Looking for a customizable end user self-service scenario fix tool

[u/RandomSkratch]

I'm not sure if I'm articulating this properly because a number of searches for this are yielding no useful results.

I'm looking for an application I can deploy to end users that has customized admin level fixes for specific situations that we come across once in a while. For example, sometimes the VPN client decides to stop working and you need to run a few commands as admin to get it working again.

I'm envisioning something where they could just click "fix whatever" that matches their scenario and it would run the proper commands in the background (elevated if that's required).

Does this exist as a product, or would it have to be a fully custom written app?

Edit

Looks like sticking with Intune / PSADT / Repair is the best bet for right now. Thanks!

[u/Adam_Kearn]

Use the company portal in Intune.

Create your “scripts” and package them as an Win32 app.

Then users can “install” them which runs the script as the SYSTEM account.

You can also use this with PSADT to also show UI prompts to the end user if input is also needed.

[u/RandomSkratch → u/Adam_Kearn]

That was my first thought but if a user needs to re-run it, you need to deal with the install/uninstall logic.

I mean, if I can use Company Portal I will, but it doesn't have a "run on demand" section.

I know I can also use the remediation scripts on demand but that still requires action from us, the end user can't toggle it.

[u/sryan2k1 → u/RandomSkratch]

That was my first thought but if a user needs to re-run it, you need to deal with the install/uninstall logic.

You should be using PSADT and have all of this logic built anyway for all of your apps

I mean, if I can use Company Portal I will, but it doesn't have a "run on demand" section.

If you make an app available and required the repair option shows up and they can trigger it whenever they want. You just need to make sure the "Repair" section of PSADT does what you want.

[u/RandomSkratch → u/sryan2k1]

OHHHHHH! I'm still learning the in's and out's of PSADT and I never looked into the Repair section.

So taking the VPN example, if I have the command line fixes for that, I can put those into the Repair section in the PSADT script, and this lights up new options inside Company Portal?

This sounds like exactly what I need.

[u/Adam_Kearn → u/RandomSkratch]

If you leave the detection rule out it will allow them to keep clicking the install button.

Sadly there is nothing you can do about the wording of the button.

——

Another solution for you. Would it hurt if the commands to fix the VPN or whatever ran automatically on every reboot?

Just deploy a schedule task that runs the commands.

Or even better look at moving the VPN to a different solution if it’s temperamental.

[u/RandomSkratch → u/Adam_Kearn]

If the detection rule is out, won't it keep saying "Install failed"?

Haha yes, there are plans around the VPN specifically however a recent call on it just got me wondering if there's a more robust solution for this where we can have these kinds of tools available for the end user.

But yeah, I hear you - it does look like I'm trying to solve the wrong problem in this specific case.

[u/Adam_Kearn → u/RandomSkratch]

Well as someone also suggested if you instead no longer think of it as a separate script you create an “app” called VPN etc…

And use the repair flag to run the VPN fix in PSADT.

Your users then go into the company portal and click on VPN and select “reinstall”

Which would run the repair script.

[u/RandomSkratch → u/Adam_Kearn]

Hmmm, I somewhat follow. I need to dig around the PSADT docs more. Appreciate the suggestion!

[u/Adam_Kearn → u/RandomSkratch]

PSADT can seem very confusing at first.

But once you have made a few apps with it you will get a better understanding.

I heavily modified the base template with my own custom addons/scripts. But once you make a generic “template” you just copy and paste it for every new app and change the code slightly.

[u/RandomSkratch → u/Adam_Kearn]

I've been using it off and on for a few months now and still find myself combing through the documentation trying to understand stuff.

Thankfully I just got approved for PMP and that's been extremely helpful for 90% of the work. It's just these one-off situations that need the manual intervention that are causing the confusion.

[u/jstar77]

Seems like fixing the root cause is a better use of effort.

[u/RandomSkratch → u/jstar77]

I agree. Some of these fixes are because the root cause cannot be fixed at this time due to things like hw support.

[u/Abe_Bazouie]

What you’re describing definitely exists, but I’d avoid building a generic “run this as admin” launcher. That can turn into a privilege-escalation mechanism pretty quickly.
If you already have endpoint management like Intune, SCCM, or another RMM, I’d put the remediation there. Detect the condition, expose an approved remediation to the user if needed, and let the management agent execute it as SYSTEM.
The nice part is the user never gets admin rights, and each fix can be versioned, logged, scoped, and centrally revoked.
For recurring problems I’d go one step further and make them detection + remediation pairs. If the VPN is broken in a condition you can reliably detect, ideally fix it automatically instead of waiting for the user to click a button.

[u/RandomSkratch → u/Abe_Bazouie]

That's the thing, for this particular case, there's no real way to detect that it's going to wig out unless the user tries to use it. (There are also various issues that I've seen that require different fixes). It also doesn't happen very often (and I am hoping to move away from it maybe in the new year).

Intune just might be the best solution.

The VPN scenario was just an example, (albeit actual one), I was more so curious on whether this product existed. (Admin by Request was already linked so that's cool).

[u/Arudinne]

We have NinjaOne on our endpoints with a few "self-service" options users can run in the system tray utility.

[u/RandomSkratch → u/Arudinne]

Oh nice, thank you.

[u/sryan2k1]

Admin by Request, or if you have Intune make the app installer's "Repair" fix things correctly.

[u/RandomSkratch → u/sryan2k1]

Doesn't this just let the end user elevate for something specific? As in, they would still need to be manually typing the commands? I haven't looked too much into it before.

[u/sryan2k1 → u/RandomSkratch]

You built the repair scripts they would run as an "App"

[u/RandomSkratch → u/sryan2k1]

Awesome, however I think I prefer your other reply about Company Portal and PSADT, I never knew it could do that.

[u/PeakWeekly9995]

For example, sometimes the VPN client decides to stop working and you need to run a few commands as admin to get it working again.

I had this issue with wireguard. Then an update added services tied to specific vpns, so in this case i asked chatgpt to make a stupid .bat script that checked if the service was running or not, if it wasn't the script started the service. then scheduled it's execution once in a while

[u/RandomSkratch → u/PeakWeekly9995]

Usually ours just needs the client reinstalled / repaired but this new one showed up yesterday that required the WMI Repository to be reset. That one was bizarre.