0

I currently have a group policy startup script (CMD file). It runs during startup, as expected, but there is no UI for the program the script invokes.

For example purposes, let's say I have this command as my startup script:

rundll32 shell32.dll,ShellExec_RunDLL "C:\Windows\System32\notepad.exe"
echo foo > C:\foo.txt

^ This invokes "Notepad" to run, and writes output to a textfile (foo.txt). Pretty simple. When group policy runs this script, the text file is produced and Notepad is running. The problem is that Notepad has no UI. The only way I can tell it is running is through Task Manager/Processes. I have verified it working, but I need Notepad to show up in my taskbar, while running.

...According to TechNet/Microsoft here: Assign computer startup scripts w/ Microsoft

Startup scripts are run as Local System, and they have the full rights that are associated with being able to run as Local System.

My problem is that I really need the Notepad program UI to display and cannot seem to make this happen when it runs under "Local System".

  1. Is there a way to have my startup script run as Administrator? Or is there a way to enable Local System user to have necessary priveleges to fully run Notepad?
  2. Do I need to alter my CMD script to "RUN AS" a different user?
  3. Should I ditch group policy for scheduled tasks? Scheduled tasks are easier to setup. it seems like a toss-up to me?

I would like to point out that I have also tried this with "Scheduled Tasks" under Control Panel/Administrative Tools. I have the same results and same situation, where my script runs successfully but Notepad UI is never displayed. I am open to suggestions using Task Scheduler as well, or different approaches. Thanks!

6
  • 1
    What do you need notepad to open up for? Is there a reason you're using rundll32 to launch it?
    – Nixphoe
    Apr 19, 2011 at 0:38
  • What are you trying to do? Run a program with administrative privileges that a regular user can operate? Startup and shutdown scripts are computer-level scripts; logon and logoff scripts are for users. If the goal is to run a program with Admin privileges without giving the user Admin privileges, that might be a better question to ask.
    – TristanK
    Apr 19, 2011 at 2:32
  • Notepad is what I used an example. What I really need is 10 .NET applications to fire up and run. These custom applications process hardware telemetry from thermostats into our database, in real time. I need these 10 .NET exes to run when the COMPUTER BOOTS UP (starts). I dont care about Login/Logoff, THAT IS NOT AN OPTION. I know everyone suggests that, but that's not really an option. We need these business intensive applications to fire up and run, without anyone ever logging on. And they need their UI's to display. I can make them "run" but I cant ever see them....what gives?
    – D3vtr0n
    Apr 19, 2011 at 14:43
  • The reason Login/Logoff scripts are not an option, is because we have 10 different servers that each need to perform this. If I need to go reboot my 10 servers, I do not want to Logon just to startup my processes. It should automatically happen after a restart. Any ideas how to make this happen for LOCAL SYSTEM user, or how to specify something else?
    – D3vtr0n
    Apr 19, 2011 at 14:45
  • 1
    If you have to log on, it's not a server process. SRVANY or similar would normally work, except that you need a UI. Look up AutoAdminLogon and see if that helps (it's not 100% reliable in my experience)
    – TristanK
    Apr 19, 2011 at 22:37

2 Answers 2

5

Getting the UI to display is going to be a real pain.

First, I'd consider wrapping these programs in a service wrapper (like Non-Sucking Service Manager, for example) and letting the Service Control Manager start them on boot. From the sound of your comment these programs really should be coded as Windows services anyway. (I'd love software vendors to stop writing non-Service "service" programs that require my servers to sit logged-on, etc. Crappy timeclock polling programs seem to all be this way, for example.)

This doesn't solve your UI problem. You're not going to get a GUI interface to launch on top of Winlogon in Windows Server 2008 without "helping" the program. You could get programs running via Startup Scripts in Windows Server 2003 to display their UI on top of Winlogon. To do such a thing now you'd need to create a process with a duplicate of the Winlogon token with the desktop set for the Winlogon desktop.

You may get the UI to pop up after logon by allowing the Service-wrapped programs to interact with the desktop. Maybe. You're probably also exposing yourself to "shatter" attacks, too.

If these are in-house programs you should consider altering them so that they work like real Service programs should. The management UI should talk to the back-end service process via an RPC mechanism. Do this over TCP/IP and, as a bonus, you can run the management program on other machines. Your monolithic Service-and-UI-together approach isn't going to give you the best results.

1

Have you tried "Run these programs at user logon" GPO setting?

http://support.microsoft.com/kb/314488

1
  • I havent tried that method of GPO, but I have been using GPO with no luck (for Startup scripts). I am really trying to avoid having to "logon" to make this happen. I dont want to have to "logon" 10 different servers, just to make my processes/exes run....I would ideally want my processes to start when the machine starts up.
    – D3vtr0n
    Apr 19, 2011 at 15:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .