RE: [ActiveDir] GPO Permissions with .vbs

Harding, Devon Fri, 07 Oct 2005 11:31:31 -0700

Btw, where are you seeing that the job is scheduled? When I logon as a non-privileged user and click Start, Run & Tasks, there are no jobs scheduled. When I run at.exe from a command prompt, I get ‘access denied’. What are your parameters for the GPO? (Security settings, Enforced etc…)

-Devon

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rich Milburn
Sent: Friday, October 07, 2005 12:11 PM
To: [email protected]
Subject: RE: [ActiveDir] GPO Permissions with .vbs

I tested several scenarios:

1) batch file in startup script in GPO with non-privileged user logging on – job appeared in AT.

2) Your script in startup script in GPO with non-privileged user logging on – job appeared in AT.

3) Your script in logon script in GPO with non-privileged user logging on – job did not appear in AT.

So I verified your results that this does not work from a logon script with a non-privileged user, and I verified that the same script can schedule jobs on the computer from a startup script.

Hope that helps –

Rich

---------------------------------------------------------------------------
Rich Milburn
MCSE, Microsoft MVP - Directory Services
Sr Network Analyst, Field Platform Development
Applebee's International, Inc.
4551 W. 107th St
Overland Park, KS 66207
913-967-2819
---------------------------------------------------------------------------
"I am always doing that which I can not do, in order that I may learn how to do it." - Pablo Picasso

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding, Devon
Sent: Friday, October 07, 2005 10:28 AM
To: [email protected]
Subject: RE: [ActiveDir] GPO Permissions with .vbs

If I put this in the Logon Scripts, it runs but just for local administrators. I need this to run for ALL users.

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of joe
Sent: Friday, October 07, 2005 11:08 AM
To: [email protected]
Subject: RE: [ActiveDir] GPO Permissions with .vbs

Error messages? Do you get anything? Do you know for sure the script is running?

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding, Devon
Sent: Friday, October 07, 2005 9:28 AM
To: [email protected]
Subject: RE: [ActiveDir] GPO Permissions with .vbs

Well it didn’t work….here’s the script:

strComputer = "."

strNewCmd = "C:\PROGRA~1\INTERN~1\iexplore.exe -new http://www.domain.com"

Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colScheduledTasks = objWMIService.ExecQuery("Select * from Win32_ScheduledJob")

For Each objTask in colScheduledTasks

intJobID = objTask.JobID

strCurCmd = objTask.Command

If strCurCmd = strNewCmd Then

Set objInstance = objWMIService.Get("Win32_ScheduledJob.JobID=" & intJobID)

objInstance.Delete

End If

Next

Set objNewJob = objWMIService.Get("Win32_ScheduledJob")

errJobCreated = objNewJob.Create (strNewCmd, "********110000.000000-240", True , 1 OR 2 OR 4 OR 8 OR 16, , , JobID)

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of joe
Sent: Thursday, October 06, 2005 9:01 PM
To: [email protected]
Subject: RE: [ActiveDir] GPO Permissions with .vbs

I can't visualize why it shouldn't work.

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding, Devon
Sent: Thursday, October 06, 2005 2:14 PM
To: [email protected]
Subject: RE: [ActiveDir] GPO Permissions with .vbs

It’ll only schedule tasks on logon scripts, not startup. Someone correct me if I’m wrong.

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rich Milburn
Sent: Thursday, October 06, 2005 11:41 AM
To: [email protected]
Subject: RE: [ActiveDir] GPO Permissions with .vbs

Can you set it to be a startup script instead of a logon script (computer configuration > software section of GPO instead of user configuration > software section) then it will run with privs, not as the non-admin.

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding, Devon
Sent: Thursday, October 06, 2005 9:48 AM
To: [email protected]
Subject: RE: [ActiveDir] GPO Permissions with .vbs

The problem is the at.exe command can only be run by administrators. How can I allow non-admins to run at.exe therefore allowing my script to work.

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Tim Vander Kooi
Sent: Wednesday, October 05, 2005 6:01 PM
To: [email protected]
Subject: RE: [ActiveDir] GPO Permissions with .vbs

What is your OS? Is it a user specific task or a computer based task? If it is a task scheduled to run after the user logs on I'm sure it is permissions, or lack there of.

Tim Vander Kooi

Microsoft Systems Administrator

Explorer Pipeline

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding, Devon
Sent: Wednesday, October 05, 2005 3:56 PM
To: [email protected]
Subject: [ActiveDir] GPO Permissions with .vbs

I created a GPO for all Domain Users to run a .vbs script to create a Scheduled Task. It works with Domain Admins, but not with regular users. How can I fix this?

Devon Harding

Windows Systems Engineer

Southern Wine & Spirits - BSG

954-602-2469

__________________________________
This message and any attachments are solely for the intended recipient
and may contain confidential or privileged information. If you are not
the intended recipient, any disclosure, copying, use or distribution of
the information included in the message and any attachments is
prohibited. If you have received this communication in error, please
notify us by reply e-mail and immediately and permanently delete this
message and any attachments. Thank You.

-------APPLEBEE'S INTERNATIONAL, INC. CONFIDENTIALITY NOTICE-------
PRIVILEGED / CONFIDENTIAL INFORMATION may be contained in this message or any attachments. This information is strictly confidential and may be subject to attorney-client privilege. This message is intended only for the use of the named addressee. If you are not the intended recipient of this message, unauthorized forwarding, printing, copying, distribution, or using such information is strictly prohibited and may be unlawful. If you have received this in error, you should kindly notify the sender by reply e-mail and immediately destroy this message. Unauthorized interception of this e-mail is a violation of federal criminal law. Applebee's International, Inc. reserves the right to monitor and review the content of all messages sent to and from this e-mail address. Messages sent to or from this e-mail address may be stored on the Applebee's International, Inc. e-mail system.

RE: [ActiveDir] GPO Permissions with .vbs

Reply via email to