|
I'm domain admin for a smallish single native 2K domain with mixed NT4Ws, W2KPro and XPPro clients. We don't allow local users admin right to their machines which makes it quite difficult to roll out emergency updates such as the recent MS03-026. Instead, I use a commercial Patch Deployment application - which also has its drawbacks (sudden restart after a 'quiet' install etc)
I created a user called 'virup' which is an administrator level user - this runs a KiXtart script to check AV revisisons and then install the latest AV updates and logout.
I'd really like to extend this functionality and create an 'up2date' user which...
1. Sets autoadmin logon to 'up2date'
2. Tests for SP4, SP6a
3. Tests for IE6 SP1
4. Tests AV versions
5. Installs all required updates, rebooting as necessary (hence stage 1)
6. On 'no updates required', removes the autologin
The only thing stopping me doing this is a concern that if the script runs for a while, clued up users could shell out and abuse the elevated priviliges. Is there any way of preventing this? - I have not made the virup user publicly accessible, but I'd like to make the up2date user accessible to all!
GPO to set scripts to asyncronous is a start, setting ACL on TASKMAN to deny execute perms for 'up2date' helps; anything else perhaps?
| 
