#113542 - 2004-02-07 02:00 AM
InGroup() when executing from RunAs
|
sixdoubleo
Starting to like KiXtart
Registered: 2004-02-06
Posts: 118
Loc: California, US
|
When I run a kix script with RunAs, how can I use InGroup to test group membership of the ORIGINAL user?
Anybody know of a clever way around this?
My thought was to group all of the InGroup()'s and checks of that sort in one script, then launch another script to RunAs the administrator and pass the information needed into it.
|
|
Top
|
|
|
|
#113549 - 2004-02-09 11:48 PM
Re: InGroup() when executing from RunAs
|
sixdoubleo
Starting to like KiXtart
Registered: 2004-02-06
Posts: 118
Loc: California, US
|
CLARIFICATION......(I thought it was pretty clear, but I guess not)
Consider two users:
JDOE (Real Human User) LOGONSVC (Service account I created)
JDOE is a member of "SALES" Group LOGONSVC is not a member of "SALES" Group.
User "JDOE" is logging in to his PC and running the logon script. At that time, InGroup("SALES") will be TRUE. and %USERNAME% will be "JDOE". But JDOE doesn't have admin rights to his PC, so to do anything really neat, I need to elevate the privilege of the logon process.
If I RUNAS /user:LOGONSVC, then all of the sudden InGroup("SALES") is FALSE and %USERNAME% is "LOGONSVC" because Kix is running under the context of the user "LOGONSVC".
I understand that I can split this up into a "User Space" script and an "Admin Space" script, and pass the needed information between them, but was just wondering if anybody had come up with a really slick way of doing this a little more clean????
|
|
Top
|
|
|
|
#113550 - 2004-02-10 12:42 AM
Re: InGroup() when executing from RunAs
|
ShaneEP
MM club member
   
Registered: 2002-11-29
Posts: 2127
Loc: Tulsa, OK
|
How about...
Code:
$user = ReadValue ("HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon","DefaultUserName")
If InStr ($user,"@@") $user = Split ($user, "@@")[0] Endif
$usergroups = UserGroups(@LDomain, $user)
If AScan ($usergroups,"Domain Admins") >= 0 ; Do Whatever You Would Do If They Were A Member Of The Above Group Endif
If AScan ($usergroups,"Domain Users") >= 0 ; Do Whatever You Would Do If They Were A Member Of The Above Group Endif
Function UserGroups($target,$user,OPTIONAL $datatype) DIM $group, $temp[2], $i $user = getobject("WinNT://$target/$user,user") if @error <> 0 and vartype($user) <> 9 exit(@error) endif for each $group in $user.groups select case $datatype = 0 ;return the group.name $temp[$i] = $group.name case $datatype = 1 ;return the groupobject $temp[$i] = $group case $datatype = 2 ;return the group.adspath $temp[$i] = $group.adspath case 1 exit(1) endselect if $i = ubound($temp) redim preserve $temp[$i+2] endif $i = $i+1 next if $i <> 0 redim preserve $temp[$i-1] $UserGroups = $temp else redim preserve $temp[$i] $usergroups = "" endif exit(0) endfunction
|
|
Top
|
|
|
|
Moderator: Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart
|
0 registered
and 1328 anonymous users online.
|
|
|