Remote scripting problems

Thanks for the reply. That is a great explanation and that info helps quite a bit.

"The script runs under the context of the local system account and that account doesn't have access to the network."

I think that explains just about every problem I was having. I can't wait for a workaround for that limitation.

I also tried running a script that copies over a batch file and runs the command from the batch file. That didn't work either. This must still be under the controll of the local system account. In my case, the executable cannot be copied to the remote machine. It must be run from the network location. I may be able to work around this, but I'd still need the remote computer to access the network resources so I doubt it will work.

P.S.- I just recommended VNCScan to my class at school. Hopefully, you'll get a few new clients soon. I love your program and your online support. Keep it up!

Lookinto PSExec a Mark Russinovich tool.
http://technet.microsoft.com/en-us/sy...

It would be neat to have in GUI format what I do now with command line.

Thanks P00PDOG, and thanks again Steve. However, both scripting methods seem to be using the System account so they will not execute files over the network. This is helpful for other things though.

sultanofsin If you are running as the system account on the remote system then that is essentially a local admin on tthe remote system. Anything you run should work unless I am mistaken about where exactly the system account is running.

Steve, no I havent tried even half of the features yet, I'm still evaluating, I was just commenting on the post that said that VNCScan can only use the "system " account, psexec.exe can run any process as any user domain or local or remote local (meaning local accounts on the remote machine like Administrator) I will look into it though, thanks.

I just typed out a nice long explanation of what I'm trying to do. When I clicked on "Post Reply", got page not found. Back button took me back to a blank reply page, Dammit!

So here's the long story short:

I'm on computer A. I'm trying to run a script on Computer B. The script executes a file from a share on Server C. (The file cannot be copied and executed from Computer B. It must be run from the share on Server C)

See the problem? The local system account on Computer B has no credentials on Server C or the Domain. Thus, every attempt results in access denied.

The script is simple:

start \\server\file.exe

I'll try using a batch file with the runas command on monday, but I doubt it will work. Anyone got any other suggestions? Thanks.

Yes I do, first I want to say that there are a lot of resources on the net about scripting/remote scripting.
first, here are some tools to consider
ScriptLogic/now Called Desktop Authority - this is by far my favorite scripting tool, however it is a per client model and could run thousands of dollars if you have a lot of clients. This is a GUI based log in scripting tool that uses Kixtart as its base. You can use the built in features (too many to get into here) or you can write custom scripts, and they have a run as feature that when a user log’s in it will run all of your scripts and will run any and all as a domain admin or whatever. This would be a one stop shopping for all of your scripting needs except it can get pricey and learning Kixtart would be desirable.

AdminScriptEditor this has morphed into an expansive script editing tool, I use it for VBscript’s and mostly my Kixtart scripts. It is able to do a "run as" and you can embed the whole package into 1 executable (it packs it up for you) but this runs on Kixtart as well so learning Kixtart would be necessary.

Ok, this leads me to Kixtart, this is my favorite scripting language, it was written specifically for sys admins. It requires an exe to run your scripts (like autoit) so I just dumped it into our domains Netlogon dir and call it from there. One of the biggest reasons I like it is that it is very easy to learn. Also its careware (You donate any amount to charity and just send a receipt to the guy who wrote it and you can use it to your hearts content) One e-book and you are scripting.

Now to your task at hand, PSexec is probably what you are looking for, its free and will run any process as any user including a domain user. If you log into a domain computer as a domain admin, and you use PSexec you will be able to run any script and access any resource on your network (as long as a domain admin has access to it hehe) you will need to get a list of your domain computers (a VB ADSI script that I can give you) then you can run PSexec on that list of computers as any user and accessing anyfile and you can use UNC paths too. I’m not sure how to get the files to you, I don’t think there is a PM system in place but Steve has my permission to forward my email to you.

Sorry for the long winded email and I hope mentioning other products on this page doesn’t violate any rules here but these are what has made me invaluable to my company. Sultanofsin, you have a lot of reading to do but I will help you if I can. I have a couple of scripts I can give you, but you have to take the initiative.

Ok cool but I'm a little confused. I thought that VNCScan can only push things out using only the "system" account and that could not access network shares. I would assume that if I run VNCScan logged into the computer as me that it is accessing resources as me, but that is not the case? I saw a couple of posts up that we could put a domain admin account on the service, and that most likely would fix sultan's problem, but I would recommend that being a choice during the install. As a matter of fact as far as the pushing out of scripts/whatever in a network environment (9x% are MS AD) that that would be a show stopper. Accessing network resources for remote scripting is pretty much a requirement. I would say that it is an "A bug"<--sorry>m not trying to be, just helpful) I like VNCScan, I like it better than all the other VNC management SW out there, much easier to use and has this network management side to it.

yes, thank you. However, passwords are thus sent over the network in clear text. Can't have that. Thanks for the extra effort.

Understood. I've also tried that unsuccessfully. Additionally, that requires manual adjustment on 500+ computers. I have created a script that works around this problem the HARD way. It took a week to code and I was VERY lucky that the executable was cooperative, but it works. Hopefully someone will come up with a solution (better workaround) before I need to tackle a similar task. Again, thanks for your help.

Instead of having the client connect to the remote share, I wrote a script that copies the file (on the share) directly to that client PC (from MY PC). It then executes the file on the client. That then creates new files in a specific folder on the client. The script then copies the data back to the server. All of this works though MY credentials from MY computer. Thus, the direct connection by the client to the server is eliminated.

More simply:

Computer A copies file to computer B. Computer B executes file (psexec). Files (exported by the executable) are then copied to Server C (from computer A). So Computer B and Server C no longer communicate directly.

Again, this was pretty complex. This solution will most certainly NOT work in other scenarios. The executable just happened to be coded conveniently to make this possible in accordance with our needs and I was able to take advantage of it with the batch script. Sorry, but this really doesn't solve the original problem.

I'm a little confused does VNCScan install a psexec/beyondexec service on each client?

sultanofsin there has to be a better way of doing it. I jist recently had major issues trying to update a very picky EMR application to 600 pc's. I have "Desktop Authority" that works for most of my remote scripting needs but its mostly a logon script tool. I have tried so many variations that I almost gave up(meaning just put domain users in the domain admins group for a day). Then I tried it old school (vb/adsi script to export all of the computer objects in my domain and dumped it into a txt file "computers.txt) then using PSEXEC I ran it against the txt file like this.

psexec.exe -accepteula @computers.txt -u ccp\scriptadmin -p "Password in quotes here" -e -i -c "\\ccpad01\netlogon\Logician_Update\logician_update_sp7.exe"

the above command line is one line. also computers.txt should be formatted with only one client per line e.g.
computer1
computer2
exc....
Now granted my executable is doing a bunch of things but it doesn't matter because its running as a domain admin.

I hope this helps in some way. If you have any questions just post here.

Poopdog, that is a good solution and it will probably work. However, as I mentioned before, your domain admin password is sent unencrypted over the network in plain text. This is not an option. At a command prompt, type psexec /? Then read the second-to-last paragraph.

I do thank you for the suggestion of using psexec though. I have found a few other uses that make my job a little easier.

We have a private network and usually I use other alternatives to PSEXEC but in a pinch it does the trick.

Steve, does the beyond exec install itself as a service on all clients or does it work like I would expect and just be installed on the pc that has VNCScan installed?