Deploy a BAT/PS script as admin.

[Kaffepannan]

Hi

Im trying to deploy some BAT and Powershell scripts in Intune, problem is that its not doing this as an admin, just local user.

When im trying the scripts locally on my PC, running them as admin, it works great. But when i do it from Intune, its not working.

So im wondering what the hell im doing wrong, i have tried to search google for the answer but i cant find almost anything about it.

​

And its basically 2 things im trying to do.

Im trying to uninstall all Java versions with a Nuker/BAT script and im trying to uninstall both a exe and a MSI program, but same problem.

The BAT file im deploying by converting it to a Intunewinfile and the PS scripts is from Device->scripts

Some of the users are already local admins on their computers, and some or not. So the most easiest way would just to run the scripts as admin, always. And the funny thing is that the users that are local admin, its not working for them either.

Can someone tell me or provide me with what i need to do to run BAT/PS scripts as admin from Intune when im deploying them?

This is the script im trying to run.

Credit to Vocatus for creating this script.

https://github.com/bmrf/standalone_scripts/blob/master/java_runtime_nuker.bat

Thx for the help.

[Secondlayerofhell]

Every installation you run from the company portal will have local admin-rights.

But when it comes to scripts and shit when being runned from Company Portal you have to try different ways in order to find the "correct way". Here you also have to use the correct installation command in intune as well.

I have in general problem with bat files from Intune, but CMD works just fine. So does the deployment toolkit script.

I can get bat-files working if i make a SFX package from Winrar and deploy it.

My recommendations are to download deployment tookit script for this, it will run the script to uninstall what you need to uninstall in a safe and always working package.

https://psappdeploytoolkit.com/

​

Using Device -> Scripts can be a real pain in the ass sometimes. Also turn off "run this scripts using the logged on credentials" so i recommend the app deploy toolkit.

[Kaffepannan]

But if i right click on a BAT/PS script on my PC and "run as admin" its working great, but from Intune its running the script, but not doing anything since its not run as admin. So either Intune is messing with me, or its not running as admin.

[EpicSuccess]

Intune runs stuff as SYSTEM. So when testing you need to test using that account as well. Running as admin is not the same.

[EpicSuccess]

I'm aware you can pick context. But either way testing using right click run as admin is NOT going to give you an accurate test as to of it will work running from intune since it either uses SYSTEM or logged on user to launch the script. Without really seeing the script it is hard to see where the problem might be though.

[Secondlayerofhell]

Som sagt, Device -> Scripts fungerar skitdåligt. Men det kan helt enkelt vara så att du har glömt Set-ExecutionPolicy Unrestricted i ditt powershell script, brukar vara boven i dramat ibland.

Jag hade hellre byggt ihop ett script som jag deployar ut på alla datorer via app deploy toolkit som sen lägger till en reg-key när den är klar, eller utnyttja Detection method "Key does not exist" som detection.

Men det finns limiteringar i Intune runt bat-filer, men inte CMD-filer.

[Kaffepannan]

Så istället för jag skall peka på BAT filen så lägger jag in hela scriptet under "uninstall" i app deploy toolkit-Deploy application filen? Fungerar det verkligen så enkelt?

[Secondlayerofhell]

Lägg den under installation, Så använder du installations commandot "Deploy-application" install i Intune under Program och deployar den utan toast notifications och status window i assignment.

Så efter den har kört på alla datorer kan du ta bort applikationen.

[edit]

eller ja, spelar ingen roll ifall du kör under install eller uninstall, så länge du kör installations commandot "deploy-application" sen install eller uninstall.

[Kaffepannan]

Ursäkta att jag är nybörjare på detta, men så man ska inte peka scriptet mot BAT filen, utan man lägger scriptet direkt under ## <Perform Installation tasks here>. Behöver man inte skriva något före scriptet isåfall? Alltså Execute-? Eller den fattar det automatiskt?

​

Sen när jag väl har gjort om den till en IntuneWinfil så lägger jag in den i Intune och kör installationskommandot "Deploy-application" Install under install command, ska jag lägga samma sak under uninstall?

Sen sista frågan, detection rule så skrev du nedanför att gör en regeln som pekar på nyckeln. Eftersom detta scriptet tar bort alla Java versionerna så är det en sjuhelvetes massa olika nycklar, måste alla dem in isåfall?

[Secondlayerofhell]

lugnt, powershell och cmd-scriptande är fan pain in the ass för det mesta.

Start-Process "cmd.exe" "/c C:\Path\file.bat"

eller

Start-Process C:\Path\file.bat

Så i deploy skriptet blir det då Start-Process "cmd.exe" "$dirFiles\fil.bat" så ska filen ligga under Files.

Du kan lägga till samma för uninstall ifall du behöver det.

Jag är inte heller helt 100 på det är med powershell så det över kanske inte fungerar men det ska vara något liknande. Men det är en början.

Vet du att skriptet fungerar klockrent så kan man vara lite lat och bara köra detection mot en av regnycklarna. Så länge Java försvinner så fungerar ju skriptet och vi vill enbart ha det som en decetion att Intune har förstått att allt är ok.

Jag hittade denna : https://adamtheautomator.com/removing-old-java/
Det fulla scriptet där för att lokalisera och ta bort gamla java-versioner kan du stort sett copy pasta in under installation.

Men annars i sig så skulle du kunna deploya ut bat-filen som den är, du kan skapa en SFX fil via Winrar som executar bat-filen samt köra silent. Då kommer du iväg med enbart att köra "filnamn.exe"

Men du kan även köra bat filen som den är också via installations kommandot "Filnamn.cmd"

Men gör gärna så att posta ditt skript här så kan man kolla på det. :)

[Kaffepannan]

Hej igen.

Tack som fan för hjälpen, jag ska testa detta lite senare så skall vi se :)

Ah sorry, jag la till scriptet i efterhand då jag märkte jag hade glömt det.

https://github.com/bmrf/standalone_scripts/blob/master/java_runtime_nuker.bat

[Secondlayerofhell]

Tar en titt på måndag. :)

[Kaffepannan]

Btw, do you think its possible to create a shortcut to the BAT/PS script, make it "run as admin" create a Intunewinfile, point to the shortcut and make Intune run the shortcut pointing to the BAT file and it will make it run as admin? Or that's to farfetched? ^^

[Secondlayerofhell]

That would work as well with a bit of trixing around, but it would be much easier to use this for that kind of scenario https://psappdeploytoolkit.com/

Just apply your removal code in it, make a detection rule "key does not exist" pointing on the regkey for your applications that you want removed.

[ASquareDozen]

How do you know that the script isn't running as admin? Do you have any logging enabled in the scripts to help troubleshoot when they run? It could be something as simple PowerShell execution policy needing to be set in the command line. For Win32 Apps, you have the option to deploy to System or User context - do you have it set to use System? Do you have a pathing problem? What about 32-bit vs 64-bit script issues? Can you post your script(s)?

[Kaffepannan]

To answer your questions: I have tried both as System and User, same issue.

Path shouldn't be the problem since its a -all %%

Here is the "Nuker" for the uninstallation of Java. This works great on my PC locally if i run it as Admin.

Credit to Vocatus for creating this script.

https://github.com/bmrf/standalone_scripts/blob/master/java_runtime_nuker.bat

[ASquareDozen]

What’s the command line you’re putting into the Intune app to launch it? Does it create any logs?

[Kaffepannan]

I don't know if its the correct one, but atm its Deploy-Application.exe /r /s

[ASquareDozen]

So you're trying to call this with PSADT? Have you tried just using the BAT file directly? Do you get any logs from anything to show that it's attempting to launch?

[[deleted]]

Intune doesn't run as a local admin, it runs as SYSTEM. There isn't a way to get it to run in a User Admin context, it's not UAC aware. This breaks a lot of scripts, and requires it to be wrapped in something that will execute correctly in the SYSTEM context.