0

I'm attempting to use SCCM to run a batch file to copy a file from an app deployment to machine's %public%/desktop folder but am getting an 'Access is denied' error while running.

The script itself looks like this: 

copy \\SCCMfqdn\DeployApp\fm-launcher\FM-Launcher.fmp12 %public%\desktop\Launcher.blah /Y
ECHO OFF
echo YOUR LAUNCHER FILE HAS BEEN COPIED
pause
exit

The error I am getting is just before 'Echo Off' and it states 'Access is denied'. If I run the script as an administrator it completes successfully.

Is there any way to accomplish what I am trying to do? Would it be better to use a group policy script? (I imagine it would have the same error?)

Thanks for any help!

Update: Per comments below it looks like the script MUST run as an admin to copy to the Public Desktop. Is there a way to script this with /runas or something? I see flags for user specifications but not for a password?

Improve this question
4
  • Access to the public folder requires administrative privileges, which is why it works when ran as admin.
    – Davidw
    Sep 14, 2015 at 22:40
  • I had kind of worked that out. I am however running in to an issue with getting the .bat file to run as an administrator? I can't find out how to embed credentials and have it run properly (I can specify user but it prompts for password?) Any advice for getting it to work? @Davidw
    – Abraxas
    Sep 14, 2015 at 22:56
  • What mechanism in SCCM are you using to run this batch file on remote computers?
    – Get-HomeByFiveOClock
    Sep 15, 2015 at 1:49
  • @Get-HomeByFiveOClock - Application Deployment - Manually copy from distrib point - Deployment type: script Installer, Content points to the location, program points to the batch file, install for system regardless of login. Let me know if you need anything else. I'm VERY new to SCCM
    – Abraxas
    Sep 15, 2015 at 1:57

2 Answers 2

Reset to default
2

Packages and Scripts deployed through SCCM will be run on the end nodes using the NT AUTHORITY\SYSTEM account. This has absolute rights on the local machine on which it is being run.

One implication of it running under this account is that the NT AUTHORITY\SYSTEM usually does not have rights to access other networked devices or locations.

This can be remedied by adding "Domain Computers" permissions to access this directory. (Please don't add "Everyone")

For more details: you can check out this answer on SO detailing the use of the NT Authority\SYSTEM and SCCM.

Improve this answer
3
  • Just to verify, you're suggesting to grant access to 'Domain Computers' on each computer's %public%/desktop folder?
    – Abraxas
    Sep 15, 2015 at 2:31
  • No, that account will by default have access to the %public%\desktop folder. Domain computers will need to be granted explicit rights to the networked path \\SCCM%fqdn%\fm-launcher\...
    – Get-HomeByFiveOClock
    Sep 15, 2015 at 11:49
  • 1
    Don't thank me. I did it for the points. :)
    – Get-HomeByFiveOClock
    Sep 15, 2015 at 18:50
0

perhaps net use could help

   NET USE \\SCCMfqdn\DeployApp\fm-launcher\ /u:server\user *password* 
   copy \\SCCMfqdn\DeployApp\fm-launcher\FM-Launcher.fmp12 %public%\desktop\Launcher.blah /Y
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .