Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Windows Server 2003 box and it is using psftp to connect to a remote linux machine and download files every hour.

Picture 1.png

I have two main challenges with this machine:

First

Scheduled tasks are currently set to run as a user on this box, which I believe requires storing the user's password in the task scheduler. However when the user's password changes the task fails to run. I'd like to have this task always run regardless.

  • I believe the solution to the first problem is to have the scheduled task run as SYSTEM. Is that correct? If so, how do I set this up? Just type SYSTEM in the "Run as" box? And do I need to set a password for SYSTEM because I believe I tried with no password and it said the job did not run because the password was incorrect. Perhaps I am doing this wrong.

Second

Putty requires that the remote key for a server is stored in the registry to verify the server's authenticity. However this seems to be stored on a per-user basis and so if I switch the script to run as a different user it seems the user must run the script interactively the first time so that the key is stored in the registry.

  • Instructions on the putty website mention that keys should be added to the following registry location:

    HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\SshHostKeys
    

But judging from "HKEY_CURRENT_USER" I don't think that will be for the SYSTEM user. If I do set up this task to run as SYSTEM, how can I make sure that the appropriate key is stored in the registry for the host? I don't mind manually adding it (there is a perl script to convert a known_hosts file), but where should it go?

ps: myscript.bat just uses psftp.exe to pull files from a remote server. Nothing special. There is no flag to skip checking authorized hosts, and the folks at putty mention that this would be a bad idea anyhow.

share|improve this question
    
Dont forget to consider using Putty's PSCP.exe copy tool. –  djangofan Dec 6 '11 at 18:09
    
heh, SSH keys in the registry... Windows.. –  Tim Dec 6 '11 at 18:28

4 Answers 4

up vote 2 down vote accepted

I realize there's already an accepted answer for this question, but I thought I'd throw in the answer to where the SYSTEM account's user registry hive is located. It's actually in HKEY_USERS\.DEFAULT which most people incorrectly assume is the default user hive for newly created accounts. More info on the history and background of the key is on Raymond Chen's MSDN blog here:

The .Default user is not the default user

share|improve this answer
    
This seems to be the best answer. I set up a profile in putty, ran the script manually, accepted the key, and then copied the values from HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\SshHostKeys into the corresponding default user @Ryan Bolger mentions, and it is working very well. Tried setting up another user on the system, but with the way permissions are set they would need to be an administrator to run scheduled tasks and I don't want to add a local administrator account, nor do i wish to rewrite user permissions with group policy or something like that. Running as system seems ok. thx! –  cwd Dec 21 '11 at 4:15

I believe the solution to the first problem is to have the scheduled task run as SYSTEM. Is that correct?

Generally you should only run something as SYSTEM if it actually needs that absolute level of privileges. A much better choice might be to setup a service account just for this task. Then you may want to disable password expiration for the account, or setup a notification schedule to remind you to update the service account password & task details.

You You can of course temporarily login to this service account so you can accept the SSH key the first time.

share|improve this answer
    
I think the user account for tasks is a great solution, thanks! Out of curiosity though, is it possible to schedule it as SYSTEM, and do you need a password? –  cwd Dec 6 '11 at 18:46
    
It is possible, SYSTEM does not have a password. I haven't used xp/2003 in a while, I am not sure the correct method to create a SYSTEM task. Try machinename\SYSTEM maybe? –  Zoredache Dec 6 '11 at 18:48

Use pscp.exe -batch -load PROFILE on the command line. Set up a profile for your connection using a ssh-key-pair for that profile and then use that profile.

The user-account you use for this should be local, but it does not require any special privileges (just read for the key and write for the files).

Try pscp -h for all command switches.

share|improve this answer
    
this looks looks pretty good. i will have to give it a try. any links on how to set up a profile? have not done that yet. –  cwd Dec 6 '11 at 22:45
    
I would use interactive Putty to set up the profile. The most important settings are target machine-name, type of ssh-protocol (2 only should work nowadays), compression on/off, login-name, private key file. –  Nils Dec 8 '11 at 22:07

I wouldn't use system like this. I'd just create a new user called puttyservice, set it to never expire, and off you go. Obviously, you'd use this new users profile.

I'd also consider installing a more robust solution like Cygwin and use the OpenSSH version of ssh, instead of putty. That's the standard version on every linux system out there and might be more robust and easier to work with than putty. Of course you lose the GUI, but that shouldn't matter in terms of scripting.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.