Page 1 of 1 1
Topic Options
#113542 - 2004-02-07 02:00 AM InGroup() when executing from RunAs
sixdoubleo Offline
Starting to like KiXtart

Registered: 2004-02-06
Posts: 118
Loc: California, US
When I run a kix script with RunAs, how can I use InGroup to test group membership of the ORIGINAL user?

Anybody know of a clever way around this?

My thought was to group all of the InGroup()'s and checks of that sort in one script, then launch another script to RunAs the administrator and pass the information needed into it.

Top
#113543 - 2004-02-07 02:04 AM Re: InGroup() when executing from RunAs
Lonkero Administrator Offline
KiX Master Guru
*****

Registered: 2001-06-05
Posts: 22346
Loc: OK
all the ingroups?
you mean something like enumgroup stuff?

ja, only way to do that is to get the info in context of the ORIG user.
basically that means that the initial script needs to provide that info.
via commandline or file or reg.
_________________________
!

download KiXnet

Top
#113544 - 2004-02-07 02:13 AM Re: InGroup() when executing from RunAs
Les Offline
KiX Master
*****

Registered: 2001-06-11
Posts: 12734
Loc: fortfrances.on.ca
Why do you need to RunAs Administrator and check group membership? Logon scripts should run in the security context of the user.
_________________________
Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.

Top
#113545 - 2004-02-07 02:15 AM Re: InGroup() when executing from RunAs
Lonkero Administrator Offline
KiX Master Guru
*****

Registered: 2001-06-05
Posts: 22346
Loc: OK
maybe to run something with elevated rights?
_________________________
!

download KiXnet

Top
#113546 - 2004-02-07 03:00 PM Re: InGroup() when executing from RunAs
Sealeopard Offline
KiX Master
*****

Registered: 2001-04-25
Posts: 11165
Loc: Boston, MA, USA
Taking a quick look at the UDF Forum for UDFs containing the word 'group' gives three UDFs that might be applicable: EnumOUs(), GetGroups(), UserGroups().
_________________________
There are two types of vessels, submarines and targets.

Top
#113547 - 2004-02-09 08:18 PM Re: InGroup() when executing from RunAs
ShaneEP Moderator Offline
MM club member
*****

Registered: 2002-11-29
Posts: 2127
Loc: Tulsa, OK
Could you not use the %username% environment variable in the second script?
Top
#113548 - 2004-02-09 08:54 PM Re: InGroup() when executing from RunAs
Lonkero Administrator Offline
KiX Master Guru
*****

Registered: 2001-06-05
Posts: 22346
Loc: OK
now isn't this what he just said he didn't want?
_________________________
!

download KiXnet

Top
#113549 - 2004-02-09 11:48 PM Re: InGroup() when executing from RunAs
sixdoubleo Offline
Starting to like KiXtart

Registered: 2004-02-06
Posts: 118
Loc: California, US
CLARIFICATION......(I thought it was pretty clear, but I guess not)

Consider two users:

JDOE (Real Human User)
LOGONSVC (Service account I created)

JDOE is a member of "SALES" Group
LOGONSVC is not a member of "SALES" Group.

User "JDOE" is logging in to his PC and running the logon script. At that time, InGroup("SALES") will be TRUE. and %USERNAME% will be "JDOE". But JDOE doesn't have admin rights to his PC, so to do anything really neat, I need to elevate the privilege of the logon process.

If I RUNAS /user:LOGONSVC, then all of the sudden InGroup("SALES") is FALSE and %USERNAME% is "LOGONSVC" because Kix is running under the context of the user "LOGONSVC".

I understand that I can split this up into a "User Space" script and an "Admin Space" script, and pass the needed information between them, but was just wondering if anybody had come up with a really slick way of doing this a little more clean????

Top
#113550 - 2004-02-10 12:42 AM Re: InGroup() when executing from RunAs
ShaneEP Moderator Offline
MM club member
*****

Registered: 2002-11-29
Posts: 2127
Loc: Tulsa, OK
How about...

Code:
$user = ReadValue ("HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon","DefaultUserName")

If InStr ($user,"@@")
$user = Split ($user, "@@")[0]
Endif

$usergroups = UserGroups(@LDomain, $user)


If AScan ($usergroups,"Domain Admins") >= 0
; Do Whatever You Would Do If They Were A Member Of The Above Group
Endif

If AScan ($usergroups,"Domain Users") >= 0
; Do Whatever You Would Do If They Were A Member Of The Above Group
Endif


Function UserGroups($target,$user,OPTIONAL $datatype)
DIM $group, $temp[2], $i
$user = getobject("WinNT://$target/$user,user")
if @error <> 0 and vartype($user) <> 9 exit(@error) endif
for each $group in $user.groups
select
case $datatype = 0 ;return the group.name
$temp[$i] = $group.name
case $datatype = 1 ;return the groupobject
$temp[$i] = $group
case $datatype = 2 ;return the group.adspath
$temp[$i] = $group.adspath
case 1
exit(1)
endselect
if $i = ubound($temp)
redim preserve $temp[$i+2]
endif
$i = $i+1
next
if $i <> 0
redim preserve $temp[$i-1]
$UserGroups = $temp
else
redim preserve $temp[$i]
$usergroups = ""
endif
exit(0)
endfunction


Top
#113551 - 2004-02-10 01:15 AM Re: InGroup() when executing from RunAs
Sealeopard Offline
KiX Master
*****

Registered: 2001-04-25
Posts: 11165
Loc: Boston, MA, USA
A "really slick way" is demonstarted in the "KiXtart Systems Management Server" and the various Task Scheduler threads and UDFs.
_________________________
There are two types of vessels, submarines and targets.

Top
Page 1 of 1 1


Moderator:  Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart 
Hop to:
Shout Box

Who's Online
0 registered and 1592 anonymous users online.
Newest Members
Viginette, ManuvdWielNL, Sir_Barrington, batdk82, StuTheCoder
17888 Registered Users

Generated in 0.139 seconds in which 0.069 seconds were spent on a total of 12 queries. Zlib compression enabled.

Search the board with:
superb Board Search
or try with google:
Google
Web kixtart.org