SU services works great if you use policy to block users from changing 9 kinds of things, if you make the SU account in your domain, this will make the user login on a local admin for that box.; Check to Ensure User is Member of Administrators Group on NT PC (Skip Non-Asset)
IF (@DOMAIN = $DOMAIN AND $ASSET = "yes" AND @INWIN=1 AND $NTTYPE = "WinNT")
IF INGROUP("\\"+ @WKSTA + "\Administrators") = 0
$RESULT = ExistKey ("HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SU")
IF $RESULT <> 0
$X = READPROFILESTRING (@LDRIVE + "\$INI.INI" , "Domain" , "AlertType")
IF ($X = "both" OR $X = "log")
IF @KIX > 3.49
$RESULT = LOGEVENT (1,1,"User " + @USERID + " not in Admin Group on " + @WKSTA,@LSERVER)
ENDIF
ENDIF
IF ($X = "both" OR $X = "msg")
$MSGTXT = "User @USERID not in Admin Group on @WKSTA."
CALL "SENDMSG.KIX"
ENDIF
$RESULT = MESSAGEBOX ("Your PC is not properly configured. Please contact your local helpdesk immediately.","Settings Enable",16,30)
$RESULT = Logoff (1)
EXIT
ENDIF
SETL "SU_PASSWORD=suservice"
SETL 'SU_COMMANDLINE=net localgroup administrators "@userid" /add'
SHELL @LDRIVE + "\Commands\SU suservice"
$RESULT = MESSAGEBOX ("Logging off to enable user settings. Please log back in when prompted.","Settings Enable",48,10)
$RESULT = Logoff (1)
EXIT
ENDIF
ENDIF
Some of this may look odd with the reference to $INI.INI we use a domain.ini file to read against, We also have the su service in a folder called commands on the netlogon share of the server, the third is for this to work first person with admin rights must log on in order to install the su service on the local system.
Note: SETL "SU_PASSWORD=suservice" this is the password for the service.
on the other of using the service account, have not done, I think I read in here some where you set the account user name as \\domain name\user name then punch in your password, then use command scheduler to do the rest, Does anyone have more insight on this?
)
