NetDocuments Tool

Problem#

NetDocuments runs background processes that make traditional automated updaters unreliable. The existing workaround was manual updates under local administrator accounts — insecure, non-auditable, time-intensive, and error-prone.

Background#

Checked existing approaches to automating NetDocuments updates and to bypassing UAC without elevating the user before settling on a design. None solved the credential-sharing problem driving the request, which is what led to combining Task Scheduler with a SYSTEM-context task and a custom COM DACL (Component Object Model discretionary access control list) instead of adopting an existing pattern outright.

Implementation#

Uses Task Scheduler + SYSTEM context to bypass UAC securely without elevating the user. Intune deploys a wrapper script creating a locked-down folder with explicit NTFS ACLs, and a Scheduled Task with a custom COM-based DACL (discretionary access control list) allowing Users only trigger rights. A desktop shortcut spawns a user-facing PowerShell window tailing the live log.

Challenges#

Balancing usability (one-click for users) with hardening (no write access, no credential leakage). The breakthrough was realising Task Scheduler's COM ACLs could expose trigger rights without modify rights.

Results#

Deployed via Intune estate-wide. Replaced all manual update processes — no more local admin accounts or break/fix remoting. Zero update-related incidents since pilot.

System structure

How the parts connect

1. Intune wrapper

   Creates the protected folder, files and scheduled task.

2. Desktop shortcut

   The signed-in user requests an update and sees progress.

3. Task permission boundary

   A COM DACL grants trigger rights without task modification rights.

4. SYSTEM update + log

   The privileged task runs the update and records progress for the user-facing window.