Not quite getting it. - KiXtart.org

You are not logged in. [Log In] KiXtart.org website » Forums » KiXtart » Basic Scripting » Not quite getting it.

Page 1 of 2

Topic Options

#21228 - 2002-05-06 06:12 PM Not quite getting it.
a_non_moose a_non_moose Fresh Scripter Registered: 2002-05-03 Posts: 17 Loc: UGA	Like many others I'm trying to modify the registy upon login to the domain. the HKCU does fine, but the HKR/HKLM balk. I understand the reasons why, but the workaround using SU to call regedit has me at a loss. What I'd like to do is have su call up regedit/kix and import to each machine the wanted entries as the local admin. (does the local admin have to have backup/restore privs too?) So far my poking and prodding of su, regedit, kix, RTFM'ing have left me even more at a loss due to my complete lack of "programming 1337'ness". Any help, clue or informative flaming, brow beating, links are appreciated.
Top

#21229 - 2002-05-06 07:37 PM Re: Not quite getting it.
Les Les KiX Master Registered: 2001-06-11 Posts: 12734 Loc: fortfrances.on.ca	Well... unles you can be more specific of what you've tried and what errors you have now, we can offer only sympathy. Perhaps instead of the whole SU thingy you may want to look into using Task Scheduler. Sealeopard has written a fair amount on it, including a UDF to push out tasks using JT. Seek and ye shall find... _________________________ Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.
Top

#21230 - 2002-05-06 10:42 PM Re: Not quite getting it.
a_non_moose a_non_moose Fresh Scripter Registered: 2002-05-03 Posts: 17 Loc: UGA	Ok, during the login script execution, I'd like to have su run regedit as the local admin. So, according to the documentation the command should be something like this: su admin "regedit /s entry.reg" . I get varied errors; 2, 1722, 1385, 1326 and so forth. I've tried full paths to the exe, reg entries and anything else I can think of...no dice except for getting notepad to run...yippie. Did the kix install script, made sure the machine I was on was listed as the copy went thru...etc, etc. Do I have to copy these files to the local machine first, then exec? (a la notepad working?) Thanks
Top

#21231 - 2002-05-06 11:49 PM Re: Not quite getting it.
FollowThisLogic FollowThisLogic Fresh Scripter Registered: 2002-05-03 Posts: 6 Loc: Jersey	Shouldn't you be able to add the appropriate reg entries using a Kix script? Even if regedit does work you'll still get the "update.reg has been entered into the registry successfully" window, and the user must click OK (an unnecessary annoyance for them). Reg edits were what brought me to Kix in the first place... What kind of entries are you putting into the registry anyway?
Top

#21232 - 2002-05-07 02:43 AM Re: Not quite getting it.
a_non_moose a_non_moose Fresh Scripter Registered: 2002-05-03 Posts: 17 Loc: UGA	Follow... I'm trying to enter the "Dreaded" HKLM (local machine/Default user) which is normally protectd from editing...except in the case of admin users, naturally. {pardon the blatant rip of my post to ARS} You see "regedit /s " works only if the entry is in the HKCU (current user) and another context (that escapes me at the moment). (the /s is silent operation...don't want confirmation if it works, but will come up if it fails). The same rules apparently apply to kix's writevalue also. Grrrr. At any rate, there is a super user utils (name "SU" of course) that will allow me to make a kix script/batch file and exec it on the local machine as an admin user...one problem: I can't get su to do what voodoo it should do. Now I know that security wise it is rather stupid to have the bat/kix file stored in plain text..so when/if I get this working I'll do the kixcrypt thing. The only thing I have not tried yet is to copy the reg files, exec files and all that to the machines (su is already deployed, as is suss the system service). Grant you, it is prolly silly of me to try this as I have maybe 2 dozen or so workstation I admin, but, despite my lack of programming skills I want to learn this (kix/automation/better admin'ing) as it will help me in the future. I suppose moving from C/C++ programming, to Hardware dude, to tech support to webmaster to sysadmin sort of proves the theory of entropy correct.
Top

#21233 - 2002-05-07 02:56 AM Re: Not quite getting it.
Les Les KiX Master Registered: 2001-06-11 Posts: 12734 Loc: fortfrances.on.ca	Actually SU stands for "Switch Users"... after the like named UNIX command. I won't touch it, preferring to use Task Scheduler instead. I do believe your issue is that of network right. The impersonated user needs the rights or else you'll have to copy all the files local. Do the reg mods need to be in sync with other commands in your script? You know, you can do remote reg mods from an admin script. I do it all the time. _________________________ Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.
Top

#21234 - 2002-05-07 04:32 AM Re: Not quite getting it.
Sealeopard Sealeopard KiX Master Registered: 2001-04-25 Posts: 11165 Loc: Boston, MA, USA	a_non_moose: Just to get you onto the right track. Under Windows NT/2000/XP certain registry areas have security settings that allow only certain users to make changes. Therefore, a 'REGEDIT /s regtext.reg' trying to write to HKLM will fail unless the user has permission to write to that area (normally a user with administrative rights). The same applies to Kixtarts WRITEVALUE function, if the user under which Kixtart runs doesn't have permission to write to that area it'll give you an error. To elaborate on LLigetfa's comment, you can run a script on your server and have it write to a remote workstation be preceeding the workstations name in front of the registry key, e.g.: \\WORKSTATION\HKEY_LOCAL_MACHINE\SOFTWARE\Kixtart. You can also run your script throught SU or scheudle it with the Task Scheduler under an administrative account. Personally, I would either run a script on a server where I can secure the script sufficiently and do remote registry editing or run it through the Task Scheduler from from a server (again, I can secure the script) _________________________ There are two types of vessels, submarines and targets.
Top

#21235 - 2002-05-07 03:01 PM Re: Not quite getting it.
a_non_moose a_non_moose Fresh Scripter Registered: 2002-05-03 Posts: 17 Loc: UGA	sealeapord: Is there a way to automate the workstation entry? such as regedit /s \\@workstation\HKLM\some_entry or is doing what I trying to do only available manually or via the task scheduler?
Top

#21236 - 2002-05-07 03:21 PM Re: Not quite getting it.
Lonkero Lonkero KiX Master Guru Registered: 2001-06-05 Posts: 22346 Loc: OK	still, better way could be reskit tool waitfor. If I recall correctly CJ has done scripts for that. explained: make "engine" run on server. engine waits for clients logon. if client sees that there is something to be done it call's engine which (started as domain admin) then does the thing. this issue popped up last week and it should be easy to dick up. cheers, _________________________ ! download KiXnet
Top

#21237 - 2002-05-07 03:32 PM Re: Not quite getting it.
Lonkero Lonkero KiX Master Guru Registered: 2001-06-05 Posts: 22346 Loc: OK	well, it was someone else after all... I quess again. check this: http://kixtart.org/cgi-bin/ultimatebb.cgi?ubb=get_topic&f=2&t=001946 cheers, _________________________ ! download KiXnet
Top

#21238 - 2002-05-07 03:40 PM Re: Not quite getting it.
BrianTX BrianTX Korg Regular Registered: 2002-04-01 Posts: 895	I fiddled around with the waitfor a little bit. The only problem with waitfor is you have to have a "handshake". For example, suppose 5 PCs PC1 - PC5 send a: waitfor -s script1 at the same time. The server-side script can only handle one of these, and the first one that responds will be the one handled. So, how do you know how long to wait for a server response? Would it be something on the client side like: code: :installprog1 shell "waitfor -s prog1" shell "waitfor -t 3 @WKSTA" If @error <> "" goto installprog1 Else ? "Installing program 1. Please wait..." Shell "Waitfor @WKSTA" Endif How do you know how long to make the timeout? Brian
Top

#21239 - 2002-05-07 03:45 PM Re: Not quite getting it.
Les Les KiX Master Registered: 2001-06-11 Posts: 12734 Loc: fortfrances.on.ca	Mr Moose, We're loosing you... If you really want to do the SU thingy, you need to factor two permissions. 1. The permissions to the local reg. 2. The permissions to the source files on the network. If you have one but not the other, you have nothing. I suggested two alternatives, Task Scheduler or remote reg mods. Task scheduler is similar to SU without the risk of password ripping. You assign a task with Jens' ScheduleTask() UDF using an account with admin rights to the local reg and enough network rights to the source files. Of couse you could copy the source files local for either SU or TaskScheduler. The other option (remote reg mods) would require that you translate all the reg keys and values into KiX and then do all the mods from within KiX and not through a RegEdit merge. Lonkero's suggestion of using WaitFor is one that I've been kicking around for some time. Haven't seen CJ do anything with it... I first saw an implementation by Wimmo... used to install SUSS, I believe. WaitFor would allow you to 'serialize' the task. That is, to hold the logon (client) script while the admin (server) script did its thing. _________________________ Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.
Top

#21240 - 2002-05-07 03:50 PM Re: Not quite getting it.
Les Les KiX Master Registered: 2001-06-11 Posts: 12734 Loc: fortfrances.on.ca	Brian, On the server side, have the admin script spawn additional copies of KiX. That way each request will have its own. That way, the only thing the parent need do is listen for WaitFor and spawn. _________________________ Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.
Top

#21241 - 2002-05-07 04:09 PM Re: Not quite getting it.
BrianTX BrianTX Korg Regular Registered: 2002-04-01 Posts: 895	So this would be using wkix32.exe? I didn't think kix32.exe would handle multiples... Also, how would you retreive the computer name from the waitfor command? Do you have to write the output to a file then read the file like this: code: break on :prog1 shell "%comspec% /c Waitfor prog1 > CPID.txt" $ok = open (1,"CPID.txt") $line = READLINE(1) $ok = Close (1) $computer = SUBSTR($line,23,LEN($line)-23) shell "%comspec% /c Waitfor -s " + $computer ? "Spawning process for " + $computer Run "wkix32.exe prog1schedtask.kix $cpname=" + $computer Goto Prog1 Would this work? Is there a better way? Brian (finally. after editing it a few times, it seems to work.. but how reliable is something like this going to be?) [ 07 May 2002, 16:27: Message edited by: BrianTX ]
Top

#21242 - 2002-05-07 04:43 PM Re: Not quite getting it.
Les Les KiX Master Registered: 2001-06-11 Posts: 12734 Loc: fortfrances.on.ca	I didn't actually run your code but the concept seems fine. Have you seen Wimmo's original? Automated SU-installer at login ! WKIX32 is a perfect candidate for this sort of thing. KIX32 would work also. One caveat with passing parameters... check out this thread. Passing Parameters _________________________ Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.
Top

#21243 - 2002-05-07 05:13 PM

Re: Not quite getting it.

BrianTX Offline

Korg Regular

Registered: 2002-04-01
Posts: 895

How about this?

Server-side:

code:

break on
:prog1
shell "%comspec% /c Waitfor prog1 > CPID.txt"
$ok = open (1,"CPID.txt")
$line = READLINE(1)
$ok = Close (1)
$computer = SUBSTR($line,23,LEN($line)-23)
shell "%comspec% /c Waitfor -s " + $computer
? "spawning sheduletask for " + $computer
Run "wkix32.exe prog1.kix " + "$$computer=" + $computer
Goto Prog1

prog1.kix

code:

shell 'jt.exe /sm \\' + $computer + ' /sj ApplicationName="\\server\share\VirusScan\setup.exe" Parameters="-s" /sc administrator password /saj prog1.job /rj /sd prog1.job'
:testdone
sleep 10
If READVALUE("HKLM\SOFTWARE\Network Associates\VirusScan","bVshieldEnabled") = 1
shell "%comspec% /c waitfor -s " + $computer
Else
Goto Testdone
Endif

Client Side:

code:

:installprog1
shell "waitfor -s prog1"
shell "waitfor -t 3 @WKSTA"
If @error <> "" goto installprog1
Else
? "Installing McAfee VirusScan. This will take a few minutes. Please wait..."
Shell "Waitfor @WKSTA"
Endif

The main problem I see with this code is that I'm unsure how to detect if the installation is complete. I am trying to detect if VirusScan is running, however there should be a better way.
Does anyone see any other problems with this code?

Brian
(obviously more error checking needs to be done.. what if install fails? but.. i'm just trying to get a basic framework for now)

[ 07 May 2002, 17:16: Message edited by: BrianTX ]

Top

#21244 - 2002-05-07 05:37 PM Re: Not quite getting it.
a_non_moose a_non_moose Fresh Scripter Registered: 2002-05-03 Posts: 17 Loc: UGA	LLigetfa: Admittadly I am getting kind of lost in the discussion, but I'm getting bits that are rather informative and will prolly lead me to a solution. I suppose I am leaning toward: Put all entries into one file. copy that reg file to the local box. exec su locally to enter the reg file get rid of the reg file. If all of that works, then kixcrypt the files to at least keep the plain text passwords away from your average snooper. I fairly sure I'm doing some of this stuff the hard way, for lack of an easier way (and one I can comprehend, too). I'm going to keep at it and watch this thread for a better way {like the auto su installer}. Moose
Top

#21245 - 2002-05-07 06:23 PM Re: Not quite getting it.
BrianTX BrianTX Korg Regular Registered: 2002-04-01 Posts: 895	Moose, I hope you don't think all my postings are extraneous info. Using task scheduler (jt.exe) to modify settings is a legitimate way of doing it. I don't like the idea of using SU or SUSS on client PCs because it poses security risks in and of itself. If you look over the scripts I've written above, they are designed to use a segment of the logon script to activate a scheduled task on the PC. The reason I'm trying to synchronize with the logon script is because we have no way of knowing when PCs will be on. Also, the jt.exe (remote task scheduler) gets around all sorts of security problems.. Sealeopard has a LOT of great info on using it and my scripts are rudimentary (read simplistic) compared to what he's done. Brian
Top

#21246 - 2002-05-07 08:13 PM Re: Not quite getting it.
a_non_moose a_non_moose Fresh Scripter Registered: 2002-05-03 Posts: 17 Loc: UGA	BrianTX: Not at all, dude. The task scheduler is quite a nice solution because the box/user is logged in and can run at an appropriate time. I can't run or call SU from a UNC path or mapped drive so the way to do it seems like copy to pc, run from pc and get rid of those specific files. But, as I've said...getting it to work manually before I automate it, and before I kixcrypt it would be the prudent thing to do. So, manual -> batch -> kix script -> kix crypt'ed script. Like the saying goes: "Tell me, and I'll forget. Show me and I might remember. Involve me and I'll never forget." And to LLigetfa: You are correct that the prudent thing to do is do the write to the registyr via kix, however it is under the same restrictions that regedit is. But, once again the issue is running it locally, vs running from a mapped drive or UNC path. There is not urgency in what I'm doing, just curiosity and a desire to learn and make things easier in the process/future. So, no big deal that I am still at step 2 and a half even after playing for less than a week's time. (and stupidly enuf, I wonder if mapping L: to netlogon and doing a 'subst (drive letter) l:\scripts' will be a good enuf cheat to run the su command? Hummmm. Thanks, Moose
Top

#21247 - 2002-05-07 08:19 PM Re: Not quite getting it.
BrianTX BrianTX Korg Regular Registered: 2002-04-01 Posts: 895	I would copy the su.exe locally to the %windir% ... if you plan on using suss.exe, copy that to the %windir%\system32. Running that stuff by using a mapped drive doesn't sound like a great idea to me. Of course... the netlogon folder is already mapped to the Z: drive... so you could always try that. Brian
Top

Page 1 of 2

Previous Topic View All Topics

Index Next Topic

Moderator: Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart

Hop to:

Shout Box

Search the board with:
superb Board Search
or try with google:

	Web kixtart.org