TqcRunas 2002.1 Edition - Index

TqcRunas 2002.2 Edition

TqcRunas 2002.2 Edition. (Windows 2000/XP)

The only way to include runas and impersonation statements in scripts.
The Quimeras Company

[ Home ] [ Overview ] [ Package ] [ Installation ] [ Deployment ] [ The Executables ] [ ActiveX Objects ] [ Evaluation ] [ Licensing TqcRunas ] [ Order form ] [ Privacy Policy ]

Reference Index

Overview
Package
Installation
Deployment
The Executables
ActiveX Objects
Evaluation
Licensing TqcRunas
Order form
Privacy Policy

The Quimeras Company

[ Home ] [ Overview ] [ Package ] [ Installation ] [ Deployment ] [ The Executables ] [ ActiveX Objects ] [ Evaluation ] [ Licensing TqcRunas ] [ Order form ] [ Privacy Policy ]

Copyrights 2000-2002 The Quimeras Company. Alberto Aragones.
http://www.quimeras.com
quimeras@quimeras.com
FAX: +34 639 118657


TqcRunas 2002.1 Edition - Overview

[ Home ] [ Overview ] [ Package ] [ Installation ] [ Deployment ] [ The Executables ] [ ActiveX Objects ] [ Evaluation ] [ Licensing TqcRunas ] [ Order form ] [ Privacy Policy ]

Overview

If you are administering Windows 2000/XP computers you know that administrative privileges are required to install applications and make configuration changes on your computers. As an administrator you would like to call setup programs and configuration routines from the logon/logoff script, this way you would automate all your administrative tasks from a centralized point. The pain is that the logon/logoff script runs under the interactive user account, therefore they cannot perform administrative tasks unless you give all your users administrator rights, obviously this is a security breach you cannot assume.

That's the reason why a lot of large companies in the world are using TqcRunas. TqcRunas is an inexpensive little program that will let you include Runas statements in your scripts in a safe and easy way. And now you can do it from your favorite scripting language!!

As you know Windows 2000 and XP has a useful utility called runas, using runas is possible to start programs that run with alternative user's credentials. This is really a powerful choice to administrators, because it would let them install programs and execute administrative tasks from scripts on Windows 2000/XP client computers.

The big problem is that runas asks for the account password interactively, therefore it is not possible to include runas statements in scripts.

TqcRunas overcomes this problem and provides several additional advantages:

  • TqcRunas accepts the password directly in the command line.
  • TqcRunas can read its command line from a strongly encrypted file, therefore you can exactly specify with programs and options your users can run with administrator's privileges without reveal the administrator's password.
  • You can make use of TqcRunas advantages using the executable modules directly or using the scriptable COM objects provided by TqcRunas.dll.
  • TqcRunas can be easily distributed to your clients computers or they can use them directly from a network share.
  • TqcRunas can execute runas commands in remote computers.
  • Another new feature in TqcRunas 2002.2 is the ability to make use of impersonation in your scripts.

As you can see, TqcRunas is a powerful utility that make easy to include "Runas" and "Impersonation" statements in scripts. TqcRunas is composed of three different software modules:

TqcRunas.dll | Includes the new scriptable objects that will make administrator's life more easy. TqcRunas objects can be used in any scripting language that supports ActiveX (COM) objects, for example JavaScript, VBScript and KiXtart.
TqcRunas.exe | This executable module works much like as previous versions of TqcRunas, has a complete command line interface and now incorporates a dialog interface. This is a Win32 executable. Returns errors in message boxes.
TqcRunasCmd.exe | This one is the console version of TqcRunas, works exactly as TqcRunas.exe, but returns errors in the console output.

Main uses

  • Use TqcRunas to run programs, commands and scripts under a different user account than the logged on user.
  • Use Runas encrypted files to let your users to install or execute specified programs with administrator privileges without giving them administrators rights.
  • Use TqcRunas to execute runas commands in remote computers.
  • Use TqcRunas scriptable objects to use TqcRunas features in your administrative scripts using your favorite scripting language.
  • The new ImpersonateUser feature allows your script to switch the user account on behalf it is running without the need to start an additional process.

The Quimeras Company


TqcRunas 2002.1 Edition - Package

Package

Package content

  • TqcRunas.dll
  • TqcRunas.exe
  • TqcRunasCmd.exe
  • TqcRunas.chm


TqcRunas 2002.1 Edition - Installation

Installation

Extract the files and save them in the folder you like.

TqcRunas.exe and TqcRunasCmd.exe
This programs can be used directly without any previous installation operations, the only requirement is that TqcRunas.dll must be present in the same folder as the executables.

TqcRunas.dll installation
To use the ActiveX objects that TqcRunas.dll provides, this library must be properly registered in the system, this operation requires administrator rights, following you can find an example of how to do it:

Running TqcRunas.exe or TqcRunasCmd.exe When any of these programs is executed with administrators rights TqcRunas.dll is registered in the system if it isn't yet.
Running Regsvr32 using TqcRunas In order to register TqcRunas.dll in all the computers of your network domain, build a tqc file storing the command line that register the dll using an administrator account as follows:
>TqcRunas -build registerdll.tqc -w -dd -user admin -pw password -e regsvr32 -a \\server\netlogon\TqcRunas.dll

then copy the built file "registerdll.tqc" to your NETLOGON share and run it from the logon script:

>TqcRunas -f \\server\netlogon\registerdll.tqc

Now you can make use of TqcRunas ActiveX objects.


TqcRunas 2002.1 Edition - Deployment

Deployment
Obviously, to enjoy the advantages of using TqcRunas, an administrator will need to launch it at the client computers. This is usually made by copying TqcRunas files to the NETLOGON share and including TqcRunas statements in the logon script.

Considerations

  • Direct use: Take in account that TqcRunas.exe and TqcRunasCmd.exe can be used directly, without any previous installation operations, the only requirement is that TqcRunas.dll must be present in the same directory as the executables. This means that you can copy these modules to a network share and launch them directly from the logon script.
  • Copying files: Another option would be copying TqcRunas files to your client computers by mean of including some copy statements in the logon script.
  • Registering TqcRunas.dll: In order to make use of the TqcRunas ActiveX objects the TqcRunas.dll must be registered into the system, this can be achieved following the directions given in the Installation page and as showed in the following example.

Deploying, installing and using TqcRunas at domain computers

I'm reproducing here part of the current logon script code that I have implemented in my network, I suppose this can help you to figure how to deploy TqcRunas and use TqcRunas objects in your network.

1. I copied all TqcRunas files to the NETLOGON share.

2. Created regtqcrunasdll.tqc using TqcRunas in build mode:

>TqcRunas -build regtqcrunasdll.tqc -dd -w -user admin -pw password -e regsvr32 -a "/s \\server\netlogon\tqcrunas.dll"

3. Copied regtqcrunasdll.tqc to the netlogon share.

My current logon script is written in JavaScript, it includes the following lines:

//////////////////////////////////////////////

...

// the Tqc.Runas variable

var tqc;
try {

// this line creates the Tqc.Runas object if TqcRunas.dll is already registered

tqc = new ActiveXObject("Tqc.Runas");
}
catch(e) {

// if TqcRunas.dll is not registered, register it using regtqcrunasdll.tqc file
var sh = new ActiveXObject("WScript.Shell");
sh.Run("\\\\tqcserver2\\netlogon\\tqcrunas.exe -f \\\\tqcserver2\\netlogon\\regtqcrunasdll.tqc",1,true);

// destroy the shell object
 sh=0;

// try again to get the Tqc.Runas object

try {

tqc = new ActiveXObject("Tqc.Runas");

}

catch(e) {

}

}

// if I got a Tqc.Runas object
if(tqc) {

// exec predefined administrative operations
tqc.ExecRunasFile("\\\\server\\netlogon\\adminfile.tqc" );

...
tqc=0;
}

// continue in user mode
...

//////////////////////////////////////////////

I hope this will be useful for you.


TqcRunas 2002.1 Edition - The Executables

The Executables

Both programs TqcRunas.exe and TqcRunasCmd.exe work much as TqcRunas 2.5 does.

The difference between both executables is that TqcRunas.exe is a windows application while TqcRunasCmd.exe is a console application. When reporting errors, TqcRunas.exe display message boxes while TqcRunasCmd.exe write messages in the console or output device.

Using TqcRunas you can define shortcuts and tasks to run an specified program under an alternative user's context. Also it is possible to build strongly encrypted files that store the entered arguments for later use. This is useful for safely deployment of installation or configuration scripts that must be ran with administrative privileges, because using encrypted files the administrative account name and password are not human readable.

TqcRunas.exe and TqcRunasCmd.exe Dialog mode

Now TqcRunas has a GUI interface, this dialog interface will be displayed if you don't enter any command line option when launching any of the executables.

The different tabs are self explained, for more information read the homologous options in the following section.

TqcRunas.exe and TqcRunasCmd.exe command line syntax

The full command line options for TqcRunas.exe are the following:

>TqcRunas [-h] | [-RegDll] | [-UnregDll] | [-f <filename>] | [[-build <filename>] [-dd] [-profile] [-env] [-netonly] [-w] [-d <domain>] -user <username> -pw <password> -e <command> [-a <arguments>]]

Normal Mode

Example:

>TqcRunas -profile -dd -user admin -pw password -e mmc.exe -a c:\winnt\system32\dfrg.msc

This command will launch the disc defragmentation tool with admin account privileges.

Note that now you can use the same command as follows:

>TqcRunas -profile -dd -user admin -pw password -e %windir%\system32\dfrg.msc

TqcRunas recognizes the file type and launch the appropriate executable. Also TqcRunas expands the environment variables.

Build Mode

In build mode TqcRunas constructs a strongly encrypted file where the command line to execute is stored for later use with the -f option.

Example:

>TqcRunas -build defrag.tqc -profile -dd -user admin -pw password -e %windir%\system32\dfrg.msc

You obtain the encrypted file defrag.tqc

NOTE: Assigning the extension ".tqc" to your built file the system will recognize it and will execute the encrypted command by simply double-clicking on it.

File Mode

In file mode TqcRunas reads its command line from a previously created file with the -build option, useful for safely use of TqcRunas in scripts or shortcuts because the password is not human readable.

Example:

>TqcRunas /f defrag.tqc

Complete options reference

Option | Meaning
-h | Display the help text.
-RegDll | Register TqcRunas.dll in the system registry. Needs administrator's rights.
-UnregDll | Unregister TqcRunas.dll from the system registry. Needs administrators rights.
-build <filename> | As stated before, the -build option will construct a strongly encrypted file storing the rest of the options specified in the same command line. Example: >TqcRunas -build defrag.tqc -profile -dd -user administrator -pw password -e mmc.exe -a c:\winnt\system32\dfrg.msc
-f <filename> | <filename> identifies a previously built file using the -build option, this file is strongly encrypted and contains the command like to execute. Example: >TqcRunas -f defrag.tqc
-dd | Use the default domain.
-profile | Load the entered user's profile.
-env | Use the current process environment block.
-netonly | Use entered credentials for network access only.
-w | Wait for the new process finish and return its exit code.
-d <domain> | <domain> specify the domain when the entered account must be validated. Use your computer's name to validate the account on your local computer.
-user <username> | <username> of the account to run the new program.
-pw <password> | <password> of the previous account.
-e <command> | Write here the command to execute. Use quotes to enclose paths with spaces. Example: >TqcRunas -dd -user admin -pw password -e "C:\my path\my file.txt"
-a <arguments> | Specify the arguments for the command to execute. Use quotes and \" to enclose quotes between quotes. Example: >TqcRunas -dd -user admin -pw password -e notepad -a "-p \"C:\my path\my file.txt\""


TqcRunas 2002.1 Edition - ActiveX Objects

ActiveX Objects

TqcRunas.dll provides two scriptable and programmable ActiveX objects:
  • The Tqc.Runas Object
  • The Tqc.ImpersonateUser Object

Usually, the Tqc.Runas object will be the only one used, because this is the object that implements all the functionality of TqcRunas. The Tqc.ImpersonateUser object is provided as a sort of demonstration.
If TqcRunas.dll is properly registered in the system you would see below the GUI interface of both objects, the objects below are fully functional.


The Tqc.Runas ActiveX Object

Once TqcRunas.dll is properly registered, the Tqc.Runas ActiveX object is available to be used.

  • Properties
  • Methods
  • GUI interface
  • Examples


[ The Tqc.Runas ActiveX Object ] [ The Tqc.ImpersonateUser ActiveX Object ]
[ Tqc.Runas Properties ] [ Tqc.Runas Methods ] [ The Tqc.Runas GUI ]

Tqc.Runas Properties

The properties defined for the Tqc.Runas ActiveX Object are those related to the command line options and syntax:

Property | Meaning
STRING TargetComputer | Specifies the name of the remote computer where the runas command will be executed, the program will be launched in fact in the remote computer. Although it is possible to launch a program in a remote computer without performing any previous installation operation of TqcRunas in the remote computer, it is highly recommended to previously register the TqcRunas.dll in the remote computer.
STRING Username | Specifies the username of the user on behalf the new process will be started.
STRING Password | Specifies the password for the entered username.
STRING Domain | Specifies the domain where the entered user will be validated. Default value is the current domain.
STRING Command | Specifies the application executable to launch.
STRING Arguments | Command line arguments for the application.
STRING WorkingDirectory | Specifies the working directory for the new launched process. If you don't specify this the current directory is assumed.
BOOL Synchronous | Run the specified application synchronously, that is, wait for the application to finish and returns its exit code. Default value is TRUE (1).
BOOL LoadProfile | Load the specified user profile to be used for the launched application. Default value TRUE (1).
BOOL UseCurrentEnv | Use the current environment block for the new launched process. Default value is FALSE (0).
BOOL NetOnly | Use the entered credential only for network access. Default value FALSE (0).
BOOL Verbose | Make TqcRunas return errors in verbose mode.


The Tqc.Runas Methods

[ The Tqc.Runas ActiveX Object ] [ The Tqc.ImpersonateUser ActiveX Object ]

[ Tqc.Runas Properties ] [ Tqc.Runas Methods ] [ The Tqc.Runas GUI ]

Tqc.Runas Methods

  • Execute( )
  • DoModalRunasDlg( )
  • ImpersonateUser( )
  • DoModalImpersonateDlg( )
  • RevertToSelf( )
  • BuildRunasFile( )
  • ExecRunasFile( )

LONG Execute(
[optional] STRING Command,
[optional] STRING Arguments,
[optional] STRING Username,
[optional] STRING Password,
[optional] STRING Domain)

The method Execute implements the basic functionality of Tqc.Runas, that is, runs the specified command and arguments as the user featured by the entered credentials (username, password and domain). Returns 0 on success or a system error code on failure.

The new process does in fact run with the security context of the user specified. Additional options are available through Tqc.Runas properties, such as Synchronous, LoadProfile and others.

If the property TargetComputer has been set, the command will be launched in the specified remote computer.

Parameters

All parameters are optional, if any of them is not specified it is taken from the homologous property. Also if any parameter is entered its homologous property will be overridden.

Parameter | Meaning
STRING Command | Specifies the application executable to launch.
STRING Arguments | Command line arguments for the application.
STRING Username | Specifies the username of the user on behalf the new process will be started.
STRING Password | Specifies the password for the entered username.
STRING Domain | Specifies the domain where the entered user will be validated. Default value is the current domain.

//-------- JavaScript example --------

var tqcra = new ActiveXObject("Tqc.Runas");

if (tqcra) {

tqcra.Username="myuser";

tqcra.Password="mypassword";

tqcra.Command="notepad";

tqcra.Execute( ); // will launch notepad as "myuser";

tqcra.Execute("regedit"); //will launch regedit as "myuser";

tqcra.Execute("cmd",,"admin","adminpassword"); // will launch cmd as "admin"

}

tqcra=0;

//----------------------------------------

VOID DoModalRunasDlg( )

DoModalRunasDlg displays a modal dialog to use TqcRunas features under a GUI interface. This is the same as using TqcRunas.exe without any command line options.

;-------- KiXtart example ------------

$tqcra = CreateObject(Tqc.Runas);

if ($tqcra)

$tqcra.DoModalRunasDlg()

endif

tqcra=0

;----------------------------------------

LONG ImpersonateUser(
[optional] STRING Username,
[optional] STRING Password,
[optional] STRING Domain)

Use the ImpersonateUser( ) method to change the user on behalf the current thread of your script is executing. When you impersonate a user all the subsequent operations performed in the script will be checked against the security context of the impersonated user. Returns 0 on success or a system error code on failure. You also can use DoModalImpersonateDlg( ) to display a dialog box to request the credentials interactively. Use RevertToSelf( ) method to revert the impersonating.

Parameters

All parameters are optional, if any of them is not specified it is taken from the homologous property. Also if any parameter is entered its homologous property will be overridden.

Parameter | Meaning
STRING Username | Specifies the username of the user on behalf the current thread will continue execution.
STRING Password | Specifies the password for the entered username.
STRING Domain | Specifies the domain where the entered user will be validated. Default value is the current domain.

;-------- KiXtart example ---------

$tqcra = CreateObject(Tqc.Runas)

if ($tqcra)

$tqcra.ImpersonateUser(user,userpassword) ;be a plain user

AddKey(HKLM\System\Hello) ;fails if user is not in administrators group

$tqcra.RevertToSelf()

$tqcra.ImpersonateUser(admin,adminpassword) ;get "admin" rights

AddKey(HKLM\System\Hello) ;works if "admin" is administrator

DelKey(HKLM\System\Hello) ;delete the previously created key

$tqcra.RevertToSelf()

endif

$tqcra=0

;----------------------------------------

INT DoModalImpersonateDlg( )

DoModalImpersonateDlg displays a modal dialog to enter the credentials of a user that will be impersonated in subsequent operations in the script. To revert the impersonating use the RevertToSelf( ) method. Returns 1 if the impersonating is successful, 2 if "Revert to self" was pressed and 0 on Cancel.

//-------- JavaScript example --------

var tqcra = new ActiveXObject("Tqc.Runas");

if (tqcra) {

if(tqcra.DoModalImpersonateDlg( )==1) {

...

RevertToSelf( );

}

else

{

...

}

}

tqcra=0;

//----------------------------------------

LONG RevertToSelf( )

The RevertToSelf( ) method is used to revert impersonating previously initiated using Impersonateuser( ). RevertToSelf( ) returns 0 on success or a system error code on failure.

LONG BuildRunasFile(STRING Filename)

BuildRunasFile construct a strongly encrypted file that stores the options defined by the current properties. Returns 0 on success or a system error code on failure.

Parameters

Filename a string that specifies the path and file name that will be created or overridden and that will store the encrypted command line to be used later.

//-------- JavaScript example --------

var tqcra = new ActiveXObject("Tqc.Runas");

if (tqcra) {

tqcra.Verbose=1;

tqcra.Username = "administrator";

tqcra.Password = "password";

tqcra.Command = "%windir%\\system32\\defrag.msc";

WScript.echo(tqcra.BuildRunasFile("w:\\defrag.tqc"));

}

tqcra=0;

//-----------------------------------------

LONG ExecRunasFile(STRING Filename)

ExecRunasFile will read the previously created file using either the BuildRunasFile( ) method, the TqcRunas dialog or by using TqcRunas from the command line, and will execute the stored command and options. Returns 0 on success or a system error code on failure.

Parameters

Filename Specifies the path and file name to decrypt for executing.

//-------- JavaScript example --------

var tqcra = new ActiveXObject("Tqc.Runas");

if (tqcra) {

tqcra.Verbose=1;

WScript.echo(tqcra.ExecRunasFile("w:\\defrag.tqc"));

}

tqcra=0;

//-----------------------------------------


Tqc.Runas GUI

[ The Tqc.Runas ActiveX Object ] [ The Tqc.ImpersonateUser ActiveX Object ]

[ Tqc.Runas Properties ] [ Tqc.Runas Methods ] [ The Tqc.Runas GUI ]

The Tqc.Runas GUI

As Tqc.Runas is an ActiveX object, its GUI interface can be inserted in programs dialogs, forms, html and asp pages.

This GUI interface is the same as the GUI interface of the TqcRunas executables and is used as them.


The Tqc.ImpersonateUser ActiveX Object

This object has no methods neither properties, it has only a graphical interface that displays a button:

Pressing the button the following dialog will appear:

After pressing OK the current thread will run impersonating the entered user, this means that when accessing local and network resources all the security checking will be validated against the entered account until the "Revert to Self" button is pressed.


TqcRunas 2002.1 Edition - Evaluation

Evaluation

You can evaluate TqcRunas for a period of 7+23 days.

When the first evaluation period (7 days) expires a message box appears remembering that you must contact The Quimeras Company for licensing TqcRunas, but the software still works up to 23 days more.


TqcRunas 2002.1 Edition - Licensing

Licensing TqcRunas

As you can see, TqcRunas is very useful for administrators and power users, for licensing TqcRunas contact The Quimeras Company by e-mail (quimeras@quimeras.com) or Fax (+34-639-118657). Please use our order form.

Prices:

TqcRunas Company License for 10 users | EUR 80
TqcRunas Company License for 25 users | EUR 175
TqcRunas Company License for 50 users | EUR 300
TqcRunas Company License for 100 users | EUR 500
TqcRunas Company License for 250 users | EUR 1000
TqcRunas Company License for 500 users | EUR 1500
TqcRunas Company License for 1000 users | EUR 2500
TqcRunas Company License for unlimited users | EUR 3000


TqcRunas 2002.1 Edition - Order form

Order form

Alberto Rodriguez Aragones.
The Quimeras Company
Francisco Pizarro,3-2B
21003 Huelva, SPAIN

Registration Form
Fax: +34 639 118657
e-mail: quimeras@quimeras.com
http://www.quimeras.com

Please complete the information below and mail or fax.
Contact Name:
Company:
Shipping Address:
Email Address:
Phone Number:
Fax Number:
Product | Price | Select
TqcRunas Company License for 10 users | EUR 80 | [ ]
TqcRunas Company License for 25 users | EUR 175 | [ ]
TqcRunas Company License for 50 users | EUR 300 | [ ]
TqcRunas Company License for 100 users | EUR 500 | [ ]
TqcRunas Company License for 250 users | EUR 1000 | [ ]
TqcRunas Company License for 500 users | EUR 1500 | [ ]
TqcRunas Company License for 1000 users | EUR 2500 | [ ]
TqcRunas Company License for unlimited users | EUR 3000 | [ ]
TOTAL price | EUR |
Notes: EUR 1 ~ USD 0.94
Payment Method: ( )Visa ( )Mastercard ( )Invoicing & Bank Transfer
Credit Card Nº: | Exp date:
Name On Card: | P.O. Nº:
Signature: | Date:
Privacy Policy: Alberto Rodriguez Aragones (The Quimeras Company or TQC) is firmly committed to protecting the privacy of its customers and those who sample our products. TQC does not share, sell, or otherwise distribute the financial or personal information of its customers or those who otherwise provide personal information to sample our products. All financial and personal information collected by TQC is held in the strictest confidentiality. Financial and personal information provided for orders is used to process payment and to send order information to our customers. More than anything, TQC tries to treat its customers as each one of us would like to be treated. We value our privacy and we value yours, too. It is our goal to make your experience with TQC a safe and positive experience. For more information on TQC's privacy policy, please feel free to contact us at: quimeras@quimeras.com


TqcRunas 2002.1 Edition - Privacy Policy

Privacy Policy

Alberto Rodriguez Aragones (The Quimeras Company or TQC) is firmly committed to protecting the privacy of its customers and those who sample our products. TQC does not share, sell, or otherwise distribute the financial or personal information of its customers or those who otherwise provide personal information to sample our products.

All financial and personal information collected by TQC is held in the strictest confidentiality. Financial and personal information provided for orders is used to process payment and to send order information to our customers.

More than anything, TQC tries to treat its customers as each one of us would like to be treated. We value our privacy and we value yours, too. It is our goal to make your experience with TQC a safe and positive experience.

For more information on TQC's privacy policy, please feel free to contact us at: quimeras@quimeras.com


The Tqc.ImpersonateUser ActiveX Object

Copyrights 2000-2002 The Quimeras Company. Alberto Aragones.
http://www.quimeras.com
quimeras@quimeras.com
FAX: +34 639 118657