Using runasset to process a cmd script

[kerrr81]

Hi

I just discovered AutoItV3 yesterday so be patient with me please!

I have a requirement to update the Policy registry keys in HKLM and HKCU for all domain users when they logon to their XP SP2 workstation. To update these keys I need to do it with administrator credentials but in the "logged on users" environment so their Current User hive is updated.

I can't get my commands to run as the admin account, it always seems like the command is being run in the context of the domain user logging on and not the adminuser because I get access denied messages. The au3 script has been compiled and gets called from a logon script.

Here's my script, if someone could assist that'd be great! thanks.

Dim $UserName, $DomainName, $Password

$UserName = "adminuser"

$DomainName = "DOMAIN"

$Password = "********"

RunAsSet ( $UserName, $DomainName, $Password, 2)

Run (@ComSpec & " /c " & "%LogonServer%\NETLOGON\regupdate.cmd")

The regupdate.cmd file contains this;

reg.exe add HKCU\Software\Policies\Microsoft\Windows

reg.exe add HKCU\Software\Policies\Microsoft\Windows\System

reg.exe add HKCU\Software\Policies\Microsoft\Windows\System /v GroupPolicyMinTransferRate /t REG_DWORD /d 0 /f

reg.exe add HKLM\Software\Policies\Microsoft\Windows

reg.exe add HKLM\Software\Policies\Microsoft\Windows\System

reg.exe add HKLM\Software\Policies\Microsoft\Windows\System /v GroupPolicyMinTransferRate /t REG_DWORD /d 0 /f

[cruizzer]

Hi

Are you sure, that you can use the variable %LogonServer% in a logon script..??

Cruizzer

[Jos]

Hi

I just discovered AutoItV3 yesterday so be patient with me please!

I have a requirement to update the Policy registry keys in HKLM and HKCU for all domain users when they logon to their XP SP2 workstation. To update these keys I need to do it with administrator credentials but in the "logged on users" environment so their Current User hive is updated.

I can't get my commands to run as the admin account, it always seems like the command is being run in the context of the domain user logging on and not the adminuser because I get access denied messages. The au3 script has been compiled and gets called from a logon script.

Here's my script, if someone could assist that'd be great! thanks.

Dim $UserName, $DomainName, $Password

$UserName = "adminuser"

$DomainName = "DOMAIN"

$Password = "********"

RunAsSet ( $UserName, $DomainName, $Password, 2)

Run (@ComSpec & " /c " & "%LogonServer%\NETLOGON\regupdate.cmd")

The regupdate.cmd file contains this;

reg.exe add HKCU\Software\Policies\Microsoft\Windows

reg.exe add HKCU\Software\Policies\Microsoft\Windows\System

reg.exe add HKCU\Software\Policies\Microsoft\Windows\System /v GroupPolicyMinTransferRate /t REG_DWORD /d 0 /f

reg.exe add HKLM\Software\Policies\Microsoft\Windows

reg.exe add HKLM\Software\Policies\Microsoft\Windows\System

reg.exe add HKLM\Software\Policies\Microsoft\Windows\System /v GroupPolicyMinTransferRate /t REG_DWORD /d 0 /f

Opt("ExpandEnvStrings", 1)
Run (@ComSpec & " /c  \\%LogonServer%\NETLOGON\regupdate.cmd")

[jinxter]

maybe use autoit to change in the registry instead of calling a cmd-file...

RegWrite ( "keyname" [,"valuename", "type", value] )

[kerrr81]

Hi

Are you sure, that you can use the variable %LogonServer% in a logon script..??

Cruizzer

Hi, yes. That variable is set before the login script runs.

It's the login script defined in the users AD profile

Edited March 22, 2007 by kerrr81

[kerrr81]

Opt("ExpandEnvStrings", 1)
Run (@ComSpec & " /c  \\%LogonServer%\NETLOGON\regupdate.cmd")

Thanks JdeB - this got variables working in the dos shell OK and got me on the right track. However it seems that the Policy area in the HKCU hive is special and the only bit actually restricted to read only access to the current user. The way the hive gets loaded means that it's just not possible to use someone elses credentials to modify the current user hive while already open. Regwrite didn't work because of this reason, but thanks for the suggestion.

I got a workaround by making the current user a local administrator first of all, then they have permission to update that area of their registry, then remove them from the group. Being new to this my script is clunky but it works so how can I streamline it. Thanks again

Dim $UserName, $DomainName, $Password

$UserName = "adminuser"

$DomainName = "DOMAIN"

$Password = "********"

RunAsSet ( $UserName, $DomainName, $Password, 0)

Opt("ExpandEnvStrings", 1)

RunWait (@ComSpec & " /c net localgroup administrators /add %username%")

RunAsSet ( $UserName, $DomainName, $Password, 2)

RunWait (@ComSpec & " /c %LogonServer%\NETLOGON\regupdate.cmd", @SystemDir)

RunAsSet ( $UserName, $DomainName, $Password, 0)

RunWait (@ComSpec & " /c net localgroup administrators /delete %username%")