As most configuration manager administrators know the local system account is used in many cases to install software. One of the biggest challenges though is testing software with the local system account. Creating a package, program, collection, advertisement, refreshing machine policy, etc all take quite a bit of time to test if the package works using the local system account. In many cases, you're likely just testing the ability to install the application silently (especially true for OSD scenarios).
One thing I like to use is PSExec from Sysinternals. In the past with OSes prior to Windows Vista, we could use the AT scheduler from the command line to create an interactive command prompt using the system account. This trick was removed in Vista and we were left with using Psexec.
- Download PSExec from http://technet.microsoft.com/en-us/sysinternals/bb897553 or alternatively, you can use http://live.sysinternals.com/psexec.exe (some web filtering software will not allow an exe to be downloaded in this manner, so the first link might be better).
- Once downloaded, navigate to the location of psexec via command line.
- From the command line enter psexec -si cmd.exe (this opens a new command prompt as the system context that's interactive)
- A new command line should open up. In the new command line type in whoami. You should see the credential as nt authority\system.
- Test whatever software package you want to install via command line (this will end up being the command line you use in your package program)
3 Responses
Yeah, I've been doing this for quite a while -- generally suggest it to people to avoid wasting their time testing packages through SCCM. In most cases, testing silent command lines under a standard user account is fine, but this takes it one step further. Good article.
Cheers,
Trevor Sullivan
I put PsExec in the Program Files (x86) folder and created a desktop shortcut on my test machine with the following target (sub in domain/admin account as needed):
C:\Windows\System32\runas.exe /user:[domain]\[admin account] "c:\program files (x86)\psexec -si cmd.exe"
The normal account I use on the test machine doesn't have admin privs, so this speeds up the process by a decent amount.
[...] -Derived from Richard Balsley’s post, found here [...]