Windows – How to allow non-admin users to run a VBS script that requires higher privileges

runaswindowswindows 7

I have a vbs script that needs to be provided to end users, but it requires more rights than they have on their locked down workstations – specifically updating some HKLM registry values and stopping/starting a windows service. Is there a way I can provide them with the ability to run the script so that it'll work? e.g. Run As a different user account, without requiring users to have a different account to log in as?

The script isn't part of a login process. It's to allow users who are testing a software product to point their machines at a different 'environment', so they can switch between Test and Live environments.

UPDATE:
I'm ok if the only solution means doing something outside VBS, just having some options would be good.

Best Answer

Not without encrypting the password and including it with the VBS script.

There are other options like remote scripting, but those setting may be off depending on if you are part of a domain.

Is the script part of a login process?

edit:

The script isn't part of a login process. It's to allow users who are testing a software product to point their machines at a different 'environment', so they can switch between Test and Live environments.

UPDATE: I'm ok if the only solution means doing something outside VBS, just having some options would be good.

Without more details, the best solution by far that I can recommend is to create a separate user account and modify the ACLs of the Registry keys to explicitly allow that account to modify those keys. Then run the script under that account. Try that.

Set Last Loggedon - Win7.vbs

    '--------------
'Start of UAC workaround code

If WScript.Arguments.length =0 Then
  Set objShell = CreateObject("Shell.Application")

  objShell.ShellExecute "wscript.exe", Chr(34) & _
  WScript.ScriptFullName & Chr(34) & " uac", "", "runas", 1
Else

'--------------
'Start of code

    dim WSHShell
    Set WSHShell = Wscript.CreateObject("WScript.Shell")
    dim strRegKey
    strComputerName = wshShell.ExpandEnvironmentStrings( "%COMPUTERNAME%" )
    strRegKey = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\"

    StrUser = InputBox("Please enter in username," & vbCrLf & vbCrLf & "e.g. joe.local", "Set Last logged on", "UserName")
    StrDomain = InputBox("Please enter in domain for logon," & vbCrLf & vbCrLf & "e.g. DOMAIN", "Set Logon Domain OR leave blank if a local user account")

    If StrDomain = "" then
         StrDomain = "."
       Else
    End If

    wshShell.RegWrite strRegKey & "LastLoggedOnUser", StrDomain & "\" & StrUser, "REG_SZ"

        WScript.Echo "Setup Completed. Please restart the computer to complete the process"

    '--------------
    'End of code


    '--------------
    'End of UAC workaround code

    End If

Full Source: Windows 7 - VBS script to change last user logged on user

Windows – Can a non-admin windows user install Firefox to their C:\Users\xx folder

The answer to that is yes users can install Firefox into their own accounts. I created a test box with multiple logins. In each user account I installed a different version of Firefox. It works great.

In comment below I mentioned the portable version of Firefox. That works too. It can be put anywhere. This is the simple way. As I mentioned below, no installer is needed. It just runs right out of the box.

Best Answer

Related Solutions

Windows 7 – VBS Script to change last logged on user

Set Last Loggedon - Win7.vbs

Windows – Can a non-admin windows user install Firefox to their C:\Users\xx folder

Related Question