Scenario:
You have a PITA program that you need to support (PITA= Pain In The Ass), these programs typically want you to assign the user as an admin on their local machine in order to run properly. Needless to say this is just an invitation for disaster and you will end up with a bunch of machines with spyware and malware on them. Ideally you should be able to just assign full control rights to the necessary registry and program files to satisfy the program. Manually configuring such permissions can be tedious and unrealistic in large organizations or remote locations.
Solution:
We can script the setting of both registry and file permissions. These tasks will require different utilities that you will first need to deploy to the workstations. REGINI.EXE and XCACLS.VBS are both free Microsoft utilities. REGINI is part of the Resource Kit Tools but is already installed in Vista machines. Download the files to the target PCs. You can then utilize the following script samples to set the permissions in the registry and the file system.
In the below sample we will assign full control permissions to “Everyone” to two registry keys, DumbApp1 and DumbApp2. This sample creates a temporary text file that the REGINI program will use to set the permissions. Once execute, the temporary file is deleted by the script.
‘==========================================================================
‘
‘ NAME: ChangeRegistryPerms.vbs
‘
‘ AUTHOR: Mark D. MacLachlan , The Spider’s Parlor
‘ URL: http://www.TheSpidersParlor.com
‘ COPYRIGHT (c) 2009 All Rights Reserved
‘ DATE : 3/22/2009
‘
‘ THIS CODE AND INFORMATION IS PROVIDED “AS IS” WITHOUT WARRANTY OF
‘ ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO
‘ THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A
‘ PARTICULAR PURPOSE.
‘
‘ IN NO EVENT SHALL THE SPIDER’S PARLOR AND/OR ITS RESPECTIVE SUPPLIERS
‘ BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY
‘ DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
‘ WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
‘ ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
‘ OF THIS CODE OR INFORMATION.
‘
‘ COMMENT: Download REGINI in the Resource Kit Tools from Microsoft.com.
‘
‘==========================================================================
‘First create our File System Object and Shell
Set objFSO = CreateObject(”Scripting.FileSystemObject”)
Set WSHShell = CreateObject(”WScript.Shell”)
‘ Next we create the temp file that regini.exe will use
strFileName = objFSO.GetTempName
Set objFile = objFSO.CreateTextFile(strFileName)
objFile.WriteLine “HKEY_LOCAL_MACHINE\SOFTWARE\DumbApp1 [1 5 7 11 17]”
objFile.WriteLine “HKEY_LOCAL_MACHINE\SOFTWARE\DumbApp2 [1 5 7 11 17]”
objFile.Close
‘ Now we execute REGINI to change the registry permissions
WSHShell.Run “regini ” & strFileName, 8, true
‘ Perform cleanup and delete temp file
objFSO.DeleteFile strFileName
If you are wondering what all those numbers are after the registry keys, have a look at this supporting documentation for REGINI. Note that WORLD is “Everyone.” Also note that whatever permissions you set override whatever was there before.
1. Administrator Full
2. Administrator R
3. Administrator RW
4. Administrator RWD
5. Creator Full
6. Creator RW
7. World Full
8. World R
9. World RW
10. World RWD
11. Power Users Full
12. Power Users RW
13. Power Users RWD
14. System OpFull
15. System OpRW
16. System OpRWD
17. System Full
18. System RW
19. System R
20. Administrator RWX
Examples:
\Registry\Machine\System\CurrentControlSet\ENUM [1 8 17] - will grant Administrator - Full Control, Everyone - Read, and System - Full Control.
\Registry\User\S-1-5-21-2053067395-480382929-641664369-1001\Software\Strange Software Thingy [1 8 17] - Same as above.
\Registry\Machine\System\CurrentControlSet\ENUM [8 17] - Will remove the Administrator group from the first example.
**************************************************
OK, so now you need to set the permissions on the program files. Here we will use XCACLS.VBS.
‘==========================================================================
‘
‘ NAME: ChangeNTFSPerms.vbs
‘ AUTHOR: Mark D. MacLachlan , The Spider’s Parlor
‘ URL: http://www.TheSpidersParlor.com
‘ COPYRIGHT (c) 2009 All Rights Reserved
‘ DATE : 3/22/2009
‘
‘ THIS CODE AND INFORMATION IS PROVIDED “AS IS” WITHOUT WARRANTY OF
‘ ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO
‘ THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A
‘ PARTICULAR PURPOSE.
‘
‘ IN NO EVENT SHALL THE SPIDER’S PARLOR AND/OR ITS RESPECTIVE SUPPLIERS
‘ BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY
‘ DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
‘ WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
‘ ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE
‘ OF THIS CODE OR INFORMATION.
‘
‘ COMMENT: Download XCACLS.VBS from Microsoft.com.
‘
‘==========================================================================
Dim objFSO, oShell, oFolder, sXPath, sFolder, sys, DomainName
‘ Create our objects for later use
Set objFSO = CreateObject(”Scripting.FileSystemObject”)
Set oShell = Wscript.CreateObject(”Wscript.Shell”)
Set sys = CreateObject(”ADSystemInfo”)
‘Find the domain name
DomainName = sys.DomainShortName
‘Specify the path to XCACLS
sXpath = “C:\Utilities\xcacls.vbs”
‘Specify the folders we want to set permissions on
sDrive1 = “C:\Program Files\BaddApp1?
sDrive2 = “C:\Program Files\BadApp2?
‘Now we bind to the folder and then execute XCACLS to set permissions
Set oFolder = objFSO.GetFolder(sDrive1)
sFolder = objFso.GetFolder(oFolder).ShortPath & ” “
‘Assign permissions to SYSTEM
oShell.Run “cmd /c cscript.exe ” & sXpath & ” “& sFolder & ” ” & _
” /I Remove /G “&Chr(34)& “System” & Chr(34)& “:F”
WScript.Sleep 2000
‘Assign permissions to DOMAIN ADMINS
oShell.Run “cmd /c cscript.exe ” & sXpath & ” “& sFolder & ” ” & _
” /E /G “&Chr(34)& “Domain Admins” &Chr(34)& “:F”
WScript.Sleep 2000
‘Assign permissions to DOMAIN USERS
oShell.Run “cmd /c cscript.exe ” & sXpath & ” “& sFolder & ” ” & _
” /E /G “&Chr(34)& “Domain Users” &Chr(34)& “:F”
‘Repeat the above steps for our second folder
Set oFolder = objFSO.GetFolder(sDrive2)
sFolder = objFso.GetFolder(oFolder).ShortPath & ” ”
oShell.Run “cmd /c cscript.exe ” & sXpath & ” “& sFolder & ” ” & _
” /I Remove /G “&Chr(34)& “System” & Chr(34)& “:F”
WScript.Sleep 2000
oShell.Run “cmd /c cscript.exe ” & sXpath & ” “& sFolder & ” ” & _
” /E /G “&Chr(34)& “Domain Admins” &Chr(34)& “:F”
WScript.Sleep 2000
oShell.Run “cmd /c cscript.exe ” & sXpath & ” “& sFolder & ” ” & _
” /E /G “&Chr(34)& “Domain Users” &Chr(34)& “:F”
No responses yet