2

In a large Enterprise Windows Environment. What do IT people do to login as a user if needed? It seems impossible to me to keep user passwords in a large environment. In a Mac environment, you have the option to masquerade as a user and login using the admin credentials.

What do large Windows Environments do when it's necessary to login as the user?

Untalented
  • 323
  • 1
  • 4
  • 14

2 Answers2

1

This feature is not included in Windows server to my knowledge. It would be a security issue. What are you trying to do that would require acting as the user, perhaps we could assist with that?

Daniel Agans
  • 229
  • 1
  • 4
  • Basically I need to log-in as a user once when setting up their profile in a new TS/XenApp farm. There are a few config items I need to do, which I can't rely on the user to do and I can't script out the config. – Untalented Oct 22 '12 at 19:05
  • 1. Ask the user for their password, explaining to them why you need it. 2. Log in as the user and make the neccessary changes, then logout. 3. Force user to change their password on the next logon. 4. Done. – joeqwerty Oct 22 '12 at 19:29
  • This is basically what I do. I'm just curious what a large Enterprise environment would do in this case if something different. – Untalented Oct 22 '12 at 20:36
  • In a large environment you'd script it, there's not much that can't somehow be scripted or customized at the profile level – Daniel Agans Oct 24 '12 at 16:40
  • it's the 'not much' that needs this question answered. – UpTide Feb 13 '17 at 18:02
0

You can do this with Group Policy. This is what you will need to do

1. Setup a Startup Script

1a. In your script, you will create a new directory on the local drive or create a registry entry (with reg add)
1b. On startup, you will check to see if this directory/registry entry exists on the local PC. If it does, you skip it.

2. Your script would have to copy the necessary files (robocopy, or you can use PowerShell or VBScript) to copy the files to the necessary location.

I read that you can't script out the config. You should be able to manage this with Group Policy. Enterprise apps like XenApp have GPO's that are designed to allow you to do this specific task. You can then apply the policy to a group of users or specific users. However if you do not have access to Group Policy then you can get creative by doing the following

On a good known working machine (preferably one that has recently been imaged and all updates applied) and then use software to capture the before and after state and export the results as a registry entry. There are several tools to assist you with this but I won't recommend one over the other.

Asking the user for their password should never be done once the person has started working. If the person is about to start, you can assign the password and take all the necessary steps then use AD to force the user to change the password upon login.

JavaScripter007
  • 11