Home / server / Questions / 223471
Accepted
bshacklett
Asked: 2011-01-18 10:16:26 +0800 CST

How can I run a process as "NT Authority\NetworkService"?

  • 772

I'm toying with an idea for a script that would update a computer's details in Active directory with its make and model information. Ideally, I'd like this script to access AD via its computer account, which means I'd need to have the script run as "NT Authority\NetworkService". Is this something that's possible? Alternatively, could I impersonate NetworkService in the script/executable?

windows security active-directory service-accounts

4 Answers

  1. Best Answer

    You can use devxexec: http://blog.developex.com/?p=1053

    For example:

    devxexec.exe /user:NETWORK_SERVICE cmd

    • 6

  2. "The scripting guy" has already answered this question here: http://www.microsoft.com/technet/scriptcenter/resources/qanda/apr05/hey0429.mspx

    You'll just need to include the WMI call to grab the machine model number...

    My implementation went like this:

    Set objSysInfo  = CreateObject("ADSystemInfo")
Set objUser     = GetObject("LDAP://" & objSysInfo.UserName)
Set objComputer = GetObject("LDAP://" & objSysInfo.ComputerName) 

If objComputer.operatingSystem = "Windows*Server*" Then
    Quit
Else
    strMessage = objUser.CN & " logged on to " & objComputer.CN & " " & Day(Date) & "/" & Month(Date) & "/" & Year(Date) & " " & Time & "." 

    objComputer.Description = strMessage
    objComputer.SetInfo 
End If

    Call the above script from a GPO, using: User Config -> Windows Settings -> Scripts -> Logon

    Then just update the permissions on the OU, so that users can modify the computer object descriptions, like this: screencap

    • 2

  3. I'm not sure how feasible it is to do what you want. Escalating permissions might be better asked over in StackOverflow. However, what not run the script as the local admin. With the exception of DC's, the account exists. On the \DC's you can run it as a domain admin or some other account that would have limited permissions for this task.

    • 0

  4. If the computers already exist in AD I would approach this problem from the other direction -- on the server side iriterate through the computer objects and use PsExec to find the information you require on the remote system and return it.

    http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx

    I'd then run the script under the account with the permissions required using Task Scheduler.

    http://technet.microsoft.com/en-us/library/cc721871.aspx

    • 0