Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 219
  • Last Modified:

elevated privileges not working in VB logon script

I found myself unable to modify the registry or any other function that requires elevated privileges via a VB logon script at a client’s network however I can use the logon script to map network drives and other functions that can be executed by local users and do not require elevated privileges.

For Example when I map the attached code as logon script I get the error message "The operation failed.0" at logon
When I execute the same script manually after the logon I get the message that it worked and it dos create the key.

I got the same results after removing the Symantec Anti-Virus Client, is there any software restriction policy in Windows 7 that would explain this behavior?

(The Account I am using has local Admin Privileges)

HKEY_LOCAL_MACHINE = &H80000002
strComputer = "."

Set ObjRegistry = _
    GetObject("winmgmts:{impersonationLevel = impersonate}!\\" _
    & strComputer & "\root\default:StdRegProv")

strPath = "SOFTWARE\ScriptLogic\Device Agent\Global Settings\TEST"

Return = objRegistry.CreateKey(HKEY_LOCAL_MACHINE, strPath)

If Return <> 0 Then
    WScript.Echo "The operation failed." & Err.Number
    WScript.Quit
Else
    wScript.Echo "New registry key created" & VBCRLF _
        & "HKLM\SOFTWARE\MYKey\"

End If

Open in new window

0
David
Asked:
David
  • 4
  • 2
2 Solutions
 
kevinhsiehCommented:
The login script will run under the context of the user, but the login script isn't elevated. From your script it looks like you are trying.to modify part of HKLM of the registry, in which case I recommend that you run it as a startup script instead. Startup scripts run in the context of the localsystem account and will be able to modify that part of the registry.
0
 
kevinhsiehCommented:
I do not recommend that you turn off UAC.
0
 
Robberbaron (robr)Commented:
kevin is correct.
but also for a startup script, all files that are referenced in that script need to be available to an 'unauthenticated' user.  So store them under NETLOGON share on the login server. (and be aware they are unsecured !)
0
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

 
kevinhsiehCommented:
None of my startup scripts are under netlogon. They are in the normal location with the group policy files, which by default any can be read by at least every computer and user.
0
 
Robberbaron (robr)Commented:
clarification.... what i meant is that any files other than the script itself.

one of my scripts copies and  installs a DLL into each PC: the source location of the DLL has to be accessible by all.

another logs its actions to a network file: the log file is in NetLogon.
0
 
kevinhsiehCommented:
The other files placed alongside the startup script are accessible to the script. I do it all the time. I have startup scripts that copy DLL, EXE, etc. without issue. That area isn't generally WRITEABLE, however. Writing to NETLOGON might be less than ideal if you have more than one domain controller as your logs will end up on multiple servers.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Easily Design & Build Your Next Website

Squarespace’s all-in-one platform gives you everything you need to express yourself creatively online, whether it is with a domain, website, or online store. Get started with your free trial today, and when ready, take 10% off your first purchase with offer code 'EXPERTS'.

  • 4
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now