access rights for application

[PaulyCopeyman]

Can an application have a higher level of access rights than the PC user logged in.  My program changes routings of IP connections through the command editor function in LabVIEW but only works when logged in as an administrator.  Is there any way around this?  The user can not be given this level of security.

[chrisger]

you could use the "runas" - command on the command line to execute the program changes as an other user. to hide the password of the administrator inside your code you could protect the VI with a password. type "runas" on the command line to get more information.

[PaulyCopeyman]

Thanks Chris,

The software will be running as an executable so protecting the password would not be an issue.  However, we are forced by our administrators to change passwords every 2 months so hardcoding would not really be feasible.

Maybe I could get a user set up specifically to perform this operation which would be exempt from the above rule.

Regards,

Paul.

[chrisger]

do YOU change the password?

if so you could open a dialog to enter the new password whenever the ip-changes failed. so YOU have to enter the password only once you have changed it. then you could encrypt the password and save it in a seperate file. for simple encryption of passwords i once used this method:

- create 10KB of random binary data (new dummy data each time you encrypt a new password)

- add blanks to the password until its length is lets say 64bytes

- replace 64x8 random bits of the dummy data with the bits of the password (the same random bits each time you encrpyt a new password)

- save the 10KB of data in a file

- when reading the data extract the bits of the password, build the string and remove blanks at the end of the string

there are much better ways to encrypt a password, but this should work.

you could set up a domain user with local admin rights for all workstations. then you could store the encrypted password on a network drive. you then have to enter the password only once in 2 months.

[PaulyCopeyman]

I change the password but will not normally be logging on to this machine.  This is a test facility in our factory which should hopefully run without my intervention.  Unfortunately, I have no control of the administration of the site network and have to pacify the people who do.

Regards,

Paul.

[PaulyCopeyman]

Chris,

Sorry, still stuggling with this one.

I have a local account set up on this machine with admin rights which will not require its password to be changed.

In the command editor I can launch another cmd window running as the local administator which allows access to the IP settings required but the password must be entered when promted.  I'm not sure how I can integrate this into my LabVIEW application.

Any help would be much appreciated.

Thanks & regards,

Paul.

[chrisger]

hi there

sorry that i mislead you with the runas - command...

try this: create a scheduled task. by doing so you can specify a user and the password. you will not be prompted for any inputs. then you can call the task using

schtasks /run /tn Taskname [/s Computer [/u [Domain\]User /p Password]] /?

[PaulyCopeyman]

Hi Chris,

This is driving me insane!

It appears that a scheduled task created by an administrator can not be run or even viewed by the user.

There must be a way of doing this.  I can't believe I'm the only person who has tried to run an application which has a higher level of access rights than the user.  Is this a security thing preventing viruses etc?

Thanks v.much for your time.

Paul.

[chrisger]

oh boy......

have you checked the "security" settings of the task (right-click on the task and open the properties page)? is it possible that YOU run the script from an other computer over the network so that YOU have to enter the password on your local machine? the /s option of schtasks gives you the opportunity to run a script on a remote host.

[PaulyCopeyman]

Hi Chris,

Unbelievably I am still working on this... on and off anyway.

There is something preventing the scheduled task from running correctly when it has been set to run under a different account to the one logged on.  I have tried this with local and network accounts, both with admin access, all with the same result.  All permissions have been set correctly.  In the task list the task status changes to "running" but nothing happens.  "Running" status remains until the task is ended manually.

The task runs fine when the "Run as" user is the same as the logged in user.

I have now spent many hours looking for solutions on the web and trying anything I can think of to make this work, all to no avail.

I am starting to think that there is some global security setting on our network that is preventing this from running correctly although I can not understand why the task status reports running and there are no errors in the schedule log.

Any more assistance would be appreciate although I realise this has now strayed a long way from LabVIEW.

Regards,

Paul.