RE: [ActiveDir] AD startup scripts problem

Fri, 28 Jan 2005 08:42:28 -0800

Title: RE: [ActiveDir] AD startup scripts problem
In my testing, the startup script runs in the context of LocalSystem unless it has to go off-box (i.e. to connect to a network share) in which case it impersonates the machine account to get access to that share. So as long as the machine account has access to the share, then it shouldn't be a permissions issue.
 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Robert Rutherford
Sent: Friday, January 28, 2005 11:31 AM
To: [email protected]
Subject: RE: [ActiveDir] AD startup scripts problem

the local computer's system account does process the script but here it looks like it doesnt have permissions to read the script on the 'servers' share
From: [EMAIL PROTECTED] on behalf of Rocky Habeeb
Sent: Fri 28/01/2005 16:26
To: [email protected]
Subject: RE: [ActiveDir] AD startup scripts problem

Correct me if I'm wrong, but doesn't the Local System account have full
control of the entire boot operation?  And isn't it responsible to process
the complete range of operations including network authentication and domain
based GPO processing?  And if not who is?  And if so, doesn't that mean >it<
should be processing this script?

Rocky
___________________________________________________________



-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Paul Wilkinson
Sent: Friday, January 28, 2005 10:58 AM
To: [email protected]
Subject: Re: [ActiveDir] AD startup scripts problem


I *think* that you do actually have network access at the point that
computer startup scripts run.  However, you'll have a security issue
because the local system account doesn't have access to your sever
share.  You could add each machine account to that share.  If one of
your computers is named Bob, add Bob$  to the ACL's of the share.  You
have to click on the "object types" button and select computers in the
window where you add the computer account.  You could also add "Domain
Computers" if you want all computers to be able to access the share with
the local system account.

I've never tried this myself, so I'm not sure if this will work.


Paul Wilkinson
865-974-0649
2422 Dunford Hall
OIT Lab Services
University of TN, Knoxville



Mark Abbiss wrote:

> I think this is it in a nutshell. When I put everything locally on the
> machine the script ran and created the report.
>
> As you say, I have no network connectivity when in the startup phase.
>
> Or is there a workaround ?
>
> Thanks for all the input
>
>
> ----Original Message Follows----
> From: <[EMAIL PROTECTED]>
> Reply-To: [email protected]
> To: [email protected]
> Subject: Re: [ActiveDir] AD startup scripts problem
> Date: Fri, 28 Jan 2005 08:05:12 -0600
>
> Hi Mark...
>
> I believe it's running at system level on startup, and i believe
> system has
> no network rights.
>
> John
>
>
>
>
>
>              "Mark Abbiss"
>              <[EMAIL PROTECTED]
>
> ail.com>                                                   To
>              Sent by:                  [email protected]
>
> [EMAIL PROTECTED]                                          cc
>              ail.activedir.org
>
> Subject
>                                        [ActiveDir] AD startup scripts
>              01/28/2005 07:07          problem
>              AM
>
>
>              Please respond to
>              [EMAIL PROTECTED]
>                 tivedir.org
>
>
>
>
>
>
> I have tried everything I know but I just cannot make a script run at
> computer start up. I have successfully got it working on a user basis at
> logon but assigning it to a computer is just not working.
>
> Here is what I have done, please can someone let me know if I have I
> missed
>
> something completely obvious ?!
>
> 1. Wrote a very simple batch file. Contents of batch is :
>              \\server01\analysepc.exe /output \\server01\output
>
> 2. Created the necessary share on SERVER01
> 3. Created a new domain security group and added the PC object into that
> group
> 4. Made sure that the new group had full rights on the new share and
> "output" directory
> 5. Created the GPO to run the batch file from the Computer Config section
> of
> the GPO. Also disabled the User Config processing section.
> 6. Linked the GPO to the OU where my PC object is held
> 7. Set the filtering to apply the GPO only to the new security group.
>
> Made sure everything was replicated and then started the computer. But
> the
> script does not work ! I have checked with gpresult that the policy is
> being
> applied and it is. If I try the command from the batch when I have logged
> on, it works !
>
> What might I be missing ?
>
> Many thanks
>
>
> List info   : http://www.activedir.org/List.aspx
> List FAQ    : http://www.activedir.org/ListFAQ.aspx
> List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
>
>
> List info   : http://www.activedir.org/List.aspx
> List FAQ    : http://www.activedir.org/ListFAQ.aspx
> List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
>
>
> List info   : http://www.activedir.org/List.aspx
> List FAQ    : http://www.activedir.org/ListFAQ.aspx
> List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/

List info   : http://www.activedir.org/List.aspx
List FAQ    : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/



List info   : http://www.activedir.org/List.aspx
List FAQ    : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/

=======================================================================
              Scanned for virus infection by Messagelabs
=======================================================================

Reply via email to