How to allow VB scripts to run on an admin account

Question

I'm encountering an issue with the VBscripts while I try to run them. I'm working on Windows 8.1 update 1 Enterprise, connected to an Enterprise domain, and I'm logged with a domain account. This domain account has been added to the Administrators group.

My VBscript must create a folder and a log file into the Program Files (x86) directory. If I run this VBscript by double-clicking on it with the local administrator account, it works perfectly. But if I try to run the same VBscript with my domain account, I get the error message Access denied.

One solution is to totally deactivate the UAC (with the enableLUA registry value set to 1), but this method blocks the Modern UI applications, and we need to keep these applications execution.

Is it possible to grant the full control to VBScripts execution on any admin account, like it is the case under the local administrator built-in account ? I didn't yet find any solution to this problem, and I can't believe that no solution exists, especially in enterprise.

Solution

the way I normally do this is to stick the following code at the top of my script:

If Not WScript.Arguments.Named.Exists("elevate") Then
  CreateObject("Shell.Application").ShellExecute WScript.FullName _
    , WScript.ScriptFullName & " /elevate", "", "runas", 1
  WScript.Quit
End If

This way, if I launch the VBS as a non admin - it tries to run, notices I'm not an admin and then relaunches - prompting me to run as admin and away we go.

I know its a pain, but its a fairly simple solution.

Hope this helps

Comments

[YannD]

Actually, you can totally deactivate the UAC on Windows 8.1, as I specified in my original post. You must set the notifications to Off, and edit the registry value EnableLUA to 1. But this solution prevent the Modern UI apps execution, and it is not what I want. Moreover, it seems the rights of the local administrator built-in account and the domain account inside the local Administrators group are not the same. Currently, my VBScript only tries to create a folder to C:\Program Files (x86). No other things.

[Ramhound]

I don't use hacks. So if you say that disables UAC then I will trust you. I can promise you that if your domain account is being placed in the local Administrator group then there is no difference between that account and the local Administrator account unless your group permissions took away a permission. Which is the reason I said to figure out which persmission you need to grant to the User group, because a user, really should not always be an Administrator for security reasons.

[Ramhound]

This is the proper solution. The same solution that every other operating system uses. You run a command without using sudo it indicates you need to do that and you then ran the command as the superuser.

[YannD]

This solution can be a good workaround for new scripts we will implement. Currently, we are using VBscripts to install applications, and we have most of them already implemented for Windows 7. Wen we tested them on Windows 8.1, we encountered the issue detailed above. So, I created a small script with only a folder creation, and i didn't work also. It could be a great thing if we don't have to modify all the existing scripts.