Map a drive from off domain machine, using alternative credentials.

[Jaan]

Hi All,

 

Little confused on how to approach this, I know the "connect as" function doesn't work anymore in GPP.

 

We have a off domain computer that has a shared folder which is mapped to certain computers via a .vbs script. I manually placed this script into the computers "startup folder".

 

This is fine if only one person has access to the computer. However i have a scenario where a computer is shared. I want user 1 to have the mapped drive, and user 2 not to have the mapped drive.

 

Can i use a "logon" (user) script via gpp to do this, or am i right to presume the user permission wont be able to launch the script. if i change it to "startup" (computer) i end up with both users having the mapped drive.

 

I can't test this at to mo as i'm off site, just brainstorming. I have the location of the folder share, username and password of the off domain shared folder.

 

Any thoughts would be appreciated.

 

The .vbs script is as below;

 

'args = WScript.Arguments.Count



Option Explicit
Dim objNetwork 
Dim strDriveLetter, strRemotePath, strUser, strPassword, strProfile

' Values of variables set
strDriveLetter = "V:" 
strRemotePath = "\\offdomain-PC\shared_folder" 
strUser = "offdomain-PC\username"
strPassword = "password1234"
strProfile = "false"

' This section creates a network object. (objNetwork)
' Then apply MapNetworkDrive method. Result V: drive
' Note, this script features 5 arguments on lines 21/22.

on error resume next
Set objNetwork = WScript.CreateObject("WScript.Network") 
objNetwork.MapNetworkDrive strDriveLetter, strRemotePath, _
strProfile, strUser, strPassword 





'if args > 0 then 
'msgbox wscript.arguments(0) & wscript.arguments(1)
'end if

[glen_j]

If it is for one user I'd just map the drive using file explorer and tick reconnect at logon and use different credentials. Drive mappings done this way are done per user so others wouldn't have access to it.

[Jaan]

It's for more than one user in more than one location now. Also our users can't manually map drives.

[glen_j]

Are the computers joined to any domain or are they on a workgroup? If on a workgroup and you know the user names you could add an if statement to the script to check the username. If they are on another domain you could create a trust and add the users which are allowed access to the share permissions. Then have a gpp mapped drive with/without item level targeting?

[Jaan]

The computer from which i need to map the drive from is on a workgroup, the computer/s that i need to mapped drive on are on a domain.

 

How would i do map with alt credentials using gpp?

[glen_j]

If the computer is on a workgoup i don't think you can. Microsoft deprecated things like that in gpp as the user / password is accessible on sysvol share. Putting an if statement in the script to check currently logged in user should work. If there are several users you'd just put several if statements in. also worth nothing you may have to use the FQDN of the servers for the share mapping to work on workgroup computers.

[mavhc]

This is the reason domains were invented, why is it off the domain?

[Jaan]

Not sure*

 

 

 

*Inventry

[psydii]

Join it to the domain.

 

Keep it away from all of your othe gpos and write a set that allows it to function

 

Firewall is off by default. Domain default is on, so that needs bespoke rules to secure.

It is set to update automatically from MS - that should be allowed to continue

It has windows defender as AV, again don’t interfere with that.

It needs bespoke power management (never lock!)

Auto logon needs to be enabled.

 

Then configure the inventry share as though it were a file server secured by ad group membership.

 

Once done you can deploy the shortcut by GPP and also the config file that enables SSO.

[djm968]

Better option would be to move the share to a file server and map that.

[psydii]

Better option would be to move the share to a file server and map that.

 

But the risk there is if the machine receives updates to the app, the client is out of date.

 

Also the inventry box has its firewalll off. You really need to secure that by policy, or completely isolate it.

 

I can see from both perspectives, and there are risks with either approach.

 

What I will finish with is that with my data protection head on, the local IT team have to own the security risk of the inventory system. So they must manage it, whether by GPO or network segmentation/isolation.

[djm968]

But the risk there is if the machine receives updates to the app, the client is out of date.

 

Also the inventry box has its firewalll off. You really need to secure that by policy, or completely isolate it.

 

I can see from both perspectives, and there are risks with either approach.

 

What I will finish with is that with my data protection head on, the local IT team have to own the security risk of the inventory system. So they must manage it, whether by GPO or network segmentation/isolation.

 

What inventory box? The OP doesn't mention an "inventory box" or in fact what the share is being used. IMO a shared folder on a file server that is joined to the domain with the required client devices mapping a drive to this folder and permission set as appropriate is a much more secure and effective way accessing a shared folder.

[sparkeh]

Ah yeah the Inventry share problem. We hit that too when MS deprecated accessing a folder on a workgroup machine as guest as while ago.

 

Is this just to launch the client?

 

Best I came up with was to add an entry into the windows credentials list for the Inventry machine's shared folder using the machines local username and password. The client can then launch.

[Jaan]

This is to map the v: to launch the console.

 

i thought the "newer" version didn't need a mapped drive.

[sparkeh]

This is to map the v: to launch the console.

 

i thought the "newer" version didn't need a mapped drive.

No you don't need to map the drive. Just add credentials and the machine can access the folder to launch the client:

 

[Jaan]

No you don't need to map the drive. Just add credentials and the machine can access the folder to launch the client:

 

[ATTACH=CONFIG]55691[/ATTACH]

 

Cool, i can do this via a credential manager gpo and send to all the machines that need access?

[sparkeh]

Cool, i can do this via a credential manager gpo and send to all the machines that need access?

...no. There's no way to do that via GPO.

 

However, there are a few PS scripts that you could take a look at:

 

https://gallery.technet.microsoft.com/scriptcenter/PowerShell-Credentials-d44c3cde

https://github.com/bamcisnetworks/BAMCIS.CredentialManager

[GPeckss]

Deny Access to the file via the security tab for the users who don't need to map the drive.

That way the script will only be accessible by the users who need the drive mapped.

At least this way you wont need to modify the script.

[mavhc]

Why is the firewall off? Don't these people know how to write software? Good job it's free.

[sparkeh]

Why is the firewall off? Don't these people know how to write software? Good job it's free.

Free? Inventry is not free by any stretch of the imagination.

[CHiLL]

No you don't need to map the drive. Just add credentials and the machine can access the folder to launch the client:

 

[ATTACH=CONFIG]55691[/ATTACH]

This looks promising, but does it illiminate the remote connection limit issue? We find that after a short while, the machine maxes out it's remote connections and refuses to allow new connections until the machine has been rebooted.

[Oaktech]

Ah this old chestnut

 

I picked up the whole client folder, moved it to a network share. Halved the login time and stopped it from being disconnected every time the PC got a bit busy. I made a fuss about the performance issues and now I get an otherwise internal email every time there is an update to the app and I just copy it over again.

[DrBeaker]

Ah this old chestnut

 

I picked up the whole client folder, moved it to a network share. Halved the login time and stopped it from being disconnected every time the PC got a bit busy. I made a fuss about the performance issues and now I get an otherwise internal email every time there is an update to the app and I just copy it over again.

 

Do you mind if I ask how this has worked for you since the last post on the issue?

[Jaan]

Do you mind if I ask how this has worked for you since the last post on the issue?

 

I did this also.

 

Its been rock solid running from our server share

[Oaktech]

Do you mind if I ask how this has worked for you since the last post on the issue?

 

Absolutely fine... I just copy it over every time their is an update.