Sign in to follow this  
Followers 0
tAKTelapis

PSexec and AutoIT scripts changing registry settings

3 posts in this topic

Hi All,

Recently users have been setting wallpapers on the public computers, Despite the Group Policy not allowing it, they are using third party applications (Such as Irfan view etc) To that end, I came up with this to allow the staff member to easily remove the wallpaper:

RegWrite("HKEY_CURRENT_USER\Control Panel\Desktop\", "Wallpaper", "REG_SZ", "")
Sleep(10)
Run("RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters")oÝ÷ Øk{
âµë-êÞ+-¯)É©Ý­çëzÈ^²Ø^ºÇ«±×¬Ú)1æ§x-êÞÉèàz¶°jYij«²0x"¶§«Þ¶¬m«_W°'!jYhÂËazkh{º×¢¶ð'!z÷«r©º×«¶²Â+!Ûm«ø¥yú%Ç(uá|G!¡hbr(­z·hÊ°Èm¢·¬zÛa{¥©zº'±ë¦

And am copying over wall.bmp to the remote C: with the bat file aswell.

Anyone have any ideas on why Removing the wallpaper works fine, But adding a new one in its place doesn't?

For the record:

If i run the bat file on computer A and tell it to change the wall on computer A it works

if i goto computer B and tell it to change the wall on computer A it doesnt work (both computers logged in as different people)

if i logon to computer A and B as the SAME person, it works fine.

Yet it does not matter who is logged in when removing of a wallpaper, just when setting it...

Anyone?

Ill take wild guesses of things to test and try.

Share this post


Link to post
Share on other sites

Ahah,

It appears that it writes to the registry key:

HKEY_CURRENT_USER\.DEFAULT

The new background applies to the Login Screen only.

Share this post


Link to post
Share on other sites

You should be using group policy to dissallow wallpaper changing. Also any actions performed through Psexec will be modifying YOUR HKCU entries, not the user logged into the remote system.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0