Ricky
Tue Jun 13 19:06:56 CDT 2006
"Pegasus (MVP)" <I.can@fly.com> wrote in message
news:%23DvvE2ujGHA.4284@TK2MSFTNGP05.phx.gbl...
> See below.
>
> "Ricky" <newsgroupsmail@gmail.com> wrote in message
> news:ebcRWbujGHA.4508@TK2MSFTNGP05.phx.gbl...
>>
>> "Pegasus (MVP)" <I.can@fly.com> wrote in message
>> news:%23hI1m0tjGHA.1272@TK2MSFTNGP03.phx.gbl...
>> >
>> > "Ricky" <newsgroupsmail@gmail.com> wrote in message
>> > news:%23U13OstjGHA.4044@TK2MSFTNGP03.phx.gbl...
>> >>
>> >> "Pegasus (MVP)" <I.can@fly.com> wrote in message
>> >> news:%23023HVojGHA.1508@TK2MSFTNGP04.phx.gbl...
>> >> >
>> >> > "Ricky" <newsgroupsmail@gmail.com> wrote in message
>> >> > news:uUwa7MojGHA.3848@TK2MSFTNGP04.phx.gbl...
>> >> >>
>> >> >> "Pegasus (MVP)" <I.can@fly.com> wrote in message
>> >> >> news:uRvSoumjGHA.1552@TK2MSFTNGP03.phx.gbl...
>> >> >> >
>> >> >> > "Ricky" <newsgroupsmail@gmail.com> wrote in message
>> >> >> > news:O%23ktDXljGHA.3440@TK2MSFTNGP02.phx.gbl...
>> >> >> >> Hi
>> >> >> >>
>> >> >> >> I need help to make a script that allows to run an executable
> file
>> >> >> >> (audit32.exe :
http://itsolutions.intuit.com/Track-It.asp)
> throught
>> >> >> >> domain
>> >> >> >> policies or schedule tasks
>> >> >> >>
>> >> >> >> I can't get done none of both... :(
>> >> >> >>
>> >> >> >> Teh first ideia has to take in the script bellow that were taken
>> > from
>> >> > the
>> >> >> >> net and adapt to Organization Units. If it was possible in each
> day
>> > of
>> >> >> >> the
>> >> >> >> week the executable file "audit32.exe" (instead of calling
>> >> >> >> notepad.exe)
>> >> >> > were
>> >> >> >> called.
>> >> >> >>
>> >> >>
>> >>
>>
>>>>> -----------------------------------------------------------------------
> -
>> > -
>> >> > -
>> >> >> > ------------------------------------------------
>> >> >> >> Schedules Notepad to run at 12:30 PM every Monday, Wednesday,
>> >> >> >> and
>> >> > Friday
>> >> >> >> strComputer = "."
>> >> >> >> Set objWMIService = GetObject("winmgmts:" _
>> >> >> >> & "{impersonationLevel=impersonate}!\\" & strComputer &
>> >> >> >> "\root\cimv2")
>> >> >> >>
>> >> >> >> Set objNewJob = objWMIService.Get("Win32_ScheduledJob")
>> >> >> >> errJobCreated = objNewJob.Create _
>> >> >> >> ("Notepad.exe", "********123000.000000-420", _
>> >> >> >> True , 1 OR 4 OR 16, , , JobID)
>> >> >> >> Wscript.Echo errJobCreated
>> >> >>
>> >>
>>
>>>>> -----------------------------------------------------------------------
> -
>> > -
>> >> > -
>> >> >> > ------------------------------------------------
>> >> >> >>
>> >> >> >> The other ideia was to make a "schedule task" and call the file
>> >> >> >> "audit32.exe" that is in the remote server. All to this step
>> >> >> >> were
>> >> >> >> right
>> >> >> > not
>> >> >> >> complicated but then i don't understant when the file
> "audit32.exe"
>> > is
>> >> >> >> called throught the remote server it does an audit of the server
>> > where
>> >> >> >> the
>> >> >> >> shedule task is and not the remote.
>> >> >> >>
>> >> >> >> I even thought to call "audit32.exe" by the bellow script but
>> >> >> >> result
>> >> >> >> is
>> >> >> > the
>> >> >> >> same
>> >> >> >> --------------------------------------------------------
>> >> >> >> set wshshell = CreateObject("WScript.Shell")
>> >> >> >> wshshell.Run "audit32.exe"
>> >> >> >> --------------------------------------------------------
>> >> >> >>
>> >> >> >> If someone could help me appreciate
>> >> >> >> []
>> >> >> >> Ricky
>> >> >> >>
>> >> >> >>
>> >> >> >
>> >> >> > Let's get the basics sorted out. Assuming that you work on
>> >> >> > PC1 and that you wish to audit PC2, what command would
>> >> >> > you run at the Command Prompt? What parameters?
>> >> >> >
>> >> >> > P.S. Please go easy with your crossposts!
>> >> >> >
>> >> >> >
>> >> >>
>> >> >>
>> >> >> The parameters that i run are: At \\remoteServerName 17:30
>> >> >> "c:\audit\audit32.exe"
>> >> >>
>> >> >> I've already try going throught the "Shedule tasks" once is easier
> to
>> >> >> shedule the tasks but the result has the same as the command
>> >> >> prompt.
>> >> >>
>> >> >> Sorry for my big text but my ideia has to explain detailed the
>> >> >> tests
>> > i've
>> >> >> already made and didn't work out.
>> >> >>
>> >> >> Thanks
>> >> >> []
>> >> >> Ricky
>> >> >>
>> >> >
>> >> > Your report tells us nothing at all about what happens
>> >> > when you run this command. I suggest you do this:
>> >> > - Create the batch file c:\audit\audit.bat on the target machine.
>> >> > - Place these lines inside:
>> >> > @echo off
>> >> > echo %date% %time% Start of task > c:\audit\test.log
>> >> > echo User=%UserName%, Path=%path% >> c:\audit\test.log
>> >> > c:\audit\audit32.exe 1>>c:\audit\test.log 2>>&1
>> >> > echo ErrorLevel of audit32.exe=%ErrorLevel% >> c:\audit\test.log
>> >> > echo %date% %time% End of task >> c:\audit\test.log
>> >> > - Schedule the this batch file to run.
>> >> > - Tell us what you see when you schedule the task.
>> >> > - Report the contents of c:\audit\test.log
>> >> >
>> >> >
>> >>
>> >>
>> >> I've made 3 kind of tests with your script:
>> >>
>> >> 1. TEST (from pc1 to pc2)
>> >> Schedule task at command prompt: "c:>at \\homestation 11:52
>> >> "c:\audit\audit.bat"
>> >> it work well and the "audit32.exe" was called and the audit here made
>> >> (created an automatic xml file with the hardware/software of the
>> >> computer)
>> >>
>> >> log file:
>> >> qua 14-06-2006 11:33:00,30 Start of task
>> >> User=, Path=C:\WINNT\system32;C:\WINNT;C:\WINNT\System32\Wbem
>> >> ErrorLevel of audit32.exe=0
>> >> qua 14-06-2006 11:33:02,17 End of task
>> >>
>> >>
>> >> 2. TEST (DC --> client computer log into domain)
>> >> I've run into a DC and then logoff/login the client computer so i
> could
>> >> register into the domain.
>> >> Then i've run the same command: "c:>at \\homestation 11:52
>> >> "c:\audit\audit.bat"
>> >> It didn't work well... the "audit32.exe" for some reason it wasn't
> called
>> >> and the xml file with hardware/software of the client computer wasn't
>> >> created
>> >>
>> >> log file:
>> >> qua 14-06-2006 11:07:00,03 Start of task
>> >> User=, Path=C:\WINNT\system32;C:\WINNT;C:\WINNT\System32\Wbem
>> >> ErrorLevel of audit32.exe=0
>> >> qua 14-06-2006 11:07:01,47 End of task
>> >>
>> >>
>> >> 3. TEST (DC --> client computer log into domain)
>> >> The log file wasn't created...
>> >>
>> >> I don't understand why sometimes the XML file is created and others
>> >> don't.
>> >>
>> >>
>> >
>> > Let's look at test case two. You now need to refine the
>> > batch file so that it tells you what's happening:
>> >
>> > @echo off
>> > echo %date% %time% Start of task > c:\audit\test.log
>> > if not exist c:\audit md c:\audit
>> > cd /d c:\audit
>> > echo User=%UserName%, PC=%ComputerName% WD=%cd% >> c:\audit\test.log
>> > dir >> c:\audit\test.log
>> > c:\audit\audit32.exe 1>>c:\audit\test.log 2>>&1
>> > echo ErrorLevel of audit32.exe=%ErrorLevel% >> c:\audit\test.log
>> > echo %date% %time% End of task >> c:\audit\test.log
>> >
>> > Note that your jobs run under the System account when you
>> > use at.exe to schedule them. The System account does not
>> > have any access rights to networked resources!
>> >
>> > A much simpler way of running audit32.exe on other PCs
>> > might be to use psexec.exe, as suggested by Dave Patrick.
>> >
>> >
>>
>>
>> I still don't understand why sometimes the file "audit32.exe" runs and
>> creates the XML (with hardware/software of the client computer) file and
>> other don't...
>>
>> Here is the result of 2 tests.
>>
>> 1. TEST (DC --> client computer log into domain)
>>
>> ter 13-06-2006 13:11:00,03 Start of task
>> User=, PC=HOMESTATION WD=C:\Audit
>> Volume in drive C has no label.
>> Volume Serial Number is FCB8-4365
>>
>> Directory of C:\Audit
>>
>> 13-06-2006 13:11 <DIR> .
>> 13-06-2006 13:11 <DIR> ..
>> 12-06-2006 22:56 38 1_audit.bat
>> 14-06-2006 10:48 290 2_audit.bat
>> 14-06-2006 12:56 384 audit.bat
>> 07-03-2005 10:55 639.488 Audit32.exe
>> 16-11-2005 11:22 52.574 auditcfg.ini
>> 13-06-2006 13:07 740 Copy of test.log
>> 13-06-2006 13:11 79 test.log
>> 7 File(s) 693.593 bytes
>> 2 Dir(s) 420.126.720 bytes free
>> ErrorLevel of audit32.exe=0
>> ter 13-06-2006 13:11:01,48 End of task
>>
>> -----------------------
>> 2. TEST (DC --> client computer log into domain) - this time didn't
> create
>> the XML file
> *** Since Test #1 and Test #2 were scheduled in exactly
> *** the same way but at different times, the problem lies
> *** with audit32.exe and not with the scheduled task.
> *** Maybe it will not run on a machine where it ran a short
> *** time before. I am convinced that it exhibits the same
> *** erratic behaviour when invoked directly from the target
> *** machine. You should resolve this first, before adding
> *** the complexity of a scheduled task.
>
>> ter 13-06-2006 13:25:20,49 Start of task
>> User=teste, PC=HOMESTATION WD=C:\Audit
>> Volume in drive C has no label.
>> Volume Serial Number is FCB8-4365
>>
>> Directory of C:\Audit
>>
>> 13-06-2006 13:25 <DIR> .
>> 13-06-2006 13:25 <DIR> ..
>> 12-06-2006 22:56 38 1_audit.bat
>> 14-06-2006 10:48 290 2_audit.bat
>> 14-06-2006 12:56 384 audit.bat
>> 07-03-2005 10:55 639.488 Audit32.exe
>> 16-11-2005 11:22 52.574 auditcfg.ini
>> 13-06-2006 13:25 84 test.log
>> 6 File(s) 692.858 bytes
>> 2 Dir(s) 420.081.664 bytes free
>> ErrorLevel of audit32.exe=0
>> ter 13-06-2006 13:25:21,94 End of task
>>
>>
>> In the 2 test i thought it didn't work since the the "ID" of the job has
> the
>> same... So i've put different "ID" in the next jobs but didn't work...
> What
>> do you advice?...
> *** The ID of a scheduled job is irrelevant. It is simply an
> *** identifier that has no effect upon the execution of the task.
>>
>> C:\>at \\homestation 13:11 "c:\audit\audit.bat"
>> Added a new job with job ID = 1
>>
>> C:\>at \\homestation 13:25 "c:\audit\audit.bat"
>> Added a new job with job ID = 1
> *** You scheduled the 13:25 job after 13:11. This is
> *** why it was assigned identifier #1 again.
>>
>>
>> C:\>at \\homestation 13:30 id:2 "c:\audit\audit.bat"
>> Added a new job with job ID = 2
> *** You should try a little harder when exploring the various
> *** parameters of at.exe.
> *** The above command will attempt to run this command:
> *** ID:2 "c:\audit\audit.bat". This is obviously nonsense.
> *** Running at.exe by itself will tell you all the currently
> *** scheduled commands and what they will run.
>
>> C:\>at \\homestation 13:33 id:3 "c:\audit\audit.bat"
>> Added a new job with job ID = 3
> *** This is also nonsense. The ID parameter can only be
> *** used when deleting a scheduled job, not when creating one.
>
> If you wish to perform some serious debugging then I recommend
> this:
> 1. Check the various parameters of at.exe.
> 2. Test each of them.
> 3. Don't just assume that they do what you think they will do.
> Verify each and every one of them!
> 4. Test the batch file audit.bat thoroughly while working on
> \\homestation.
> 5. Get a copy of LocalSystem.zip (
http://assarbad.info/en/stuff)
> and use it to start a Command Prompt on \\homestation
> under the System account. Repeat Step 4 above.
> 6. When you are really satisfied that everything works the way
> it should, test audit.bat with at.exe.
>
> So far you have worked mainly on Step 6. You will probably
> find that Step 6 becomes a non-issue after you have covered
> the preceding steps carefully and in detail.
>
> I still think you should adopt Dave Patrick's suggestion and use
> psexec.exe. It would deliver the same functionality but it would
> give you instant feedback, showing you immediately where you
> go wrong. Running scheduled tasks is much more demanding
> than running tasks directly because you cannot easily see your
> mistakes. The command
>
> at \\homestation 13:33 id:3 "c:\audit\audit.bat"
>
> illustrates this nicely: You obviously did not know that the command
> does nothing at all. Psexec.exe would have told you.
>
>
Thanks for all the help you've give so far but i can't figure out how can i
solve this issue
Results from your last advice:
--------------------------------------------------------------
*****Using "CMDasSYS.exe"********
C:\localsystem\Localsystem>at \\homestation 15:31 "c:\audit\audit.bat"
Access is denied.
--------------------------------------------------------------
C:\PsExec>psexec \\homestation "c:\audit\audit.bat"
PsExec v1.71 - Execute processes remotely
Copyright (C) 2001-2006 Mark Russinovich
Sysinternals - www.sysinternals.com
c:\audit\audit.bat exited on homestation with error code 0.
-----------------------------------------------------------------
Tell me what to do... next...
I don't know if it is possible or more difficult to write a script (see
below) and adapt it/put it on the group policy of the domain?... and then
call the "audit32.exe"...
-----------------------------------------------------------
Schedules Notepad to run at 12:30 PM every Monday, Wednesday, and Friday
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set objNewJob = objWMIService.Get("Win32_ScheduledJob")
errJobCreated = objNewJob.Create _
("Notepad.exe", "********123000.000000-420", _
True , 1 OR 4 OR 16, , , JobID)
Wscript.Echo errJobCreated