Beating SCCM! Software distribution to PC/NB without administration right in interactive mode

Usage and Config SWD
1

Hi team,

Sorry for the emergency call!

My customer current uses MS SCCM 2018 to manage over 100k endpoints, we got an opportunity for BigFix evaluation, they will make the decision this week.
Now I’m facing an SWD requirement, which they use this function in SCCM for years, but I don’t have related experience with it before.

In the customer SWD environment, most endpoints are joined AD domain, without administration right, which mentions doesn’t have software installation right as well.

Over 95% of SWD jobs situation is the interactive mode (not silent installation), the end-users can see the progression of software installation.

Due to the end-users without software installation permission, the SCCM agent will deploy software as the current login user, raise the permission of current user (similar run application as administrator), so the customer can see the pop-up window, input the information they need, then go ahead until the finish.

I used the “runascurrentuser.exe” (no effects, can’t see any pop-up window or processes in tasks) and “override” (can pop-up the software welcome window to the current user desktop but immediately appearing the administrator authentication request dialog) functions, still can’t do what SCCM did.

The testing will be closed on Friday, please kindly help us.
Any comment is welcome!

Thank you so much!

Tim

2

This is possible with BigFix.

Please see the override actionscript command and note in particular the following options:

RunAs=localuser
user={name of current user}
password=impersonate
asadmin=interactive

See also this recent post as reference: Show Program messages when run as system

2 Likes
3

Actually, I’m not sure my statement above is necessarily correct. Let me confirm and follow up…

4

I tried the following and it seems to address your scenario:

override wait
runas=localuser
completion=job
password=system
user={name of current user}

user currently logged on my machine does not have admin permission but I was able to interactively install a sw.

When creating the task from Software Distribution dashboard I used the following settings:

image

If no user is logged on I think that the task will fail, so I would add a relevance that check if a user is logged on.

3 Likes