[sims] Auto install of SIMS - UAC - securing the server share

[digone52]

I don't want for much - just an automated install of SIMS.NET that allows UAC to be left on and a secured share of SIMS.NET on the server.

 

I've seen some articles on edugeek relating to UAC, but no definative answers. We don't use SOLUS3 by the way. I'm not sure if this is the fix to the UAC problem, but our support people don't support SOLUS3 at the moment, so I don't think that this is an option for us yet anyway.

 

SIMS is new to me, so need a bit of advice.

 

I have crafted a script in Kixtart which runs as a startup script for Windows 7 32 bit, which I'll share with you...

 

use I: "\\adminsims\simshare"

Shell(%COMSPEC% + ' /c start /wait i:\sims\setups\simsinfrastructuresetup.exe -a {QuietMode} {SIMSWorkstation} {FMSWorkstation}')

Shell(%COMSPEC% + ' /c start /wait i:\sims\setups\simsapplicationsetup.exe /s {QuietMode} [sIMSDirectory]="I:\SIMS\" [sIMSDotNetDirectory]="C:\Program Files\SIMS\SIMS .net"')

Shell(%COMSPEC% + ' /c start /wait i:\sims\setups\simsmanualsetup.exe /s {QuietMode} [sIMSDirectory]="I:\SIMS\" [sIMSDotNetDirectory]="C:\Program Files\SIMS\SIMS .net"')

Shell(%COMSPEC% + ' /c start /wait i:\sims\setups\SIMSAMPARKSetup.exe /s {QuietMode} [sIMSDirectory]="I:\SIMS\" [sIMSDotNetDirectory]="C:\Program Files\SIMS\SIMS .net"')

Copy $HomeFolder + "\" + $Package + "\Source\connect.ini" "c:\program files\sims\sims .net\connect.ini"

Copy $HomeFolder + "\" + $Package + "\Source\SIMS.ini" "C:\Windows\SIMS.ini"

 

 

If $OS="Win7"

Shell('C:\Windows\System32\icacls.exe "C:\Program Files\Sims" /grant "admin\staff: (OI)(CI)F"')

Shell('C:\Windows\System32\icacls.exe "' + %ALLUSERSPROFILE% + '\Start Menu\Programs\SIMS Applications" /grant "admin\staff: (OI)(CI)F"')

Shell('C:\Windows\System32\icacls.exe "C:\Windows\Sims.ini" /grant "admin\staff:F"')

Shell('"' + $HomeFolder + '\' + $Package + '\Source\SubInAcl.exe" /KEYREG HKEY_LOCAL_MACHINE\SOFTWARE\Classes /GRANT=admin\staff')

Shell('"' + $HomeFolder + '\' + $Package + '\Source\SubInAcl.exe" /KEYREG HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID /GRANT=admin\staff')

Shell('"' + $HomeFolder + '\' + $Package + '\Source\SubInAcl.exe" /KEYREG HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface /GRANT=admin\staff')

Shell('"' + $HomeFolder + '\' + $Package + '\Source\SubInAcl.exe" /KEYREG HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib /GRANT=admin\staff')

EndIf

 

Shell(%COMSPEC% + ' /c ECHO Sims Installed > "C:\Program Files\SIMS\SIMS .net\installed.txt"')

 

USE I: /DELETE

 

-----

 

This script has a wrapper, so it will run only the once, and $Homefolder and $Package are variables passed from the wrapper, so are declared.

 

Hopefully if you deploy SIMS.NET already, you'll see what this script is up to. It deploys fine, and no UAC prompts or updates when you fire up SIMS, but what will happen on the next big update?

 

Our SIMS.NET support line have so far been non-commital as to whether this will work with UAC turned on, and I really don't want to wait until the next update to find out!

 

Anyone have any idea whether this script will work with UAC?

 

On another point, our support line say that all SIMS users should have modify access to the server files, which I'd have thought was recipe for disaster.

 

Anyone secured their server share?

 

Thanks in anticipation.

Edited November 25, 2011 by digone52

[3s-gtech]

We have UAC turned on. SIMS is deployed with a batch file - it maps the drive as an install user, then runs the installers for the three main components from the SIMS server install directory (I don't run the infrastructure setup unless needing FMS). Permissions on C:\Program Files\SIMS.net are then changed to allow users to Modify, and that's it. Installs and updates fine. Basically, that seems to be exactly what your script is doing - you may find the odd workstation will play up and might need an admin logon to update, but should work generally.

 

To help protect the share, hide the share mapped drive. Can't remember exactly what permissions we have set on it, but it's more open for admin (rather than teaching) staff.

[vikpaw]

You could try to trigger it on a test machine to run again, i think even if no update is needed it will just run those files anyway, because it knows no different.

To make it more real, download the ISO from SupportNet and put newer versions of those files on a secret 'hidden to all but you' share and map to it with the I drive on that one test machine. Ideally, you have a test stafflike user to do it with, rather than your account so you can see impact of any other policies / restrictions too.

[digone52]

Thanks for your help on this one.

 

Having had the script run successfully on my PC, and I can see that the permissions are set correctly, but if I run the installers, I promptly get UAC kick in.

 

For instance, if I run the following as myself from a command prompt...

 

start /wait i:\sims\setups\simsmanualsetup.exe /s {QuietMode} [sIMSDirectory]="I:\SIMS\" [sIMSDotNetDirectory]="C:\Program Files\SIMS\SIMS .net"

 

... UAC prompts, and I have done a ProcMon capture of what is going on, and I get the log below (I didn't let the installer go beyond a UAC prompt)...

 

 

I can't see anything in this capture where simsmanualsetup.exe is trying to access something it can't.

 

I'm a bit stumpted over this one at the moment.

[vikpaw]

What if you run as admin the command prompt then do it?

With win 7 there is that issue with the user that things are done as, so you can actually have two mappings to the same drive, under different security contexts.

I can't find the exact thread, but it should also be on M$ site too.

This thread may help a little.

 

EDIT: forgot to paste! http://www.edugeek.net/forums/mis-systems/67803-sims-install-windows-7-problem-unable-write-shared-directory-s-sims.html

Edited November 26, 2011 by vikpaw
add link

[digone52]

If I start a command prompt running as administrator and kick off simsmanualinstall.exe, the install happens fine.

 

Just to clarify, we are heading into a situation where the vast majority of our users are not local administrators, and I want to leave UAC on. I think that there are very good reasons why we should have both of these.

 

I also want the initial setup of SIMS.NET to be automated. It obviously needs to be done under the context of an administrator, so hence the startup script above.

 

With every post I have seen, it has not been absolutely clear that anyone has got SIMS.NET working in this scenario.

 

Thanks.

[Michael]

My understanding is that UAC has to be turned off for SIMS. It just won't install properly with it enabled (using the GUI method).

 

It can also create problems with Anti-Virus software too. You can't install the Sophos Enterprise Console with UAC enabled.

 

I think the other problem you may run into is updating SIMS when future releases spring up. As a result I just disable UAC as recommended.

[Arthur]

if I run the installers, I promptly get UAC kick in.

This is probably caused by the application manifest embedded in the installers (shown below is the one from SIMSInfrastructureSetup.exe). There is a way to force the installer to run with different privileges using Microsoft's Application Compatibility Toolkit, but I haven't tried this myself.

 

  
     
                 level="[color="#FF0000"]requireAdministrator[/color]"
        />
     
  

 

Manifest files can include the requestedElevationLevel tag that specifies a value defining the level of privilege the application should be launched with. The three values are:

 

asInvoker

The application runs with the same token as the parent process.

 

highestAvailable

The application runs with the highest privileges the current user can obtain. If the user is a standard user, elevation will not be attempted; if the user is a protected administrator, elevation will be triggered.

 

requireAdministrator

The application runs only for administrators and requires that the application be launched with the full token of an administrator. (Sources: [1] [2])

[digone52]

Hi Michael. Thanks for your reply.

 

When you say as recommended, Our support company have just told me to turn UAC off if I have problems - i.e. a suck it and see approach, which I did not find very helpful to be honest, but I have not heard that Capita recommend turning it off. Is this their official line?

 

Will Solus 3 help with this situation anyone know?

 

I have not yet looked into the functionality of SIMS.NET yet, and I'm sure it is very capable, but from a setup perspective the words "dogs dinner" spring to mind!

 

I guess I could move systems where users are local administrators into an OU with a group policy to enable UAC, and move systems where users are not local administrators into a different OU where UAC is disabled by policy.

[vikpaw]

SOLUS 3 would help, because it installs as a different user with privilege. Similarly, couldn't you invoke the script overnight, not under the user context. Then you can use whichever elevated privileges are required to get the upgrade done. Leaving the local groups, and UAC settings untouched.

[digone52]

Arthur - thanks for the info, really interesting. Looks like it forces administrator then.

 

vikpaw - I did wonder whether I could do something like forcing a reinstall once SIMS.NET has been updated through the scripts, but the problem is that we are using laptops which are usually hibernated, so I can't see how I could force the update as an administrator equivalent since there is no certainty that computers ar started on the network after an update.

Edited November 26, 2011 by digone52

[Michael]

Hi Michael. Thanks for your reply.

 

When you say as recommended, Our support company have just told me to turn UAC off if I have problems - i.e. a suck it and see approach, which I did not find very helpful to be honest, but I have not heard that Capita recommend turning it off. Is this their official line?

 

I liaise with Link2ICT (in Birmingham) and it was their recommendation to disable UAC. You can easily do this with a GPO and SIMS then works perfectly on Windows 7 SP1 x86. I have tried installing SIMS with UAC enabled and it is problematic. I wouldn't recommend it and as I say, speaking from experience, disabling UAC does allow SIMS to work correctly.

[Arthur]

disabling UAC does allow SIMS to work correctly

As @vikpaw mentioned, isn't this fixed with SOLUS3? There is a service called "Solus3Agent" which installs updates under the LocalSystem account.

 

Disabling UAC isn't a particularly good idea because it also disables many useful features including file-system and registry virtualization, Internet Explorer's protected mode, the Secure Desktop, UI Privilege Isolation, UAC remote restrictions etc.

[digone52]

It does look like I'm going to have to find out more about SOLUS 3, even though our support don't currently use it, and in the meantime switch off UAC if that's what it takes. As you say Arthur, it isn't a good idea, but I think necessary in the short term to get SIMS upgrading unless there is an avenue I have not explored.

 

Presumably I can leave UAC enabled on the few users who are local admins?

[Michael]

I agree, Solus3 is certainly worth looking at, but I'm not currently using that as yet.

 

A lot more schools are now taking the register through Sims, so it's installed on every workstation. Of course the same upgrades apply throughout the year, so it's important this can happen as smoothly as possible.

 

I was under the impression Solus3 simply automated upgrades, so theoretically, UAC would still create problems. You could argue Capita just need to make Sims compatible with Windows 7 in a default state. I also remember reading on these very forums about a proper Sims MSI, but this never materialised.

[vikpaw]

Keep UAC on, and the only issue is potentially an update not working.

Lets see if we can at least come up with a workaround for that.

Could you by policy the day before upgrading the server make them all local admins for the day? Are your users that high a risk group?

What if you put in a start up script, and tell them that they need to not hibernate but shutdown and restart on the morning after upgrade. Tell them a week in advance, then if it fails, and you have to attend, at least they were warned.

Do they use SIMS all day every day, you could initiate the upgrade while they are logged on somewhere, assuming the connection is good enough and they aren't needing SIMs.

There must be a way to do at least part of it, without sacrificing your network config.

Are you intending on moving to the latest version, as it's still unavailable so you have time to plan.

[digone52]

Hi vikpaw. Thanks for the suggestions.

 

I'd really love to leave UAC on. The solution can't give them local administrator, as I want to keep a strict policy that they are not local admins of their computer at any time. I'm more concerned about the installation of software that replaces the software we install by policy. I know that this happens currently with the XP laptops where they are local admins, and with a strict policy under Windows 7, there will be no way that our users can replace components of the build, or install products such as VNC which I'd object to. If users are told to shut down and not hibernate, I think that more than half wouldn't follow the instructions to be honest, and a mess would ensue. I know that my messages go unread at the best of times, and then a lot would forget anyway. We have a lot of machines and few staff, so to be rushing around the morning after an upgrade fixing computers is not ideal.

 

I was looking at WPKG | Open Source Software Deployment and Distribution yesterday to deploy. I had a quick look, but it looks like this product might have issues with Windows 7. Might be worth investigating though.

 

I've also contacted our support to see whether Solus 3 will do the job, and if so I asked them when we can have it.

[vikpaw]

I don't think SOLUS 3 will get around a hibernating machine because the machine and therefore the service is effectively off. So you still need to combat how to wake the machine and then run an update. While the machine is on, you could use it to update the machine, but now you have to get staff to leave the machine on, and not access sims, whilst connected to your network for long enough to upgrade SIMS, which is almost the same issue as before.

You're between a rock and a hard drive.

[digone52]

Sorry to be a bit green, but I don't know much about Solus 3. It was mentioned earlier in this thread that it is a service so the install does not happen under the user context but one of an admin equivalent (I think), so if I could use Solus 3, presumably it gets around permissions issues. However, if Solus 3 is a push technology, so you have to wait for the computer to be on-line and then push the update, then I can't see this working at all. If in some way once the Solus 3 service is on the network and can see the update, then it can pull the update down in some fashion, then that might work as long as the user doesn't have time to use SIMS.NET and mess things up in the meantime.

 

The thing is, this really shouldn't be difficult I feel. UAC has been around for years, and so has the idea of hibernating laptops. Using these technologies is good practice, as is not giving users local admin.

 

If with SOLUS 3 the computers have to be on the network at the time of update, then surely laptops can't be used with SIMS.NET?

 

If Capita expect that their users are not allowed to hibernate if using SOLUS 3, be local admins or not use UAC if not using SOLUS 3, and on top of this unless you use SOLUS 3 have the network admins open up permissions on the local computer to allow for updates - well, I hold my head in my hands in despair.

 

On top of this, on our SIMS server all SIMS users have modify access to all files on the SIMS share, and our help line inform us that that's the way it has to be. Surely this can't be the case?

 

I'd love to know the thinking behind all of this. Excuse the rant!

[vikpaw]

Check out the docs for SOLUS 3 on SupportNet. I don't use it, because it just wasn't up to it a few versions ago, and i dont have the time. I think the service pings the server to check if it needs updating, but you can push it out as well. My only concern, especially with laptops is that you don't just want it to initiate randomly.

 

I thought the idea was that all machines were upgraded over night. If you get it working, it should be okay, but you still have to deploy the agent, and then authorise the machines to take the upgrade. Someone that is using it now will be able to answer in more detail. I would hope you can authorised it all on your console and then when they come online, they will say, hey, i need to upgrade.

 

Sorry, i might have confused things with my earlier comment. My only concern with updating laptops is, if it takes a while, or they are roaming it can break the update. This is why for laptops i have a program that runs instead of the normal SIMS icon, and it checks if an upgrade is needed, then gives the user the choice to plug in to ethernet or delay until later. I can imagine it only getting worse if it starts doing it, when they haven't even initiated SIMS and are just walking across the building. Just my view. Desktops are a lot easier though.

 

I think they have to be on the network for update, i can't remember if its supposed to deliver the files in advance, or if that was the server side of updates.

[digone52]

Thanks. I don't have a SupportNet account yet, but have registered, so hopefully will get the creds tomorrow so I can take a look at the documentation.