Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We are trying to copy 3 files from our domain controller to a user PC and have it execute from a .bat file when a user logs in via Active Directory.

When we associate the .bat file to a user in AD for their logon, the PC copies down the 2 files, but the executable isn't launched.

Am I doing something wrong here?

Here is the script in question:

mkdir c:\stinger_dl
copy \\DC01\netlogon\install\PsExec.exe c:\stinger_dl\
copy \\DC91\netlogon\install\stinger.exe c:\stinger_dl\
c:\stinger_dl\psexec.exe /accepteula -u domain\admin -p MagicPassword -d -h c:\stinger_dl\stinger.exe --SILENT --ADL --GO --RPTALL --DELETE --REPORTPATH=c:\stinger_dl

We had a nasty virus outbreak last Friday (current virus protection missed it) and are trying to force a scan on all user PCs with Stinger when they login tomorrow.

Anyone interested, this is the virus that got us

share|improve this question
    
The script works on XP machines fine. The issue we ran into was Win7 and higher because of UAC. That is why we decided to try the GPO route since those logon commands run elevated from AD. I'll try the pause command now and get back to you. –  ProfessionalAmateur Mar 25 '13 at 3:51

2 Answers 2

Using group policy you could add the .exe to run on start up on its own, not via a .bat file? Will still allow you to have your parameters etc.

User Configuration > Windows Settings > Scripts(Log on/Log off) Just add the exe here with the parameters.

share|improve this answer
    
We tried that, we finally got Win7 and XP to work, but Win8 was still giving us fits. We only have 5 Win8 machines at this point so Im calling it a night. –  ProfessionalAmateur Mar 25 '13 at 5:07
    
What did you do to make it work on both xp & 7? –  Dan Mar 25 '13 at 5:21
    
The XP worked from the start. Once we removed the PSEXEC call it worked on Win7 straight from a .bat file. Win8 still seems to prompt with some form of UAC regardless... Its really odd. –  ProfessionalAmateur Mar 25 '13 at 6:44

Hate to answer so late to the party, but this is worth noting...

c:\stinger_dl\psexec.exe /accepteula -u domain\admin -p MagicPassword .exe...

A login script must of course be on the network where users' accounts can see it. While the chance of most users having both the curiosity and the resourcefulness to find it is low, it's still there, where anyone can read it should they trip over the correct network share.

It's a good idea to not use your 'main' domain administrator anytime credentials must be stored in scripts. Create a temporary domain admin (or power user when it'll do) with a different password, disabling the account when the need passes--the sooner the better. If you have a similar need in a few weeks, change the password before re-enabling the account.

The last thing you want is giving domain admin creds to that jerk in accounting who got fired from helpdesk for yelling at customers. :-)

share|improve this answer
    
I believe it is possible to create a user whose only administrative permission is to add machines to the domain. –  Falcon Momot Aug 8 '14 at 3:37
    
@FalconMomot Good point; that sounds correct, but my AD-Fu is not very strong. If that concept can be extrapolated to relegating a user to copying files or running precisely one executable, it'll drain my Chicken Little post of a little gravity. –  zedmelon Aug 8 '14 at 17:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.