Registered: 2004-07-15
Posts: 16
Loc: Texas of Course!
I'm writing a login script and I need to write entries into the registry when a normal domain user logs in.
I get an error 5 which I'm assuming is access denied.
Our company policy turns off regedit for domain users. I've tried to search for something like my situation but it doesn't cover it totally or the topic goes off tangent.
If there is something specific, forgive me, my head is spinning reading though the threads and I'm approaching a deadline and really need to get something working.
This is all I have for code (pretty straight forward).
Code:
writevalue( "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon","LegalNoticeCaption","Important Notice from ATI","REG_SZ")
$comps=comnetview()
for each $comp in $comps
$rc=writevalue('\\'+$comp+'\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
,"LegalNoticeCaption","Important Notice from ATI","REG_SZ")
next
COMNetView() is available in the UDF Forum.
Edited by Sealeopard (2007-07-2406:11 AM)
_________________________
There are two types of vessels, submarines and targets.
MartMart KiX Supporter
Registered: 2002-03-27
Posts: 4673
Loc: The Netherlands
It does not matter if running regedit is disabled or not. Regular user cannot write to HKLM on Windows XP unless the permissions are changed.
There are some topics around on this board about runas (one N) and runnas (two N's). Runas is not secure because the username and password is in plain text in your script. Anyone can read this and therefore (ab)use the credentials. Runnas is a tokenized runas app that is much more secure then the first one.
Also you could warp the script in an executable. For example ASE can do that but there is also a free app on this board called kix2exe.
If there is no other way whatsoever I'd go for runnas (with the two N's).
The best (imho) and most secure way however would be to fix the AD and use GPO.
