Trying out new 9.5.5 "Run As Specified User" capability

[fermt]

@steve

Added “Run As Specified User” capability: Allows execution of actions as a particular user for software installations, machine registration, etc.

Where is the documentation for this new feature?

---

Originally posted here: BigFix 9.5 Patch 5 is now available - #5 by steini44

[Waldemar]

That is a good question!!

[Aram]

Please see the ‘runas=localuser’ override option: https://developer.bigfix.com/action-script/reference/execution/override.html

[steini44]

RunAs=localuser specifies a user different from the logged on user.

user=<username> or {relevance to describe the username} where the username specified must be either local or listed in local accounts.

So from the documentation, this is not possible with domain accounts? You need to create a local user first with Administrator rights (because I think this will be most of the time the case why we want a “specified user” to run an action → Admin on the pc, but not system account)? Or if they are in a Group on the computer (like Administrator Group or User group), will that be ok too?

Can you clarify please?

[Aram]

I believe you should be able to specify a domain user using the following format: user@domain.com (but I will test to verify).

[steini44]

Ok, perfect. I’ll test also tomorrow in my test environment.

Thanks!

[AlanM]

That was the intent with the feature that domain accounts should be usable. What was your testing able to show?

[steini44]

@AlanM, @Aram

@Aram

user@domain.com

I’ve looked into it last real quick last week, but didn’t get it to work.

I’ve tried the following:

But in the log I have following error:

Command failed (Override value is unknown for this keyword.) override RunAs=localuser (action:8088)

I’v also tried RunAs=user@domain.com, but same error… (except that =localuser is changed by user@domain.com in the error)

Is there an example available on how to use it?

[akira]

The message seem to indicate the value “localuser” for keyword RunAs is not recognized. Are you sure you are using 9.5.5?

Also, I believe keyword Password is required for Windows. (When I ran the same override with 9.5.5.193 FixletDebbuger, I got the message “RunAsLocalUser in Windows requires the keyword 'password' to be speicifed.”)

[steini44]

Hi @akira

Can you post that part of your script? Maybe i’m missing something…

[akira]

The version that matters is the version of Agent, not Console.
From 9.5.5.193 Agent, I got following in the log:

At 17:53:09 +0900 - actionsite (http://mycompany.test.local:52311/cgi-bin/bfgathe
r.exe/actionsite)
   Command succeeded override wait (action:40)
   Command succeeded override hidden=true (action:40)
   Command succeeded override RunAs=localuser (action:40)
   Command succeeded override user=aaa@bbb (action:40)
   Command succeeded override completion=job (action:40)
   Command failed (RunAsLocalUser in Windows requires the keyword 'password' to be specified.) wait test.bat (action:40)

[steini44]

@akira

Yes, ofcourse… didn’t think of that, didn’t upgrade the agent yet

edit: is there no upgrade fixlet for the client? latest I see is 9.5.4?

I can see client deployment tool 9.5.5, but isn’t there one for the client?

[akira]

Hi @steini44
Unfortunately 9.5.5 client is not available right now but hopefully available again soon. Please check following thread:

BigFix 9.5 Patch 5 Agent Inspector Issue

The IBM BigFix team has identified an issue affecting a specific inspector with v9.5.5.193 Agents. As a result, IBM is temporarily removing the v9.5.5.193 Agent upgrade Fixlets from BES Support while investigating the full scope of the issue and working to address the situation. Please standby as we expect to follow up with more details and a resolution early next week. Affected Products and Versions BigFix Agents v9.5.5.193 (all platforms except Mac OS X) Unaffected Products and Versions …

[steini44]

Thanks for the update, missed that one i’ll install the client manually for my test machine, i’ll let you know if it works.

[steini44]

The agent update worked and it can read, but I still have an error:

   Command failed (LogonUser() failed) wait (action:8094)

This is my action:

I’ve tried following things for user:
user=user@domain.com
user=user
user=Domain\user

But no luck… Any idea?

[akira]

Somehow I thought domain account is supported, but I realized that https://developer.bigfix.com/action-script/reference/execution/override.html says "username specified must be either local or listed in local accounts."
So I suppose domain account is not supported.

[steini44]

@steini44

RunAs=localuser specifies a user different from the logged on user.
user=<username> or {relevance to describe the username} where the username specified must be either local or listed in local accounts.

So from the documentation, this is not possible with domain accounts? You need to create a local user first with Administrator rights (because I think this will be most of the time the case why we want a “specified user” to run an action –> Admin on the pc, but not system account)? Or if they are in a Group on the computer (like Administrator Group or User group), will that be ok too?

Can you clarify please?

Well, that was my original question

[AlanM]

The domain account should be supported but the statement should reflect that the user needs to have logged onto the machine at some point. So if the domain user has never logged onto the endpoint it wouldn’t have a registry hive local to the machine.

[steini44]

Hmmm… Then that’s not very handy, is it? So even if I’m creating a service account for software deployment, that would mean that I need to log in on 18k devices first so that I can use that account? Are there any plans to change this so that it just looks in the Local Groups (like Administrator) and see if it’s there?

[DavidWFranklin]

@steve

Added “Run As Specified User” capability:

Where will I find documentation of the “Run As Specified User” capability? Site search and Google search have failed me.

Sincerely,

David