|
Randy,
A lot
of people use psexec from Sysinternals to run services or commands on a remote
machine. I do this to run NTRes kit commands on remote machine via batch files
etc. Use the external cmd in SA to trigger it.
the
down side is that you have to pass the username and password that has rights to
run the remote commands in clear text.
Hope
that helps
Barry
Did
you also try that when used execute external command using your cmd.exe
trick?
I have tried that repeatedly with domain\user
and just user, and It will only work if SA is not run as a
service!
Randy Fuller
LIS Coordinator
Southeast Missouri Hospital
----- Original Message -----
Sent: Wednesday, October 29, 2003
9:08 AM
Subject: RE: [SA-list] SA Service
local system account and rights
On the alert tab you select properties of the execute command
(reboot server) and you check the authentication there. When you
execute a command you cannot set a username and password so by executing
cmd.exe you are not proving anything other than that the local system
account does not have privileges to reboot the remote server which we
already knew. If you choose reboot NT/2K server and you enter the
same authentication information (and check the box that says "authenticate
before checking" (which should be changed to "authenticate before
executing")) as you are currently logged in with on that machine you
should not have any problems.
No messages in the remote
eventlog.
If I just put an alert to Execute Command
and put cmd.exe in the command to execute box and after the cmd prompt
is opened, I go to the cmd prompt that was opened by SA running as a
service and type SHUTDOWN -R -M \\computername
I get a message that says: "A required
privilege is not held by the client.
If I open a cmd prompt on the same system
by type cmd at the Run menu and then type the above command it works
fine.
Another thing I noticed if I enter the
command "net localgroup" in the cmd prompt spawned by SA I get
this:
System error 1312 has
occurred.
A specified logon session does not exist.
It may alread have been terminated.
I know it has something to do with the
rights that the SA service has. I really need to be able to sent
REBOOTs from SA, but so far looks like the only way I can get it to work
is to NOT run SA as a service!
Any further ideas?
Randy
----- Original Message -----
Sent: Wednesday, October 29, 2003
2:04 AM
Subject: RE: [SA-list] SA Service
local system account and rights
check the eventlog of the remote system to see what message you
get...
dirk.
There are no errors, just an entry that
says Sending reboot command to server name
If I run Servers Alive as an
application, it works fine.
Just has the problem with running as a
service.
----- Original Message -----
Sent: Tuesday, October 28,
2003 3:55 PM
Subject: RE: [SA-list] SA
Service local system account and rights
Do you have logging enabled under setup? If so what
does the log show? If not turn on logging please and let us
know what the log says. It should give some error number
which will help us debug.
I put in the info in the format
domain\user and then password, and it still will not
work.
----- Original Message -----
Sent: Tuesday, October
28, 2003 3:24 PM
Subject: RE: [SA-list] SA
Service local system account and rights
there should be a check box to
authenticate before issuing the command. If you put the
proper account info in there then SA will execute with the
correct permissions.
We have Servers Alive running
as a service in XP and have the Local system account checked
with the Interact with desktop check. We have a check
that needs to restart a W2000 computer and the Execute
command for Restart does not work.
So, we used a batch file that
issues the shutdown.exe command. It will work when you
test it from a command prompt, but from SA, it will not
work.
We found from further testing,
that the issue has to do with the Local System Account not
having the rights to issue the command. If you run SA
as a desktop application, both the SA Reboot NT/W2K Server
command and the external batch file running the shutdown.exe
work perfectly. Neither will work when SA is running
as a service.
My question is, can I give the
Local System Account rights to use these commands, and if
so, HOW?
Randy Fuller
|
