Run a Script with administrative privileges via GPO

lx07 said:

runas isn't a program really. It is a standard part of windows command shell.

It works if run as a local administrator, otherwise it fails - it doesn't stop as there is no error handling - it just makes zero byte output files.

The script suppresses messages but if you remove this running as standard user gives

Code:

<snip>
C:\Users\Hali\Downloads>REG SAVE HKU\.DEFAULT C:\Registry_Backups\DEFAULT
ERROR: A required privilege is not held by the client.

C:\Users\Hali\Downloads>REG SAVE HKLM\SAM C:\Registry_Backups\SAM
ERROR: A required privilege is not held by the client.

C:\Users\Hali\Downloads>REG SAVE HKLM\SECURITY C:\Registry_Backups\SECURITY
ERROR: Access is denied.

C:\Users\Hali\Downloads>REG SAVE HKLM\SOFTWARE C:\Registry_Backups\SOFTWARE
ERROR: A required privilege is not held by the client.
<snip>

I don't know of any way to run programs at startup for non local-admins unless you specify a (not disabled) user/password of an account that does have local admin rights.

This batch script require administrative privilege to backup registry hives i was hoping OP will test the batch script using GPO.

FreeBooter said:

Looks like its the program causing the issue.

Probably but my concern now is that also your script didn't work .... maybe I am doing some error in setting the GPO script at start.....

epulone said:

Probably but my concern now is that also your script didn't work .... maybe I am doing some error in setting the GPO script at start.....

If i set script to start from GPO it works for me i don't know why it does not work for you.

FreeBooter said:

If i set script to start from GPO it works for me i don't know why it does not work for you.

I'm 99% sure that is because your user is part of the local admin group. Try it as a standard user without saving credentials.

I think OP needs to either grant admin access to these 100 users or go and save admin credentials on all the machines. Neither is a good solution. Alternatively look into what privileges the program really needs and if it really needs to be run as admin. That would depend who wrote it.

I have just test for fun a very simple script (where is not requested admin right ):

msg * "Welcome in my nightmare"

In this case it worked.

If understood well GPO is unable to perform a script if it require an admin right.... and not solution to go around!

Am I right?

lx07 said:

I'm 99% sure that is because your user is part of the local admin group. Try it as a standard user without saving credentials.

I think OP needs to either grant admin access to these 100 users or go and save admin credentials on all the machines. Neither is a good solution. Alternatively look into what privileges the program really needs and if it really needs to be run as admin. That would depend who wrote it.

Yes my user account is member of the Administrator group.

lx07 said:

I'm 99% sure that is because your user is part of the local admin group. Try it as a standard user without saving credentials.

This lab before was in a workgroup environment. We decided to joint them in a local independent domain to make easier the management. Before there was 1 local user not admin [ student] and 1 admin user.

Now in the domain we have created a general user [ student] only part of another group = "network operational group" but NOT admin group.

Do you think there is the possibility of some user profile corruption?

I'm 99% sure that is because your user is part of the local admin group. Try it as a standard user without saving credentials.

The user [ student] is not a local admin
If we elevate a student account be part of the administrative group they will mess around everything ....

epulone said:

I have just test for fun a very simple script (where is not requested admin right ):



In this case it worked.

If understood well GPO is unable to perform a script if it require an admin right.... and not solution to go around!

Am I right?

I agree with lx07 you need admins rights to execute the script.

I contacted the vendor of the software. They tested and confirmed the issue.

I linked the GPO to a domain admin user (at startup) and the error appear as well....so the issue is not connected totally to the admin right.

Just the last think .... I used a prompt command with elevated right adding it in the RunAs tool program and I use the import script on it below:

RunAsTool.exe “/U=Admin” “/P=PassWord” “/I=Import.rnt”

.....it worked fine.

Theoretically the problem could be solved if the script could be execute in each machine using a CMD with high elevate right....
Is it possible?