Run as elevated rights
Updated: 08 Dec 2011 | 10 comments
Hello everyone.
I need to run wrapper to execute CCMSETUP.EXE (sccm client) as elevated rights. Our sccm server is down and rebuild, in order to redirect, i need to install client through login script. Login script runs as user level permission.
i can run my wrapper and it install fine if user has admin rights, but not for non admin user. we have mixed windows 7 enterprise and windows xp pro.
i am using wise package studio 8.
any example or suggestion would be appreciate.
thanks
Discussion Filed Under:
Comments
Are you able to use PSEXEC to
Are you able to use PSEXEC to run your install in the context of the local administrator account?
If your issue has been solved, please use the "Mark as Solution" link on the most relevant thread.
I'm wondering what the point of that would be?
If the server is down, what possible use can the SCCM client be? Once the server is up, you can force-install the client to your workstations.
Don't know why 'x' happened? Want to know why 'y' happened? Use ProcMon and it will tell you.
Think about using http://www.google.com before posting.
VBScab: long story short,
VBScab: long story short, SCCM has been rebuild but with different site code and MP. So, i need to uninstall client and reinstall client with right sitecode and Fall back.
When i tried remotely with PSexec, it installs fine. when i login as user and launch with wrapper, it won't install, when i have given (local admin username and password). i don't get any error.
item: Remark
end
item: Set Variable
Variable=APPTITLE
Value=Microsoft SCCM Client
end
item: Set Variable
Variable=FILE-INSTALL
Value=%INST%\ccmsetup.exe
end
item: Remark
end
item: Remark
end
item: Set Variable
Variable=PSEXEC
Value=%inst%\PSexec.exe
end
breakpoint item: Set Variable
Variable=USER
Value=admin\admin
end
item: Set Variable
Variable=PASS
Value=password
end
item: Remark
end
item: Remark
end
item: Execute Program
Pathname=%PSEXEC%
Command Line=-u %user% -p %pass% %file-install%
end
You can change the site
You can change the site code without reinstalling the client. It's a registry key.
If your issue has been solved, please use the "Mark as Solution" link on the most relevant thread.
I know i can, but we have
I know i can, but we have changed new primary site and each MP to secondary sites and fallback point too.
Here is some vbscript which
Here is some vbscript which changes the site code that I used a few years ago:
If your issue has been solved, please use the "Mark as Solution" link on the most relevant thread.
thanks for your script EDT.
thanks for your script EDT. It is just not changing sitecode will take care all clients to talk with mp. I am consultant with this company and they had lots of problem with SCCM. There had been lots of upgrade happened, its a mess. They only thing i can do to uninstall any client if exists and reinstall with right sitecode, MP and FSP.
So i can incorporate a local admin username and password (actually user in the security group to local administrators group) in the script and run it. Thats i need help in wrapper mentioned above, looking for any help or someone has suggestion to run exe with admin rights to user doens't has admin rights....
With a mixed XP and Win 7
With a mixed XP and Win 7 environment, I really don't think a wrapper solution is going to work. XP was less secure and therefore you could do things with the AT scheduler that are no longer possible with Win 7.
If you have a valid audit list of your machine names, it would be trivial to set up something in the login script which reads the computer name, connects to the C:\ drive using admin credentials, transfers a copy of the new client, and uses PSEXEC to delete the old client and install the new. You could even include something like an AutoIT script which disables the keyboard and mouse so that the user cannot initiate a shutdown while the process is running, although with PSEXEC it is possible to do it all silently in the background if required.
If you have an environment where you can use Group Policy for deployment, that could be used in place of SCCM to handle the distribution of an updated client.
If your issue has been solved, please use the "Mark as Solution" link on the most relevant thread.
Edt said "......set up
Edt said "......set up something in the login script which reads the computer name, connects to the C:\ drive using admin credentials...."
thats exactly i am trying to accompolish. In my environment, login script runs as user level. I would like to run executable using admin crendentials with wisecript wrapper, the reason wrapper for security. I know this is not the best but at least something.
So, in wrapper above how can i integrate psexec to run ccmsetup.exe?
thanks for your help
PSEXEC
It has been a while since I last used psexec, so I had a quick look at the command line options to remind myself (http://technet.microsoft.com/en-us/sysinternals/bb897553) .
From looking at the options, it appears you can direct psexec to target all computers in the current domain, or to use a list of computers from a text file. This suggests to me that you could use a simple logon script command to copy the SCCM client installation files to the user profile (eg application data) and then log the computer name on your logon share (if you don't have a list of target machines available) so that you can then create a list on a daily basis and then run psexec from your admin workstation using the appropriate credentials to cause the installation of the code from each machine after the client has been transferred. (reduces network loading and makes sure the client installs quickly).
If this method is too interactive for your taste, then you can do things automatically in one of two ways:
1. Run the Wisescript from your logon share to install the psexec.exe and the sccm client installation files to somewhere in the user profile. Turn off install logging on the wisescript and make sure you are not asking it to do anything during the install that would require elevated permissions. Once the files are on the system, you can use the Execute Program command to run psexec.exe (ensuring you have specified the full path in double quotes in the EXE field) and include the rest of the command line parameters including domain admin name and password in the argument field. As before, ensure any paths with spaces in them are double quoted.
This should install your client. If you need to do an uninstall first, then you can use the Execute Program command to run msiexec.exe and the argument would be /x {product code of old MSI} /qn and make sure that you have the wait option flagged so that the Wisescript waits until the uninstall is finished before continuing. Finally, clean up the psexec and sccm installer files by deleting them from the location you installed them to.
2. Use the Wisescript as above, but call the psexec.exe file and the SCCM installer direct from the network share rather than installing them to the local system. The wisescript %INST% variable returns the full path to the EXE you are running so with a bit of parsing you can determine the correct path to use to call psexec.exe and the sccm client installer. No need to clean up afterwards.
The things you will need to check are your antivirus response to what you are trying to do. Some A/V programs consider psexec.exe to be malware and quarantine/block it. You are also going to be running an EXE from a network location which may also cause the A/V to respond protectively.
I hope this is enough to get you up and running but if you have any more questions let me know.
If your issue has been solved, please use the "Mark as Solution" link on the most relevant thread.
Would you like to reply?
Login or Register to post your comment.