DSA.MSC

[LucasZ]

Hi guys, I've been trying different methods of getting dsa.msc (Active Directory Users and Computers) running using AutoIt through CyberArk.  I've tried several different methods and just can't seem to get it to launch when I test it locally and explicitly filling in the password and username variables.  I even tried creating  batch file that would launch dsa.msc and call that batchfile with the Runas command within AutoIt, but no luck.  My current script is:

 

Dsamsc()

Func Dsamsc()

   Local $sUserName = "actualusername"
   Local $sPassword = "actualpassword>"

   ;Command to run batch file that will run dsa.msc as target user from CyberArk
   Local $iPID = RunAs($sUserName, @ComputerName, $sPassword, "dsamsc.bat", "", @SW_SHOWMAXIMIZED)

   WinWait("[CLASS:MMCMainFrame]", "", 10)

   ProcessClose($iPID)

EndFunc

I've tried changing the launch command to 'c:\windows\system32\mmc.exe "dsa.msc"' as well with no luck.

Any help or advice in getting this done would be greatly appreciated.

[Earthshine]

Perhaps add #RequireAdmin keyword at the top of the script?

[water]

Why automate the GUI? Use my AD UDF to directly access Active Directory.

Edited January 18, 2018 by water

[Earthshine]

I don't even have that .msc file so I can't test. Water is 100% right

[LucasZ]

That doesn't make it function either unfortunately.

[LucasZ]

I'm doing this through CyberArk so I don't want the users ever having access to the actual password themselves and it would allow the session to be recorded for review.

[water]

Does CyberArk provide an API to handle such cases?

[LucasZ]

35 minutes ago, water said:

Does CyberArk provide an API to handle such cases?

Not a built in one that I'm aware of.  I'm creating a connection component utilizing AutoIt, which they seem to heavily recommend for things like this.

[Earthshine]

I’ll do a little digging tomorrow morn.  Getting tired. 

[LucasZ]

1 hour ago, Earthshine said:

I’ll do a little digging tomorrow morn.  Getting tired. 

Yeah no worries.  I appreciate you even looking at all.  Have a great night and thank you.

[LucasZ]

I figured out what I was doing wrong here.  I had to add in the logon flag as a 2 after the $sPassword variable.  Once I did that it processed successfully even with MMC and DSA.msc defined.  So basically I changed below:

RunAs($TargetUsername, $TargetDomain, $TargetPassword, 2, 'C:\Windows\System32\mmc.exe "C:\Windows\System32\dsa.msc"', "", @SW_SHOWMAXIMIZED)

Hope this helps someone else.

 

[chrweav86]

I'm looking to do the same but for BeyondTrust instead of CyberArk. I want to launch mmc with the AD Snap-in and have BeyondTrust pass credentials to the AutoIT exe.

This is the script I have thus far:

#include <AutoItConstants.au3>
#include <Constants.au3>
If $CmdLine[0] <> 3 Then
   MsgBox($MB_OK, "Usage", "mmc_launch <domain> <username> <password>")
Else
   mmc_launch($CmdLine[1], $CmdLine[2], $CmdLine[3])
EndIf

mmc_launch()

Func mmc_launch($domain, $username, $password)

    ; Run Notepad with the window maximized. Notepad is run under the user previously specified.
    Local $iPID = RunAs($Username, $Domain, $Password, 2, 'C:\Windows\System32\mmc.exe "C:\Windows\System32\dsa.msc"', "", @SW_SHOWMAXIMIZED)

    ; Wait for 2 seconds.
    Sleep(2000)

    ; Close the process using the PID returned by RunAs.
    ProcessClose($iPID)
EndFunc

 

Edited February 6, 2019 by Jos

[JLogan3o13]

@chrweav86 That's great you told us what you want. How about filling us in on what problem you're running into (error code, etc. etc.)?

 

[chrweav86]

Here is the error I get 

[Jos]

1 hour ago, chrweav86 said:

mmc_launch()

This line probably does that. What is it doing there?

It is way easier to run it from SciTE first before compiling. 
...and even better is to load the Full SciTE4AutoIt3 version which will run au3check before the run and tell you about these things:

>Running AU3Check (3.3.14.5)  from:C:\Program Files (x86)\AutoIt3  input:D:\Development\AutoIt3\programs\test\test.au3
"D:\test.au3"(12,47) : error: mmc_launch() called by a previous line with 0 arg(s). Min = 3. First previous line calling this Func is 7.
Func mmc_launch($domain, $username, $password)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
D:\Development\AutoIt3\programs\test\test.au3 - 1 error(s), 0 warning(s)

Jos

Edited February 6, 2019 by Jos

[chrweav86]

I've got it working now. How do I elevate the script to run elevated with respect to UAC?

I can get it to run with BeyondTrust with UAC turned off on the server.

I removed the session killer and the mmclaunch() form the script and it works now.

[Jos]

Just add #RequireAdmin at the top of your script? 

[chrweav86]

Perfect

 

[molsicor]

Hello Lucas, can you share your script ? 

[molsicor]

I think I couldn't launch it well so my own script doesn't work