up vote 2 down vote favorite
share [g+] share [fb]

I'm currently managing a large group of Windows 7 machines where no one has privileges to install applications (all 64-bit Enterprise version of Windows 7).

Because no one has privileges to install things, we manage software installations in two ways:

  1. Centrally via software deployment server - we have a product that can run any executable with admin privileges
  2. Shortcuts on people's desktops for self-service installs/updates

For #2 above I found a .vbs script from Jeffery Hicks that let's us call any executable using the RunAs command and the .vbs script passes in the password.

However, this .vbs script solution is starting to cause us problems because our users are starting to close the runas command window more and more. I've already tried modifying it to call WshShell.AppActivate by process ID, but our users still manage to close it down before the password is entered in via WshShell.SendKeys.

We've tried communicating to our users not to touch the window but that isn't working either.

Are there any solutions out there that will let us call any executable as a different user WITHOUT having to type in a password or wait for a .vbs script to pass in the password?

I found RunasSpc and Steel Run As... is there anything else that people have found that works?

link|improve this question
feedback

1 Answer

up vote 7 down vote

Instead of publishing updates to their desktop and using those scripts (which allow the password to be sniffed out since it has to be passed in plain text to run as) you should use Group Policy Software Installation in Publish mode instead of Assign mode. This will allow users to go into Add/Remove Programs and install it on demand.

link|improve this answer
3  
+1 for passwords boing sniffed. Many people not aware of that issue – Dave M Feb 9 at 20:33
Good point about passwords being sniffed (the admin account is a local admin, not domain admin). Also, it seems that the Group Policy management editor only lets me add MSIs as Software Installation packages. What if I need to have the user run a .bat file? – Colorado Techie Feb 9 at 21:04
You could always use something like a login or startup script, or any of the hundreds of other GPO settings. It's very rare to have a bat file be the only way to solve a problem. Could you give a concrete example? If you want to install non-MSI software, you'll have to wrap it in an MSI. There are lots of free tools to do this. – MDMarra Feb 9 at 21:09
:-) The software I'm dealing with right now is some HP Printer Drivers. The corporate version I managed to download from HP is a setup.exe file. When I extract the contents of the setup.exe they do have an MSI, but it won't install when I try to run it (it just shows a window for a second then disappears). So rather than fight with that, I just want the user to be able to call the setup.exe as an admin. (Other times I write .bat files to apply some registry settings to HKLM that fixes a problem that they are experiencing) – Colorado Techie Feb 9 at 21:28
1  
Better yet, use HP's Universal Print Driver if the printers support PCL. Nothing to install at all and no annoying popups from HP. – Chris S♦ Feb 9 at 21:58
show 2 more comments
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.