RE: [ActiveDir] GPO Permissions with .vbs

Mon, 10 Oct 2005 01:15:21 -0700

_vbscript_ version below. If you launch this with:
 
wscript <scriptname>.vbs
 
then it won't create a window (so you don't need quiet) I've added an inital check so the program just terminates if the needed time has passed.
 
Joe - I can't get to your web site today; nslookup doesn't give me an IP address. Not sure if that's a problem with your site or our DNS ...
 
Steve
 
set oShell=createobject("wscript.shell")
sTime="10 oct 2005 09:09"
scmd="c:\\progra~1\\intern~1\\iexplore.exe -new www.joeware.net"
if datediff("s",now,sTime) >0 then
  do while datediff("s",now,sTime) >0
    wscript.sleep 60000
  loop
  oShell.run sCmd
end if
 
 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of joe
Sent: 08 October 2005 04:21
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO Permissions with .vbs

Now that I have a nice steak from Texas Roadhouse in my belly I can think straight. :o)
 
Assuming the perl script is called timedfire.pl
 
my $d1="10/7/2005";
my $t1="23:04";
my $cmd="c:\\progra~1\\intern~1\\iexplore.exe -new www.joeware.net";

my ($mon,$day,$year)=split(/\//,$d1);
my ($hour,$min)=split(/:/,$t1);
my $cmp=GetCmpVal($year,$mon,$day,$hour,$min);
$curr=GetCurrentTime();
while($cmp>$curr)
 {
  sleep 60;
  $curr=GetCurrentTime();
 }
exec $cmd;
 
sub GetCmpVal
 {
  return sprintf("%04s%02s%02s%02s%02s",@_);
 }
 
sub GetCurrentTime
 {
  my @lt=localtime();
  return GetCmpVal($lt[5]+1900,$lt[4]+1,$lt[3],$lt[2],$lt[1]);
 }
 
You should be able to put in the logon script
 
quiet timedfire.pl
 
 
 
That can be further reduced but I wanted it to be readable. If someone wants to convert to _vbscript_, that might be fun for people who don't do perl.
 
   joe
 
 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Brian Desmond
Sent: Friday, October 07, 2005 9:15 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO Permissions with .vbs

This should be a piece of cake to do with a .net app. It's got an easy option to hide from the taskbar, so you don't have to call the Win32 API to do that (not that its hard...), it has a couple of timer classes, and it has a Process class you can use to kick off a process. Sounds like a compelling reason to learn C# or VB.Net to me. ;)
 
Thanks,
Brian Desmond
 
c - 312.731.3132
 
 
 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of joe
Sent: Friday, October 07, 2005 9:02 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO Permissions with .vbs

Oh I just chased back through this thread... You want to fire up IE, I didn't catch that before, I didn't look that close at the specific process you wanted fire, just that you wanted to fire a process. You should still be able to do this with a startup script with AT as long as you specify interactive, it should pop in the current interactive session but I would be concerned of the security context it runs in which would be localsystem. In order to schedule something in the security context of another ID you will need to be able to specify userid/password which isn't fun either since someone will probably be able to see it if they are bright.
 
What you want is something that opens an IE window in the context of the current user at a specified time. I am not aware of anything that will do that. You almost need a special app that can be launched by the user in the logon script in their security context that will sleep until the specified time and then fire the app. Here is a point where being an admin with programming skills is nice though you may be able to do this with a script. Have the script fire another process that hides itself from the task bar and pops into the screen at the designated time. 
 
I will think about this. There might be a way to pull this off with a perl script.    
 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harding, Devon
Sent: Friday, October 07, 2005 4:46 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO Permissions with .vbs

How would I use schtask to assign to more than one computer.  It seems like that may be our only option.

 

I can’t believe its that difficult to get a popup of IE on ALL users desktop at a specific time.

 

-Devon

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kamlesh Parmar
Sent: Friday, October 07, 2005 2:45 PM
To: ActiveDir@mail.activedir.org
Subject: Re: [ActiveDir] GPO Permissions with .vbs

 

This is specific to opening the internet explorer with higher privileges... (nothing to do with script runing at logon or startup)

If I knew, that this scheduled job runs under Admin account
I can elevate my privileges to local admin, instantly,
once the website is opened, I have to just type  c:\ into address bar,  (c:\ will open with FULL ACCESS)


anyway, my actual point is, task will run as scheduled but the Internet explorer will never popup onto user's screen
as it is running under LOCALSYSTEM account.

you will need to schedule task which runs under normal user account, and AT.exe will not allow you to specify the user account.

You will have to create schedule task using schtasks.exe, where u can specify the normal user account under which to run the task.
But gotcha is, you will have to provide the password for user under which u want task to run.

e.g.
schtasks /create /SC WEEKLY /D MON,TUE,WED,THU,FRI /TN myTaskName /TR "C:\PROGRA~1\INTERN~1\iexplore.exe -new http://www.slashdot.org" /ST 11:00 /IT /RU runuser /RP runpasswd /F

but schtasks saves the day as you can schedule the task remotely onto computers. /S is option for specifying the remote system.

But, if you want to use th script then issue is saving the password from prying eyes. :) 
( I normally use AutoIt.exe to create encrypted EXE out of script, for such tasks)

--
Kamlesh

On 10/7/05, Kamlesh Parmar <[EMAIL PROTECTED]> wrote:

At.exe will always reqire admin rights, but normal user account can always schedule task using, Task Scheduler..

 

So use command line utility schtasks.exe, it should be present on all XP box, don't know about win2K..

 

just see the help...

 

schtasks.exe /create /?



 

On 10/6/05, Harding, Devon <[EMAIL PROTECTED] > wrote:

The problem is the at.exe command can only be run by administrators.  How can I allow non-admins to run at.exe therefore allowing my script to work.

 

From: [EMAIL PROTECTED] [mailto: [EMAIL PROTECTED]] On Behalf Of Tim Vander Kooi
Sent: Wednesday, October 05, 2005 6:01 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] GPO Permissions with .vbs

 

What is your OS? Is it a user specific task or a computer based task? If it is a task scheduled to run after the user logs on I'm sure it is permissions, or lack there of.

Tim Vander Kooi

Microsoft Systems Administrator

Explorer Pipeline

 

From: [EMAIL PROTECTED] [mailto: [EMAIL PROTECTED]] On Behalf Of Harding, Devon
Sent: Wednesday, October 05, 2005 3:56 PM
To: ActiveDir@mail.activedir.org
Subject: [ActiveDir] GPO Permissions with .vbs

I created a GPO for all Domain Users to run a .vbs script to create a Scheduled Task.  It works with Domain Admins, but not with regular users.  How can I fix this?

 

Devon Harding

Windows Systems Engineer

Southern Wine & Spirits - BSG

954-602-2469

 

__________________________________
This message and any attachments are solely for the intended recipient
and may contain confidential or privileged information. If you are not
the intended recipient, any disclosure, copying, use or distribution of
the information included in the message and any attachments is
prohibited. If you have received this communication in error, please
notify us by reply e-mail and immediately and permanently delete this
message and any attachments. Thank You.




--
~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Fortune and Love befriend the bold"
~~~~~~~~~~~~~~~~~~~~~~~~~~~




--
~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Fortune and Love befriend the bold"
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Reply via email to