Standard user's in big companies
usually runs as unprivileged users, thus they cannot execute admin
tasks. But sometimes it's necessary to run a task with admin rights
(automated software deploy) - runas, in some situations, is a bad idea
because it needs a user and a clear text password (and no, the password
compiled in an exe file is not very safe!).
So
my idea is, let those tasks run as system user with the task scheduler.
Microsoft provides a great tool, jt.exe, an extended at.exe command
line task scheduler. The scheduled task will be created without a
schedule (funny eh?) and will be executed manually by the user. Here is
the step by step instruction:
1) Installation phase (as administrator):
We create a scheduler config file with this content:
----------------------------------------
/sj ApplicationName = "C:\123.cmd"
/sj WorkingDirectory = "C:\"
/sj Comment = "just a stupid comment"
/sj SystemRequired = 1
/saj jobname
/sm localhost
/sc "" NULL
----------------------------------------
To
get detailed help what those switches means, have a look at jt.exe's
help function. The most important stuff is, this scheduled task should
execute a file called c:\123.cmd as system user.
Now create the job itself:
> jt.exe @path\to\the\file\above
Example output:
C:\> jt.exe @C:\mytask.txt
[TRACE] Setting job's properties
[TRACE] Setting job's properties
[TRACE] Setting job's properties
[TRACE] Setting job's properties
[TRACE] Adding job 'jobname'
[TRACE] Setting target computer to 'localhost'
[TRACE] Setting account information
The
Job file is now created, you can verify it by browsing to
%windir%\tasks, there should be a new jobname.job file. Now, here comes
the important task, change the file permission of the jobname.job file
and add write access (change right) for your users (everyone, users or
whatever you prefer).
Of course you should now edit the file c:\123.cmd and add some more or less intelligent content.
2) User Phase
The user can now run C:\123.cmd as SYSTEM user by entering this command:
> jt.exe /sac jobname /rj
That’s it! Feel free to post your experiences..
Download jt.exe here (Microsoft FTP).