How-To Guide: Secure IP Address Change via EventID & Scheduled Task (No Admin Rights)

⚠️ Security Considerations

• Predefine everything: Scripts and tasks should be set up in advance by an administrator.
• Limit scope: The scheduled task can only execute a specific, signed script with strict controls.
• No arbitrary commands: Users cannot provide their own input beyond triggering the event.

🛠️ Step 1: Prepare the IP Address Change Script

This script will be executed by the scheduled task with admin rights. It should:

• Be stored securely (e.g., C:\Scripts\ChangeIP.ps1).
• Have hardcoded or controlled inputs to avoid abuse.

Example PowerShell Script (ChangeIP.ps1)

# Define the interface name and the new IP address details
$InterfaceAlias = "Ethernet"
$NewIPAddress = "192.168.1.100"
$NewSubnetMask = "255.255.255.0"
$NewGateway = "192.168.1.1"

# Change the IP address
Try {
    # Remove any existing IP addresses
    Get-NetIPAddress -InterfaceAlias $InterfaceAlias -AddressFamily IPv4 | Remove-NetIPAddress -Confirm:$false
    
    # Set new IP address
    New-NetIPAddress -InterfaceAlias $InterfaceAlias -IPAddress $NewIPAddress -PrefixLength 24 -DefaultGateway $NewGateway

    # Optionally set DNS servers
    Set-DnsClientServerAddress -InterfaceAlias $InterfaceAlias -ServerAddresses ("8.8.8.8", "8.8.4.4")

    Write-EventLog -LogName Application -Source "ChangeIPScript" -EventId 2001 -EntryType Information -Message "IP address successfully changed."
} Catch {
    Write-EventLog -LogName Application -Source "ChangeIPScript" -EventId 2002 -EntryType Error -Message $_.Exception.Message
}

Best Practices:

• Register ChangeIPScript as an Event Source if not already done.
• Log actions for auditing.
• Make the script read-only for everyone but admins.
• Digitally sign the script to prevent tampering.

🛠️ Step 2: Create the Event Trigger Mechanism

The engineer will trigger an event using a simple script they’re allowed to run.

Example PowerShell Event Trigger Script (TriggerChangeIPEvent.ps1)

# This script just writes an event log entry that the scheduled task listens for.
Write-EventLog -LogName Application -Source "ChangeIPRequest" -EventId 5000 -EntryType Information -Message "Engineer requested IP change."

Best Practices:

• Register ChangeIPRequest as an Event Source if needed.
• This script does not do anything dangerous. It simply triggers the event.

🛠️ Step 3: Set Up the Scheduled Task (Admin Action Required)

Now you need an elevated scheduled task that listens for Event ID 5000 and runs the IP change script.

Create Task Using Task Scheduler (GUI)

1. General Tab:
   – Name: ChangeIP_OnEvent
   – Run whether user is logged on or not.
   – Run with highest privileges.
   – User account: Select an admin account.
   – Disable “Allow task to be run on demand” (optional for security).
2. Triggers Tab:
   – New Trigger → Begin the task: On an event.
   – Log: Application
   – Source: ChangeIPRequest
   – Event ID: 5000
3. Actions Tab:
   – Start a Program: powershell.exe
   – Arguments: -ExecutionPolicy Bypass -File "C:\Scripts\ChangeIP.ps1"
4. Conditions/Settings Tabs:
   – Configure as appropriate for security.
   – Disable “Stop the task if it runs longer than…” if unnecessary.

Create Task Using PowerShell (Alternative)

$Action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument '-ExecutionPolicy Bypass -File "C:\Scripts\ChangeIP.ps1"'
$Trigger = New-ScheduledTaskTrigger -Log "Application" -Source "ChangeIPRequest" -EventId 5000
$Principal = New-ScheduledTaskPrincipal -UserId "NT AUTHORITY\SYSTEM" -RunLevel Highest

Register-ScheduledTask -TaskName "ChangeIP_OnEvent" -Action $Action -Trigger $Trigger -Principal $Principal -Description "Change IP address on EventID 5000"

🛡️ Step 4: Lock Down the Environment

• Script Folder Security:
  – C:\Scripts and ChangeIP.ps1 should be read-only for non-admins.
  – Only SYSTEM and administrators can write/modify.
• Scheduled Task Protection:
  – Only administrators can modify the task.
  – Ensure task does not accept parameters from the triggering event.
• Audit Logging:
  – Enable auditing on script execution and scheduled task actions.
  – Use Event Logs to track every step.
• Optional:
  – Sign the PowerShell script with a trusted certificate.
  – Disable PowerShell for non-admins beyond the allowed trigger script.

🧪 Step 5: Test the Process

1. Log in as the engineer.
2. Run TriggerChangeIPEvent.ps1 (no admin required).
3. The event should be written to the log.
4. Scheduled Task detects EventID 5000 and runs the elevated IP change script.
5. IP address changes without the engineer having admin rights.

✅ What We’ve Achieved

• Non-admin users can request an IP change securely.
• The IP change process is fully controlled.
• There’s no way for the user to hijack the system to install rogue software because:
  – They can’t edit the IP script.
  – They can’t modify the scheduled task.
  – They can’t inject their own commands.

📝 Recap

• Engineer triggers EventID 5000.
• Event triggers a secure Scheduled Task.
• Task runs a predefined script under admin privileges.
• Security is ensured by locking down the files, tasks, and inputs.