So i have a login script witch shuold set some values to HKEY_CURRENT_USER\Software\Policies The problem is the user executing the script has no Write Permission here. I have tried using RunAs or cpau.exe to call the .bat ( the .bat has for example "reg import myreg.reg") But It is not working, I need help to solve this. I have thought of using other tools like subinacl (not working at the moment), will try RegDAcl, and regrant. Wish I could do all by VB. Maybe if I impersonate System and then try to write? I could not find a simple example of importing Registry keys from a .txt, is tehre any? Thanks in advance
I would have thought the user should have permission to that key area? I guess you could edit the domain security template to grant users permission and then you could just run plain vbscript in the user context.
But here is a solution I did for a similar problem, I created a service type account with just enough permissions to do the job.
and used a script like this.
Runas.vbs
then for a bit of extra security obfuscated it with SCRENC Microsoft Script encoder like this
Hey Tom, thanks for the tip. I was heading that way before but my RunAs function was not working, I added some of your lines. But the whole problem here is "user context", if one makes changes to HKEY_CURRENT_USER, it has to be that user. Witch does not happen if I runas the .reg file. So for Now I am using cpau.exe 3 times. (cpau.exe its kind of runas but you can preset password, it encrypt as well =:) 1st. put userX in local admin 2nd run, runas with userX to update Registry (admin previlegis dont take effect immediatly, but thru runas it does!) 3rd remove userX from local admin group
Anyways, the script is not very dynamic, but at the moment its working!
ahh. cool about the little encryption u made, can you explain more how it works? I see no ref. to .vbe...
Hey 4scriptmoni, sorry about the runas blunder. maybe you can package it as another idea. Would be interested in seeing the whole script as it sounds an interesting problem and I am only guessing at answers.
I did see somewhere, I think this forum, a script where you can punch in registry values remotely to this key with WMI, I know you can do it with regedit if you know the user's sid.
re the script encoder. it is just a download from Microsoft and the vbe part is the extension you give the file.
You cannot encrypt a password within a VBScript. You can encode the entire script. There are even some third party tools that will let you compile the script into an executeable but be careful you can still extract the password from most of them.
Well. I wish there was a better way to encrypt single Strings. Maybe I will think of a function in the future that checks exactly the vbscript file size, if it has been modified then it will not decrypt. But also this would not be completly enough. Anyone that knows a the basic of vb could get the password, oh well. I am pretty much done with this script, it got longer and more complicated then I expected. But it does a lot. The general idea is to implement some BUsinses POlicy once the laptop is use with a Local Login acount. It adds some registry keys, reset explorer, and sync files if the server is found.
< Message edited by 4scriptmoni -- 3/7/2008 12:01:28 AM >
Posts: 1916
Score: 16
Joined: 5/15/2003
From: USA
Status: offline
This is one thing I wish Wscript did better. But since it doesn't you can also use AutoIT to elevate permissions and the plus on AutoIT is that you when you compile the script you can "prevent" decompilation.
here is the example from the AutoIT help file
In the above, you could have your vbscript call the exe which in turn can either do what you want it to do or call an additional script to do what you want it to do.
_____________________________
Mike
For useful Scripting links see the Read Me First stickey!
Hi 4scriptmoni, Thats a pretty big script, I think that the user should have full permission to read and write to HKEY_CURRENT_USER. (via VBScript)
I have come across a similar thing on my domain, the users don't have permission to access the registry via registry editing tools like regedit, reg, etc due to grouppolicy. (Your script is using reg)
Posts: 1916
Score: 16
Joined: 5/15/2003
From: USA
Status: offline
For a "normal" user, if they have denied access, via policy, to edit the registry then even though they might be an admin they still wouldn't be able to run a .reg. They could edit the registry via a script but not via a .reg. At least this is how we have it setup.
If you are trying to have them edit the CU reg key then you can add this to your script
Add this before your regedit 'Enable registry access Set WSHShell = WScript.CreateObject("WScript.Shell") WSHShell.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools"
Add this to turn off the reg access. 'Disable registry access Set WSHShell = WScript.CreateObject("WScript.Shell") WSHShell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools", 1, "REG_DWORD"
_____________________________
Mike
For useful Scripting links see the Read Me First stickey!
mbouchard Thanks for the ideas. But autoit is not something we use much here.I dont understand what is the big advantage since you are showing the Passowrd here : RunAsSet('USER', @Computername, 'PASSWORD') and then calling a .exe
I am just doing a decrypt(sPass3) then:
call RunAs("runas",sPass3,"net localgroup Administradores testuser /add") ' ADDS THE USER TO LOCAL ADMIN call RunAs(strUser,"testuser","regedit /s " & RegSala) 'RUNS THE REG UPDATED UNDER TESTUSER CONTEXT call RunAs("runas",sPass3,"net localgroup Administradores testuser /delete") ' REMOVES THE USER TO LOCAL ADMIN
The entries on the regeistry that you mention is also something we dont have.But I think Tom does.
But by default regular users do not have the rights to change HKCU Policies or HKLM (none of the policies keys). The things maybe I could improve here would be, the impersonate, encryption..., the POPUPS, my last version does use a new Exec function, witch no longer shows the Popup.
But with the RunAs function, this can not be done :(
I wish there was a better way to impersonate in general a script call. For example, Impersonate user X and execute cmds from this account, maybe for WMI or LDAP calls it can be done???
ebgreen Maybe you could explain the encoding and fake vbs streaming, sorry I am not sure how this works...
Posts: 1916
Score: 16
Joined: 5/15/2003
From: USA
Status: offline
quote:
ORIGINAL: 4scriptmoni
mbouchard Thanks for the ideas. But autoit is not something we use much here.I dont understand what is the big advantage since you are showing the Passowrd here : RunAsSet('USER', @Computername, 'PASSWORD') and then calling a .exe
The advantage here would be that you compile your AutoIT script into an EXE that cannot be easily decompiled.
_____________________________
Mike
For useful Scripting links see the Read Me First stickey!
All Forums >> [Scripting] >> WSH & Client Side VBScript >> Registry Edit in Login Script 
Printable Version
Registry Edit in Login Script - 
RE: Registry Edit in Login Script - 
New Messages
No New Messages
Hot Topic w/ New Messages
Hot Topic w/o New Messages
Locked w/ New Messages
Locked w/o New Messages
Post New Thread