Re: creating "runas" shortcut through vb script

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

Not very elegant from the point of view of security, and the principle of
least privilege.

Our experience is that when someone (i.e. the developer of the software)
says that the users need to have admin privs, this is because they did a
poor job of designing the security in properly in the first place. Quite
often, however, the user does not actually need full admin privs, but only a
subset. Sometimes this is read/write access to a specific application file
or folder, sometimes read/write access to a registry key.

In one case (dragon naturally speaking) we found that we could make the end
user a local administrator, use her account to do the install and run the
application once, permit a specific folder read/write to the user, then
demote her account to a reqular user. Unfortunately, it can be quite tricky
to track down what the required accesses are, which is why the lazy
developers avoid doing this by taking the easy way out and saying the user
must be an administrator.

/Al

"Pegasus (MVP)" <I.can@xxxxxxx> wrote in message
news:%23UPoW%23gLIHA.3400@xxxxxxxxxxxxxxxxxxxxxxx
A more elegant method might be to make all domain users
members of the local "Administrators" group. This would
remove the need for any "runas" stuff.


"Josh Nikle" <jnikle@xxxxxxxxx> wrote in message
news:0d0be697-d7bb-4784-9746-7ff806189e5e@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Good afternoon. Currently I have to give all my users admin rights on
their machines for the sake of a few programs, so I've started playing
around with runas. Specifically I want a script that will create a
shortcut for a given program that runs it with different credentials.
I've been piecing bits of code together, and so far I've arrived at
the below script which creates the shortcut on my desktop, but for
whatever reason I can not get the application path correct. It
insists on putting a leading quote in the path name no matter what I
do.

Should be: runas /user:<my domain>\<the user> "<some program file
path>"
Getting instead: "runas /user:<my domain>\<the user> "<some program
file path>""

I've tried many iterations of the strAppPath line, but no luck.
Anyone have any ideas?



Option Explicit
Dim objShell, objDesktop, objLink
Dim strAppPath, strWorkDir, strIconPath

strWorkDir ="%SystemRoot%\system32"
strAppPath ="runas /user:<my domain>\<the user> ""<some program file
path>"""
strIconPath = "%SystemRoot%\system32\SHELL32.dll,5"

Set objShell = CreateObject("WScript.Shell")
objDesktop = objShell.SpecialFolders("Desktop")
Set objLink = objShell.CreateShortcut(objDesktop &
"\ShortcutTest.lnk")

' ---------------------------------------------------
' Section which adds the shortcut's key properties

objLink.IconLocation = strIconPath
objLink.TargetPath = strAppPath
objLink.WindowStyle = 3
objLink.WorkingDirectory = strWorkDir
objLink.Save

WScript.Quit

-Josh




.

Relevant Pages

  • Re: Access 2003 Macro Security Modification
    ... > development and deployment is supposed to be modified, ... I'm not much of .NET developer (OK, I'm not a .NET developer at ... Or is the security level ... to determine if the code has been altered (Public Key). ...
    (microsoft.public.access.modulesdaovba)
  • RE: Deny access to copy files
    ... "I think the above should work, I know it is restrictive to the developer, but we are trying to find a solution aren't we?" ... To achieve a acceptable security processing much of the responsibility is left to the programmer. ... Microsoft.NET Framework Developer's Guide, Introduction to Code Access Security, ... BDO Kendalls is a national association of separate partnerships and entities. ...
    (Security-Basics)
  • Re: Access 2010 for software development
    ... Others seem to think you want to produce an Access 2003 MDE with Access ... user/group level security (for what that is worth, ... applications are sufficiently simple that an experienced developer can ... The applications I create with Access for my clients are "bespoke" ...
    (comp.databases.ms-access)
  • Re: Sharepoint - Security Logistics Nightmare?
    ... there is no item level security - security for a doc lib is at the doc lib ... If you dont belong there, ... No one else in the company can view my private ... > Invoices should be private between each developer and HR. ...
    (microsoft.public.sharepoint.portalserver)