CPAU is here:
http://www.joeware.net/freetools/tools/cpau/index.htm
From its author's website:
"Command line tool for starting process in alternate security context. Basically this is a runas replacement. Also allows you to create job files and encode the id, password, and command line in a file so it can be used by normal users."
For example:
L:\GPOEXE\KB941158>CPAU -u DOMAIN\PCS_Elevated -p wE+JRggXuq&t,C9myEk&H5pnldMCCe0-s7H0nxgWdcEapNCdcwYt!DWbrsn\Lx# -ex "\\SERVERNAME
\APPS\GPOEXE\KB941158\IE8-WindowsXP-KB941158-v2-x86-ENU.exe /quiet /norestart"
-enc -file tn-demo.job
CPAU V01.11.00cpp Joe Richards (joe@joeware.net) November 2005
Current working directory is a network drive. Redirecting local
to avoid security context issues starting process.
Alternatively specify current working directory with -cwd option.
Current Security Context: DOMAIN\NETWizz
WARN:
WARN: This will not be an interactive authentication. This means
WARN: that the credentials are only valid for connecting to remote
WARN: resources, locally you will have the credentials CPAU was
WARN: launched with. If you need the specified credentials to work
WARN: on the local machine you need to use -LWP or -LWOP options.
WARN:
Attempting to create CPAU job file: bft63.job
Job file Created with following information:
Job File: tn-demo.job
Domain : DOMAIN
User : PCS_Elevated
Password: wE+JRggXuq&t,C9myEk&H5pnldMCCe0-s7H0nxgWdcEapNCdcwYt!DWbrsn\Lx#
Execute : \\SERVERNAME\APPS\GPOEXE\KB941158\IE8-WindowsXP-KB941158-v2-x86-ENU.exe /quiet /norestart
CRC Files:
Note that other options including -profile are NOT encoded, use
them in the decode command.
The command completed successfully.
L:\GPOEXE\KB941158>
Now, I have an active Directory user DOMAIN\PCS_Elevated has Local Admin rights to ALL the computers in my area of Active Diretory... More Specifically, it is a member of a Domain Local Group, which is a member of each computer's COMPUTERNAME\Adminstrators group; hence, PCS_Elevated has full Admin Rights to ALL my computers.
ALL of my users are Limted users. They can't install anything on their computers; hence, we have thousands of computers are work and very few software problems to deal with.
The installation of the above would work like this:
\\SERVERNAME\APPS\GPOEXE\KB941158\cpau -dec -file \\SERVERNAME\APPS\GPOEXE\KB941158\tn-demo.job -lwp
It will cause CPAU to process a job running that specific PATCH with the credentials DOMAIN\PCS_Elevated and the password wE+JRggXuq&t,C9myEk&H5pnldMCCe0-s7H0nxgWdcEapNCdcwYt!DWbrsn\Lx#
That password is then encrypted in the .job file, which is an ASCII file containing 2KB worth of HEX.
My code looks like this:
PHP:
'----------------------------------------------------------------------------------------
'Created by: NETWizz, My State Agency Name |
'Date: April 15, 2011 |
'This Logon script installs IE8-WindowsXP-KB941158-v2-x86 |
'-----------------------------------------------------------------------------------------
On Error Resume Next
strComputer = "."
Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate,(Shutdown)}!\\" & strComputer & "\root\cimv2")
FQDN = "domain.gov"
Dim objFSO,objFILE,objShell,objNetwork
set objFSO=CreateObject("Scripting.FileSystemObject")
set objShell=CreateObject("Wscript.Shell")
set objNetwork=CreateObject("Wscript.Network")
strDesktop=objShell.SpecialFolders("Desktop")
'Ping a host to verify network connectivity
pingHost = "10.1.2.3"
strPingStatus = PingStatus(pingHost)
If strPingStatus <> "Success" Then
Wscript.Quit
End If
'Read IP Address information from network adapter
Set IPConfigSet = objWMIService.ExecQuery ("SELECT IPAddress, DnsDomain FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled=TRUE")
For Each IPConfig in IPConfigSet
If InStr(IPConfig.DnsDomain, FQDN) Then
systemIP = IPConfig.IPAddress(0)
End If
Next
'Match site based on range of IP Addresses
If ipbetween(systemIP, "10.1.0.1", "10.1.255.254") Then
site = "SITE1"
End If
'If ipbetween(systemIP, "10.2.0.1", "10.2.255.254") Then
' site = "SITE2"
'End If
If ipbetween(systemIP, "10.3.0.1", "10.3.255.254") Then
site = "SITE3"
End If
If ipbetween(systemIP, "10.4.0.1", "10.4.255.254") Then
site = "SITE4"
End If
If ipbetween(systemIP, "10.5.0.1", "10.5.255.254") Then
site = "SITE5"
End If
If ipbetween(systemIP, "10.6.0.1", "10.6.255.254") Then
site = "SITE6"
End If
'Allow the use of a variable called FORCESITE to override the detected site i.e. Laptops
forcesite = objShell.ExpandEnvironmentStrings("%FORCESITE%")
If (forcesite <> "%FORCESITE%") Then
site = forcesite
End if
'**************************************************************************************************
'End of IP and Site Detection Header
'**************************************************************************************************
'Specify the computer we want to connect to
strComputer = "."
'HKEY_LOCAL_MACHINE Constant
const HKLM = &H80000002
'Connect to the Registry provider via Windows Management Instrumentation
set objRegistry = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")
'Read Registry to see if Patch is already installed
objRegistry.GetStringValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KB941158-v2-IE8","DisplayName",strName
if IsNull(strName) then
strName = ""
end if
'If the update is installed, quit
if (strName = "Hotfix for Windows Internet Explorer 8 (KB941158-v2)") then
wscript.quit
end if
'SITE 1 NAME
If (site = "SITE1") then
objShell.Run ("\\SITESERVER1\APPS\GPOEXE\KB941158\cpau -dec -file \\SITESERVER1\APPS\GPOEXE\KB941158\site1.job -lwp")
wscript.quit
End If
'SITE 2 NAME
If (site = "SITE2") then
objShell.Run ("\\SITESERVER2\apps\GPOEXE\KB941158\cpau -dec -file \\SITESERVER2\apps\GPOEXE\KB941158\site2.job -lwp")
wscript.quit
End If
'SITE 3 NAME
If (site = "SITE3") then
objShell.Run ("\\SITESERVER3\APPS\GPOEXE\KB941158\cpau -dec -file \\SITESERVER3\APPS\GPOEXE\KB941158\site3.job -lwp")
wscript.quit
End If
'Blah Blah Blah
'Blah Blah Blah
'**************************************************************************************************
'End of main script (Functions Below)
'**************************************************************************************************
Function IsAMemberOf(strDomain,strUser,strGroup)
On Error Resume Next
Set objUser=GetObject("WinNT://" & strDomain & "/" & strUser & ",user")
Set objGrp=GetObject("WinNT://" & strDomain & "/" & strGroup & ",group")
If objGrp.IsMember(objUser.ADsPath) Then
IsAMemberOf=True
Else
IsAMemberOf=False
End If
End Function
Sub MapIt(strDrive,strMap)
On Error Resume Next
If objFSO.DriveExists(strDrive) Then objNetwork.RemoveNetworkDrive(strDrive)
objNetwork.MapNetworkDrive strDrive,strMap
If Err.Number<>0 And blnShowError Then
strMsg="There was a problem mapping drive " & UCase(strDrive) & " to " &_
strMap & VbCrLf & strHelpMsg & VbCrLf & "Error#:" & Hex(err.Number) &_
VbCrLf & Err.Description
objShell.Popup strMsg,iErrorTimeOut,"Error",vbOKOnly+vbExclamation
Err.Clear
End If
End Sub
Function PingStatus(pingHost)
On Error Resume Next
strWorkstation = "."
Set objWMISvc = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strWorkstation & "\root\cimv2")
Set colPings = objWMISvc.ExecQuery _
("SELECT * FROM Win32_PingStatus WHERE Address = '" & pingHost & "'")
For Each objPing in colPings
Select Case objPing.StatusCode
Case 0 PingStatus = "Success"
Case 11001 PingStatus = "Status code 11001 - Buffer Too Small"
Case 11002 PingStatus = "Status code 11002 - Destination Net Unreachable"
Case 11003 PingStatus = "Status code 11003 - Destination Host Unreachable"
Case 11004 PingStatus = _
"Status code 11004 - Destination Protocol Unreachable"
Case 11005 PingStatus = "Status code 11005 - Destination Port Unreachable"
Case 11006 PingStatus = "Status code 11006 - No Resources"
Case 11007 PingStatus = "Status code 11007 - Bad Option"
Case 11008 PingStatus = "Status code 11008 - Hardware Error"
Case 11009 PingStatus = "Status code 11009 - Packet Too Big"
Case 11010 PingStatus = "Status code 11010 - Request Timed Out"
Case 11011 PingStatus = "Status code 11011 - Bad Request"
Case 11012 PingStatus = "Status code 11012 - Bad Route"
Case 11013 PingStatus = "Status code 11013 - TimeToLive Expired Transit"
Case 11014 PingStatus = _
"Status code 11014 - TimeToLive Expired Reassembly"
Case 11015 PingStatus = "Status code 11015 - Parameter Problem"
Case 11016 PingStatus = "Status code 11016 - Source Quench"
Case 11017 PingStatus = "Status code 11017 - Option Too Big"
Case 11018 PingStatus = "Status code 11018 - Bad Destination"
Case 11032 PingStatus = "Status code 11032 - Negotiating IPSEC"
Case 11050 PingStatus = "Status code 11050 - General Failure"
Case Else PingStatus = "Status code " & objPing.StatusCode & _
" - Unable to determine cause of failure."
End Select
Next
End Function
Function ipbetween(testip, lowerip, upperip)
saved = testip
tmpip = Split (testip,".",4)
testip = ((tmpip(0) * 256 + tmpip(1)) *256 +tmpip(2)) *256 + tmpip(3)
tmpip = Split (lowerip,".",4)
lowerip = ((tmpip(0) * 256 + tmpip(1)) *256 +tmpip(2)) *256 + tmpip(3)
tmpip = Split (upperip,".",4)
upperip = ((tmpip(0) * 256 + tmpip(1)) *256 +tmpip(2)) *256 + tmpip(3)
ipbetween = False
If (testip >= lowerip) and (testip <= upperip) Then
ipbetween = True
End If
systemIP = saved
End Function
There is some stuff in there it doesn't need to do because I have written 50+ scripts and tend to re-cycle code. I really don't need to declare that many objects in the beginning.
The final version of this script I totally cleaned up...
It has two additions added:
'Constant to Hide Window with ObjShell.Run
Const HIDE_WINDOW = 0
Each execution looks like this:
objShell.Run "\\SITESERVER3\APPS\GPOEXE\KB941158\cpau -dec -file \\SITESERVER3\APPS\GPOEXE\KB941158\site3.job -lwp", HIDE_WINDOW
That way the command prompt does not open and close on the user's screen when it executes the Logon Script. On fast computers, it would happen so fast they didn't see it, but on slower computers, they might see the command prompt and close it before it executes CPAU and loads the job.
Now, it is totally silent if the command prompt launches i.e. no Window. vB Script is always silent unless you display something
The user never sees it install, but it briefly shows up in the Task Manager until installed:
