TqcRunas 2004.3 Edition

TqcRunas 2012 Edition

TqcRunas 2012 Edition

The power of RUNAS made scriptable, easy and secure. Now supporting Windows Vista and Windows 7.

In few words, TqcRunas makes possible to execute runas commands from a strongly encrypted file where all the needed specifications are stored, allowing administrators to launch runas commands from scripts in an easy and secure way.

Copyright 2004-2012 Quimeras Software Company


TqcRunas 2012 Edition

TqcRunas 2012 Edition

Overview

If you are administering Windows computers you know that administrative privileges are required to install applications and make configuration changes on your computers. As an administrator you would like to call setup programs and configuration routines from your logon/logoff scripts, this way you would automate all your administrative tasks from a centralized point. The pain is that the logon/logoff scripts run under the interactive user account, therefore they cannot perform administrative tasks unless you give all your users administrator rights, obviously this is a security breach you cannot assume.

As you know Windows OSs have a useful utility called runas, using runas is possible to start programs that run with different user credentials and therefore different rights and privileges. This is really a powerful choice to administrators, because it would let them install programs and execute administrative tasks from scripts on Windows computers. The big problem is that runas asks for the account password interactively, therefore it is not possible to include runas statements in scripts.

That's the reason why a lot of large companies in the world are using TqcRunas. TqcRunas is an inexpensive little program that will let you include runas statements in your scripts in a safe and easy way. And you can do it even from your favorite scripting language!!

TqcRunas provides the following advantages:

  • TqcRunas builds a strongly encrypted file that stores all your specifications to runas a command and to control the process created. Thus you can exactly specify with programs and options your users can run with administrator's privileges without reveal the administrator's password.
  • TqcRunas can improve its security by use of digital certificates to encrypt the TqcRunas settings.
  • You can make use of TqcRunas advantages using the executable module directly or using the provided ActiveX objects.
  • TqcRunas can be easily distributed to your clients computers or they can use them directly from a network share.

Main uses

  • Use TqcRunas to run programs, commands and scripts under a different user account than the logged on user.
  • Use Runas encrypted files to let your users to install or execute specified programs with administrator privileges without giving them administrators rights.
  • Use TqcRunas scriptable objects to use TqcRunas features in your administrative scripts using your favorite scripting language.


Features

TqcRunas 2012 Edition

New Features

TqcRunas documents (.tqc files) can be edited by it's creator.

Ability to use the current logged on user's registry profile in the executed application.

Mapped drives and printers in the current logged on user session will be automatically mapped and available in the executed program.

Many settings have been included to control the behavior of the executed program.

Ability to use digital certificates to double encrypt the runas settings.

Now is possible to pass arguments to the encrypted file.

TqcRunas is now only one module: TqcRunas.exe


Using TqcRunas

1. Build your .tqc file using the GUI interface and save it.
2. To execute a .tqc file run the following from the command line or from a script:

TqcRunas -f yourfile.tqc

or simply:

TqcRunas yourfile.tqc

It's a good idea to use full UNC paths to refer TqcRunas.exe and yourfile.tqc in your scripts.

3. You can also invoke a .tqc file using the TqcRunas.Document object as follows:

VBScript:
Dim oTqcrunas
Set oTqcRunas = CreateObject("TqcRunas.Document")
oTqcRunas.ExecTqcFile("yourfile.tqc")

JScript:
var oTqcrunas = new ActiveXObject("TqcRunas.Document");
oTqcRunas.ExecTqcFile("yourfile.tqc");

4. You can test your .tqc file from the GUI interface using the menu command [Tools]->[Test current .tqc file]

Copyright 2004-2012 Quimeras Software Company


Property Pages

The GUI of TqcRunas is now a document oriented interface. The different property pages allow you to edit the options and settings that will be saved in the TqcRunas document (the .tqc file).

Command

The command page sets the command, arguments and working directory that will run with the entered credentials.

Execution options

This page lets you control some run time features of the launched program.

Remote execution

TqcRunas can launch commands in a remote computer, use this page to specify the target computer. The current user must be an administrator.

Security

In the Security page you can set additional security settings to prevent malicious use of TqcRunas files. Options include the ability to check the contents, creation time, modification time and size of the target executable.

A new feature of TqcRunas 2007 Edition is the ability to double encrypt .tqc files using digital certificates, thus ensuring that only target subjects (that is people owning the private certificate key) can decrypt the .tqc document and execute it.


Command Page

This property page defines the elements of the TqcRunas document in relation with the runas command.

Command

Enter the executable to run, it should be a full path to the executable or application.

Arguments

The modifiers and options to pass to the executable. Can be empty.

Working directory

Sets the working directory for the executable. If nothing is specified the location of the executable file will be used.

Allow passing additional arguments to the encrypted file

Checking this option you allow to pass additional arguments to the executable when executing the TqcRunas document. (See the -aa option in the Command Line Reference).

Username, Password and Domain

The credentials of the user the command will be launched with.


Execution Options Page

The Execution Options page lets you specify some settings in order to control some features of TqcRunas and the launched application at execution time.

Be Silent

Tells TqcRunas to not report errors at execution time.

Load Profile

Tells TqcRunas to load the runas user's profile in order to be available for the runas program.

Map HKCU to the current user

Checking this box the launched application will work with the current user's profile instead of the runas user.

Use current environment variables

Checking this box the current environment variables will be available for the executed program.

Use runas credentials only for network access

Check this box when you want the executed program to be launched as the current user but can access network resources as the runas user.

Create new console

When console applications are launched, tells the system to create a new console for the process.

Create new process group

A new process group is created with the application.

Run Synchronously

When this options is set TqcRunas does not return until the launched application terminates.

Maximum wait time (in milliseconds)

Sets the maximum wait time in milliseconds when the Run Synchronously option is set.

Return process' exit code

When the Run Synchronously option is set this option tells TqcRunas to return the launched application's exit code.

Window

Sets the window style of the application being executed.

Process' Priority Class

Sets the execution priority class for the application being executed.


Remote Execution Page

TqcRunas is able to make remote computers execute commands. To use this feature the current user must be a domain administrator.

In this portion of the TqcRunas document you can specify the name of the remote computer where the command will be executed.

Target Computer

If you want TqcRunas to execute the command in a remote computer enter here its name.


Security Page

TqcRunas incorporates some features in order to improve security and avoid malicious usage of .tqc files.

Checksums (hashes)

To ensure that the target executable launched at run time is the intended one, you can tell TqcRunas to check its content, creation time, modification time and size. Obviously, the security is improved if you specify the command executable as a full path where regular users only have read access.

Size of the executable file

If this option is checked, TqcRunas stores the size of the executable file to be verified at execution time.

Last modification time of the executable file

If this option is checked, TqcRunas stores the last modification time of the executable file to be verified at execution time.

Creation time of the executable file

If this option is checked, TqcRunas stores the creation time of the executable file to be verified at execution time.

Content of the executable file

If this option is checked, TqcRunas hashes the content of the executable file to be verified at execution time.

Digital Certificates

The TqcRunas document (the .tqc file) can be double encrypted using digital certificates, using this feature you can exactly specify who will be able to execute the .tqc file, because only the owners of the selected digital certificates will be able to decrypt it.

Use digital certificates to double encrypt .tqc files

Check this option to enable the selection of certificates.

Target subjects

List of selected certificate subjects. TqcRunas uses the list of subjects to select the certificates used to double encrypt the document (the .tqc file).

Select subjects

The select subjects button helps you to find digital certificates from those stored in your computer.

Clear list

Clears the list of target subjects.


Menus

File menu

Contains the classic New, Open, Save, Save as, MRU list (most recent used documents) and Exit commands.

Execute command

The File menu also contains the Execute command, that will directly execute the current TqcRunas document

View menu

From the View menu you can enable or disable the toolbar and the status bar.

Tools menu

Test current .tqc file

This command saves the current document and executes it in a separate process. Very useful to test the exact behavior of the .tqc file.

Enable debug file

Checking this option sets a flag in the document that tells TqcRunas to create and save a trace file in the current user's %TEMP% directory. The trace file is called TqcRunas.dbg.

Help menu

The help menu let you access this help file and display the about dialog containing the license information.


Command line reference

TqcRunas 2012 Edition

Command line interface reference

TqcRunas 2007 Edition accepts the following arguments in the command line. Note that TqcRunas 2005 Edition cannot build .tqc files from the command line, .tqc files must be built from the GUI interface.

Utilities
Option / Argument | Explanation
-regserver | Registers the TqcRunas.Document object. This is needed only if you're going to use the ActiveX objects provided by TqcRunas.
-newkey | Generates a new encryption key. This is the key used to encrypt/decrypt .tqc files. WARNING! once you generate a new encryption key you won't be able to open/run previous .tqc files created with the old key. (Unless you saved a backup copy of TqcRunas.exe.
Encrypted execution mode
Option / Argument | Explanation
-f yourfile.tqc | Executes the runas command encrypted and saved in the file. Use the GUI interface to create these .tqc files. This works the same even if you don't specify the -f switch.
-aa "your additional arguments" | Optional. Use in conjunction with the -f switch to pass additional arguments to the command specified when the .tqc file was created. Will work only if the .tqc file accepts additional arguments as specified when it was created (see the GUI interface help).
Not encrypted execution mode
Option / Argument | Explanation
-user username | The username for the runas command.
-pw password | The user's password for the runas command.
-d domain | Optional. The user's domain. Admits environment variables such as %COMPUTERNAME%. The default value is the current domain.
-profile | Optional. When this modifier is specified the system will load the runas user's profile.
-env | Optional. Use the current environment variables.
-netonly | Optional. Use the entered runas credentials only for network access.
-w | Optional. Executes the runas command in synchronous mode. TqcRunas won't return until the launched program finishes.
-maxwait time | Optional. Used in conjunction with the -w modifier. "time" specifies in milliseconds the maximum time to wait for the launched process.
-rec | Optional. Used in conjunction with the -w modifier. When specified the launched program's exit code is returned by TqcRunas.
-e executable | Specifies the executable command to be launched by TqcRunas.
-a "your arguments" | Optional. Specifies the arguments to pass to the executable.
-wd workingdirectory | Optional. Sets the working directory for the launched program.
-t targetcomputer | Optional. Sets the remote target computer where the program will be launched.
-newconsole | Optional. Used when a console process will be launched. Indicates that a new console must be created for the process.
-newprocgroup | Optional. Specifies that a new processes group must be created.
-debug | Optional. A trace file will be saved in the %temp% directory.
-mapHKCU | Optional. Specifies that the current user's registry profile must be used as HKCU by the launched process, instead of the runas credential's one.
-quiet | Optional. Don't report errors.
-priority N | Optional. Sets the execution priority class for the launched program. Available values are: 0=Above Normal Priority Class 1=Normal Priority Class 2=Below Normal Priority Class 3=Idle Priority Class 4=High Priority Class 5=Real Time Priority Class Default value is 1=Normal Priority Class.
-window W | Optional. Sets the window for the launched program. Available values are: 0=Normal window. 1=Minimized window. 2=Maximized window. 3=Hidden window. Default value is 0=Normal window.


ActiveX object reference

TqcRunas 2012 Edition

ActiveX object interface reference

Registration

The TqcRunas.Document object is registered running:
TqcRunas -regserver

Object instantiation

To create the TqcRunas ActiveX Object just use the scripting syntax to create objects:

VBScript:
Dim oTqcrunas
Set oTqcRunas = CreateObject("TqcRunas.Document")

JScript:
var oTqcrunas = new ActiveXObject("TqcRunas.Document");

TqcRunas.Document Object Properties

Property | Explanation
STRING Username | Sets the username for the runas command.
STRING Domain | Sets the user's domain for the runas command.
STRING Password | Sets the user's password for the runas command.
STRING Command | Sets the executable file to be launched by TqcRunas.
STRING Arguments | Sets the arguments to pass to the executable.
STRING WorkingDirectory | Sets the working directory for the launched program.
BOOL LoadProfile | Load the runas user's profile.
BOOL UseCurrentEnvironment | Use the current environment variables in the new process.
BOOL Synchronous | Executes the runas command in synchronous mode. TqcRunas won't return until the launched program finishes.
BOOL ReturnExitCode | Used in conjunction with the Synchronous property. When specified the launched program's exit code is returned by TqcRunas.
INT MaxWait | Used in conjunction with the ReturnExitCode property. Specifies in milliseconds the maximum time to wait for the launched process termination.
BOOL NetOnly | Use the entered runas credentials only for network access.
BOOL MapHKCU | Specifies that the current user's registry profile must be used as HKCU by the launched process, instead of the runas credential's one.
BOOL CreateNewConsole | Used when a console process will be launched. Indicates that a new console must be created for the process.
BOOL CreateNewProcessGroup | Specifies that a new processes group must be created.
INT PriorityClass | Sets the execution priority class for the launched program. Available values are: 0=Above Normal Priority Class 1=Normal Priority Class (DEFAULT) 2=Below Normal Priority Class 3=Idle Priority Class 4=High Priority Class 5=Real Time Priority Class
INT Window | Sets the window for the launched program. Available values are: 0=Normal window (DEFAULT) 1=Minimized window 2=Maximized window 3=Hidden window
BOOL ChecksumContent | Indicates that on execution the content of the executable file must be validated against the content of the executable file when the encrypted .tqc file was created.
BOOL ChecksumCtime | Indicates that at execution the Creation Time of the executable file will be validated against the Creation Time of the executable file when the encrypted .tqc file was created.
BOOL ChecksumMtime | Indicates that at execution the Last Modified Time of the executable file will be validated against the Last Modified Time of the executable file when the encrypted .tqc file was created.
BOOL ChecksumSize | Indicates that at execution the size of the executable file will be validated against the Size of the executable file when the encrypted .tqc file was created.
BOOL UseCertificates | Indicates that TqcRunas is using digital certificates to double-encrypt the .tqc file. At run time TqcRunas will try to find a valid user's certificate to decrypt the .tqc file.
BOOL Silent | Do not report errors.
BOOL EnableDebug | A trace file will be saved in the %temp% directory.
STRING TargetComputer | Sets the remote computer where the runas program will be launched.

TqcRunas.Document Object Methods

Method | Explanation
INT ExecTqcFile ( STRING Filename, [optional] STRING AddArgs ) | Executes the .tqc file specified by Filename, and pass the additional arguments specified by AddArgs. The additional arguments will be only accepted at execution time if the .tqc file was created with the proper switch. Returns 0 if success or a system error code.
INT Execute ( [optional] VARIANT Command, [optional] VARIANT Arguments, [optional] VARIANT Username, [optional] VARIANT Password, [optional] VARIANT Domain ) | Runas Command and Arguments using the supplied credentials. The arguments can be set using the correspondent properties and then call Execute() without parameters. Returns 0 if success or a system error code.
INT Save ( STRING Filename ) | Saves the current settings as a .tqc file. Returns 0 if success or a system error code.
VOID AddCertificateName (STRING Name ) | Adds Name to the list of subjects for which TqcRunas will use their certificates to double-encrypt the .tqc file.
VOID EmptyCertificateList ( ) | Clears the certificates subjects list.


Installation

TqcRunas.exe can be used directly without any previous installation operations.

In order to use the TqcRunas ActiveX object you must register TqcRunas by simply running "TqcRunas.exe -regserver" with administrator rights.


TqcRunas 2004.3 Edition licensing model

TqcRunas 2012 Edition

TqcRunas 2012 Edition licensing model

TqcRunas 2012 licensing model is basically the same as in previous versions.

1. TqcRunas is licensed by workstation, you do need a license for every computer where TqcRunas will ever run, regardless of the location where TqcRunas is being loaded from.

2. The license fee is a one time fee, no yearly renewals are needed.

3. You buy the product not the version, so the license grants you the right to upgrade to all future versions for free.

The license file

When you buy TqcRunas you receive a license file, this file must be renamed to TqcRunas.lic and must be copied to the same folder where you are running TqcRunas.exe from. On execution TqcRunas will look for the license file to validate your license and the number of licensed workstations.

Evaluation licenses are available at Quimeras Software Company's web site http://www.quimeras.com

Support

Support is provided through our web site and by e-mail.

TqcRunas License Agreement

QUIMERAS SOFTWARE COMPANY provide the computer software product contained in the download file (the "Software") and the associated documentation contained in the download file (the "Documentation") and license their use under the terms set forth herein. You assume responsibility for the selection of the Software to achieve your intended results, and for the installation, use and result obtained from the Software. Do not use the Software in any case where significant damage or injury to persons, property or business may happen if an error occurs.

LICENSE

1. You are granted a personal or company, non-transferable and non-exclusive license to use the number of copies of the Software, on the same number of computers and by the same number of users or clients computers, as the number of licenses you acquire, and to use the Documentation under the terms stated in this Agreement.

2. You, your employees, and/or agents may not distribute or otherwise make the Software or Documentation available to any third party.

3. You may not assign, sublicense or transfer this license and may not decompile, reverse engineer, modify, or copy the Software or Documentation for any purpose, except you may copy the Software into machine readable or printed form for backup purposes in support of your use of the Software. You may combine the Software with other computer software. Any portion of the Software merged into or used in conjunction with other computer software will continue to be the property of QUIMERAS SOFTWARE COMPANY and subject to the terms and conditions of this Agreement.

4. The Software and Documentation are copyrighted by QUIMERAS SOFTWARE COMPANY. You agree to respect and not to remove or conceal from view any copyright, trademark or confidentiality notices appearing on the Software or Documentation, and to reproduce any such copyright, trademark or confidentiality notices on all copies of the Software and Documentation or any portion thereof made by you as permitted hereunder and on all portions contained in or merged into other computer software products and documentation. YOU MAY NOT USE, COPY, MODIFY, OR TRANSFER THE SOFTWARE OR DOCUMENTATION, OR ANY COPY, MODIFICATION OR MERGED PORTION, IN WHOLE OR IN PART, EXCEPT AS EXPRESSLY PROVIDED FOR IN THIS LICENSE. IF YOU TRANSFER POSSESSION OF ANY COPY, MODIFICATION OR MERGED PORTION OF THE SOFTWARE OR DOCUMENTATION TO ANOTHER PARTY, YOUR LICENSE IS AUTOMATICALLY TERMINATED.

TERM This license is effective until terminated. You may terminate it at any time by destroying the Software and Documentation with all copies, modifications and merged portions in any form. It will also terminate upon conditions set forth elsewhere in this Agreement if you fail to comply with any term or condition of this Agreement. You agree upon such termination to destroy the Software and Documentation together with all copies, modifications and merged portions in any form.

THE UTILITIES PROVIDED BY QUIMERAS SOFTWARE COMPANY (THE "SOFTWARE") IS PROVIDED "AS IS" AND "WITH ALL FAULTS." QUIMERAS SOFTWARE COMPANY MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND CONCERNING THE QUALITY, SAFETY OR SUITABILITY OF THE SOFTWARE, EITHER EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTIES OF MERCHANTABILITY, OR FITNESS FOR A PARTICULAR PURPOSE.

You are solely responsible for adequate protection and backup of the data and equipment used in connection with any of the Software, and QUIMERAS SOFTWARE COMPANY will not be liable for any damages that you may suffer in connection with using, modifying or distributing any of the Software.

QUIMERAS SOFTWARE COMPANY is not associated with Microsoft Corporation in any way. Windows 2000, Windows XP, Windows NT and Windows 95,98,Me are registered trademarks of Microsoft Corporation.


Contact Information

Quimeras Software Company
PO BOX 41914
41001 Sevilla
SPAIN

Web: http://www.quimeras.com

Mail: info@quimeras.com

Telephone: +34 629 288946
Fax: +34 639 118657


Privacy Policy

Quimeras Software Company is firmly committed to protecting the privacy of its customers and those who sample our products. Quimeras Software Company does not share, sell, or otherwise distribute the financial or personal information of its customers or those who otherwise provide personal information to sample our products. All financial and personal information collected by Quimeras Software Company is held in the strictest confidentiality. Financial and personal information provided for orders is used to process payment and to send order information to our customers.

More than anything, Quimeras Software Company tries to treat its customers as each one of us would like to be treated. We value our privacy and we value yours, too. It is our goal to make your experience with Quimeras Software Company a safe and positive experience.

For more information on Quimeras Software Company's privacy policy, please feel free to contact us at: quimeras@quimeras.com


Copyright 2004 Quimeras Software Company

Copyright 2004-2012 Quimeras Software Company


TqcRunas 2004

TqcRunas 2012 Edition