run script with administrator's right ?

Forums

My Profile

Inbox

Address Book

My Subscription

My Forums

run script with administrator's right ?

Logged in as: Guest

arrSession:exec spGetSession 2,2,39351

	Active Users: There are 0 members and 0 guests.
	Users viewing this topic: none

Printable Version

All Forums >> [Scripting] >> WSH & Client Side VBScript >> run script with administrator's right ?
Do you like VisualBasicScript.com? Link to us and help spread the word about our forum. Thanks!

Page: [1]

Message

<< Older Topic Newer Topic >>

run script with administrator's right ? - 11/1/2006 7:12:59 PM

andrewli

Posts: 3
Score: 0
Joined: 12/13/2005
Status: offline

here is my logon script code

Set objWshNet = CreateObject("Wscript.Network")
strCN = lcase(objWshNet.ComputerName)
strCU = lcase(objWshNet.UserName)
Set objGroup = GetObject("WinNT://" & strCN & "/Administrators")
Set objUser = GetObject("WinNT://kill.com/" & StrCU )
objGroup.Add(objUser.ADsPath)

i want set this script with group policy , when user logon their computer
this script can add this logon user to administrator group

here is my problem ~~~ all user in my domain just domain user , how can i set
that when user logon and run this script that can add users to local administrator group without administrator's right ?

Post #: 1

RE: run script with administrator's right ? - 11/1/2006 8:35:40 PM

gdewrance

Posts: 587
Score: 3
Joined: 3/16/2006
Status: offline

I'm not sure what your trying to do. Does this help
There are two different scripts here.

'==========================================================================
'
' NAME: AddUserToLocalAdminGroup.vbs
'
' AUTHOR: Mark D. MacLachlan , The Spider's Parlor
' URL: http://www.thespidersparlor.com
' DATE  : 8/8/2004
'
' COMMENT: <comment>
'
'==========================================================================
On Error Resume Next

Set WSHShell = CreateObject("WScript.Shell")
Set WSHNetwork = CreateObject("WScript.Network")

'Edit the next line with your domain name
DomainString = "DomainName"
UserString = WSHNetwork.UserName

'Add the user to the local admins group
Call WSHShell.Run("cmd.exe /C net localgroup administrators " & DomainString & "\" & UserString & " /add")

'Remove the user from the local admins group
'Call WSHShell.Run("cmd.exe /C net localgroup administrators " & DomainString & "\" & UserString & " /delete")

Second script

'==========================================================================
'
' NAME:     WorkstationAdminGroups.vbs
'
' AUTHOR:     Adam Freden 
' DATE  :     5/18/2006
'
' COMMENT:    This is designed to be a logon script, but can easily be modified.
'            to a stand-alone script (for instance, use a "multiple computer
'            wrapper" script (available at www.ScriptingAnswers.com) to allow
'            the reading of computer names from a text file or Active Directory.
'==========================================================================
'            This will add three groups (defined in the "Variable declarations"
'            section below) to the local 'Administrators' group of only 
'            workstation-class Windows 2000 and XP computers.  This will not 
'            modify local group membership of server-class Windows computers
'            or any other class of computer.  There are inline comments throughout.
'
'==========================================================================

' Variable declarations and assignments
 Dim objNet
 Dim objFS
 Dim LogFile
 Dim strTextStream
 Domain = "YOURDOMAIN"                    ' Replace this with your domain name
 
 ' These will be the domain groups that will be added to the local Administrators group
 GroupName1 = "GroupName1"                ' Replace this with your first group name    
 GroupName2 = "GroupName2"                ' Replace this with your second group name    
 GroupName3 = "GroupName3"                ' Replace this with your third group name

' Get Name of of Local Computer - although the WMI query will work with just a ".", the logging
' will totally suck - especially if used in a logon script (you won't be able to look at the log  
' to see which computer was being referenced in any given line).  Therefore, when we use this to  
' grab the actual local computer name, the logging will reflect that.
Set objNet = CreateObject("WScript.NetWork") 
ComputerName = objNet.ComputerName

' Create a new file system object - this is for the centralized log file
Set objFS = CreateObject("Scripting.FileSystemObject")

' Get Name of Log File
LogFile = "\\SERVERNAME\ShareName$" ' Change this to your centralized server & sharename.
                                  ' Make sure it's writable by all users!  Probably 
                                  ' best to use a hidden share, to obscure the log file.

' Determine whether this is a workstation OS or a server OS
' - - - We only want DOMAIN ADMINS to be server administrators
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & ComputerName & "\root\cimv2")
Set colOperatingSystems = objWMIService.ExecQuery ("SELECT * FROM Win32_OperatingSystem")
For Each objOperatingSystem in colOperatingSystems
strOsType = objOperatingSystem.Caption ' Get the Operating System description and place in StrOsType variable
If InStr(strOsType,"Server") Then
   ' If the string 'Server' is in the 'strOsType' variable, then skip the update and log the reason
   strMsg = " - This is a server system - Skip this computer.  OS=" & strOsType
   LogResult = WriteLog(ComputerName,strMsg)
   ' Clear out the variables (so there's no way for us to reuse the value later on and screw things up
   strMsg = Null 
   strOsType = Null 
Elseif InStr(strOsType,"Professional") Then
   ' If the string 'Professional' is in the 'strOsType' variable, then try to add the three groups
   ' ------------------
  ' Add the 'CSC Team' group to the local administrators group
    Select Case AddGroupToLocalAdmins(ComputerName,Domain,GroupName1)
      Case 0
        ' Write a seperator line in the log file, to visually separate different computers in the log file
        strMsg = "-------------------------------------------"
        LogResult2 = WriteLog("----------",strMsg)
        LogResult2 = Null 
        strMsg = Null 
        strMsg = GroupName1 & " added to the local ADMINISTRATORS group"
        LogResult = WriteLog(ComputerName,strMsg)
        ' Clear out the variables (so there's no way for us to reuse the value later on and screw things up)
        strMsg = Null 
      Case 1
        ' Write a seperator line in the log file, to visually separate different computers in the log file
        strMsg = "-------------------------------------------"
        LogResult2 = WriteLog("----------",strMsg)
        LogResult2 = Null 
        strMsg = Null 
        strMsg = GroupName1 & " failed - unable to add the group to the local administrators group"
        LogResult = WriteLog(ComputerName,strMsg)
        ' Clear out the variables (so there's no way for us to reuse the value later on and screw things up)
        strMsg = Null 
      Case 2
        ' Write a seperator line in the log file, to visually separate different computers in the log file
        strMsg = "-------------------------------------------"
        LogResult2 = WriteLog("----------",strMsg)
        LogResult2 = Null 
        strMsg = Null 
        strMsg = GroupName1 & " is already a member of the local ADMINISTATORS group"
        LogResult = WriteLog(ComputerName,strMsg)
        ' Clear out the variables (so there's no way for us to reuse the value later on and screw things up)
        strMsg = Null 
      Case 3
        ' Write a seperator line in the log file, to visually separate different computers in the log file
        strMsg = "-------------------------------------------"
        LogResult2 = WriteLog("----------",strMsg)
        LogResult2 = Null 
        strMsg = Null 
        strMsg GroupName1 & " failed - Unable to connect to the computer"
        LogResult = WriteLog(ComputerName,strMsg)
        ' Clear out the variables (so there's no way for us to reuse the value later on and screw things up)
        strMsg = Null 
    End Select  
  
  'Add the 'Entex SAV' group to the local administrators group
    Select Case AddGroupToLocalAdmins(ComputerName,Domain,GroupName2)
      Case 0
        strMsg = GroupName2 & " Added to the local ADMINISTRATORS group"
        LogResult = WriteLog(ComputerName,strMsg)
        ' Clear out the variables (so there's no way for us to reuse the value later on and screw things up)
        strMsg = Null 
      Case 1
        strMsg = GroupName2 & " failed - unable to add the group to the local administrators group"
        LogResult = WriteLog(ComputerName,strMsg)
        ' Clear out the variables (so there's no way for us to reuse the value later on and screw things up)
        strMsg = Null 
      Case 2
        strMsg = GroupName2 & " is already a member of the local ADMINISTATORS group"
        LogResult = WriteLog(ComputerName,strMsg)
        ' Clear out the variables (so there's no way for us to reuse the value later on and screw things up)
        strMsg = Null 
      Case 3
        strMsg = GroupName2 & " failed - Unable to connect to the computer"
        LogResult = WriteLog(ComputerName,strMsg)
        ' Clear out the variables (so there's no way for us to reuse the value later on and screw things up)
        strMsg = Null 
    End Select
  
  'Add the 'Domain Admins' group to the local administrators group
    Select Case AddGroupToLocalAdmins(ComputerName,Domain,GroupName3)
      Case 0
        strMsg = GroupName3 & " Added to the local ADMINISTRATORS group"
        LogResult = WriteLog(ComputerName,strMsg)
        ' Clear out the variables (so there's no way for us to reuse the value later on and screw things up)
        strMsg = Null 
      Case 1
        strMsg = GroupName3 & " failed - unable to add the group to the local administrators group"
        LogResult = WriteLog(ComputerName,strMsg)
        ' Clear out the variables (so there's no way for us to reuse the value later on and screw things up)
        strMsg = Null 
      Case 2
        strMsg = GroupName3 & " is already a member of the local ADMINISTATORS group"
        LogResult = WriteLog(ComputerName,strMsg)
        ' Clear out the variables (so there's no way for us to reuse the value later on and screw things up)
        strMsg = Null 
      Case 3
        strMsg = GroupName3 & " failed - Unable to connect to the computer"
        LogResult = WriteLog(ComputerName,strMsg)
        ' Clear out the variables (so there's no way for us to reuse the value later on and screw things up)
        strMsg = Null 
    End Select
    ' Clear out the variables (so there's no way for us to reuse the value later on and screw things up)
    strOsType = Null 
Else 
   strMsg = " - DID NOT ATTEMPT - Could not determine Operating System Type.  OS Type = " & strOsType
   LogResult = WriteLog(ComputerName,strMsg)
  ' Clear out the variables (so there's no way for us to reuse the value later on and screw things up)
   strMsg = Null 
   strOsType = Null
End If
Next

'#############################
'Function AddGroupToLocalAdmins

'Variables
 'ComputerName
 'Domain of Group being added
 'GroupName (User account can be used as well)
 
'Returns
 '0 if Group is added successfully to the local Admin group
 '1 if function was unable to add the Group to the local Admin group
 '2 if Group is already a member of the local Admin group
 '3 if the function was unable to connect to the specified Computer

Function AddGroupToLocalAdmins(ComputerName,Domain,GroupName)

On Error Resume Next

'Create a group object referencing the local Administrators group on the computer
  Set objLocalGroup = GetObject("WinNT://" & ComputerName & "/Administrators, group")
  If Err.Number = 0 Then

'Check to see if the Group already exists in the local Admin group
    For each Group in objLocalGroup.Members 
      If Instr(ucase(Group.ADSPath),ucase(Domain & "/" & GroupName)) <> 0 Then
        AlreadyExists = True
      End If
    Next

'Add the specified group to the local Administrators group if it doesn't already exist
    If AlreadyExists = False Then
      objLocalGroup.Add("WinNT://" & Domain & "/" & GroupName)

If Err.Number = 0 Then   ' If there's no error, then the return value will be "0" for AddGroupToLocalAdmins
        AddGroupToLocalAdmins = 0
        Err.Clear
      Else
        AddGroupToLocalAdmins = 1 ' If there was an error attempting to add the group, then the return value will be "1"
        Err.Clear
      End If

Else
      AddGroupToLocalAdmins = 2 ' If the group already exists, then the return value will be "2" for AddGroupToLocalAdmins
      Err.Clear
    End If

Else
    AddGroupToLocalAdmins = 3 ' If there was some other type of error, then the return value will be "3" for AddGroupToLocalAdmins
    Err.Clear
  End If

End Function
  
' Log Results
Function WriteLog(strLocalComputer,strMsg)
  Dim strTextStream
  Set strTextStream = objFS.OpenTextFile(LogFile, 8, true)
  strTextStream.WriteLine(Date & vbTab & Time & vbTab & ComputerName & vbTab & strMsg)
  strTextStream.Close
  ' strTextStream = Nothing 
End Function
      
'#############################

< Message edited by gdewrance -- 11/19/2006 5:15:26 PM >

(in reply to andrewli)

Post #: 2

RE: run script with administrator's right ? - 11/1/2006 9:01:10 PM

andrewli

Posts: 3
Score: 0
Joined: 12/13/2005
Status: offline

thanks your help

when i run first script to add local administrator groups , you must be a admin to run this script

but my question is ,

i want that when i run this script to add local administrator groups , i am not a admin members , just a user

(in reply to gdewrance)

Post #: 3

RE: run script with administrator's right ? - 11/1/2006 9:37:54 PM

gdewrance

Posts: 587
Score: 3
Joined: 3/16/2006
Status: offline

then you will need to search the forum for runas.
If you do not have admin rights, then ask your administrator. or are you trying to give yourself admin privileges?

< Message edited by gdewrance -- 11/1/2006 9:42:12 PM >

(in reply to andrewli)

Post #: 4

RE: run script with administrator's right ? - 11/2/2006 2:12:57 AM

SAPIENScripter

Posts: 271
Score: 2
Joined: 11/1/2006
From: SAPIEN Technologies
Status: offline

I'm assuming you don't want to give all domain uses admin rights, just the user logging on. Do multiple people logon to a specific computer or do you know that user Jane always and only logs on to computer XP01? To add a user to the local administrator's group you can use a script and run it as a computer startup script. However, you would need to somehow pass it the name of the user who will be logging on.

One idea that comes to mind is to put the username in the description of the computer object. Your computer start up script would get the description and add the user to the local administrator's group. You could even put in multiple users and separated by commas and parse the description as an array.

Once you know the name you want to add, here's another script that will add it to the local administrator's group if it doesn't already exist.

@echo off
::Add2LocalAdmin.bat
::9/20/2002 
::Revised Agust 2006
::Jeffery Hicks        jhicks@jdhitsolutions.com
::USAGE: Add2LocalAdmin groupname|useraccount
::DESC:  Add specified group or user to local administrators group.
::If grou pnames have spaces,be sure to enclose group in " "

::For example: add2localAdmin "MYDOMAIN\Tech Support"

::NOTES: You can use this as a computer startup script to add specified domain groups
::or users to the local Administrators group.  
::You could modify to add groups to Power Users group
::instead.

::A hidden audit log is written to C:\

if %1$==$ GOTO :NOPARAM

set _audit=c:\~grpaudit.log

::specify group(s) to be added.  
set _ADDME=%1

date /t >>%_audit% & time /t >>%_audit%

net localgroup administrators |find /i "%_ADDME%" >NUL

if %errorlevel%==1 GOTO :NOTFOUND
if %errorlevel%==0 GOTO :FOUND
GOTO :OUT

:FOUND
REM echo Found %_ADDME%
GOTO :OUT

:NOTFOUND
REM echo %_ADDME% Not Found
echo Adding %_ADDME% to local administrators group >>%_audit%
NET LOCALGROUP ADMINISTRATORS %_ADDME% /Add >>%_audit%
NET LOCALGROUP ADMINISTRATORS >>%_audit%
echo ************************************************************* >>%_audit%
Attrib +H %_audit%
GOTO :OUT

:NOPARAM
echo.
echo Missing parameter!
echo USAGE: Add2LocalAdmin group|user
echo Examples:  
echo  add2localadmin company\IT
echo  add2localadmin domain\juser
echo.
echo If group names have spaces,be sure to enclose group in " "
echo For example: 
echo  add2localAdmin "MYDOMAIN\Tech Support"
echo.
GOTO :OUT

:OUT
set _audit=
set _ADDME=

::EOF

Running the script as a computer startup script will get the job done. The trick is finding a creative way to specify the user(s) as a run time parameter.

_____________________________

Jeffery Hicks
Windows PowerShell MVP
SAPIEN Technologies - Scripting, Simplified. www.SAPIEN.com

Follow Me: http://www.twitter.com/JeffHicks

(in reply to gdewrance)

Post #: 5

RE: run script with administrator's right ? - 11/16/2006 3:36:28 AM

BigKidd1310

Posts: 2
Score: 0
Joined: 11/16/2006
Status: offline

I'm having a similar problem with some of our computers. We recently found a potentially harmful service running on many computers across our network and we have created a script which will search for this service and the files associated with it and if found delete them. The problem we have is that since many of our users are students we have one account they login to which is severly restricted on the actions they can perform. The script is set to run at login, however if it finds the file and service it attempts to delete them and we get a "Permission Denied" error message for our script.

I read the other replies in this topic but wanted to see if anyone knew a way so that the script when it ran would authenticate itself and make the computer believe it is the administrator running the script, rather than the user. This would save us from having to add this account, as well as individual accounts across the network,(even temporarily) to the Local Admin group.

Is it clear what I am asking? If not let me know and I'll try to rephrase or provide some more info on the situation. Thanks in advance for your help.

(in reply to SAPIENScripter)

Post #: 6

RE: run script with administrator's right ? - 11/19/2006 5:07:25 PM

netxman

Posts: 99
Score: 0
Joined: 8/1/2005
Status: offline

I think there is only one way to do that as I used.

One way has two choices. One is Runas. Another is PsExec.

Because Runas can not get the password input so I prefer PsExec.The premise is you should have an administrator account on that PC.

(in reply to BigKidd1310)