Page 1 of 1 1
Topic Options
#186815 - 2008-04-09 11:02 PM INGROUP and Kix startup script via GPO
Brainstormer Offline
Fresh Scripter

Registered: 2007-05-16
Posts: 23
Loc: USA
I am trying to get this question answered:

If there is a GPO setup to run a kix script under the computer startup scripts, (not user login scripts) and I use INGROUP, what is Kix validating since this is running under the system account?

More explanation, I have a lot of PCs I need the kix script to run, but not few others. I can put the other computer name in a AD security group, so the script would be:

IF INGROUP (OTHER_PCS)
DO NOTHING
ELSE
EXECUTE SCRIPT
ENDIF

The script requires local admin rights, so can not be placed in the user section of the GPO.

Will this work?

Top
#186816 - 2008-04-09 11:09 PM Re: INGROUP and Kix startup script via GPO [Re: Brainstormer]
Witto Offline
MM club member
*****

Registered: 2004-09-29
Posts: 1828
Loc: Belgium
 Originally Posted By: Brainstormer
If there is a GPO setup to run a kix script under the computer startup scripts, (not user login scripts) and I use INGROUP, what is Kix validating since this is running under the system account?

Good question.
If this would work, I would think the "computer account"

Top
#186817 - 2008-04-09 11:19 PM Re: INGROUP and Kix startup script via GPO [Re: Witto]
Witto Offline
MM club member
*****

Registered: 2004-09-29
Posts: 1828
Loc: Belgium
I don't see the problem.
The way to go is IMHO as follows
  • Create a Computer Policy
  • Set this policy on a OU above the computers where you want to run the script on
  • Create a Global Group
  • Populate goup with Computers you want to run the script on
  • Edit the Security settings
  • Remove the "Authenticated Users"
  • Add the Global Group to the Security settings
  • Give "Read" and "Apply Group Policy" permissions

Take a look at this: Group Policy Computer Startup Software Installation Script
and at this: Group Policy Object (GPO) Rules. where I want to quote this:
 Quote:
As per Microsoft recommendation you should remove *Authenticated Users* group and create a new Group and add all members to this group and then use Group Policy Filtering technique.

Top
#186850 - 2008-04-10 08:35 PM Re: INGROUP and Kix startup script via GPO [Re: Witto]
Brainstormer Offline
Fresh Scripter

Registered: 2007-05-16
Posts: 23
Loc: USA
Thanks,

I already have the GPO, and it's using the "Authenticated Users", but I wanted the Kix script to work with the security group, basically verify that the computer account is member of the group.

I don't want to modify the GPO since it has other general purpose settings, and a new GPO is not permitted.

I wish Kix had a customizable INGROUP, for example

IF @WKSTA INGROUP ('DOMAIN\PC GROUP')
DO THIS
ELSE
DO ELSE
ENDIF

This is impossible to debug since the script never runs under the system service account unless the scipt is executed during startup.


Edited by Brainstormer (2008-04-10 08:37 PM)
Edit Reason: additional explenation

Top
#186851 - 2008-04-10 08:40 PM Re: INGROUP and Kix startup script via GPO [Re: Brainstormer]
Allen Administrator Offline
KiX Supporter
*****

Registered: 2003-04-19
Posts: 4574
Loc: USA
See ComputerInGroup() -
http://www.kixtart.org/forums/ubbthreads.php?ubb=showflat&Number=84539
_________________________
(... better days ahead)

Top
#186854 - 2008-04-10 10:10 PM Re: INGROUP and Kix startup script via GPO [Re: Allen]
Brainstormer Offline
Fresh Scripter

Registered: 2007-05-16
Posts: 23
Loc: USA
Yes, thanks Allen, I actually came across it and it does the job perfectly.
Top
Page 1 of 1 1


Moderator:  Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart 
Hop to:
Shout Box

Who's Online
0 registered and 1046 anonymous users online.
Newest Members
Viginette, ManuvdWielNL, Sir_Barrington, batdk82, StuTheCoder
17888 Registered Users

Generated in 0.055 seconds in which 0.023 seconds were spent on a total of 13 queries. Zlib compression enabled.

Search the board with:
superb Board Search
or try with google:
Google
Web kixtart.org