remain in the script to ensure that machines get the update, I have a lot of laptops that are out in the field for weeks at a time. See what I have below so far....was able to get TQCRunAs to work. Just need to be able to register a .dll on a users PC. The key exists parts are for testing, will be removed. The XP part works great, am working on the 2K now...
code:
Select Case @PRODUCTTYPE = "Windows XP Professional" $ReturnCode = ExistKey("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP2\KB824146") If $ReturnCode = 0 ? "Win XP Key exists...." Else ? "Win XP Not Installed...." Run "%COMSPEC% /c \\gtb1\os\KB824146\WindowsXP-KB824146.tqc" MessageBox("A Windows Critical Update is being installed to your PC. Once finished, a restart may be required.","Windows Critical Update KB824146",64,30) EndIf Case @PRODUCTTYPE = "Windows 2000 Professional" $ReturnCode = ExistKey("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows 2000\SP5\KB824146") If $ReturnCode = 0 ? "Key exists...." Else ? "Not Installed...." MessageBox("A Windows Critical Update is being installed to your PC. Once finished, a restart may be required.","Windows Critical Update KB824146",64,30)
Registered: 1999-09-09
Posts: 1264
Loc: The Netherlands
Shane,
how about:
Should work...
_________________________
Greetz, Patrick Rutten
- We'll either find a way or make one... - Knowledge is power; knowing how to find it is more powerful... - Problems don't exist; they are challenges...
[ 13. September 2003, 20:15: Message edited by: MightyR1 ]
_________________________
Greetz, Patrick Rutten
- We'll either find a way or make one... - Knowledge is power; knowing how to find it is more powerful... - Problems don't exist; they are challenges...
Registered: 1999-09-09
Posts: 1264
Loc: The Netherlands
*bump*
MODS ???
_________________________
Greetz, Patrick Rutten
- We'll either find a way or make one... - Knowledge is power; knowing how to find it is more powerful... - Problems don't exist; they are challenges...
Registered: 1999-09-09
Posts: 1264
Loc: The Netherlands
Johan,
In my example the 'deployer' user is a normal domain user placed in a domain group localadm, which is a member of the local admininistrators group. Since domain admins are members of the local admins by default, my guess is it will work.
Try it out and let us know...
_________________________
Greetz, Patrick Rutten
- We'll either find a way or make one... - Knowledge is power; knowing how to find it is more powerful... - Problems don't exist; they are challenges...
Registered: 2000-07-13
Posts: 21
Loc: Lisbon, Portugal
Hi there!
While running "makeexe_sanur.cmd" nothing happens!
I've downloaded the requested files and putted in the same directory. Then I changed user/passwd on requested scripts. I noticed one space before $SANUR_PASSWORD=1234567890 is it so? Or is a typo? The Kix version is 4.20.
Registered: 1999-09-09
Posts: 1264
Loc: The Netherlands
Mig,
checked and no type errors... These codes work for me.
Jens,
challenge was to install stuff from within logon proces. Scheduletask is not allowed by normal users... This method is also a good start of installing applics on demand!
[ 17. September 2003, 21:32: Message edited by: MightyR1 ]
_________________________
Greetz, Patrick Rutten
- We'll either find a way or make one... - Knowledge is power; knowing how to find it is more powerful... - Problems don't exist; they are challenges...
Registered: 2001-04-25
Posts: 11164
Loc: Boston, MA, USA
Login script sends install request to KiXtart script running on admin server, which checks for requests on a regular basis. If request is detected it sends back a scheduled task to install and removed the request from the queue (.e.g .INI file).
BTW, whenever I install something I reboot the system right after as a precaution. That's why my installs normally happen during nighttime hours.
KSMS, BTW, demonstrates this behavior. I don't have any application that is so important that it must be installed during the login process.
_________________________
There are two types of vessels, submarines and targets.
Registered: 2000-07-13
Posts: 21
Loc: Lisbon, Portugal
Patrick,
I've run MAKEEXE_SANUR.cmd after replacing Wkixcrpt.exe from a version downloaded from "http://home.wanadoo.nl/scripting". The file you've mentioned taken from "http://www.sgbit.demon.co.uk/kix/files" couldn't run.
...now the problem seems to be while running KASAI_SANUR_STARTER.kix nothing happens. For what I've understood I should see a messagebox displaying the admin-user and privileges. If I run directly KASAI_SANUR_SCR2RUN.kix, which is mentioned on previous script, I've no problem. But when called fron within KASAI_SANUR_STARTER.kix, the console returns nothing
Registered: 1999-09-09
Posts: 1264
Loc: The Netherlands
Jens,
I've looked at KSMS and I'm sure it works great. Challenge is that in me env. not all 'client' software is installed on all machines. By doing an install on demand my way, the software gets installed the fastest way.
The scheduletask is a nice option, but if you wanted to install the app immediately, there must be two things. 1 = really 'short' loop on server, 2 = exact time sync in env.
The first needs no explaining I guess. The second does. What if your client runs a minute ahead of your server, and the server starts a now job at 11:59:45 (so execution time = 12:00:00)? The job will never start on the client since it's time has been 12:00:00 already!!!
_________________________
Greetz, Patrick Rutten
- We'll either find a way or make one... - Knowledge is power; knowing how to find it is more powerful... - Problems don't exist; they are challenges...
Registered: 2000-08-02
Posts: 310
Loc: Sacramento, CA USA
Nice demonstration for usage of Sanur Patrick. This will be much easier to use in the cases where I don't (or don't want to) have SU set up. Makes a lot more sense using the built-in Runas functionality anyway.
One note, it does not like being tested in paths with spaces, and encapsulating didn't seem to help.
_________________________
He was a good little monkey and always very curious...