PSexec and AutoIT scripts changing registry settings

[tAKTelapis]

Hi All,

Recently users have been setting wallpapers on the public computers, Despite the Group Policy not allowing it, they are using third party applications (Such as Irfan view etc) To that end, I came up with this to allow the staff member to easily remove the wallpaper:

RegWrite("HKEY_CURRENT_USER\Control Panel\Desktop\", "Wallpaper", "REG_SZ", "")
Sleep(10)
Run("RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters")oÝ÷ Øk{
âµë-êÞ+-¯)É©Ý­çëzÈ^²Ø^ºÇ«±×¬Ú)1æ§x-êÞÉèàz¶°jYij«²0x"¶§«Þ¶¬m«_W°'!jYhÂËazkh{º×¢¶ð'!z÷«r©º×«¶²Â+!Ûm«ø¥yú%Ç(uá|G!¡hbr(­z·hÊ°Èm¢·¬zÛa{¥©zº'±ë¦

And am copying over wall.bmp to the remote C: with the bat file aswell.

Anyone have any ideas on why Removing the wallpaper works fine, But adding a new one in its place doesn't?

For the record:

If i run the bat file on computer A and tell it to change the wall on computer A it works

if i goto computer B and tell it to change the wall on computer A it doesnt work (both computers logged in as different people)

if i logon to computer A and B as the SAME person, it works fine.

Yet it does not matter who is logged in when removing of a wallpaper, just when setting it...

Anyone?

Ill take wild guesses of things to test and try.

[tAKTelapis]

Ahah,

It appears that it writes to the registry key:

HKEY_CURRENT_USER\.DEFAULT

The new background applies to the Login Screen only.

[weaponx]

You should be using group policy to dissallow wallpaper changing. Also any actions performed through Psexec will be modifying YOUR HKCU entries, not the user logged into the remote system.