Elevate a part of a script using Run As

[dbs179]

Hi all,

I have a utility I am working on that I want to users to be able to launch  regardless of their privileges on a workstation.  The utility runs through several warning GUI's and then collects a bunch of system data, such as IP address, ODBC connections and so forth.  It has the option to create a screenshot of the utility placing it on the users desktop and an option to email the screenshot using outlook.  I want users to be able to run this regardless of being administrators so that the screenshot shows up on their desktop and the email function uses their Outlook accounts.

I have that piece all worked out, but my problem is that further along in the utility I need to create some directories on the  C: drive, modify the Hosts file, and write to the registry.  If the script is not run with Admin rights, none of that happens but if I run it with admin rights the screenshot/email piece don't work as I wish. 

I think I could create another script and call it with RunAs and prompt for elevated rights, but I want the final compiled product to be all in one exe.  Is there anyway to solve this issue?

Thanks,

Dave

[BrewManNH]

Compile the second script, then FileInstall the second script into the first script's compiled exe.

[jguinch]

The BrewManNH suggestion seems to be the best...

You can also make a script such as this :

If NOT @Compiled Then Exit MsgBox(16, "", "You must compile the script")

If $CmdLine[0] = 1 AND $CmdLine[1] = "-admin" Then
    _AdminPart()
    Exit
EndIf



MsgBox(0, "", "I'm the main code, running with user rights." & @CRLF & "Now, I run myself with elevate rights.")
ShellExecute(@ScriptFullPath, "-admin", @ScriptDir, "RunAs")



Func _AdminPart()
    MsgBox(0, "", "I'm a part of the script, running in admin mode...")
EndFunc

What about this ?

Edited April 21, 2014 by jguinch

[dbs179]

Compile the second script, then FileInstall the second script into the first script's compiled exe.

BrewManNH, that makes sense, the only issue I'm having is I need to have the second portion of the script password protected.  Right now, the GUI I generate from the first part has some integers that are randomly generated and expects a password to continue based on the integers.  The submit button reads the GUI and then can call the Run for the second part.   I can move all of the GUI reads to the second part of the script, but I can't seem to get it to read that GUI since it didn't create it.  I can re-do the GUI, if I have to, but would rather keep it the same and have the second part read it if possible.

 

When it's all in the same script I have the GUI read portion down fine.

Thanks again for any help.

Dave

[BrewManNH]

Not going to work that way, you can't elevate part of a script, you elevate the whole thing or not at all.

[dbs179]

Not going to work that way, you can't elevate part of a script, you elevate the whole thing or not at all.

Ok, I re-worked my GUI's and scripts to keep part 2 still protected but now I'm having issues running script 2 from script 1.  I tried RunAs first and have code working with notepad but every time I change it to run the compiled Script #2 I get an error.  I tried just using Run and letting WIndows prompt for the Admin rights, but that didn't work either.  The only way I can get Script 1 to run compiled script 2 is to remove the #RequireAdmin line.  Am I missing something here?  I included my test script.  Again, the only way for me to get it to run the compiled script 2 is to remove #requireAdmin from Script 2 and re-compile it.

Thanks,

Dave

expandcollapse popup

#include <GUIConstantsEx.au3>
#include <GUIToolTip.au3>
#include <WindowsConstants.au3>
#include <MsgBoxConstants.au3>
#include<EditConstants.au3>

AdminAccount()





Func AdminAccount()
    $AdminAccountInput = GUICreate("Administrative Account Credentials Required", 615, 310, 552, 240, $WS_BORDER)
    $Icon1 = GUICtrlCreateIcon("C:\Program Files (x86)\AutoIt3\Icons\Warning.ico", 10, 15, 8, 64, 64)
    $Label1 = GUICtrlCreateLabel("In order to continue this" & @CRLF & "utility requires Administrative Rights." & @CRLF & @CRLF & "Please enter account details below.", 88, 15, 458, 66)
    GUICtrlSetFont(-1, 10, 400, 0, "MS Sans Serif")
    $GUI_Domain_Label = GUICtrlCreateLabel("Domain:", 117, 104, 43, 17)
    $GUI_User_Account_Label = GUICtrlCreateLabel("User Account:", 88, 151, 72, 17)
    $GUI_Password_Label = GUICtrlCreateLabel("Password:", 107, 199, 53, 17)
    $GUI_Domain_Input = GUICtrlCreateInput("", 184, 102, 345, 21)
    $GUI_User_Account_Input = GUICtrlCreateInput("", 184, 149, 345, 21)
    $GUI_Password_Input = GUICtrlCreateInput("", 184, 197, 345, 21, $ES_PASSWORD)
    $Continue = GUICtrlCreateButton("Continue", 88, 240, 96, 25)
            Local $hButton = GUICtrlGetHandle($Continue)
            Local $hToolTip = _GUIToolTip_Create(0)
            _GUIToolTip_AddTool($hToolTip, 0, "Click here to continue.", $hButton)
    $Exit = GUICtrlCreateButton("Exit", 438, 240, 96, 25)
            Local $hButton = GUICtrlGetHandle($Continue)
            Local $hToolTip = _GUIToolTip_Create(0)
            _GUIToolTip_AddTool($hToolTip, 0, "Click here to exit", $hButton)
    GUISetState(@SW_SHOW)

    While 1
        $nMsg = GUIGetMsg()
        Switch $nMsg

            Case $Continue
                $sDomain = GUICtrlRead($GUI_Domain_Input)
                $sUserName = GUICtrlRead($GUI_User_Account_Input)
                $sPassword = GUICtrlRead($GUI_Password_Input)
                Run("C:\Temp\Part 2.exe","C:\")
                ;RunAs($sUserName, $sDomain, $sPassword, 0, "Part 2.exe")
                If @Error Then
                    Msgbox(48, "Error Opening", "Could not open the application.",0)
                EndIf

            Case $Exit
                Exit

        EndSwitch
    WEnd
EndFunc

Edited April 23, 2014 by dbs179

[dbs179]

So I thought I was going crazy yesterday and decided to try this again.  I used the same script  I posted above with a few changes.  I'll refer to that as Script 1.  My plan is to have Script 1, file install Script 2 in compiled form to a known location and then execute it using run as (I know how to do all of that with no issues and have left it out of my test script to simplify my testing).  In my testing yesterday, I could not get Script 1 to launch compiled Script 2.  I tried all sorts of testing, thinking that maybe it was my gui, my variables, or something else.  I found that it seemed to be the #RequireAdmin line in compiled script 2.

So today, I started testing again.  This time I made two very simple versions of Script 2, one with #RequireAdmin and one without.   I get the exact same results.  I have to either be missing something simple, or totally misunderstanding how RunAs and #RequireAdmin work together.  Any help would be greatly appreciated!!

 

P.S. after I posted this I tried ShellExecute and it does work,  and prompts for the Admin Account and Password as it would if launching normally, so that will probably be my fall back solution if this method doesn't work.

 

Script 1

expandcollapse popup

#include <GUIConstantsEx.au3>
#include <GUIToolTip.au3>
#include <WindowsConstants.au3>
#include <MsgBoxConstants.au3>
#include<EditConstants.au3>

AdminAccount()





Func AdminAccount()
    $AdminAccountInput = GUICreate("Administrative Account Credentials Required", 615, 310, 552, 240, $WS_BORDER)
    $Icon1 = GUICtrlCreateIcon("C:\Program Files (x86)\AutoIt3\Icons\Warning.ico", 10, 15, 8, 64, 64)
    $Label1 = GUICtrlCreateLabel("In order to continue this utility requires Administrative Rights." & @CRLF & @CRLF & "Please enter account details below.", 88, 15, 458, 66)
    GUICtrlSetFont(-1, 10, 400, 0, "MS Sans Serif")
    $GUI_Domain_Label = GUICtrlCreateLabel("Domain:", 117, 104, 43, 17)
    $GUI_User_Account_Label = GUICtrlCreateLabel("User Account:", 88, 151, 72, 17)
    $GUI_Password_Label = GUICtrlCreateLabel("Password:", 107, 199, 53, 17)
    $GUI_Domain_Input = GUICtrlCreateInput("", 184, 102, 345, 21)
    $GUI_User_Account_Input = GUICtrlCreateInput("", 184, 149, 345, 21)
    $GUI_Password_Input = GUICtrlCreateInput("", 184, 197, 345, 21)
    ;$GUI_Password_Input = GUICtrlCreateInput("", 184, 197, 345, 21, $ES_PASSWORD)
    $Continue = GUICtrlCreateButton("Continue", 88, 240, 96, 25)
            Local $hButton = GUICtrlGetHandle($Continue)
            Local $hToolTip = _GUIToolTip_Create(0)
            _GUIToolTip_AddTool($hToolTip, 0, "Click here to continue.", $hButton)
    $Exit = GUICtrlCreateButton("Exit", 438, 240, 96, 25)
            Local $hButton = GUICtrlGetHandle($Continue)
            Local $hToolTip = _GUIToolTip_Create(0)
            _GUIToolTip_AddTool($hToolTip, 0, "Click here to exit", $hButton)
    GUISetState(@SW_SHOW)

    While 1
        $nMsg = GUIGetMsg()
        Switch $nMsg

            Case $Continue
                $sDomain = GUICtrlRead($GUI_Domain_Input)
                $sUserName = GUICtrlRead($GUI_User_Account_Input)
                $sPassword = GUICtrlRead($GUI_Password_Input)
                RunAs($sUserName, $sDomain, $sPassword, 0, "Part 2 - Admin.exe")
                If @Error Then
                    Msgbox(48, "RunAs - Error Opening", "Could not open Part 2 - Admin with RunAs.",0)
                EndIf

                Run("Part 2 - Admin.exe")
                If @Error Then
                    Msgbox(48, "Run - Error Opening", "Could not open Part 2 - Admin with Run.",0)
                EndIf

                RunAs($sUserName, $sDomain, $sPassword, 0, "Part 2 - No Admin.exe")
                If @Error Then
                    Msgbox(48, "RunAs - Error Opening", "Could not open Part 2 - No Admin with RunAs.",0)
                EndIf

                Run("Part 2 - No Admin.exe")
                If @Error Then
                    Msgbox(48, "Run - Error Opening", "Could not open Part 2 - No Admin with Run.",0)
                EndIf


            Case $Exit
                Exit

        EndSwitch
    WEnd
EndFunc

Script 2 With #RequireAdmin

#include <MsgBoxConstants.au3>
#RequireAdmin
Msgbox(48, "It Worked!", "This script does have #RequireAdmin in it.",0)

Script 2 Without #RequireAdmin

#include <MsgBoxConstants.au3>

Msgbox(48, "It Worked!", "This script does NOT have #RequireAdmin in it.",0)

.

Edited April 24, 2014 by dbs179

[dbs179]

I never really got a good answer on this, but I'm just moving forward with by using ShellExecute.  It works just as well.

Thanks,

Dave