Category list

1.2. At Least Three Ways to Do It

People like to work in different ways. Some prefer graphical user interfaces (GUI) while others like command-line interfaces (CLI). And experienced system administrators like to automate tasks using scripts. Since people prefer different methods , and no one method is necessarily better than another, we decided to write solutions to recipes using as many of each as is available. That means instead of just a single solution per recipe, we include several using GUI, CLI, and scripting examples. That said, some recipes cannot be accomplished with one of the three methods or it may be very difficult to do with a particular method. In that case, we cover only the applicable methods.

In the GUI and CLI solutions, we use standard tools that are either provided with the operating system or available for download from Microsoft's web site. But because there is a lot of good freeware and shareware out there, we also include a section on applicable tools you can download that can help you accomplish the task.

We took a similar approach with the scripting solutions. While one of the authors prefers Perl, we focus on VBScript due to its widespread use among Windows administrators. It is also the most straightforward from a coding perspective when using Windows Management Instrumentation (WMI) and Windows Script Host (WSH). For those familiar with other languages such as Visual Basic, Perl, and JScript, it is very easy to convert code from VBScript. For those of you who wish that all of the solutions were written with Perl instead of VBScript, you are in luck. On the book web site we've posted companion Perl scripts for each VBScript example. Go to http://www.rallenhome.com/books/ to download the code.

1.3. Where to Find the Tools

For the GUI and CLI solutions to mean much to you, you need access to the tools that are used in the examples. For this reason, in the majority of cases and unless otherwise noted, we used only tools that are part of the default operating system or available in the Resource Kit or Support Tools.

The Windows Server 2003 and Windows 2000 Resource Kit tools can be installed on Windows XP and provide numerous utilities that aid administrators in their daily tasks . More information on the Resource Kit can be found at the following web site: http://www.microsoft.com/ windows /reskits/. Some of the Resource Kit tools are free; for others you must buy the Resource Kit.

Windows Support Tools also includes many "must have" tools for people who work with Windows XP. The installation MSI for the Windows Support Tools can be found on an XP CD in the \support\tools directory.

1.4. Running Tools with Alternate Credentials

A best practice for managing Windows XP systems is to create separate administrator accounts and grant them elevated privileges, instead of letting administrators use their normal user account that they use to access network resources. This is beneficial because an administrator who wants to use elevated privileges has to log on explicitly through an admin account instead of having privileges all the time, which could lead to accidental changes. With the separate account method, the administrator would need alternate credentials to use tools to administer systems unless he or she logged on (locally or with Terminal Services) to the target machine using admin credentials.

There are several ways to specify alternate credentials when running tools. Many GUI and CLI tools have a user and password authentication option. If the tool you want to use does not have that option you can use the runas.exe command instead. The following command runs the enumprop.exe command under the credentials of the administrator account in the rallencorp.com domain:

> runas /user:administrator@rallencorp.com /netonly "enumprop LDAP://dc1/

dc=rallencorp,dc=com"

Sometimes it is convenient to create an MMC console that runs under administrator privileges. In this case, simply use mmc.exe as the command to run from runas :

> runas /user:administrator@rallencorp.com /netonly "mmc.exe"

This will create an empty MMC console from which you can add consoles for any snap-in that has been installed on the local computer. This is beneficial because all of the consoles that you add will be run under that administrative account. If you don't want to type that command over and over, simply create a shortcut on your desktop and put the command as the target path . By doing this you eliminate one of the common complaints about using alternate credentials, that is, it makes the job more tedious .

The /netonly option is necessary if the user you are authenticating with does not have local logon rights on the computer from which you are running the command, or if you want to authenticate with an account from a non-trusted domain.

There is another option for running MMC snap-ins or any GUI program with alternate credentials. Click on the Start menu and browse to the tool you want to open , hold down the Shift key, and then right click on the tool. If you select Run As, you will be prompted to enter alternate credentials with which to run the tool.

Flylib.com

Category list

Similar pages

1.2. At Least Three Ways to Do It