Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a vbs script that needs to be provided to end users, but it requires more rights than they have on their locked down workstations - specifically updating some HKLM registry values and stopping/starting a windows service. Is there a way I can provide them with the ability to run the script so that it'll work? e.g. Run As a different user account, without requiring users to have a different account to log in as?

The script isn't part of a login process. It's to allow users who are testing a software product to point their machines at a different 'environment', so they can switch between Test and Live environments.

UPDATE: I'm ok if the only solution means doing something outside VBS, just having some options would be good.

share|improve this question
1  
VBScript cannot do that unfortunalty :( There are programs to force an elevation.. but you still need to put the password in.. is that what you want? But doing it silently ... no Why? Because of hackers who made life hell at MS so now we have all this bollocks security.. The only way is to write a .NET app and sign it with a UAC certificate for your domain/computer so it can securely elevate it self silently... –  ppumkin Jan 4 '12 at 9:49

4 Answers 4

Not without encrypting the password and including it with the VBS script.

There are other options like remote scripting, but those setting may be off depending on if you are part of a domain.

Is the script part of a login process?

edit:

The script isn't part of a login process. It's to allow users who are testing a software product to point their machines at a different 'environment', so they can switch between Test and Live environments.

UPDATE: I'm ok if the only solution means doing something outside VBS, just having some options would be good.

Without more details, the best solution by far that I can recommend is to create a separate user account and modify the ACLs of the Registry keys to explicitly allow that account to modify those keys. Then run the script under that account. Try that.

share|improve this answer
    
Just added an update above - not part of login but rather something that users want to do on ocassion. –  Rory Jan 4 '12 at 12:15
    
Added something to try. –  surfasb Jan 4 '12 at 13:06

One way of doing this would be to use NSSM or a similar tool to run the script as a system service. You can then configure the security on the service to allow the user to start it, and perhaps write a script that does this for them.

share|improve this answer

A bit of a programming-centric answer, but I would write a small .NET Windows service and client application that could communicate securely over WCF/remoting. The service would just listen to requests from the client and, if the client was authorized, run the script. The service would be running as an account with the correct permissions.

EDIT

In a similar strategy, you could set up the script as a scheduled task that is set to run as a user with permissions to do what you need. Then, grant your users permission to execute the scheduled task. To do that, you need to go into %SYSTEMROOT%\System32\Tasks and set the NTFS permissions on the appropriate task file.

share|improve this answer
    
That's a lot of work to service one person. –  surfasb Jan 4 '12 at 16:44
    
Unfortunately there are several users who will need access to this but it's not really feasible/ideal to write and install a windows service & client to support this minor piece of functionality. But good idea and I guess if this is the only way to do it then it's the only way. –  Rory Jan 6 '12 at 17:07

To grant permissions for running scripts on the local computer

  1. In Internet Explorer, open %windir%\system32 (for example, C:\WINDOWS\System32).
  2. In the Details pane, right-click cmd.exe, and then click Properties.
  3. In the cmd.exe Properties dialog box, on the Security tab, click Add.
  4. In the Select Users, Computers, or Groups dialog box, in the Enter the object names to select box,
  5. type the name of the user to whom you want to grant permissions, and then click OK.

In the cmd.exe Properties dialog box, on the Security tab, in the Permissions for Administrators box, select the Allow check box for Read & Execute, and then click OK.

share|improve this answer
    
Would this not create a larger security issue? –  Dave M Nov 27 at 16:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.