Windows Service Security Descriptors

Project:  Windows Service Security Descriptors

Overview:  A project aimed at tracking and mitigating the vulnerabilities in ACLs on Windows services in your network.

Requirements:

1. Windows Clients - Windows Vista+
2. Microsoft SMS/SCCM 2003+

Why Should I Care?:

1. Windows services run with the NT Authority\System account, unless otherwise specified.
2. The application of Windows service ACLs is left up to the vendor who installs the service.
3. Many Windows services (especially driver services) are poorly written so that the service allows Everyone, Full Control access.
4. The exploitation of vulnerable service ACLs is very common part of a hacker's escalation path in your network.

In a nutshell, any normal user account that is on a system with this vulernable ACL on a service can very easily elevate their credentials to that of a local Administrator.  This is a key part of the escalation path because once a hacker has local Administrator access, they can run/install any program they want on a system to start stealing domain-level user credentials.

Scope:

This project is nothing more than addressing one facet of a single part of a hacker's entire escalation path.  Some might argue that this is more effort than its worth and depending on your network's security requirements, and for some, it absolutely is.  However, if your goal is a high security environment or you simply want to prevent a hacker from penetrating your network by any and all means, this information would be of interest to you.

How it Works:

1. Host
• A script runs on each host that queries the Windows services for ACL information.  The data is filtered, formatted, and then written to a custom WMI namespace and class.  The SMS/SCCM client accounts for the new class and sends the data up to the SMS/SCCM server with the frequency of its own hardware inventory.
2. SMS/SCCM Server
• The SMS_DEF.MOF file must be updated to tell the SCCM clients to start accounting for the new WMI class in the new namespace. 

Now that the information is being aggregated by the SMS/SCCM client natively, you can leverage SMS/SCCM collections, reports, advertisements, etc. to:

1. Provide reports on vulnerable services in your network.
2. Create collections of "like" services with the same vulnerability.
3. Use advertisements to fix vulnerable services throughout your network in a targetted way. 

Installation Aspects:

1. Security_Descriptor_Service_WMI.vbs
• This script creates a custom WMI namespace and class and then populates that namespace and class with the data from the vulnerable services on the host.  This script should run at system startup or through an SCCM package.  I'd highly recommend the SCCM package over a startup script because of the integrated ability to enforce that the script runs and it runs with any kind of frequency.  A startup script requires the machine be rebooted before it will run.
2. SMS_DEF.MOF Modifications
• Append the mof file definitions to this file so the SMS/SCCM clients will start aggregating this information up to the SMS/SCCM database.  If you have multiple site servers, these changes must be done to each SMS_DEF.MOF file on each server.

Example Report:

VBScript Function: Split a string, character by character

Custom function to give VBS the ability to split a string, character by character.



Function SplitByCharacter(strString)
 Dim arrTemp()
 iLen = Len(strString)-1
 redim arrTemp(iLen)
 For iCounter = 0 to iLen
  arrTemp(iCounter) = Mid(strString, iCounter + 1,1)
 Next

 SplitByCharacter = arrTemp
End Function

SCCM/SMS Client Uninstall Script

Forgive the sloppy code but I'm just posting this in response to a post on TechNet in regards to someone trying to mass uninstall the SCCM client.

This script was hastily/sloppily written to address a major problem we had migrating from SMS 2003 to SCCM 2007 where the clients didn't like being reassinged to a new site. The fix action ended up being a myraid of things:

1. Hung 'ccmexec' service due to the process not terminating
2. The uninstall didn't fully complete
3. Duplicate GUID problems
4. ...etc

You may have to change some parts around:

On Error Resume Next

Set objShell = CreateObject("WScript.Shell")
Set objFSO = CreateObject("Scripting.FileSystemObject")

strOutputFile = "CCMOutputFile.txt"
strComputerFile = "computers.txt"
strSMSCfgFile = "c$\Windows\smscfg.ini"
strSMSDelCertString = "c:\temp\ccmdelcert.exe"
strSMSUninstallString = "c:\windows\system32\ccmsetup\ccmsetup.exe /uninstall"
strSMSCleanString = "c:\temp\ccmclean.exe /all /q"
strSCCMServer = "SCCMSERVERNAME"
strSMSServiceName = "ccmexec"

iComputersSuccess = 0
iComputersOffline = 0
iComputersTotal = 0



arrComputers = Split(getTextFile(strComputerFile), vbCrLf)

If IsArray(arrComputers) Then
 For Each strComputer In arrComputers
  strComputer = Trim(strComputer)
  If strComputer <> "" Then 
   WScript.Echo "Pinging " & strComputer & " to see if it is online."
   If Ping(strComputer) Then
    WScript.Echo "Binding to " & strComputer & " via WMI."
    Set objWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
    If Err.Number <> 0 Then
     displayError("Binding error to WMI on:  " & strComputer)
     Err.Clear
    End If
    
    If Not objWMI Is Nothing Then
    
     WScript.Echo "Copying pertinent files to c:\temp"
     If Not objFSO.FileExists("\\" & strComputer & "\c$\" & strSMSUninstallString) Then
      objFSO.CopyFile "\\" & strSCCMServer & "\SCCM Client Tools\*", "\\" & strComputer & "\c$\temp\", true
     End If
     
     killProcess strComputer, "ccmexec.exe"

     Set objWMIProcess = GetObject("winmgmts:\\" & strComputer & "\root\cimv2:Win32_Process") 
     
     WScript.Echo "Running delcert process on remote host."
     If objFSO.FileExists("\\" & strComputer & "\c$\temp\ccmdelcert.exe") Then
      spawnProcess strComputer, strSMSDelCertString
     Else
      WScript.Echo "Unable to locate delcert executable for execution."
     End If
     
     WScript.Echo "Running ccmsetup /uninstall process on remote host."
     If objFSO.FileExists("\\" & strComputer & "\c$\windows\system32\ccmsetup\ccmsetup.exe") Then
      spawnProcess strComputer, strSMSUninstallString
     Else
      WScript.Echo "Unable to locate ccmsetup executable for execution."
     End If
     
     WScript.Echo "Running ccmclean process on remote host."
     If objFSO.FileExists("\\" & strComputer & "\c$\temp\ccmclean.exe") Then
      spawnProcess strComputer, strSMSCleanString
     Else
      WScript.Echo "Unable to locate ccmclean executable for execution."
     End If
           
     iComputersSuccess = iComputersSuccess + 1
    Else    
     WScript.Echo "Error binding to WMI using the syntax:  winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2"
    End If
   Else
    iComputersOffline = iComputersOffline + 1
   End If
   iComputersTotal = iComputersTotal + 1
  End If
  If iComputersTotal Mod 5 = 0 Then
   WScript.Echo ""
   WScript.Echo "STATUS UPDATE:"
   WScript.Echo vbTab & "Hosts Successfully Uninstalled:  " & iComputersSuccess
   WScript.Echo vbTab & "Hosts Offline:  " & iComputersOffline
   WScript.Echo vbTab & "Total Hosts Evaluated:  " & iComputersTotal
   WScript.Echo ""
  Else
   WScript.Echo ""
  End If
 Next
End If



' ***********************************************************************************

Sub displayError(strMessage)
    'Display custom message and information from VBScript Err object.

    strError = VbCrLf & "ERROR:  " & strMessage & VbCrLf & _
      "Number (dec) : " & Err.Number & VbCrLf & _
      "Number (hex) : &H" & Hex(Err.Number) & VbCrLf & _
      "Description  : " & Err.Description & VbCrLf & _
      "Source       : " & Err.Source
    Err.Clear
    WScript.Echo strError

End Sub

Function Ping(strComputer)
 Dim objPing, strPing

 Set objPing = objShell.Exec("ping -n 1 -w 2000 " & strComputer & "")
 
 strPing = objPing.StdOut.ReadAll()
 
 If Instr(strPing, "Reply") <> 0 Then
  Ping = True
 Else
  Ping = False
 End If
End Function


Function getTextFile(strFilePath)
 If Not objFSO.FileExists(strFilePath) Then
  WScript.Echo "Could not locate text file:  " & strFilePath
  WScript.Quit
 End If
 
 Set objTextFile = objFSO.OpenTextFile(strFilePath, 1)
 strTemp = objTextFile.ReadAll
 objTextFile.Close
 
 getTextFile = strTemp
End Function

Sub killProcess(strComputer, strProcess)
 Set objSWbemLocator = CreateObject("WbemScripting.SWbemLocator") 
 objSWbemLocator.Security_.privileges.addasstring "sedebugprivilege", true
 Set objWMIService = objSWbemLocator.ConnectServer(strComputer, "root\CIMV2")
 Set colProcesses = objWMIService.ExecQuery("Select * From Win32_Process Where Name = '" & strProcess & "'")
 
 If colProcesses.Count = 0 Then
  log("Process not found to be running:  " & strProcess & vbCrLf)
 ElseIf colProcesses.Count > 0 Then
  For Each objProcess in colProcesses
   intReturn = objProcess.Terminate()
   log("Attempting to kill process (" & strProcess & ") returned error code:  " & intReturn & vbCrLf)
  Next
 Else
  log(".Count method returned an unexpected value while attempting to kill:  " & strProcess & vbCrLf)
 End If
End Sub

Sub spawnProcess(strComputer, strExec)
 intReturn = objWMIProcess.Create(strExec)
 Select Case intReturn
  Case 0 WScript.Echo "Process creation was a success"
  Case 2 WScript.Echo "Process creation returned Access Denied"
  Case 3 WScript.Echo "There were insufficient priviledges to complete the process"
  Case 8 WScript.Echo "Unknown failure"
  Case 9 WScript.Echo "Path not found"
  Case 21 WScript.Echo "Invalid Parameter"
  Case Else WScript.Echo "Process creation returned an unrecognized parameter"
 End Select
End Sub

SCCM 2007 User/Group Rights Distribution

Example of SetPermissions.txt:

# Permissions based off available 'ClassPermissions' Property in the SMS_UserClassPermissions Class found here:  http://msdn.microsoft.com/en-us/library/cc143194.aspx
# Example Syntax:
#  Class;[ObjectName;]domain\[user|group][;Permission1[,Permission2,Permission3]]
#
# Example 1 - Sets all permissions to all classes for the specified user/group:
#   CLASS_ALL;contoso\Contoso SCCM Administrators
#
# Example 2 - Setting Specific class permissions:
#  Advertisement;contoso\Contoso SCCM Administrators;READ&MODIFY&DELETE&ADMINISTER&CREATE
#  Collection;contoso\Contoso SMS Site Administrators;READ&MODIFY&DELETE&REMOTE_CONTROL&ADVERTISE&MODIFY_RESOURCE&ADMINISTER&CREATE&VIEW_COLL_FILE&READ_RESOURCE&MODIFYCOLLECTIONSETTING&MANAGEBMC&VIEWBMC
#  MeteredProductRule;contoso\Contoso SMS Site Administrators;READ
#
# Example 3 - Instance specific permissions:
#  This section is out-of-date.  At the writing of this document, the source script has changed.  Please visit http://pleasepressanykey.blogspot.com/2011/04/vbscript-set-permissons-on-configmgr.html for the latest version of the instance-specific permissions for more information.

Script:

' ********************************************************************************
'
' Author:  Cameron Wilson (aka thepip3r)
' Date:   4/15/2011
' Credit:  Original script development and import format taken and adapted from Jonas Hettich's script for setting instance-specific permissions (4/15/2011)
'    http://pleasepressanykey.blogspot.com/2011/04/vbscript-set-permissons-on-configmgr.html
' Description: Jonas's script is designed around setting instance-specific permissions.   At my location, we almost exclusively set class-level permissions only so
'    this version of the script goes through and sets class-level permissions.  Other deviations from Jonas's script are some variable spelling and naming
'    consistency changes, the inclusion of all Class objects and all possible permissions as constants for use, and also some custom work that allows you
'    to just specify a class name and the script assigns all available rights off of a static assignment.
' 
' ********************************************************************************



Dim strChosenPermissions  
Dim strSiteServer : strSiteServer = ""  
Dim strSitecode : strSitecode = ""  
Dim objSWbemLocator : Set objSWbemLocator = CreateObject("WbemScripting.SWbemLocator")  
Dim objSWbemServices : Set objSWbemServices = objSWbemLocator.ConnectServer(strSiteServer,"root/sms/site_" & strSitecode)  
  
Dim objFSO : Set objFSO = CreateObject("Scripting.FileSystemObject")  
Dim objFile : Set objFile = objFSO.OpenTextFile("SetPermissions.txt")  
Dim strCurrentLine  
Dim strObjectsType, strObjectName, strUser, strPermissions  

' Class Permission Constants
Const CP_READ      = 1
Const CP_MODIFY      = 2
Const CP_DELETE      = 4
Const CP_DISTRIBUTE     = 8
' Class Permission 16 is NOT used
Const CP_REMOTE_CONTROL    = 32
Const CP_ADVERTISE     = 64
Const CP_MODIFY_RESOURCE   = 128
Const CP_ADMINISTER     = 256
Const CP_DELETE_RESOURCE   = 512
Const CP_CREATE      = 1024
Const CP_VIEW_COLL_FILE    = 2056
Const CP_READ_RESOURCE    = 4096
Const CP_DELEGATE     = 8192
Const CP_METER      = 16384
Const CP_MANAGESQLCOMMAND   = 32768
Const CP_MANAGESTATUSFILTER   = 65536
Const CP_MANAGEFOLDER    = 131072
Const CP_NETWORKACCESS    = 262144
Const CP_IMPORTMACHINE    = 524288
Const CP_CREATETSMEDIA    = 1048576
Const CP_MODIFYCOLLECTIONSETTING = 2097152
Const CP_MANAGEOSDCERTIFICATE  = 4194304
Const CP_RECOVERUSERSTATE   = 8388608
Const CP_MANAGEBMC     = 16777216
Const CP_VIEWBMC     = 33554432
Const CP_MANAGEAI     = 67108864
Const CP_VIEWAI      = 134217728

' Class Constants
Const C_COLLECTION      = 1  ' ConfigMgr DisplayName:  'Collection'
Const C_PACKAGE       = 2  ' ConfigMgr DisplayName:  'Package'
Const C_ADVERTISEMENT     = 3  ' ConfigMgr DisplayName:  'Advertisement'
Const C_STATUSMESSAGE     = 4  ' ConfigMgr DisplayName:  'Status message'
' Class ID 5 NOT USED
Const C_SITE       = 6  ' ConfigMgr DisplayName:  'Site'
Const C_QUERY       = 7  ' ConfigMgr DisplayName:  'Query'
Const C_REPORT       = 8  ' ConfigMgr DisplayName:  'Report'
Const C_METEREDPRODUCTRULE    = 9  ' ConfigMgr DisplayName:  'Software metering rule'
Const C_APPLICABLEUPDATESSUMMARYEX  = 10 ' ConfigMgr DisplayName:  'Applicable updates summary' 
Const C_CONFIGURATIONITEM    = 11 ' ConfigMgr DisplayName:  'Configuration items'
' Class ID 12 Omitted
' Class ID 13 Omitted
Const C_OPERATINGSYSTEMINSTALLPACKAGE = 14 ' ConfigMgr DisplayName:  'OS install package'
Const C_TEMPLATE      = 15 ' ConfigMgr DisplayName:  'Deployment template'
Const C_UPDATESASSIGNMENT    = 16 ' ConfigMgr DisplayName:  'Deployment'
Const C_STATEMIGRATION     = 17 ' ConfigMgr DisplayName:  'Computer association'
Const C_IMAGEPACKAGE     = 18 ' ConfigMgr DisplayName:  'OS image'
Const C_BOOTIMAGEPACKAGE    = 19 ' ConfigMgr DisplayName:  'Boot image package'
Const C_TASKSEQUENCEPACKAGE    = 20 ' ConfigMgr DisplayName:  'Task sequence package'
Const C_DEVICESETTINGPACKAGE   = 21 ' ConfigMgr DisplayName:  'Device setting package'
Const C_DEVICESETTINGITEM    = 22 ' ConfigMgr DisplayName:  'Device setting item'
Const C_DRIVERPACKAGE     = 23 ' ConfigMgr DisplayName:  'Driver Package'
Const C_SOFTWAREUDPATESPACKAGE   = 24 ' ConfigMgr DisplayName:  'Deployment package'
Const C_DRIVER       = 25 ' ConfigMgr DisplayName:  ?





' Begin Code Execution
 
 WScript.Echo "Site Server:  " & strSiteServer 
 
'Loop the Source File  
Do While not objFile.AtEndOfStream  
 strCurrentLine = objFile.ReadLine  

 'Skip Comment and Blank lines  
 If strCurrentLine <> "" Then  
  If Not Left(strCurrentLine,1) = "#" Then  
   'Parse the information  
   arrLine = Split(strCurrentLine,";")
   
   If Ubound(arrLine) = 1 Then ' Check for 2 arguments, if so, assume set all class permissions on user/group
    ' Set Class Permissions
    WSCript.Echo "Found Custom-Level ALL Definition... Executing"
    strObjectsType = arrLine(0)  
    strUser = arrLine(1)  
    
    Call SetClassRights_All(strUser)
   ElseIf Ubound(arrLine) = 2 Then ' Check for 3 arguments, if so, assume assignment of a class-level permission on user/group
    ' Set Class Permissions
    WSCript.Echo "Found Class-Level Definition... Executing"
    strObjectsType = arrLine(0)  
    strUser = arrLine(1)  
    strPermissions = arrLine(2)
    
    Call SetClassRights(strObjectsType, strUser, strPermissions)
   ElseIf (Ubound(arrLine)) = 3 Then ' Check for 4 arguments, if so, assume assignment of an instance-level permission on an entity for a user/group
    ' Set Instance Permissions
    WSCript.Echo "Found Instance-Level Definition... Executing"
    strObjectsType = arrLine(0)  
    strObjectName = arrLine(1)  
    strUser = arrLine(2)  
    strPermissions = arrLine(3)
    
    Call SetInstanceRights(strObjectsType, strObjectName, strUser, strPermissions)
   Else
    WScript.Echo "An invalid number of parameters have been passed, please check the permissions file for proper formatting."
    WScript.Quit
   End If

     

   'Reset the Permissions for the next action  
   strChosenPermissions = 0  
  End If  
 End If  

Loop  
  
' Grabs the GUID for the instance-level object
' Not modified from Jonas's script except for variable renaming 
Function NameToID(strObjectType,strObjectName)  
 Dim colResuls, objResult  

 Select Case (strObjectType)  
  Case("Collection")  
   Set colResults = objSWbemServices.ExecQuery ("select * from SMS_Collection where Name='" & strObjectName & "'")  
   For Each objResult In colResults  
    NameToID = objResult.CollectionID  
   Next  
  Case("Package")  
   Set colResults = objSWbemServices.ExecQuery ("select * from SMS_Package where Name='" & strObjectName & "'")  
   For Each objResult In colResults  
    NameToID = objResult.PackageID  
   Next  
  Case ("Advertisement")  
   Set colResults = objSWbemServices.ExecQuery ("select * from SMS_Advertisement where AdvertisementName='" & strObjectName & "'")  
   For Each objResult In colResults  
    NameToID = objResult.AdvertisementID  
   Next  
 End Select  
End Function  

' Sets the permissions on the instance-level object
' Not modified from Jonas's script except for variable renaming 
Function SetInstanceRights(strObjectType, strObjectName, strUser, strPermissions)  
 Dim arrPermissions, strPermission  
 Dim strObjectID  
 Dim objUserInstancePermissions  
 SetInstanceRights = False  

 Set objUserInstancePermissions = objSWbemServices.Get("SMS_UserInstancePermissions")  

 'Create UserInstancePermissionsObject  
 Set objNewUserInstancePermissions = objUserInstancePermissions.SpawnInstance_  

 'Set the Object type  
 Select Case (strObjectType)   
  Case "Package"  
   objNewUserInstancePermissions.ObjectKey = 2  
  Case "Advertisement"  
   objNewUserInstancePermissions.ObjectKey = 3  
  Case "Collection"  
   objNewUserInstancePermissions.ObjectKey = 1  
  Case Else  
   WScript.Echo "Objecttype not supported"  
 End Select   


 'Set the Object ID  
 strObjectID = NameToID(strObjectType,strObjectName)  
 If strObjectID <> "" Then   
  objNewUserInstancePermissions.InstanceKey = strObjectID  
 Else  
  WScript.Echo strObjectType & " was not found: " & strObjectName  
  WScript.Quit  
 End if  

 'Set the User or Group  
 objNewUserInstancePermissions.UserName = strUser  

 'Set the Permissions  
 arrPermissions = Split(strPermissions,"&")  
 For Each strPermission In arrPermissions  
  'Parse the Permissions  
  Select Case UCASE(strPermission)  
   Case "READ"  
    strChosenPermissions = strChosenPermissions + 1  
   Case "MODIFY"  
    strChosenPermissions = strChosenPermissions + 2  
   Case "DELETE"  
    strChosenPermissions = strChosenPermissions + 4  
   Case "DISTRIBUTE"  
    strChosenPermissions = strChosenPermissions + 8  
   Case "REMOTE_CONTROL"  
    strChosenPermissions = strChosenPermissions + 32  
   Case "ADVERTISE"  
    strChosenPermissions = strChosenPermissions + 64  
   Case "MODIFY_RESOURCE"  
    strChosenPermissions = strChosenPermissions + 128  
   Case "ADMINISTER"  
    strChosenPermissions = strChosenPermissions + 256  
   Case "DELETE_RESOURCE"  
    strChosenPermissions = strChosenPermissions + 512  
   Case "CREATE"  
    strChosenPermissions = strChosenPermissions + 1024  
   Case "READ_RESOURCE"  
    strChosenPermissions = strChosenPermissions + 4096  
   Case "MODIFYCOLLECTIONSETTING"  
    strChosenPermissions = strChosenPermissions + 2097152  
   Case Else  
    WScript.Echo "Permissions not supported"  
  End Select   
 Next  

 objNewUserInstancePermissions.InstancePermissions = strChosenPermissions  


 'Creating Permissions  
 On Error Resume Next  
 objNewUserInstancePermissions.put_  


 If Err.Number = 0 Then  
  WScript.Echo "Successfully set following Permissions:"  
  WScript.Echo vbTab & " - " & strObjectType  
  WScript.Echo vbTab & " - " & strObjectName  
  WScript.Echo vbTab & " - " & strUser  
  WScript.Echo vbTab & " - " & strPermissions   
 Else  
  WScript.Echo "Error (" &Err.Description  &") when trying to create the object:"  
  WScript.Echo vbTab & " - " & strObjectType  
  WScript.Echo vbTab & " - " & strObjectName  
  WScript.Echo vbTab & " - " & strUser  
  WScript.Echo vbTab & " - " & strPermissions   
 End If  

 Set objNewUserInstancePermissions = Nothing  
End Function  


' Sets permissions on the class level object
Function SetClassRights(strObjectType, strUser, strPermissions)  
 Dim arrPermissions, strPermission  
 Dim strObjectID  
 Dim objUserClassPermissions  
 SetClassRights = False  

 Set objUserClassPermissions = objSWbemServices.Get("SMS_UserClassPermissions")  

 ' Create UserClassPermissionsObject  
 Set objNewUserClassPermissions = objUserClassPermissions.SpawnInstance_  

 ' Set the Object type  
 ' Here we specify all classes for greater script flexibility
 Select Case UCase(strObjectType)   
  Case "COLLECTION"
   objNewUserClassPermissions.ObjectKey = C_COLLECTION  
  Case "PACKAGE"
   objNewUserClassPermissions.ObjectKey = C_PACKAGE  
  Case "ADVERTISEMENT"
   objNewUserClassPermissions.ObjectKey = C_ADVERTISEMENT  
  Case "STATUSMESSAGE"
   objNewUserClassPermissions.ObjectKey = C_STATUSMESSAGE
  Case "SITE"
   objNewUserClassPermissions.ObjectKey = C_SITE
  Case "QUERY"
   objNewUserClassPermissions.ObjectKey = C_QUERY
  Case "REPORT"
   objNewUserClassPermissions.ObjectKey = C_REPORT
  Case "METEREDPRODUCTRULE"
   objNewUserClassPermissions.ObjectKey = C_METEREDPRODUCTRULE
  Case "APPLICABLEUPDATESSUMMARY"
   objNewUserClassPermissions.ObjectKey = C_APPLICABLEUPDATESSUMMARYEX
  Case "CONFIGURATIONITEM"
   objNewUserClassPermissions.ObjectKey = C_CONFIGURATIONITEM
  Case "OPERATINGSYSTEMINSTALLPACKAGE"
   objNewUserClassPermissions.ObjectKey = C_OPERATINGSYSTEMINSTALLPACKAGE
  Case "DEPLOYMENTTEMPLATE"
   objNewUserClassPermissions.ObjectKey = C_TEMPLATE
  Case "UPDATESASSIGNMENT"
   objNewUserClassPermissions.ObjectKey = C_UPDATESASSIGNMENT
  Case "STATEMIGRATION"
   objNewUserClassPermissions.ObjectKey = C_STATEMIGRATION
  Case "IMAGEPACKAGE"
   objNewUserClassPermissions.ObjectKey = C_IMAGEPACKAGE
  Case "BOOTIMAGEPACKAGE"
   objNewUserClassPermissions.ObjectKey = C_BOOTIMAGEPACKAGE
  Case "TASKSEQUENCEPACKAGE"
   objNewUserClassPermissions.ObjectKey = C_TASKSEQUENCEPACKAGE
  Case "DEVICESETTINGPACKAGE"
   objNewUserClassPermissions.ObjectKey = C_DEVICESETTINGPACKAGE
  Case "DEVICESETTINGITEM"
   objNewUserClassPermissions.ObjectKey = C_DEVICESETTINGITEM
  Case "DRIVERPACKAGE"
   objNewUserClassPermissions.ObjectKey = C_DRIVERPACKAGE
  Case "SOFTWAREUPDATESPACKAGE"
   objNewUserClassPermissions.ObjectKey = C_SOFTWAREUDPATESPACKAGE
  Case "DRIVER"
   objNewUserClassPermissions.ObjectKey = C_SOFTWAREUDPATESPACKAGE
  Case Else  
   WScript.Echo "Object type unknown:  " & strObjectType 
 End Select   

 ' Set the User or Group  
 objNewUserClassPermissions.UserName = strUser  

 ' Set the Permissions  
 ' Included all permissions avaiable for all classes.
 arrPermissions = Split(strPermissions,"&")  
 For Each strPermission In arrPermissions  
  'Parse the Permissions  
  Select Case UCASE(strPermission)  
   Case "READ"  
    strChosenPermissions = strChosenPermissions + CP_READ  
   Case "MODIFY"  
    strChosenPermissions = strChosenPermissions + CP_MODIFY  
   Case "DELETE"  
    strChosenPermissions = strChosenPermissions + CP_DELETE  
   Case "DISTRIBUTE"  
    strChosenPermissions = strChosenPermissions + CP_DISTRIBUTE  
   Case "REMOTE_CONTROL"  
    strChosenPermissions = strChosenPermissions + CP_REMOTE_CONTROL  
   Case "ADVERTISE"  
    strChosenPermissions = strChosenPermissions + CP_ADVERTISE  
   Case "MODIFY_RESOURCE"  
    strChosenPermissions = strChosenPermissions + CP_MODIFY_RESOURCE  
   Case "ADMINISTER"  
    strChosenPermissions = strChosenPermissions + CP_ADMINISTER  
   Case "DELETE_RESOURCE"  
    strChosenPermissions = strChosenPermissions + CP_DELETE_RESOURCE  
   Case "CREATE"  
    strChosenPermissions = strChosenPermissions + CP_CREATE
   Case "READ_RESOURCE"  
    strChosenPermissions = strChosenPermissions + CP_READ_RESOURCE
   Case "VIEW_COLL_FILE"  
    strChosenPermissions = strChosenPermissions + CP_VIEW_COLL_FILE 
   Case "DELEGATE"  
    strChosenPermissions = strChosenPermissions + CP_DELEGATE
   Case "METER"  
    strChosenPermissions = strChosenPermissions + CP_METER
   Case "MANAGESQLCOMMAND"  
    strChosenPermissions = strChosenPermissions + CP_MANAGESQLCOMMAND
   Case "MANAGESTATUSFILTER"  
    strChosenPermissions = strChosenPermissions + CP_MANAGESTATUSFILTER
   Case "MANAGEFOLDER"  
    strChosenPermissions = strChosenPermissions + CP_MANAGEFOLDER
   Case "NETWORKACCESS"  
    strChosenPermissions = strChosenPermissions + CP_NETWORKACCESS
   Case "IMPORTMACHINE"  
    strChosenPermissions = strChosenPermissions + CP_IMPORTMACHINE
   Case "CREATETSMEDIA"  
    strChosenPermissions = strChosenPermissions + CP_CREATETSMEDIA
   Case "MODIFYCOLLECTIONSETTING"  
    strChosenPermissions = strChosenPermissions + CP_MODIFYCOLLECTIONSETTING
   Case "MANAGEOSDCERTIFICATE"  
    strChosenPermissions = strChosenPermissions + CP_MANAGEOSDCERTIFICATE
   Case "RECOVERUSERSTATE"  
    strChosenPermissions = strChosenPermissions + CP_RECOVERUSERSTATE
   Case "MANAGEBMC"  
    strChosenPermissions = strChosenPermissions + CP_MANAGEBMC
   Case "VIEWBMC"  
    strChosenPermissions = strChosenPermissions + CP_VIEWBMC
   Case "MANAGEAI"  
    strChosenPermissions = strChosenPermissions + CP_MANAGEAI
   Case "VIEWAI"  
    strChosenPermissions = strChosenPermissions + CP_VIEWAI
    

   ' BEGIN:  Custom Class 'ALL' Descriptors 
   ' This allows for just the specification of a user/group for a class and these are all available permissions for each class

   Case "ADVERTISEMENT_ALL"
    strChosenPermissions = CP_READ + CP_MODIFY + CP_DELETE + CP_ADMINISTER + CP_CREATE + CP_DELEGATE + CP_MANAGEFOLDER
   Case "APPLICABLE_UPDATES_SUMMARY_ALL"
    strChosenPermissions = CP_READ + CP_MODIFY + CP_DELETE + CP_ADMINISTER + CP_CREATE + CP_DELEGATE
   Case "ASSET_INTELLIGENCE_ALL"
    strChosenPermissions = CP_ADMINISTER + CP_DELEGATE + CP_MANAGEAI + CP_VIEWAI
   Case "BOOT_IMAGE_PACKAGE_ALL"
    strChosenPermissions = CP_READ + CP_MODIFY + CP_DELETE + CP_DISTRIBUTE + CP_ADMINISTER + CP_CREATE + CP_DELEGATE + CP_MANAGEFOLDER
   Case "COLLECTION_ALL"
    strChosenPermissions = CP_READ + CP_MODIFY + CP_DELETE + CP_REMOTE_CONTROL + CP_ADVERTISE + CP_MODIFY_RESOURCE + CP_ADMINISTER + CP_DELETE_RESOURCE + CP_CREATE + CP_VIEW_COLL_FILE + CP_READ_RESOURCE + CP_DELEGATE + CP_MODIFYCOLLECTIONSETTING + CP_MANAGEBMC + CP_VIEWBMC
   Case "COMPUTER_ASSOCIATION_ALL"
    strChosenPermissions = CP_READ + CP_DELETE + CP_ADMINISTER + CP_CREATE + CP_DELEGATE + CP_MANAGEFOLDER + CP_RECOVERUSERSTATE
   Case "CONFIGURATION_ITEMS_ALL"
    strChosenPermissions = CP_READ + CP_MODIFY + CP_DELETE + CP_DISTRIBUTE + CP_ADMINISTER + CP_CREATE + CP_DELEGATE + CP_MANAGEFOLDER + CP_NETWORKACCESS
   Case "DEPLOYMENT_ALL"
    strChosenPermissions = CP_READ + CP_MODIFY + CP_DELETE + CP_ADMINISTER + CP_CREATE + CP_DELEGATE
   Case "DEPLOYMENT_PACKAGE_ALL"
    strChosenPermissions = CP_READ + CP_MODIFY + CP_DELETE + CP_DISTRIBUTE + CP_ADMINISTER + CP_CREATE + CP_DELEGATE + CP_MANAGEFOLDER
   Case "DEPLOYMENT_TEMPLATE_ALL"
    strChosenPermissions = CP_READ + CP_MODIFY + CP_DELETE + CP_ADMINISTER + CP_CREATE + CP_DELEGATE 
   Case "DEVICE_DRIVER_ALL"
    strChosenPermissions = CP_READ + CP_MODIFY + CP_DELETE + CP_ADMINISTER + CP_CREATE + CP_DELEGATE + CP_MANAGEFOLDER
   Case "DEVICE_SETTING_ITEM_ALL"
    strChosenPermissions = CP_READ + CP_MODIFY + CP_DELETE + CP_ADMINISTER + CP_CREATE + CP_DELEGATE
   Case "DEVICE_SETTING_PACKAGE_ALL"
    strChosenPermissions = CP_READ + CP_MODIFY + CP_DELETE + CP_DISTRIBUTE + CP_ADMINISTER + CP_CREATE + CP_DELEGATE + CP_MANAGEFOLDER
   Case "DRIVER_PACKAGE_ALL"
    strChosenPermissions = CP_READ + CP_MODIFY + CP_DELETE + CP_DISTRIBUTE + CP_ADMINISTER + CP_CREATE + CP_DELEGATE + CP_MANAGEFOLDER
   Case "OS_IMAGE_ALL"
    strChosenPermissions = CP_READ + CP_MODIFY + CP_DELETE + CP_DISTRIBUTE + CP_ADMINISTER + CP_CREATE + CP_DELEGATE + CP_MANAGEFOLDER
   Case "OS_INSTALL_PACKAGE_ALL"
    strChosenPermissions = CP_READ + CP_MODIFY + CP_DELETE + CP_DISTRIBUTE + CP_ADMINISTER + CP_CREATE + CP_DELEGATE + CP_MANAGEFOLDER
   Case "PACKAGE_ALL"
    strChosenPermissions = CP_READ + CP_MODIFY + CP_DELETE + CP_DISTRIBUTE + CP_ADMINISTER + CP_CREATE + CP_DELEGATE + CP_MANAGEFOLDER
   Case "QUERY_ALL"
    strChosenPermissions = CP_READ + CP_MODIFY + CP_DELETE + CP_ADMINISTER + CP_CREATE + CP_DELEGATE + CP_MANAGEFOLDER
   Case "REPORT_ALL"
    strChosenPermissions = CP_READ + CP_MODIFY + CP_DELETE + CP_ADMINISTER + CP_CREATE + CP_DELEGATE + CP_MANAGEFOLDER
   Case "SITE_ALL"
    strChosenPermissions = CP_READ + CP_MODIFY + CP_DELETE + CP_ADMINISTER + CP_CREATE + CP_DELEGATE + CP_METER + CP_MANAGESQLCOMMAND + CP_MANAGESTATUSFILTER + CP_IMPORTMACHINE + CP_MANAGEOSDCERTIFICATE
   Case "SOFTWARE_METERING_RULE_ALL"
    strChosenPermissions = CP_READ + CP_MODIFY + CP_DELETE + CP_ADMINISTER + CP_CREATE + CP_DELEGATE + CP_MANAGEFOLDER
   Case "STATUS_MESSAGE_ALL"
    strChosenPermissions = CP_READ + CP_DELETE + CP_ADMINISTER + CP_CREATE
   Case "TASK_SEQUENCE_PACKAGE_ALL"
    strChosenPermissions = CP_READ + CP_MODIFY + CP_DELETE + CP_ADMINISTER + CP_CREATE + CP_DELEGATE + CP_MANAGEFOLDER + CP_CREATETSMEDIA
    
   ' END:  Custom Class 'ALL' Descriptors 
    
   Case ""
   Case Else  
    WScript.Echo "Permission not supported:  " & strPermission 
    WScript.Echo "Object Type:  " & strObjectType
  End Select   
 Next  

 ' Set the permissions
 objNewUserClassPermissions.ClassPermissions = strChosenPermissions  


 'Creating Permissions  
 'On Error Resume Next  
 objNewUserClassPermissions.put_  


 'If Err.Number = 0 Then  
 ' WScript.Echo "Successfully set following Permissions:"  
 ' WScript.Echo vbTab & " - " & strObjectType  
 ' WScript.Echo vbTab & " - " & strObjectName  
 ' WScript.Echo vbTab & " - " & strUser  
 ' WScript.Echo vbTab & " - " & strPermissions   
 'Else  
 ' WScript.Echo "Error (" &Err.Description  &") when trying to create the object:"  
 ' WScript.Echo vbTab & " - " & strObjectType  
 ' WScript.Echo vbTab & " - " & strObjectName  
 ' WScript.Echo vbTab & " - " & strUser  
 ' WScript.Echo vbTab & " - " & strPermissions   
 'End If  

 Set objNewUserClassPermissions = Nothing  
End Function  

' Sets all permissions on all classes for the given user/group
Function SetClassRights_All(strUser)
 Call SetClassRights("COLLECTION", strUser, "COLLECTION_ALL")
 Call SetClassRights("PACKAGE", strUser, "PACKAGE_ALL")
 Call SetClassRights("ADVERTISEMENT", strUser, "ADVERTISEMENT_ALL")
 Call SetClassRights("STATUSMESSAGE", strUser, "STATUS_MESSAGE_ALL")
 Call SetClassRights("SITE", strUser, "SITE_ALL")
 Call SetClassRights("QUERY", strUser, "QUERY_ALL")
 Call SetClassRights("REPORT", strUser, "REPORT_ALL")
 Call SetClassRights("METEREDPRODUCTRULE", strUser, "SOFTWARE_METERING_RULE_ALL")
 Call SetClassRights("APPLICABLEUPDATESSUMMARY", strUser, "APPLICABLE_UPDATES_SUMMARY_ALL")
 Call SetClassRights("CONFIGURATIONITEM", strUser, "CONFIGURATION_ITEMS_ALL")
 Call SetClassRights("OPERATINGSYSTEMINSTALLPACKAGE", strUser, "OS_INSTALL_PACKAGE_ALL")
 Call SetClassRights("DEPLOYMENTTEMPLATE", strUser, "DEPLOYMENT_TEMPLATE_ALL")
 Call SetClassRights("UPDATESASSIGNMENT", strUser, "DEPLOYMENT_ALL")
 Call SetClassRights("STATEMIGRATION", strUser, "COMPUTER_ASSOCIATION_ALL")
 Call SetClassRights("IMAGEPACKAGE", strUser, "OS_IMAGE_ALL")
 Call SetClassRights("BOOTIMAGEPACKAGE", strUser, "BOOT_IMAGE_PACKAGE_ALL")
 Call SetClassRights("TASKSEQUENCEPACKAGE", strUser, "TASK_SEQUENCE_PACKAGE_ALL")
 Call SetClassRights("DEVICESETTINGPACKAGE", strUser, "DEVICE_SETTING_PACKAGE_ALL")
 Call SetClassRights("DEVICESETTINGITEM", strUser, "DEVICE_SETTING_ITEM_ALL")
 Call SetClassRights("DRIVERPACKAGE", strUser, "DRIVER_PACKAGE_ALL")
 Call SetClassRights("SOFTWAREUPDATESPACKAGE", strUser, "DEPLOYMENT_PACKAGE_ALL")
 'Call SetClassRights("DRIVER", strUser, "DRIVER_ALL")
End Function

Random Local Administrator Password Changer

Title:  Random Local Administrator Password Changer
Author:  Cameron Wilson (thepip3r)
Last Updated:  10/20/10
Date Developed: 03/15/06
Description:
Generates random passwords of the max complexity and length using the Microsoft
specifications for an account password.

The purpose of this script is to randomize the local administrator account password.
This was developed to be used in an domain/enterprise environment where you either never
want end-users logging in with the local admin account and/or you want a high random
complexity set for the local admin account.  Active Directory does not give a way
to control this value so to ensure it's not used by people we don't want to use it,
we rely on our Domain/Enterprise/Delegated Admin accounts for access.

FAQ:
Q:  What if I need to know the local admin password?
A:  A person with the appropriate rights level can remotely change the value of the
local admin password and then log in where necessary.
Q:  What if the computer has lost connectivity/trust to the domain?
A:  Rely on password cracking utilities to reset the password.
(e.g. ERD Commander, Linux Crack Disk, etc.)

Requirements:
 - Windows 2000 or better
 - MUST be run as a startup script via Group Policy

The commented-out values in generatePassword() are for a possible upcoming feature I just haven't gotten around to yet where you'll be able to specify (via command-line args) what complexity level of a password to generate (e.g. alphas, alphas+nums, alphas+nums+specials, etc.).

Remember that this is written to randomly generate an UNKNOWN password to set as the local admin password in order to give a best attempt that it won't be cracked remotely/interactively. As everyone knows though, if you have local-physical access to the machine, anyone will be able to simply overwrite this value using a bootable password cracking utility.

Examples of generated passwords at max length with max complexity (forgive the formatting issues with the blog):

g`Lp_Ogy[[D-\)>W7U=Dq\XMmh5[+6/CIb-0@QH!<]&G=+bqrox^R^9ONjpug8RE*ei2dk*;`waIxECtSrY`3atj/*RwH:3He=bL],#VY7Zcq_<LMJRz,9m*(DKOAl-z

#vb+ue#5qpZBq>TmMkRY,rmc(#KqAKEY^xCFVg^7Rr;]S@w-.+4thtOed&,1"Nh[@z$Hy'?Qu3w_4[X/i-ovIv0%E@g3^PI]!:_JZ)zSW5Xao]:IJGPx*6k'&BHM?j*w

70v@/y7I++oW,Sh'a%gnA,(w=8_+V`Yms2WZj!rKf-PqgU2AB?H.".cyx:@E7b"oT59\4<Tf0G1sHomD$B)0]1D:YT"Grd^r5Ot_o>5hkIlv*qN^_\e3>K%<;V]bS%?2

0(o8'r0A$#gO$KazYx_f9%zp50X#NXQfk+PRctkD_%Hi`M*:;8@'t'[rq29>/ZuhL-1U,4L^(@)lAhe<v:")V)=2RMt@j]Vj.GlWg6-`cBen"jGVWT]+7Cx43OUZLw7*

iaNq`Piz]\F.]*@Y8W>Er^YOni7\-70EJd/1BSJ#>^'H?,cstqy`S`:QPkrwh9TG+fj4em+=aybKzGDuUs[b5bvk1,SyI<5Ig&K6Fof?B!DM[I&563<dp"Wml.49+Vpc

PH4XG7OaCC-oDk'?y=%,YD@5UPwCnxq+1Jpr(:0c%Eh/%mJYZX`F:G!8x:AE7b#pT59\4<Tf0G1tIomD$B*1]1D:ZT"Hre^r5Ot_o>5hkJlv*rN^_\e3?K&<;W]bS%?2

(!g1zj(:vv_HwDYrRpX_2wsh.)PvFQJ^d#HK[lc<WxAbXF#2309ymyTji+16(Sm`E&*M%,DV!8"d9`^5n3t!N"5+JEm8cUNc&@eO`/&Y\:]gub?OPMU$/<p-,GNSDo0#

QI6YH9QbED.pEl(Az?&-ZFA7VQyDoyr-2Lqs*;2e&Fi0'nK[\YaH;H"98SZ_P!</mNRvMUm%IaJ3b/,]=[CJwJ^Ssn;a1$w1Oh3x.WN'*c,5C1hwxu$LXd?UTpv!m>XK

?8$H7'?Q33v_4[p/i-ovI40%E@g3]hau!:_br)zSn5Xyo]:IJGP6*6k'&BHM?j*w\<Ad<C[m8O9!PwuL+J18e9LBa\*Ozlez=W"fwF=psQt#2yVfgdl;FS-DB^ej[,G:

vnZ$m]u-iiS;j7MeEcKR%jf[!vCi:D=QWq<>O`W0Kk4UK9p&'$,l`mG^\x%)uFaT8sw@rz8Jn+oX-SQ(b&hoAo(x>8`,VIBVs3XCS"sLO.PZhV2BC@Iq#/dzy;AF7c#p

/'m7&p.@""fN#J_xXv^e8#yn4/V"MWPdj)OQariB^$Gh^L)897?%s&Zqo17<.YsgK,0S+3K]'>(j@fd;u9z'T(;1PKs?i[Ui,FkVf5,_b@cm!hEUVS\*6Bw32NTYJv6)

OG3WF6N`BB,nCj&>x<$+XC?4TOvBmwp*0Ioq'90b$Dg.$lIYYW_E9Fz75QX\Ny:-kLPsKSk#G^H1`,*[;Y@HtH[Qqk9_/!u/Lf1v,UL%(a)3A/euvs"JVb=SRntyj<VI

And here is the actual vbs:

' *************************************************************************
' Title:  Random Local Administrator Password Changer
' Author:  Cameron Wilson (thepip3r)
' Last Updated:  10/20/10
' Date Developed: 03/15/06
' Description:
'  Generates random passwords of the max complexity and length using the Microsoft
'  specifications for an account password.
'
'  The purpose of this script is to randomize the local administrator account password.
'  This was developed to be used in an domain/enterprise environment where you either never
'  want end-users logging in with the local admin account and/or you want a high random
'  complexity set for the local admin account.  Active Directory does not give a way
'  to control this value so to ensure it's not used by people we don't want to use it, 
'  we rely on our Domain/Enterprise/Delegated Admin accounts for access.
'
' FAQ:
'  Q:  What if I need to know the local admin password? 
'  A:  A person with the appropriate rights level can remotely change the value of the 
'   local admin password and then log in where necessary.
'  Q:  What if the computer has lost connectivity/trust to the domain?
'  A:  Rely on password cracking utilities to reset the password.
'   (e.g. ERD Commander, Linux Crack Disk, etc.)
'
' Requirements:
'  - Windows 2000 or better
'  - MUST be run as a startup script via Group Policy
'
' Link References:
'  http://blogs.technet.com/b/heyscriptingguy/archive/2005/07/22/how-can-i-determine-if-the-local-administrator-account-has-been-renamed-on-a-computer.aspx
'  http://blogs.technet.com/b/heyscriptingguy/archive/2007/07/03/how-can-i-change-the-local-administrator-password-on-all-my-computers.aspx
'  http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/windows_password_tips.mspx?mfr=true
' *************************************************************************


strPassword = generatePassword(127)
strAdminUser = getLocalAdminUser()
setAccountPassword ".", strAdminUser, strPassword


' *************************************************************************
' User Defined Functions
' *************************************************************************

Function generatePassword(iLength)

 If NOT IsNumeric(iLength) Then
  WScript.Echo "The value specified for the password generation must be a number."
  WScript.Quit
 End If

 ' Microsoft specifies that a password can be anywhere between 0 and 127 characters
 If iLength < 0 OR iLength > 127 Then
  WScript.Echo "The number specified for the password generation must be between 0-127."
  WScript.Quit
 End If

 'strSpecialCharacters = "33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,58,59,60,61,62,63,64,91,92,93,94,95,96,123,124,125,126"
 'strNumbers = "48,49,50,51,52,53,54,55,56,57"
 'strAlphaCap = "65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90"
 'strAlphaLower = "97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122"
 
 'arrSpecialCharacters = Split(strSpecialCharacters, ",")
 'arrNumbers = Split(strNumbers, ",")
 'arrAlphaCap = Split(strAlphaCap, ",")
 'arrAlphaLower = Split(strAlphaLower, ",")
 
 For i = 0 To iLength
  iRandomNumber = generateRandomInteger(33, 122)
  strTempPassword = strTempPassword & Chr(iRandomNumber)
 Next
 
 generatePassword = strTempPassword

End Function

' Generates a random integer between two given bounds
Function generateRandomInteger(iLower, iUpper)
 If Not IsNumeric(iLower) or Not IsNumeric(iUpper) Then
  WScript.Echo "The values passed to the random number generator function must be numbers."
  WScript.Quit
 End If
 
 ' Seed Rnd with a random value(Randomize) and then calculate the random value using the given bounds
 Randomize
 generateRandomInteger = Int((iUpper - iLower + 1) * Rnd + iLower)
End Function

' Find the local admin password based off of the indentifying SID attributes
Function getLocalAdminUser()
 strComputer = "."

 Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
 Set colAccounts = objWMIService.ExecQuery("Select * From Win32_UserAccount Where LocalAccount = TRUE")

 For Each objAccount in colAccounts
  If Left (objAccount.SID, 6) = "S-1-5-" and Right(objAccount.SID, 4) = "-500" Then
   strAdminAccountName = objAccount.Name
  End If
 Next
 
 getLocalAdminUser = strAdminAccountName
End Function

' Set the local admin account password based off of the random password generation params
Sub setAccountPassword(strDomain, strUser, strPassword)
 Set objUser = GetObject("WinNT://" & strDomain & "/" & strUser)
 objUser.SetPassword strPassword
End Sub