Remote administration of customers' Windows servers, no Administrator access

Question

I'm after some general advice and perhaps specific tools/products to assist in automating the administration of customers' Windows boxes.

Here's the environment:

We give customers a Windows box and they have full control of the Administrator account. We have a secondary logon, which is a member of the Administrators group but do not have their Administrator password. Their machine might be a domain controller or it might just be in its own workgroup. The 2008 boxes have UAC enabled (I can't change this.) We have serial console access with which we can log on using our secondary account. We do all our administration from Linux and all scripts are run on our backend systems from which we can log on to the console and access the database.

So my problem is that sometimes, I need to do things such as copy files to their machine and install new software. Currently, I write Python scripts to pull data from our database, log on over the serial console, send a bunch of commands, mount a central share and copy files from it etc. It is not so much of a problem on Windows 2003, but on Windows 2008 UAC gets in the way - we end up doing up things manually.

I want automation to work exactly the same for 2003 and 2008. I want full control of their box when I need it, without having access to the Administrator account, without RDP and without using any kind of GUI.

Is this possible? Have you had to work around these kind of limitations before?

Thanks!

Answer 1

Unless you have access to either the local Administrator account (and it has to be The Administrator account) for a stand alone server, or you have an account is a member of the Domain Administrators group for a domain member then you cannot suppress UAC behaviour unless you turn it off completely which is a bad idea.

If you have access to The Administrator account or a Domain Admin account then you should be able to emulate most of the behaviour you see in Windows 2003 by modifying the "User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode" GPO to enable auto-elevation without prompting. The details of the settings for this can be found here.

There's some info on auto-elevation in Windows 7 here most of which applies to Windows 2008 too. This is the mechanism you want to trigger in order to ensure that commands you execute can invoke administrator rights if they need to, even with the above "auto-elevate without prompting" setting enabled the mechanism still needs to be triggered if you need to do something that requires rights that are only available to the administrative token.