Login script with admin priveleges

Wondering if anyone could help me out with the following:

On NT, W2K and XP client machines I need a way to run an exe, through the
login script, with admin priveleges. I've looked into "runas" and "su",
however, they're not the best options as I run into problems with
compatability with NT or the fact that one has to insert the password when
prompted. I've also looked into "Admin Script Editor" and its packager
which lets one create and .exe to be run with alterante credentials.

Anyone know if this is possible through VBScript using impersonation?

Any enlightment into this matter would be appreciated.

Thanks!
JCOliveira

JCO wrote:

> Any enlightment into this matter would be appreciated.

In my view, this should never happen. The whole point of a logon script
is to set up the user environment, not to run silly EXE files as the admin.

--
Gerry Hickman (London UK)

"Gerry Hickman" wrote in message
news:eKfZr5iFFHA.1932@TK2MSFTNGP14.phx.gbl...
: JCO wrote:
:
: > Any enlightment into this matter would be appreciated.
:
: In my view, this should never happen. The whole point of a logon script
: is to set up the user environment, not to run silly EXE files as the
admin.

So, what's the difference between a silly EXE file and a serious one and is
it alright to run those as the admin in a logon script? (O:=

--
Roland Hall
/* This information is distributed in the hope that it will be useful, but
without any warranty; without even the implied warranty of merchantability
or fitness for a particular purpose. */
Technet Script Center - http://www.microsoft.com/technet/scriptcenter/
WSH 5.6 Documentation - http://msdn.microsoft.com/downloads/list/webdev.asp
MSDN Library - http://msdn.microsoft.com/library/default.asp

On Sat, 19 Feb 2005 12:42:07 -0600, "Roland Hall" <nobody@nowhere> wrote
in microsoft.public.scripting.vbscript,
microsoft.public.win32.programmer.wmi, microsoft.public.windowsxp.wmi:

>"Gerry Hickman" wrote in message
>news:eKfZr5iFFHA.1932@TK2MSFTNGP14.phx.gbl...
>: JCO wrote:
>:
>: > Any enlightment into this matter would be appreciated.
>:
>: In my view, this should never happen. The whole point of a logon script
>: is to set up the user environment, not to run silly EXE files as the
>admin.
>
>So, what's the difference between a silly EXE file and a serious one and is
>it alright to run those as the admin in a logon script? (O:=

By definition, a silly (=inappropriate) EXE file in a login script is
one which requires more privileges than the current user has. They
belong in a machine startup script and necessary rights granted to
Domain Computers.

--
Michael Bednarek http://mbednarek.com/ "POST NO BILLS"

"Michael Bednarek" wrote in message
news91g11l1s48v0n69b9chkk6nthpsuf6u51@4ax.com...
: On Sat, 19 Feb 2005 12:42:07 -0600, "Roland Hall" <nobody@nowhere> wrote
: in microsoft.public.scripting.vbscript,
: microsoft.public.win32.programmer.wmi, microsoft.public.windowsxp.wmi:
:
: >"Gerry Hickman" wrote in message
: >news:eKfZr5iFFHA.1932@TK2MSFTNGP14.phx.gbl...
: >: JCO wrote:
: >:
: >: > Any enlightment into this matter would be appreciated.
: >:
: >: In my view, this should never happen. The whole point of a logon script
: >: is to set up the user environment, not to run silly EXE files as the
: >admin.
: >
: >So, what's the difference between a silly EXE file and a serious one and
is
: >it alright to run those as the admin in a logon script? (O:=
:
: By definition, a silly (=inappropriate) EXE file in a login script is
: one which requires more privileges than the current user has. They
: belong in a machine startup script and necessary rights granted to
: Domain Computers.

I was just being silly but the response was worth reading. Thanks.

--
Roland Hall
/* This information is distributed in the hope that it will be useful, but
without any warranty; without even the implied warranty of merchantability
or fitness for a particular purpose. */
Technet Script Center - http://www.microsoft.com/technet/scriptcenter/
WSH 5.6 Documentation - http://msdn.microsoft.com/downloads/list/webdev.asp
MSDN Library - http://msdn.microsoft.com/library/default.asp

Hi Roland,

> I was just being silly but the response was worth reading. Thanks.

Hehe

The point we're making is that logging on time is for getting the user's
desktop and drives up as quickly as possible, it's not the right time to
be messing around with admin programs.

Maybe there's a legitimate use for such a program (?), but in the first
instance I'd suggest trying to re-design your systems so that this kind
of thing isn't needed at logon time. e.g. on my own netowrk, I run the
admin programs overnight.

--
Gerry Hickman (London UK)

"Gerry Hickman" <gerry666uk@yahoo.co.uk> wrote in message
news:%23FoOHH1FFHA.1528@TK2MSFTNGP09.phx.gbl...
: Hi Roland,
:
: > I was just being silly but the response was worth reading. Thanks.
:
: Hehe
:
: The point we're making is that logging on time is for getting the user's
: desktop and drives up as quickly as possible, it's not the right time to
: be messing around with admin programs.
:
: Maybe there's a legitimate use for such a program (?), but in the first
: instance I'd suggest trying to re-design your systems so that this kind
: of thing isn't needed at logon time. e.g. on my own netowrk, I run the
: admin programs overnight.

Yes, that makes sense. I guess I'm going to have to agree with you, but I'm
fighting it. *smirk*

--
Roland Hall
/* This information is distributed in the hope that it will be useful, but
without any warranty; without even the implied warranty of merchantability
or fitness for a particular purpose. */
Technet Script Center - http://www.microsoft.com/technet/scriptcenter/
WSH 5.6 Documentation - http://msdn.microsoft.com/downloads/list/webdev.asp
MSDN Library - http://msdn.microsoft.com/library/default.asp

Hi Everybody,
I agree that we should avoided running SILLY programs at logon time bu
there may be some peculiar circumstances when we require this.
For e.g. in my network P.C's are being shared by users and users don’
have roaming profiles but still few users require TIME in PST and som
other require TIME in GMT for this I cant find any option in Window
2000 Group Policy. The only way i can do this is by doing registr
changes at logon time and for running this script Admin rights would b
required, so if possible give me the solution for this.

Any other solution for this problem will also be appreciated

--
Jaspreet Singh JollyPosted from http://www.pcreview.co.uk/ newsgroup acces

In a multi-user environment each user can set a separate timezone on W2K and
XP. This is saved in their profile and can be different for each user.
With Roaming Profiles this is easier to manage as it only needs to be set
once. You should also be able to change the TZ in the User registry with a
script but not the machines time zone. The machine time zone should always
reflect it's physical location for other reasons.

Try finding the setting in HKCU for time zone.

--
Jim Vierra

"Jaspreet Singh Jolly" <Jaspreet.Singh.Jolly.1pr11a@> wrote in message
news:j76dnT8wAfY3DgXfRVn_vg@giganews.com...

>
> Hi Everybody,
> I agree that we should avoided running SILLY programs at logon time but
> there may be some peculiar circumstances when we require this.
> For e.g. in my network P.C's are being shared by users and users don't
> have roaming profiles but still few users require TIME in PST and some
> other require TIME in GMT for this I cant find any option in Windows
> 2000 Group Policy. The only way i can do this is by doing registry
> changes at logon time and for running this script Admin rights would be
> required, so if possible give me the solution for this.
>
> Any other solution for this problem will also be appreciated.
>
>
> --
> Jaspreet Singh JollyPosted from http://www.pcreview.co.uk/ newsgroup
> access
>

Also, if you want to stay with using some sort of change upon startup,
consider using a startup script rather than a login script. Startup scripts
run in the administrative context (and prior to anyone logging in) and will
get around the issue of users not having permissions to reset the zone.


"Jim Vierra" <jvierra@msn.com> wrote in message
news:uFSexNBZFHA.3488@tk2msftngp13.phx.gbl...

> In a multi-user environment each user can set a separate timezone on W2K
> and XP. This is saved in their profile and can be different for each
> user. With Roaming Profiles this is easier to manage as it only needs to
> be set once. You should also be able to change the TZ in the User
> registry with a script but not the machines time zone. The machine time
> zone should always reflect it's physical location for other reasons.
>
> Try finding the setting in HKCU for time zone.
>
> --
> Jim Vierra
>
> "Jaspreet Singh Jolly" <Jaspreet.Singh.Jolly.1pr11a@> wrote in message
> news:j76dnT8wAfY3DgXfRVn_vg@giganews.com...

>
>