Last year I wrote the VBScript Function “IfUserPerms” to enable scripts to determine if the current user/session was a protected administrator (an administrator capable of elevating, but who is currently not elevated). It worked reasonably well, but had a few warts that needed clipping for its re-release with the upcoming CSI-Windows.com VBScript UAC Kit…

When I started working on IfUserPerms I found that re-plumbing a couple items would make the script faster and more flexible. Now it can report back on tons of information regarding the session it is running under. For instance, did you know that new SIDs from Windows 7 (and Vista) can help you detect if you are connected through Dialup, whether you are a domain admin or whether you are logged in over a remote connection?

Like this script? Subscribe to our newsletter (without loosing your place in this article). (Please ensure that the confirmation email clears your spam filter so that you will see future mailings.)

I have also included some checks for UAC settings that are not determined by whoami.exe, but registry keys instead.

Support For All Versions Of Windows

I know you are going to have XP (and Server 2003) around for a long time – so CSI_IsSession has been engineered to automatically supports them. By automatic I mean that the exact same script works for all OSes.

For instance, if in a login script that runs on all your computers you place the call CSI_IsSession(“ELEVATED_ADMIN”) you will get true for an XP admin and you will get the right answer for a Vista or Windows 7 user depending on whether your script is running elevated.

Since XP and Windows 2003 and before did not include whoami.exe, you must place a copy of the Windows Support Tool “whoami.exe” next to the script. Click here for the XP SP2 Support Tools download page.

Upgraded Functionality

The key changes to IfUserPerms include:

• Automatically works with pre-vista, pre-server 2003 just place support tools version whoami.exe in the same folder. (Uses native version on OSes that have it integrated even if a support tools version is present in same folder.)
• ALIASes (such as ELEVATED_ADMIN) function correctly on XP by manipulating the PermissionQuery before it is submitted.
• Implementation of a cache for the information from whoami (speed boost, single CMD prompt for all queries).
• Use of regular expressions to match information.
• Support for wildcards (especially good with certain SIDs like Enterprise Admin).
• Multiple (and-ed) permission queries in one call.
• Added the following aliases: PROTECTED_ADMIN, ELEVATED_ADMIN, HIGH_IL, MEDIUM_IL, LOW_IL, INTERACTIVE_SESSION, SERVICE_SESSION, REMOTE_LOGON_SESSION, DIALUP_SESSION, DOMAIN_USER, DOMAIN_ADMIN, DOMAIN_COMPUTER,DOMAIN_CONTROLLER, DOMAIN_RAS-IAS
• KERNEL6_CHECK Special alias returns true if running on Windows Vista or Server 2008 or later. This check is not derived from whoami.exe.
• UAC_SILENTADMINPROMPT Special alias returns true if admin prompt is currently silenced. This check is not derived from whoami.exe.
• UAC_ENABLED and UAC_DISABLED Special aliases returns true if their respective condition is true. Reports false on pre-Kernel 6. This check is not derived from whoami.exe.
• DUMP_TO_TEMP dumps output to a temp file that ends in "-CSI_IsSessionWhoamiDump.txt", helpful for determining token values in non-interactive sessions such as running under a Windows service.

Sample Code

If IsSession("DIALUP") Then
  Msgbox "Skipping Software Distribution"
Else
  If IsSession("PROTECTEDADMIN")  Then
    If NOT IsSession("UAC_SILENTADMINPROMPT") Then
      Msgbox "Please approve admin rights when requested"
    End If
  End If
  If IsSession("FinanceGroup") Then
    'deploy finance package
  End If
  If IsSession("OrderEntryGroup") Then
    'deploy order entry patch
  End If
End If

Ask your own elevation question and if the user denies elevation you can capture that fact and react appropriately (continue processing non-admin type items, record user’s response, etc.). You can also detect if the elevation prompt is set to silent and simply not display your own elevation prompt if the one of the system is off anyway.

Some Known Limitations

• When running under wscript.exe, a single command line prompt flashes. This is due to the use of vbscript’s shell.exec to allow output to be directly piped back to the script. Under cscript.exe, this behavior does not occur.
• If you use the SID or group name that indicates whether a session is a console session, it will always return true. This is because the script must launch a console to retrieve output from whoami.exe.
• Windows appears to strip out SeImpersonatePrivilege when the script is run via wscript.exe, cscript.exe accurately detects the presences of the privilege.

Determining What to Check

Sometimes it can be difficult to know what values you need to check for if the script will be running under a service or in some other non-interactive context. There are two ways to exact the needed information in these cases:

• Check the “Security” tab of Process Explorer.
• Use “DUMP_TO_TEMP” parameter (helpful for when the process is non-interactive and happens too quickly to find in Process Explorer.

Any of the values in the last three columns of the below table can be used to detect the respective state in the first column.

The “whoami text value” is simple, but could be ambiguous if new groups are added in the future. The SIDs are the most stable in terms of not changing in the future. The CSI_IsSession aliases map to SIDs for reliability, but in some cases they may also perform multiple checks for complex conditions or adjust their output based on the version of Windows.

The wildcarded SIDs below are usually wildcarding the Domain portion of the SID. For any wildcarded SID you can also identify a SPECIFIC domain by using CSI_IsSession with the full SID. For instance, if you want to know if a computer is a domain controller in the “ACME” domain, you would put the SID for the acme domain in place of the wildcard listed below.

Additional SIDS which can be detected using CSI_IsSession.vbs are listed in the Microsoft knowledge base article KB243330: http://support.microsoft.com/kb/243330

Explanation of Windows special privileges are here: http://msdn.microsoft.com/en-us/library/bb530716(VS.85).aspx?ppud=4

If you think of any additional uses or enhancements, please drop a line at our contact page.

Attachments:

CSI_IsSession.zip

[ ]

6 Kb