A Scripting Server for Domain Automation Tasks Christian Trachimow, DESY 5/13/2019 The DESY WindowsNT Group

Domain administration tasks User management delegated to group administrators and „user service“ set passwords, create, move, delete, archive,... Group management define composition System management query computers for special properties license management different group are taking part of this processes But: most jobs can be done only with domain admin privileges Need a server, that holds scripts, controls security and executes scripts 5/13/2019 The DESY WindowsNT Group

Requirements for a Scripting Server Scripts should be stored on the Scripting Server Scripts can be triggered by remote machines Secure connections with remote machines (Encryption) Scripts must be run with DA privileges (Impersonation) Identify which users submits the execution request (Authentication ) Define which groups are allowed to launch the script (Security control) Easy way of launching scripts Logging all operations (Event log) 5/13/2019 The DESY WindowsNT Group

Why Transaction Server ? Only used as DCOM repository Impersonation: can be defined for a package (collection of objects) Encryption: DCOM network security: „packet privacy„ Authentication is done by DCOM: NTLM Easy way of invoking scripts (DCOM)  Implement a COM object on MTS Read config file identify calling user and check if user is allowed .. Execute script and return standard output 5/13/2019 The DESY WindowsNT Group

The DESY WindowsNT Group Basic Idea 1 Store all script on the tranaction server (MTS) moveuser.pl setpasswd.vbs movehome.pl Edit config file: xml format 2 Alias Name Script location Role Pass calling user MoveUser Perl.exe moveuser.pl User Support No Passwd Cscript.exe setpasswd.vbs MoveHomedir Perl.exe movehome.pl Domain Operator 5/13/2019 The DESY WindowsNT Group

The DESY WindowsNT Group Basic Idea (cont.) 3 Define Roles on Transaction Server User Support: desynt\usg desynt\Domain Admins Domain Operators: desynt\Domain Admins desynt\operators User Support Domain Operators 5/13/2019 The DESY WindowsNT Group

The DESY WindowsNT Group Basic Idea (cont.) Set obj = CreateObject(„DSH.ExecuteSync“) obj.InvokeScript(„Passwd“, „user1 newpassword“) Alias Name Script location Role Pass calling user MoveUser Perl.exe moveuser.pl User Support No Passwd Cscript.exe setpasswd.vbs MoveHomedir Perl.exe movehome.pl Domain Operator COM object Client / Web Server execute script User Support Domain Operators Tranaction Server 5/13/2019 The DESY WindowsNT Group

Implementation COM object COM object Client / Web Server Load config file by MS XML provider COM object on MTS: Impersonation „GetOriginalCallerID“ from ISecurityContext DCOM: Network: „packet privacy“ Authentication: NTLM Alias Name Script location Role Pass calling user MoveUser Perl.exe moveuser.pl User Support No Passwd Cscript.exe setpasswd.vbs MoveHomedir Perl.exe movehome.pl Domain Operator COM object COM object Client / Web Server User Support Domain Operators IObjectContext interface provides „IsCallerInRole“ method Execute script redirect standard output to pipe Log activity Tranaction Server 5/13/2019 The DESY WindowsNT Group

The DESY WindowsNT Group Example store script on MTS define role on MTS configure config file Alias name Script location Role ActiveX control makes changes in configuration file write client script / Web interface (ASP) Example: write script / configure server / write client script / call script 5/13/2019 The DESY WindowsNT Group

Conditional execution Problem: allow execution only if some conditions are valid Group administrators are only allowed to set the password of their users, not of all users Group adminis can remove their computers from the domain Could be done within the script Execute „Passwd“, „user1 newpassword“ only if calling user is allowed to manage „user1“ Condition table defines relationship between calling user and managed object Defines which management groups are permitted to manage which kind of users, computers or groups 5/13/2019 The DESY WindowsNT Group

Management definition table Check if „Calling User“ is in management group and the argument is in a group which is managed Calling User Argument of type „user“ Management groups Groups to manage Group1adm Group2adm Group3adm Domain Admins Group1 Group2 Group3 * 5/13/2019 The DESY WindowsNT Group

The DESY WindowsNT Group Set obj = CreateObject(„DSH.ExecuteSync“) obj.InvokeScript(„Passwd“, „user1 newpassword“) Who is calling ? COM object Calling User Argument Management groups Groups to manage Group1adm Group2adm Group3adm Domain Admins Group1 Group2 Group3 * 5/13/2019 The DESY WindowsNT Group

The DESY WindowsNT Group Config File Extension Alias Name Script location Role Pass calling user Arg. to check Arg. type Passwd Cscript.exe setpasswd.vbs User Support No 1 User Types of arguments: COMPUTERS USERS GROUPS 5/13/2019 The DESY WindowsNT Group

The DESY WindowsNT Group Summary Script can be stored and executed on the „Scripting Server“ (within Domain Administrator rights) Define by „role“ who is permitted to launch the scripts Conditional execution: a table defines relationship between calling user and managed object Configuration settings can be managed by ActiveX component Example: configure condition 5/13/2019 The DESY WindowsNT Group

Asynchronous Execution Some scripts take a long time to finish Move homedirectory, archive user data Web server has timeout interval for ASP pages The user cannot see, if script was executed successfully Asynchronous execution submitting a script execution request, method returns an ID Check status of the execution by ID In queue / currently executed / finished Notification after execution has finished 5/13/2019 The DESY WindowsNT Group

Implementation: MSMQ (Message Queue Server) execution request currently executed finished transaction server Set obj = CreateObject(„DSH.ExecuteAync“) obj.InvokeScript(„Passwd“, „user1 newpassword“, „user@desy.de“, „some text for the body“) 5/13/2019 The DESY WindowsNT Group

Event Driven Execution Query computer for special properties Problem: script fails if computer is not online Hold script in queue and launch script only if event occurs Events: „computer is online“, „time is reached“, ... Other requirements: retry execution on error define a time range until execution request will be dropped notification by email 5/13/2019 The DESY WindowsNT Group

The DESY WindowsNT Group Implementation: MSMQ check event: „computer is online“ execution request currently executed finished transaction server 5/13/2019 The DESY WindowsNT Group

The DESY WindowsNT Group Example Web based domain management 5/13/2019 The DESY WindowsNT Group