AutomoxAutomox
Automox Q&A

Running worklet as end user, not as system

tehreet
October 20, 2020 at 5:41 pm UTC

I have a use case where i need to install a certificate, and the EXE wanting to do that needs to be run as the user. Automox runs as SYSTEM, is there anyway i can execute an EXE as another user (the logged in user) to install the certificate, without prompting the user?

Full context here, under the Windows section: https://duo.com/docs/trusted-endpoints-generic

This discussion is archived and closed to replies. Continue it in the Automox Community Slack.

Discuss on Slack

Replies (5)

Nic-AutomoxOctober 20, 2020
#1

You can do that using the scheduled task workaround that I use in this worklet:

jesumyipOctober 23, 2020
#2

Please note that:

$currentusr = (Get-WmiObject -class win32_process -ComputerName ‘localhost’ | Where-Object name -Match explorer).getowner().user

only works properly IF there is a user currently logged on when you execute that command above. If the computer is turned on and no user is logged on, $currentusr will be NULL (actually, that line above will fail with an error since getowner().user won’t execute).

Since you want to install a certificate, you should check if there is a user logged on in the “Evaluation” section of the worklet. If no user is logged on, return 0.

jesumyipOctober 23, 2020
#3

If anyone is interested, I have a solution that allows your script to run in the context of the currently logged on user, and it gets triggered only upon user logon. This behaviour is very similar to how per-user GPOs are triggered. I’m waiting for Nic to approve my posting. 🙂

jesumyipOctober 26, 2020
#4

Hmmm post not yet approved. Maybe he is busy. Here it is anyway:

powershell17 lines
$ShedService = New-Object –comobject "Schedule.Service"
$ShedService.Connect()

$Task = $ShedService.NewTask(0)
$Task.RegistrationInfo.Description = "UserLogonScript"
$Task.Settings.Enabled = $true
$Task.Settings.AllowDemandStart = $true

$trigger = $task.triggers.Create(9)
$trigger.Enabled = $true

$action = $Task.Actions.Create(0)
$action.Path = "cmd.exe"
$action.Arguments = "/c echo %temp% > c:\temp\out.txt"

$taskFolder = $ShedService.GetFolder("\")
$taskFolder.RegisterTaskDefinition("UserLogonScript", $Task , 6, "Users", $null, 4)

This PS code creates a scheduled task that is triggered on user logon, and it will run in the context of the user that just logged on. You can check the contents of the file c:\temp\out.txt to verify this.

Nic-AutomoxOctober 26, 2020
#5

Sorry about that, your worklet is now live!

Back to all discussions