I work in an environment where local admin privileges for users isn't allowed. At all. This is very nice, but can be also be a pain when employees who must have local admin permissions to run a program or install software that requires elevated privileges even if only to do the install. There is a user in bookkeeping who receives a monthly DVD from a vendor of ours that contains much needed reports. In order to look at the reports and make a backup, she must run the executable on the DVD. The executable requires Admin privileges for the install. So since I've been here, every month I run the .exe, UAC appears and I supply the much-needed information to run the installer.
If this was a one time program I would use the Microsoft Application Compatibility Toolkit gimmick to bypass UAC http://www.techrepublic.com/blog/windows-and-office/selectively-disable-uac-for-your-trusted-vista-applications/ However, since this is a new DVD sent to her each month I need some kind of tool she can use herself for this operation.
I have looked around Server Fault and also did Google-Fu, but haven't found anything useful. I might be one of some in a unique situation.
I want to use Poweshell to make the tool. Ideally, I want her to be able to put in the DVD and then launch the Poweshell tool (from her desktop shortcut, no doubt) that looks at the DVD drive and runs the setup.exe file as a local admin without the UAC prompt, without her having to supply any credentials.
What I have so far is some pieced together junk at the moment. I am not a Powershell Jedi. I am a Poweshell padawan. I have half of what I need. I still need to store the password so it doesn't have to be defined and input each time she runs the script. I want this to be as smooth and as few clicks as possible.
For the creds I am choosing to go with the local admin account since that password doesn't change. The local admin account will get the job done. I will need to store that account information on the computer so Powershell can retrieve the account each time she runs the script. So this will need to be an encrypted file in a path variable.
# define path to store password and input password $path = "C:\Users\User\Password folder" # get the encrypted local admin password from user path $encpwd = Get-Content $path\admin.bin # convert admin file to secure string $passwd = ConvertTo-SecureString $encpwd # define local admin credential $cred = new-object System.Management.Automation.PSCredential 'computer name\local admin',$passwd # go to DVD drive launch setup.exe as local admin with no user input required Set-Location D:\ Start-Process PowerShell -Cred $cred -ArgumentList .\setup.exe
I might get a few downvotes for this, but I know somewhere I need to define and put in ""Read-Host "some text about entering password" -AsSecureString"" in an existing variable or a new variable. I have to get the password input into the process. I have tried a few spots. Thoughts? Wisdom? Impossible?
Windows 7 Pro Powershell v4