02 Tools / Internal deployment
NetDocuments Tool
User-triggered NetDocuments updates via Task Scheduler.
Trigger access only · No shared credentials
Lets users update NetDocuments without administrator credentials.
Workflow
- 01User shortcut
- 02Trigger-only permission
- 03SYSTEM scheduled task
- 04Update + progress log
Problem
NetDocuments runs background processes that make traditional automated updaters unreliable. The existing workaround was manual updates under local administrator accounts — insecure, non-auditable, time-intensive, and error-prone.
Background
Checked existing approaches to automating NetDocuments updates and to bypassing UAC without elevating the user before settling on a design. None solved the credential-sharing problem driving the request, which is what led to combining Task Scheduler with a SYSTEM-context task and a custom COM DACL instead of adopting an existing pattern outright.
Implementation
Uses Task Scheduler + SYSTEM context to bypass UAC securely without elevating the user. Intune deploys a wrapper script creating a locked-down folder with explicit NTFS ACLs, and a Scheduled Task with a custom COM-based DACL allowing Users only trigger rights. A desktop shortcut spawns a user-facing PowerShell window tailing the live log.
Challenges
Balancing usability (one-click for users) with hardening (no write access, no credential leakage). The breakthrough was realising Task Scheduler's COM ACLs could expose trigger rights without modify rights.
Results
Deployed via Intune estate-wide. Replaced all manual update processes — no more local admin accounts or break/fix remoting. Zero update-related incidents since pilot.
Project outcomes
0Credentials stored
20+Endpoints deployed
0Update incidents