RunAsSet() and Interactive Programs

[Airwolf]

I am trying to create a script that will run a program which needs to interact with the desktop environment. Basically, if I'm logged on as Administrator in another session and I run script.exe from a different session then the script works. If the Administrator session is closed (i.e. I logoff as Administrator) and then run script.exe in my normal user session then the script fails.

Is there any way to accomplish this without being logged in to an idle session as Administrator?

[Jos]

I am trying to create a script that will run a program which needs to interact with the desktop environment. Basically, if I'm logged on as Administrator in another session and I run script.exe from a different session then the script works. If the Administrator session is closed (i.e. I logoff as Administrator) and then run script.exe in my normal user session then the script fails.

Is there any way to accomplish this without being logged in to an idle session as Administrator?

Just run the script with PSEXEC ...

[Airwolf]

Just run the script with PSEXEC ...

I still don't seem to be getting anywhere with it. I have it setup to use a password and when I login to the machine and the login script calls this program psexec still prompts for a password. Here is what I have so far... SubInAcls commands are not working, the permissions don't change at all so it seems PSexec is still not running this interactively.

Global $admin
Global $pass
Global $user

$admin = "admin"
$pass = "password"
$user = @username

RunWait(@ComSpec & " /c Start" & '%LOGONSERVER%\NETLOGON\Misc\psexec.exe /accepteula -u ' & $admin & '-p ' & $pass & ' -i %LOGONSERVER%\NETLOGON\Misc\subinacl.exe /file "C:\Documents and Settings\' & $user & '\Desktop" /revoke=DOMAIN\' & $user,"",@SW_HIDE);revoke desktop permissions for logged on user

RunWait(@ComSpec & " /c Start" & '%LOGONSERVER%\NETLOGON\Misc\psexec.exe /accepteula -u ' & $admin & '-p ' & $pass & ' -i %LOGONSERVER%\NETLOGON\Misc\subinacl.exe /file "C:\Documents and Settings\' & $user & '\Desktop" /grant=DOMAIN\' & $user & '=E',"",@SW_HIDE);grant Read/Execute permissions for logged on user's desktop

My ultimate goal is to have a user's desktop locked down to read/execute when they login instead of the full access control they receive by default. I can get the script to work but the admin account has to be logged into the machine when users logon in order to succeed.

Edited May 3, 2007 by Airwolf123

[PsaltyDS]

Just run the script with PSEXEC ...

I'm not a fan of PSEXEC. At least back-n-the-day, it sent passwords in the clear over the network. Got in the habit of authenticated user CIFS file transfers and kicking off programs with SCHTASKS.EXE (or AT.EXE back then). Of course PSTools and Mark Russinovich are Microsoft owned products now. Might be much updated by now...

[PsaltyDS]

Is this something that can't be done WITHOUT a desktop? Like with SetACL.EXE? Without the need for a Windows GUI desktop, you don't need the logged in session.

[Airwolf]

I finally got something to work... but it has nothing to do with AutoIt.

I ended up using cacls.exe with the user's rights (no runas since the user is the directory owner... not needed). All I had to do was add this code to the logon script:

C:\WINDOWS\system32\cacls.exe "C:\Documents and Settings\%USERNAME%\Desktop" /E /P DOMAIN\%USERNAME%:R

Thanks for the suggestions!