Runing 2.3.0 WindowsAgent without Admin user

Question

Hi,

I am wondering if it is possible to run client ocspackage.exe to collect and send data without having access to AD/local admin account?

I found in DOCO:

Launcher OcsLogon.exe can use the following command line parameters:

• /PACKAGER setup all-in-one installer “ocspackage.exe” (See Using OCS Packager to create an all-in-one installer to setup agent and server certificate), to install Agent and server certificate even if user does not have Administrator privileges.

But even i have created package with /PACKAGER option - it doesnt start with normal user privilages (need to run it as a Administrator to start collecting / sending data)

How to solve it? Does UAC have something with it?

Answer 1

I doubt you can install software using a normal account on a machine joined to a domain if no group policies authorize software installs. If you have domain admin credentials, you can either create a GPO with either a startup script for any domain authenticated user or use PSEXEC if remote admin shares are enabled:

psexec \\HOSTNAME -u DOMAIN\user -c -f c:\WINDOWS\system32\robocopy.exe "\\share\Path-to-OCSNG-Windows-Agent-2.1.1.1" "C:\temp\OCS" OCS-NG-Windows-Agent-Setup.exe
psexec \\HOSTNAME -u DOMAIN\user -c -f c:\WINDOWS\system32\robocopy.exe "\\share\Path-to-OCSNG-Windows-Agent-2.1.1.1" "C:\temp\OCS" cacert.pem
psexec \\HOSTNAME -s C:\temp\OCS\OCS-NG-Windows-Agent-Setup.exe /S /NOSPLASH /NO_SYSTRAY /NOW /ca="cacert.pem" /SERVER=http://ocshostname/ocsinventory

Answer 2

If you really want to make it work, you can use Process Monitor (https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx) to capture every location OCS needs write permissions (Registry, NTFS, Services) and give access to those locations to the user.