Run script as System or Administrator on non-access user

[RestrictedUser]

Hello AutoIt scriptwriters

I want to run script as System Account or Administrator Account on non-access users

 

I had set my server a password when non-access user wants to luanch or install exe files

 

But i want to make my script start automatically on all users even non-access users without asking password for luanching my AutoIt exe script at startup

Edited March 7, 2019 by Colduction

[Subz]

Configure Task Scheduler to run your script on logon as System account or use a GPO Startup Script.

[RestrictedUser]

49 minutes ago, Subz said:

Configure Task Scheduler to run your script on logon as System account or use a GPO Startup Script.

I know, but i want do these steps by script 

 

How can i? 

[BrewManNH]

Compile the script and run it through the task scheduler.

[Juvigy]

Why not just use RunAs ? And put the script in the startup folder....

[benched42]

You can do that if you know the Administrator or System password. However, even if you obfuscate the password it could be obtained by a clever user.

[RestrictedUser]

39 minutes ago, benched42 said:

You can do that if you know the Administrator or System password. However, even if you obfuscate the password it could be obtained by a clever user.

Yeah, i know the password, but how to do that? 

[RestrictedUser]

22 hours ago, BrewManNH said:

Compile the script and run it through the task scheduler.

No, because some of my users delete these schedules =(

[BrewManNH]

Do you have access to Group Policy? If you do, you can run it at log on through GP.

[RestrictedUser]

9 hours ago, BrewManNH said:

Do you have access to Group Policy? If you do, you can run it at log on through GP.

Yeah, i have access, but i want to do these by AutoIt Script

[BrewManNH]

Run the script compiled during log in or boot up or how ever you want the script to run. You can use a batch file to run the executable from within GP.

[benched42]

On 3/8/2019 at 3:39 PM, Colduction said:

Yeah, i know the password, but how to do that? 

Well I tried that at one time by building the admin password one character at a time using the CHR() function.

For a password of "Password1" the code I wrote initially was very rudimentary:

$theAdminPassword = Chr(80) & Chr(97) & Chr(115) & Chr(115) & Chr(119) & Chr(111) & Chr(114) & Chr(100) & Chr(49)

Doesn't do a lot to stop a clever and determined user, but does obfuscate it somewhat. Another way is to put the numbers into a text file and read them line by line to build the admin password. Then you can easily change admin passwords without rewriting code. I wrote something like this later as we changed our admin password:

$fHandle = FileOpen({some UNC path to a public file on the network}, 0)
$theAdminPassword = ""
While 1
  FileReadLine($fHandle, $theChar)
  If @error
    ExitLoop
  Endif
  $theAdminPassword = $theAdminPassword & Chr($theChar)
WEnd
FileClose($fHandle)

 

[caramen]

From what i know in my windows knowledge you can configure an executable to have administration rigth anyway without prompt. 

You just have to set it one time like that : 

I apologise for the "circles" 😂😂.

Rigth click on the executable and "properties"

Left click on "advanced"

This is working with all exe & shordcut

Edited March 12, 2019 by caramen

[Jos]

39 minutes ago, caramen said:

From what i know in my windows knowledge you can configure an executable to have administration rigth anyway without prompt. 

Nah... UAC will come up when enabled and rightly so or else we are back in the win95 days with all its security risks.  

Jos

[caramen]

Yeah anywhere the shield is seen you will have an UAC prompt(I have UAC disabled that's why i have no shield). But it's only when you remove the prompt i guess not when you run the item.

I dont know issue with that. If you can learn me that .

Edited March 12, 2019 by caramen

[RestrictedUser]

25 minutes ago, caramen said:

Yeah anywhere the shield is seen you will have an UAC prompt(I have UAC disabled that's why i have no shield). But it's only when you remove the prompt i guess not when you run the item.

I dont know issue with that. If you can learn me that .

maybe should use AsInvoker 🤕

[AdamUL]

To not get the UAC prompt for Admins, without completely turning off UAC.  You would want to set the ConsentPromptBehaviorAdmin to 0, which is $UAC_ELEVATE_WITHOUT_PROMPTING.  I wrote a UDF for this.  This function call would need to be in a different script, run as admin, to set the setting.  After that, your scripts with #RequireAdmin or a compiled script with the manifest set to requireAdministrator will run without the UAC prompt.  As mentioned in the UDF: "Use this option only in the most constrained environments."

#RequireAdmin
#include <UAC.au3>

_UAC_SetConsentPromptBehaviorAdmin($UAC_ELEVATE_WITHOUT_PROMPTING)

 

Adam