Configure the runurl program
If you do not install Credential Provider software on users’ workstations to allow them to access the domain help account, the runurl
program, which is used to launch a web browser in kiosk mode, must be installed on a public share accessible to computers in the domain. You can then add runurl
to the group policy for the help user, and it will be executed when the help user logs into the domain.
To configure the runurl
program:
Copy the files from the addon\Domain Login Assistant\ directory in your Bravura Security Fabric installation to the SYSVOL share on each domain controller.
You can determine the location of your SYSVOL share by typing net share from the command prompt on your DC.
Locate the
gina.z
file from the skin\default\en-us\ directory and make a copy of that file to the sysvol share as well.Create a text file called
runurl.cfg
that contains arguments (separated by whitespace) for the runurl program. Place this file with the other runurl files on the SYSVOL share.Test
runurl
from a command prompt on the Active Directory DC by typing:%LOGONSERVER%\sysvol\runurl.exe -cfg %LOGONSERVER%\sysvol\runurl.cfg
Ensure that a web browser opens to the specified URL, and that the workstation is locked down according to the options you specified.
Test
runurl
from the command prompt of a workstation logged into the domain by typing:%LOGONSERVER%\sysvol\runurl.exe -cfg %LOGONSERVER%\sysvol\runurl.cfg
Ensure that a browser window opens to the specified URL, and that the workstation is locked down according to the options you specified.
runurl usage and examples
The runurl
program launches a web browser on a Windows workstation and opens it to a specified URL. When configured to launch in kiosk mode the browser window fills the screen, removes all window borders and decorations, disables navigation, and disables all function keys, the Alt and Ctrl keys, the Windows logo key, and any combination of keys that you specify.
A major use for the runurl
program is to enable users to reset their own passwords using a secure kiosk account (SKA).
Requirements
When invoked by a local SKA or Credential Provider, runurl is launched from the Login Assistant\ directory on the user’s workstation.
The following files must be located in the share or directory from which runurl is launched:
msgmap.txt
– used to disable Windows message events on Windows workstations.webbrowser.dll
– used to block the [Ctrl], [Alt], and the right mouse button, and to run the web browser. It is also used by the Credential Provider.pscredprov.dll
– used to block the [Ctrl], [Alt], and the right mouse button, and to run the web browser. It is used by the Credential Provider.launch_ska.exe
– used to launch the SKA and invoke the runurl command.
Ensure that Internet Explorer 9 or higher is installed on the domain controller and all workstations that will access the help account. The runurl
program relies on some components that are part of Internet Explorer 9 or higher.
Usage
runurl.exe -url <URL> [<options>] runurl.exe -cfg <filename>
The runurl
program works with the following command-line arguments:
Argument | Description |
---|---|
-url <URL> | Specify the URL that will be displayed in the web browser. |
-userid <userID> | Bravura Security Fabric user ID to pass through the URL. |
-ntkeymap <args> | Enable or disable a key or combinations of keys on a Windows workstation . |
-msgmap <filename> | Specify a file containing Windows message events to block. Do not modify this file unless you know what you are doing. |
-reg <filename>.reg | Load the named registry file into the registry before terminating runurl. This is used to restore standard registry entries in case runurl was launched during the first login of the help account, using a restrictive security policy, and the user elected to not save settings – which means that registry changes were applied to the default user rather than help. |
-kiosk | Start the web browser in kiosk mode. |
-keylock | Disable [ Ctrl] , [Alt] , and the right mouse button. This is implied by -kiosk. |
-no_icw | Do not pop up Internet Connection Wizard when the user starts up the browser the first time. |
-logoff | Log off from the workstation after the web browser closes. |
-run "<programname>, <args>" | Run this program with these parameters before exiting, and before logging off. The run option requires quotes around the external program name and param arguments. If you need quotes inside of this then use a \ to escape them. If both run and logoff are specified, run will execute first. |
-cfg <filename> | If the command line is too long, use this option to read all arguments from this file. Write the file with the arguments separated by white space. |
-trapsesslock | Trap the Windows workstation lock notification to ensure that runurl handles locked workstations correctly; for example a browser displaying a User notifications (PSN) module notification is returned to the state it was in before the lock. |
Enabling or disabling key combinations
You can run runurl
with the -ntkeymap option to enable or disable keys and combinations of keys on a Windows workstation (XP or higher). Write the arguments for -ntkeymap using the following syntax:
[-] [(] [<MOD>+] <KEY> [)] [, ...]
Where:
-
enables the keys that follow( )
are optional brackets (these are for formatting only, they do not modify the meaning of the text)<MOD>
specifies one of [Alt] , [Shift] , [Ctrl] , or the Windows key <KEY > specifies the name of the key to enable/disable<KEY>
can be any of the following:’ B F22 Num+ S , Backspace F23 Num- ScrollLock - C F24 Num0 Shift . CapsLock F3 Num1 Space / Ctrl F4 Num2 SysReq 0 D F5 Num3 T 1 E F6 Num4 Tab 2 Enter F7 Num5 U 3 Esc F8 Num6 V 4 F F9 Num7 W 5 F1 G Num8 Win 6 F10 H Num9 X 7 F11 I NumDel Y 8 F12 J O Z 9 F13 K P [ ; F15 L Pause \ = F2 M Q ] A F20 N R ‘ Alt F21 Num* RightShift
Examples
To launch a web browser in kiosk mode and open it to the Change passwords (PSS) module, open a command prompt, and type on one line:
runurl.exe -kiosk -logoff -no_icw -trapsesslock -url https://<server>/<instance>/change-passwords
If
runurl
is run from a public share rather than your current workstation, specify the UNC path torunurl
in your command. If the share is located on an Active Directory domain controller, open a command prompt, and type on one line:\\MyADDC\SYSVOL\runurl.exe -kiosk -logoff -no_icw -trapsesslock -url https://<server>/<instance>/change-passwords
To disable keys on a Windows workstation using the -ntkeymap option, open a command prompt, and type on one line:
runurl.exe -kiosk -logoff -no_icw -trapsesslock -url https://<server>/<instance>/change-passwords -ntkeymap Win+F1,-Shift+F1,Alt+Shift+F1,F1
This is the same as:
runurl.exe -kiosk -logoff -no_icw -trapsesslock -url https://<server>/<instance>/change-passwords -ntkeymap (Win+F1),(-Shift+F1),(Alt+Shift+F1),(F1)
To print a list of available key names for the -ntkeymap option on the command line, type the following in the Login Assistant\ directory:
runurl -ntkeymap ?
An example of a
runurl.cfg
file:-kiosk -logoff -no_icw -trapsesslock -url http://<server>/<instance>/?
To run commands from a configuration file, type:
runurl -cfg runurl.cfg