Give non admins MSG.EXE Access? Net send

[CREATISH]

Hello Guys, wanting to use a MSG.EXE Script with GUI to allow an Admin to be able to send prompts to teachers computer for budging them for things, the script works for me as admin but not for non admin, tried researching permission but unable to find anything, how could I do it so that non admin can just get permission to do this, many thanks

 

Link to the script I want to use

I am an apprentice and still learning.

 

https://gallery.technet.microsoft.com/scriptcenter/Message-Center-GUI-using-0c587bea

[CREATISH]

anyone

[5tu]

I'm doing something similar in a powershell script used by staff that calls msg.exe to send urgent messages to SLT when assistance is required in a classroom. As you have found, msg.exe can only be run by admins.

 

What I ended up doing was calling MSG.exe via Invoke-WmiMethod using the -Credential option to specify an admin account....

 

Invoke-WmiMethod -Credential $MyCredential -Path Win32_Process -Name Create -ArgumentList "C:\Windows\System32\msg.exe * /time:9999 Assistance is required in room $($textfield.text)"

 

Obviously you don't want a plain text admin password in a script so I used the steps at https://www.pdq.com/blog/secure-password-with-powershell-encrypting-credentials-part-2 to encrypt it which works well.

 

HTH

[CREATISH]

Hi thanks for the reply, this credentials looks like the good thing for me to learn

 

I see your script and see it something I want to use aswell working in a school too.

 

so I assume for each room you put the room number and copy that script to there desktops or via gpo, but running the script it just opens the message on the computer you run it on, how do i change it to send to my pc name opposed to just messaging itselfs?

 

Cheers again

[5tu]

My script sends an alert to a predefined list of desktops - those used by SLT. A teacher runs the script via a shortcut on their desktop which opens a popup box where they enter their room number. Once submitted an alert is sent to SLT and a confirmation box shown to the teacher requesting assistance.

 

Script below for you if you'd like to try it. Usual advice applies - use entirely at your own risk. Remember to secure the encrypted password and key files with appropriate NTFS permissions!

 

Amend the bits in red...

 

# Load the Winforms assembly
[reflection.assembly]::LoadWithPartialName( "System.Windows.Forms")

function do_exit
{
    $form.close()
}

function send_msg
{
    foreach ($Computer in $Computers)
    {
       if (Test-Connection -ComputerName $Computer -Count 1 -Quiet)
       {
           Invoke-WmiMethod -Credential $MyCredential -Path Win32_Process -Name Create -ArgumentList "C:\Windows\System32\msg.exe * /time:9999 Assistance is required in room $($textfield.text)" -ComputerName $Computer
       } 
   }
}

# Set MSG Credential

$User = "[color="#FF0000"]domain\adminaccount[/color]"
$PasswordFile = "[color="#FF0000"]\\\EncryptedPassword.txt[/color]"
$KeyFile = "[color="#FF0000"]\\\AES.key[/color]"
$key = Get-Content $KeyFile
$MyCredential = New-Object -TypeName System.Management.Automation.PSCredential `
-ArgumentList $User, (Get-Content $PasswordFile | ConvertTo-SecureString -Key $key)

# Get target computers
$ComputersFile = "[color="#FF0000"]\\\Computers.txt[/color]"
$Computers = Get-Content $ComputersFile

# Create the form
$form = New-Object Windows.Forms.Form

#Set the dialog title
$form.text = "Classroom Support Required"
$form.Size = New-Object Drawing.Point 400,200

# Create the label control and set text, size and location
$label = New-Object Windows.Forms.Label
$label.Location = New-Object Drawing.Point 80,30
$label.Size = New-Object Drawing.Point 500,15
$label.text = "Enter the room name where help is required"

# Create TextBox and set text, size and location
$textfield = New-Object Windows.Forms.TextBox
$textfield.Location = New-Object Drawing.Point 50,60
$textfield.Size = New-Object Drawing.Point 300,30

# Create Button and set text and location
$button = New-Object Windows.Forms.Button
$button.text = "Request Assistance"
$button.Location = New-Object Drawing.Point 120,90
$button.Size = New-Object Drawing.Point 150,30

# Set up event handler to extract text from TextBox and display it on the Label.

$button.add_click({
send_msg;
$label.Text = "A request for assistance in room " + $textfield.text + " has been sent.";
$form.controls.remove($button);
$form.controls.remove($textfield);
# Create Close Button and set text and location
$closebutton = New-Object Windows.Forms.Button;
$closebutton.text = "Close";
$closebutton.Location = New-Object Drawing.Point 120,90;
$closebutton.Size = New-Object Drawing.Point 150,30;
$form.controls.add($closebutton);

(
# Set up event handler to close form.
$closebutton.add_click({
$form.Close()
})
)

})

# Add the controls to the Form
$form.controls.add($button)
$form.controls.add($label)
$form.controls.add($textfield)

# Display the dialog
$form.ShowDialog()

Edited February 11, 2019 by gybe78

[CREATISH]

Thanks just learn't first bit of dealing with scripts here!

 

 

Done the above and creating the AES and password text and getting this error

 

Invoke-WmiMethod : User credentials cannot be used for local connections

 

using domain admin credentials

[5tu]

Have you followed the steps given at https://www.pdq.com/blog/secure-password-with-powershell-encrypting-credentials-part-2 to encrypt your password with a suitable key?

[CREATISH]

I did although some of the text boxes it asks you to do you some are examples, finding it tricky in which ones I need to do, I created the password.txt and AES

 

On the link which tasks did you complete?

 

so First I did this one

 

$KeyFile = "\\Machine1\SharedPath\AES.key"

$Key = New-Object Byte[] 16 # You can use 16, 24, or 32 for AES

[security.Cryptography.RNGCryptoServiceProvider]::Create().GetBytes($Key)

$Key | out-file $KeyFile

 

Changed the output to somewhere on a shared drive

then I did this one

 

 

$File = "\\Machine1\SharedPath\Password.txt"

[byte[]] $key = (1..16)

$Password = "P@ssword1" | ConvertTo-SecureString -AsPlainText -Force

$Password | ConvertFrom-SecureString -key $key | Out-File $File

 

Then I inputted the location of each in your script

[5tu]

I didn't ever get the error you're seeing so it's hard to help you troubleshoot. I can only suggest amending the script to use unencrypted credentials and seeing if that works first, then if it does, try to do the encryption steps again.

[CREATISH]

Thanks will try this, what do i put instead of path if i just want to enter credentials? (newbie)

[bald_pig]

You stated that the user sending the command would be an admin, what's wrong with right-click > run as administrator?

[CREATISH]

Sorry I mean't Admin as admin worker, they are not an administrator of the domain.

 

- - - Updated - - -

 

You stated that the user sending the command would be an admin, what's wrong with right-click > run as administrator?

 

Sorry Mean't Admin worker rather then an administrator of our domain

 

- - - Updated - - -

 

I didn't ever get the error you're seeing so it's hard to help you troubleshoot. I can only suggest amending the script to use unencrypted credentials and seeing if that works first, then if it does, try to do the encryption steps again.

 

Thanks will try this, what do i put instead of path if i just want to enter credentials? (newbie)

 

 

 

[LukeRowberry]

This seems really suspicious

[chazzy2501]

you could add the script to a scheduled task that you allow to run on demand and place the creds of a privileged user then use GPP to deploy it.

Then create a shortcut to the scheduled task.

[gshaw]

This seems really suspicious

Doesn't sound like a student using illegitimate local admin rights at all does it [emoji6]

[CREATISH]

Doesn't sound like a student using illegitimate local admin rights at all does it [emoji6]

 

not really what you want me to say,

 

I'm an apprentice at a school only IT staff and my manager in another school has recently left and left on my own until someone gets replaced so i can contact them for support.

[mrcrazy04]

I think it's worth highlighting what the script linked to by gybe78 says - anybody who has access to the AES key (in this case any teachers) could recover the password.

I also saw mention of supplying domain admin credentials - Please don't do that, as all it would take is one curious student and an unlocked teacher workstation to compromise your domain.

 

I think whether to implement something like this or not requires careful consideration of the associated risks and how to manage them.

[mavhc]

What's wrong with using email?

[CREATISH]

What's wrong with using email?

 

You think its likely a staff member walks into the class at 9pm and open there email client open?

 

they walk in open the resources and start teaching, realisticly the admins should threaten with sanctions over this rather then find an IT solutions but hey ho, its the job in hand, could do with something like this as a call for alert too

[bald_pig]

You think its likely a staff member walks into the class at 9pm and open there email client open?

 

If you meant 9am, then yes. At the schools I've worked at, all staff were expected to monitor their emails throughout the day, teachers included. It's not an unreasonable expectation.

[CREATISH]

If you meant 9am, then yes. At the schools I've worked at, all staff were expected to monitor their emails throughout the day, teachers included. It's not an unreasonable expectation.

 

sorry yes, 9am, 10am, 11am ect, yes I agree, not only should they monitor email but they should do register in first 10 minutes, and admin staff has to run around for them to do it, I think they should be punished if they dont do it, just creating extra jobs.

[mavhc]

What they should have is a notification when they get an email, then they wouldn't have to check, they'd be told by the computer

[CREATISH]

Well because teachers are never in the same room they use online office 365, so notification wont come through unless you open the email

 

plus using outlook will store the emails on the hard drive which will eat up the 120gb SSD pretty quick (so small I know).

 

Shame you can't add access to small tasks lime msg.exe, just one member of staff I want to give it too

[Katy]

We don't have anything like this, teachers log on to the computer in the room they are timetabled (teachers move rooms quite often), first things they open are iSAMS and Outlook Web, then do their register then teach. New emails pop up the little card and make a bing noise.

[mavhc]

A small, easy to config en mass, program to check for email would be great.

 

Otherwise could just set staff Chrome home page tab to open OWA with auto login.