2

I'm encountering an issue with the VBscripts while I try to run them. I'm working on Windows 8.1 update 1 Enterprise, connected to an Enterprise domain, and I'm logged with a domain account. This domain account has been added to the Administrators group.

My VBscript must create a folder and a log file into the Program Files (x86) directory. If I run this VBscript by double-clicking on it with the local administrator account, it works perfectly. But if I try to run the same VBscript with my domain account, I get the error message Access denied.

One solution is to totally deactivate the UAC (with the enableLUA registry value set to 1), but this method blocks the Modern UI applications, and we need to keep these applications execution.

Is it possible to grant the full control to VBScripts execution on any admin account, like it is the case under the local administrator built-in account ? I didn't yet find any solution to this problem, and I can't believe that no solution exists, especially in enterprise.

3
  • You can't deactive UAC on Windows 8.x and I suspect that won't change for any future version of Windows. If your domain account was part of the local Administrator group you wouldn't be getting this error, you have to determine which permission this script requires, and grant that to your User group.
    – Ramhound
    Jun 6, 2014 at 10:47
  • Actually, you can totally deactivate the UAC on Windows 8.1, as I specified in my original post. You must set the notifications to Off, and edit the registry value EnableLUA to 1. But this solution prevent the Modern UI apps execution, and it is not what I want. Moreover, it seems the rights of the local administrator built-in account and the domain account inside the local Administrators group are not the same. Currently, my VBScript only tries to create a folder to C:\Program Files (x86). No other things.
    – YannD
    Jun 6, 2014 at 10:58
  • I don't use hacks. So if you say that disables UAC then I will trust you. I can promise you that if your domain account is being placed in the local Administrator group then there is no difference between that account and the local Administrator account unless your group permissions took away a permission. Which is the reason I said to figure out which persmission you need to grant to the User group, because a user, really should not always be an Administrator for security reasons.
    – Ramhound
    Jun 6, 2014 at 11:05

2 Answers 2

3

the way I normally do this is to stick the following code at the top of my script:

If Not WScript.Arguments.Named.Exists("elevate") Then
  CreateObject("Shell.Application").ShellExecute WScript.FullName _
    , WScript.ScriptFullName & " /elevate", "", "runas", 1
  WScript.Quit
End If

This way, if I launch the VBS as a non admin - it tries to run, notices I'm not an admin and then relaunches - prompting me to run as admin and away we go.

I know its a pain, but its a fairly simple solution.

Hope this helps

2
  • This is the proper solution. The same solution that every other operating system uses. You run a command without using sudo it indicates you need to do that and you then ran the command as the superuser.
    – Ramhound
    Jun 6, 2014 at 11:03
  • This solution can be a good workaround for new scripts we will implement. Currently, we are using VBscripts to install applications, and we have most of them already implemented for Windows 7. Wen we tested them on Windows 8.1, we encountered the issue detailed above. So, I created a small script with only a folder creation, and i didn't work also. It could be a great thing if we don't have to modify all the existing scripts.
    – YannD
    Jun 6, 2014 at 11:04
0

This trick is useful if you are using command-line:

  1. Go to System32 (or Syswow4 for x64)
  2. Copy cscript.exe and wscript.exe and name them csadmin.exe and wsadmin.exe
  3. Open their properties, set "Run as admin" flag.

Now if you want to run your script as admin, use one of these:

csadmin myscript.vbs
wsadmin myscript.vbs

(And if you want to run as default, use wscript and cscript)

Note: If you want to run all scripts as admin (UAC window will appear each time), then just set "Run as admin" flag on cscript.exe and wscript.exe.

Hope it helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.