Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a vbs script that needs to be provided to end users, but it requires more rights than they have on their locked down workstations - specifically updating some HKLM registry values and stopping/starting a windows service. Is there a way I can provide them with the ability to run the script so that it'll work? e.g. Run As a different user account, without requiring users to have a different account to log in as?

The script isn't part of a login process. It's to allow users who are testing a software product to point their machines at a different 'environment', so they can switch between Test and Live environments.

UPDATE: I'm ok if the only solution means doing something outside VBS, just having some options would be good.

share|improve this question
1  
VBScript cannot do that unfortunalty :( There are programs to force an elevation.. but you still need to put the password in.. is that what you want? But doing it silently ... no Why? Because of hackers who made life hell at MS so now we have all this bollocks security.. The only way is to write a .NET app and sign it with a UAC certificate for your domain/computer so it can securely elevate it self silently... –  ppumkin Jan 4 '12 at 9:49
add comment

3 Answers

Not without encrypting the password and including it with the VBS script.

There are other options like remote scripting, but those setting may be off depending on if you are part of a domain.

Is the script part of a login process?

edit:

The script isn't part of a login process. It's to allow users who are testing a software product to point their machines at a different 'environment', so they can switch between Test and Live environments.

UPDATE: I'm ok if the only solution means doing something outside VBS, just having some options would be good.

Without more details, the best solution by far that I can recommend is to create a separate user account and modify the ACLs of the Registry keys to explicitly allow that account to modify those keys. Then run the script under that account. Try that.

share|improve this answer
    
Just added an update above - not part of login but rather something that users want to do on ocassion. –  Rory Jan 4 '12 at 12:15
    
Added something to try. –  surfasb Jan 4 '12 at 13:06
add comment

One way of doing this would be to use NSSM or a similar tool to run the script as a system service. You can then configure the security on the service to allow the user to start it, and perhaps write a script that does this for them.

share|improve this answer
add comment

A bit of a programming-centric answer, but I would write a small .NET Windows service and client application that could communicate securely over WCF/remoting. The service would just listen to requests from the client and, if the client was authorized, run the script. The service would be running as an account with the correct permissions.

EDIT

In a similar strategy, you could set up the script as a scheduled task that is set to run as a user with permissions to do what you need. Then, grant your users permission to execute the scheduled task. To do that, you need to go into %SYSTEMROOT%\System32\Tasks and set the NTFS permissions on the appropriate task file.

share|improve this answer
    
That's a lot of work to service one person. –  surfasb Jan 4 '12 at 16:44
    
Unfortunately there are several users who will need access to this but it's not really feasible/ideal to write and install a windows service & client to support this minor piece of functionality. But good idea and I guess if this is the only way to do it then it's the only way. –  Rory Jan 6 '12 at 17:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.