VB Scripts and UAC elevation

With User Account Control (UAC) enabled in Windows 7, one needs to open an elevated Command Prompt in order to run scripts under administrative privileges. Although the elevated Command Prompt accomplishes the task, the question How to run as script under elevated privileges/admin privileges

1. without using the Command Prompt? 

2. without user being admin on machine?

We can achieve the same by GPO which can deploy application etc. using system account but it doesn't solve the purpose where only selected users need to install applications with no admin rights on machine.

Scenario in my organization

We have intranet site in our organization with downloads page for installation of any software's for users.

Downloads page has a link to .vbs script which installs the software from local available repository when users click on the link

Problem is that users with no admin rights on local machine cannot install software especially in windows 7 as most of our users have been migrated to windows 7 with no administrator rights.

Solution: 

We created a script which can install the software on any machine with no admin privileges

We encoded the final script to protect from users

Below is the script:

******************************************************************

Option Explicit

Dim MyArr, i, IPaddress, tstr, Subnet2, Subnet3

Dim SCSserver,MapPath,oWshShell

Dim strArgs, strAdminUser, strAdminPass

Dim objFSO, wshNetwork, strComputer, objShell, strCommand

Set objFSO = WScript.CreateObject("Scripting.FileSystemObject")

Set wshNetwork = WScript.CreateObject("WScript.Network")

Set objShell = WScript.CreateObject("WScript.Shell")

'Enter your domain admin user id/password or account with admin privelliges on your organisation machines

strAdminUser = "domain\userid"

strAdminPass = "password"

Dim WSHShell

            Dim objNTInfo

            Dim GetComputerName

            Set objNTInfo = CreateObject("WinNTSystemInfo")

            GetComputerName = lcase(objNTInfo.ComputerName)

            Set WSHShell = WScript.CreateObject("WScript.Shell")

           

If WScript.Arguments.Count < 1 Then

      Call Normal_User_Commands

ElseIf WScript.Arguments(0) = "AsAdmin" Then

      Call Admin_User_Commands

Else

      MsgBox "Unknown Argument received"

End If

Sub Normal_User_Commands

      'MsgBox "Running as initiating user"

      strComputer = GetComputerName

      'Download psexec.exe and copy it on network as we are using psexec.exe

      strCommand = "cmd /c <Path for psexec.exe> \\" & strComputer & " -i -u " & strAdminUser & " -p " & strAdminPass & " wscript.exe <complete path for your script which installs application/software.vbs> ""AsAdmin"""

      objShell.Run strCommand, 0, True

End Sub

Sub Admin_User_Commands

      'Now running as Administrator on the target machine

      'MsgBox "Running as Admin"

      strCommand = "notepad.exe"

      objShell.Run strCommand, 0, True

End Sub

********************************************************************

Force software to always run as admin without exposing admin password

     
I have some software that only functions right if the person has administrative permissions on the machine. I don't want to give my users the admin passwords so they can do a Run As for obvious reasons.  Is there a way to force a program to run as administrator without exposing the admin password?

The answer is yes and can be achieved using a simple command and then creating a windows shortcut.

You can create and save the shortcut on any normal users desktop. You will have to configure to run the program as Administrator / Domain Admin account and it will save the password (don't worry it will be hidden)

User who wants admin rights to run any application can now be restricted as a normal user by this workaround.

runas /savecred /user:ComputerName\UserName "Full Path of Program"

or 

runas /savecred /user:Domain\UserName "Full Path of Program"

Example:

runas /savecred /user:ComputerName\UserName "c:\Program Files\CCleaner.exe"

Create a new windows shortcut and paste this command and save the shortcut on users desktop

Once you have the shortcut created, you will need to run the shortcut from the users profile and enter the admin password (one time so that savecred saves password).

From there the user should always be opening the program/application with admin rights and not be asked for a password. 

You can even change the icon for shortcut in properties screen.