Privilege elevation system and method for desktop administration
View Patent ↗In one embodiment, a method is executed by an information handling system comprising computer hardware. The method includes monitoring a desktop environment of a user for a desktop-administration event. The method further includes, responsive to a detected occurrence of the desktop-administration event, identifying at least one script-execution process to invoke. The at least one script-execution process executes at least one privilege-agnostic desktop-administration script. The method also includes determining whether the at least one script-execution process is designated for privilege elevation. Moreover, the method includes, responsive to a determination that the at least one script-execution process is designated for privilege elevation, injecting a security token of the at least one script-execution process with elevated privileges to yield a privilege-injected script-execution process. Also, the method includes invoking the privilege-injected script-execution process in the desktop environment so that the desktop-administration script executes as the user with the elevated privileges.
1. A method comprising, on an information handling system comprising computer hardware:
monitoring a desktop environment of a user for a desktop-administration event, the desktop environment comprising a computer operating system;
responsive to a detected occurrence of the desktop-administration event, identifying at least one script-execution process to invoke based, at least in part, on an invocation policy associated with the desktop-administration event;
wherein the at least one script-execution process executes at least one privilege-agnostic desktop-administration script that modifies a configuration setting in the desktop environment, wherein the at least one privilege-agnostic desktop-administration script is written as if any given user in whose desktop environment the privilege-agnostic desktop-administration script is invoked has already been granted all necessary privileges;
wherein the at least one privilege-agnostic desktop-administration script is designed to execute the modification to the configuration setting in response to the desktop-administration event;
determining whether the at least one script-execution process is designated for automatic privilege elevation based, at least in part, on a stored elevation policy, wherein the stored elevation policy specifies script-execution processes that are designated for automatic privilege elevation;
responsive to a determination that the at least one script-execution process is designated for automatic privilege elevation in the stored elevation policy, automatically injecting a security token of the at least one script-execution process with elevated privileges that are beyond what the user has been granted to yield a privilege-injected script-execution process; and
invoking the privilege-injected script-execution process in the desktop environment so that the at least one privilege-agnostic desktop-administration script executes as the user with the elevated privileges.
2. The method of claim 1 , wherein the injecting comprises modifying the at least one security token to include at least one additional right.
3. The method of claim 1 , wherein the desktop-administration event comprises a logon event and the at least one privilege-agnostic desktop-administration script comprises a logon script.
4. The method of claim 1 , wherein the at least one privilege-agnostic desktop-administration script modifies at least one configuration setting on the desktop environment.
5. The method of claim 4 , wherein the at least one configuration setting is selected from the group consisting of: a security policy, a drive mapping, a startup application, a registry setting, a printer assignment, a folder redirection, Internet settings, a desktop shortcut, a proxy configuration, an application path, an application setting, and at least one profile.
6. The method of claim 1 , wherein the elevated privileges comprise administrative privileges.
7. The method of claim 1 , wherein the desktop environment comprises a virtual desktop environment.
8. An information handling system comprising:
a hardware computer processor and memory, wherein the hardware computer processor in combination with the memory is operable to:
monitor a desktop environment of a user for a desktop-administration event, the desktop environment comprising a computer operating system;
responsive to a detected occurrence of the desktop-administration event, identify at least one script-execution process to invoke based, at least in part, on an invocation policy associated with the desktop-administration event;
wherein the at least one script-execution process executes at least one privilege-agnostic desktop-administration script that modifies a configuration setting in the desktop environment, wherein the at least one privilege-agnostic desktop-administration script is written as if any given user in whose desktop environment the privilege-agnostic desktop-administration script is invoked has already been granted all necessary privileges;
wherein the at least one privilege-agnostic desktop-administration script is designed to execute the modification to the configuration setting in response to the desktop-administration event;
determine whether the at least one script-execution process is designated for automatic privilege elevation based, at least in part, on a stored elevation policy, wherein the stored elevation policy specifies script-execution processes that are designated for automatic privilege elevation;
responsive to a determination that the at least one script-execution process is designated for automatic privilege elevation in the stored elevation policy, automatically inject a security token of the at least one script-execution process with elevated privileges that are beyond what the user has been granted to yield a privilege-injected script-execution process; and
invoke the privilege-injected script-execution process in the desktop environment so that the at least one privilege-agnostic desktop-administration script executes as the user with the elevated privileges.
9. The information handling system of claim 8 , wherein the injection comprises modifying the at least one security token to include at least one additional right.
10. The information handling system of claim 8 , wherein the desktop-administration event comprises a logon event and the at least one privilege-agnostic desktop-administration script comprises a logon script.
11. The information handling system of claim 8 , wherein the at least one privilege-agnostic desktop-administration script modifies at least one configuration setting on the desktop environment.
12. The information handling system of claim 11 , wherein the at least one configuration setting is selected from the group consisting of: a security policy, a drive mapping, a startup application, a registry setting, a printer assignment, a folder redirection, Internet settings, a desktop shortcut, a proxy configuration, an application path, an application setting, and at least one profile.
13. The information handling system of claim 8 , wherein the elevated privileges comprise administrative privileges.
14. The information handling system of claim 8 , wherein the desktop environment comprises a virtual desktop environment.
15. A computer-program product comprising a non-transitory computer-usable medium having computer-readable program code embodied therein, the computer-readable program code adapted to be executed to implement a method comprising:
monitoring a desktop environment of a user for a desktop-administration event, the desktop environment comprising a computer operating system;
responsive to a detected occurrence of the desktop-administration event, identifying at least one script-execution process to invoke based, at least in part, on an invocation policy associated with the desktop-administration event;
wherein the at least one script-execution process executes at least one privilege-agnostic desktop-administration script that modifies a configuration setting in the desktop environment, wherein the at least one privilege-agnostic desktop-administration script is written as if any given user in whose desktop environment the privilege-agnostic desktop-administration script is invoked has already been granted all necessary privileges;
wherein the at least one privilege-agnostic desktop-administration script is designed to execute the modification to the configuration setting in response to the desktop-administration event;
determining whether the at least one script-execution process is designated for automatic privilege elevation based, at least in part, on a stored elevation policy, wherein the stored elevation policy specifies script-execution processes that are designated for automatic privilege elevation;
responsive to a determination that the at least one script-execution process is designated for automatic privilege elevation in the stored elevation policy, automatically injecting a security token of the at least one script-execution process with elevated privileges that are beyond what the user has been granted to yield a privilege-injected script-execution process; and
invoking the privilege-injected script-execution process in the desktop environment so that the at least one privilege-agnostic desktop-administration script executes as the user with the elevated privileges.
16. The computer-program product of claim 15 , wherein the at least one privilege-agnostic desktop-administration script modifies at least one configuration setting selected from the group consisting of: a security policy, a drive mapping, a startup application, a registry setting, a printer assignment, a folder redirection, Internet settings, a desktop shortcut, a proxy configuration, an application path, an application setting, and at least one profile.
17. The computer-program product of claim 15 , wherein the elevated privileges comprise administrative privileges.