question

BraunCharles-8479 avatar image
0 Votes"
BraunCharles-8479 asked StefanHorz edited

Runbook alternatives to IE + Silverlight

I get it that as long as Windows 10 is supported, that IE will be supported from a security patching perspective. However, that is not stopping my department from doing everything in their power to prevent users from using IE going forward and moving to Edge or Chrome as the only browsers that we will support.

We have a few apps that we are working with vendors on where their apps only work in IE and we are working with those vendors to make their apps compatible with Edge or Chrome. I am being tasked with figuring out how to let my users of various SCO Runbooks continue to function once we decide that IE + Silverlight are no longer acceptable to be used. And although I don't think we can even disable iexplore.exe from running without breaking windows 10 we are going to come up with something to strongly discourage its use as a web browser.

So without IE + Silverlight, what are my options when it comes to the use of runbooks by my users?

Maybe some way for Powershell to interact with the Runbook Server(s), by taking user input and putting it into the Initialize data fields? Or some other form of a web form that is acceptable to interact directly with a runbook? Are there any other ways for users to input data that can be used by a runbook? Maybe a Sharepoint form since we are users of Sharepoint Online?

My other alternative is to just build a Windows 10 VM as a jumpbox of sorts with no internet access or anything. Maybe like a Kiosk and the only thing people can do is RDP to it and launch IE and use it to kick off their desired Runbook.

Of course the final option is to go to any competing applications that will do the same thing as SCO, without IE + Silverlight, but I am not even sure what competitors are out there, if any or how easy / difficult it would be to migrate my runbooks to a different platform.

msc-orchestrator
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Try use WebSCO - alternative web console for Microsoft System Center Orchestrator


0 Votes 0 ·
AndreasBaumgarten avatar image
2 Votes"
AndreasBaumgarten answered

Hi @BraunCharles-8479 ,

there are a few options:

au2mator - Self Service Portal:
https://au2mator.com/

If you like to start a Runbook via PowerShell:
https://techcommunity.microsoft.com/t5/system-center-blog/cool-tool-new-command-line-utility-to-start-a-runbook/ba-p/345890
https://archive.codeplex.com/?p=orchestrator

Starting Runbooks and Stopping Jobs Using the System Center 2012 Orchestrator Web Service
https://techcommunity.microsoft.com/t5/system-center-blog/starting-runbooks-and-stopping-jobs-using-the-system-center-2012/ba-p/345024


(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

BraunCharles-8479 avatar image
0 Votes"
BraunCharles-8479 answered

Thank you for those suggestions. I am probably going to go down a different path as I have been thinking about this. I will probably work with our web dev team and come up with some forms on a site that ask all the questions currently asked by the "Initialize Data Activity" in my runbooks.

When a user completes the form it will write a text file out to a directory that is monitored every 2 minutes for new files. When the runbook detects a new file has been created it will read the data in the file and use that as the input for the rest of the runbook to act upon.

Seems like the simplest way to go as these are not overly complicated runbooks they are however used frequently and I just need a way other than IE + Silverlight for users to initiate a runbook based on the user's input.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

AndreasBaumgarten avatar image
0 Votes"
AndreasBaumgarten answered

Hi @BraunCharles-8479 ,

your approach sounds good as well.

There may be a point to consider:
If you're building the solution from scratch, you'll need to create a custom web form per runbook. You also need a service to process the input and create the output. Technically, it will work, I'm confident of that. But it gets complex -> web form, engine, folder, monitor runbook to select the text file and start the associated runbook.
The au2mator solution offers these functions by default.


(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

BraunCharles-8479 avatar image
0 Votes"
BraunCharles-8479 answered

I currently have about a half dozen or so runbooks that are usable by our developers. Things like to request "Just in time" admin rights to server or to create a Hyper-V Checkpoint of a server.

For instance, my JIT Admin Rights runbook, when started via IE + Silverlight asks:
What server do you need access to
How long do you need admin rights
Do you also need RDP
Which admin account of yours needs this access
Your E-Mail address for confirmation
A few other questions and then acts on the input data to write data to SQL which is then acted upon by the various activities.

There is another runbook that checks the SQL DB every 15 minutes or so and confirms the expiration time of the currently valid admin rights requests and if that time is past, the admin rights are taken away.

So I guess what I might envision is a website landing page that where the users will be given a list of runbooks that they can run and they click on the link, similar to what they do currently when they go to my SCO server running the webservice.

When they click the link for "Request Just In Time Admin Rights On A Server" they will be presented with a webform that either writes their responses into a SQL DB that SCO can check every few minutes on to see if there is a new request pending or the data they input into the webform will be written to a text file and dropped in the "JIT Admin Requests" folder on the SCO server. Then have a runbook to check if there is a new file in the JIT Admin Requests folder every 2 minutes and if so, fire off the JIT Admin Requests runbook using the data in the text file for the parameters of the request.

The Au2mator solution looks pretty slick but I don't know if my organization would be willing to pay even a small amount of money for something that we can do for "free" using our existing resources.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

pfzim avatar image
0 Votes"
pfzim answered

I can recommend a free alternative console for Orchestrator that doesn't require Silverlight. But the moderator does not allow posting the link.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

StefanHorz avatar image
0 Votes"
StefanHorz answered StefanHorz edited

Hi,

I just have been informed that Microsoft released on 10/20/2021 System Center Orchestrator 2019 Web Console & Web API:
- New WebConsole that works in modern browsers without Silverlight.
- New WebApi that is primarily used only by the new WebConsole.
- The WebApi uses Windows Authentication for all endpoints. Additionally, Folder and Runbook permissions set using the RunbookDesigner are honoured.
https://www.microsoft.com/en-us/download/details.aspx?id=103552

The link from @pfzim for the alternative console for Orchestrator that doesn't require Silverlight: https://github.com/pfzim/websco

Regards,
Stefan

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.