1

We are trying to copy 3 files from our domain controller to a user PC and have it execute from a .bat file when a user logs in via Active Directory.

When we associate the .bat file to a user in AD for their logon, the PC copies down the 2 files, but the executable isn't launched.

Am I doing something wrong here?

Here is the script in question:

mkdir c:\stinger_dl
copy \\DC01\netlogon\install\PsExec.exe c:\stinger_dl\
copy \\DC91\netlogon\install\stinger.exe c:\stinger_dl\
c:\stinger_dl\psexec.exe /accepteula -u domain\admin -p MagicPassword -d -h c:\stinger_dl\stinger.exe --SILENT --ADL --GO --RPTALL --DELETE --REPORTPATH=c:\stinger_dl

We had a nasty virus outbreak last Friday (current virus protection missed it) and are trying to force a scan on all user PCs with Stinger when they login tomorrow.

Anyone interested, this is the virus that got us

1
  • The script works on XP machines fine. The issue we ran into was Win7 and higher because of UAC. That is why we decided to try the GPO route since those logon commands run elevated from AD. I'll try the pause command now and get back to you. Mar 25, 2013 at 3:51

2 Answers 2

1

Using group policy you could add the .exe to run on start up on its own, not via a .bat file? Will still allow you to have your parameters etc.

User Configuration > Windows Settings > Scripts(Log on/Log off) Just add the exe here with the parameters.

3
  • We tried that, we finally got Win7 and XP to work, but Win8 was still giving us fits. We only have 5 Win8 machines at this point so Im calling it a night. Mar 25, 2013 at 5:07
  • What did you do to make it work on both xp & 7?
    – Dan
    Mar 25, 2013 at 5:21
  • The XP worked from the start. Once we removed the PSEXEC call it worked on Win7 straight from a .bat file. Win8 still seems to prompt with some form of UAC regardless... Its really odd. Mar 25, 2013 at 6:44
1

Hate to answer so late to the party, but this is worth noting...

c:\stinger_dl\psexec.exe /accepteula -u domain\admin -p MagicPassword .exe...

A login script must of course be on the network where users' accounts can see it. While the chance of most users having both the curiosity and the resourcefulness to find it is low, it's still there, where anyone can read it should they trip over the correct network share.

It's a good idea to not use your 'main' domain administrator anytime credentials must be stored in scripts. Create a temporary domain admin (or power user when it'll do) with a different password, disabling the account when the need passes--the sooner the better. If you have a similar need in a few weeks, change the password before re-enabling the account.

The last thing you want is giving domain admin creds to that jerk in accounting who got fired from helpdesk for yelling at customers. :-)

2
  • I believe it is possible to create a user whose only administrative permission is to add machines to the domain. Aug 8, 2014 at 3:37
  • @FalconMomot Good point; that sounds correct, but my AD-Fu is not very strong. If that concept can be extrapolated to relegating a user to copying files or running precisely one executable, it'll drain my Chicken Little post of a little gravity.
    – zedmelon
    Aug 8, 2014 at 17:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .