Having some issues with a .bat

[mpiersant]

I am having a bit of trouble with batch file I am writing.

First off, the secnario: I am a student worker for an ITT-Tech campus. I was given the task of making a host file to redirect a list of sites, given to me from corp, back to the itt-tech main page, for obvious reasons. Now this is not the issue. I have the host file and it is fine. However, the list is updated almost daily, and while the original file was implamented into our new qaurter image, I can not deploy the file to the 200+ machines on the campus effectively.

So, on to the problem. The host fiel now sits on the campus dc where I can update it as needed day to day. I am in the process of writing a script that grabs the file off the server and replaces it in the sys32 folder where it belongs.

Now of course none of the student accounts have admin rights, again for obvious reasons, so this must be done via administrator. I have a solution to this, but I can not seem to get it to work right.

Here is the test script I am working on:

@net use z: \\********\Local\TestA /user:******** password | ********
z:
copy TestDoc.txt \\*********\Local\TestB

Note: I have astricted out our dc name, user login, and password for security reasons. This info is not needed for the question I am posing.

Now this is a very simple batch, and I dont understand why it does not function properly. When I run the batch the cmd flashes and closes and I can not see what it is doing, but from my understanding it should work.

I know research is always the best method to solving a problem, and I am continuing to do just that. However, I thought it wise to seek second opinions and outside advice.

Thank you all for taking the time to help me and for reading my post.

-mpiersant@itt-tech.edu

 

[office politics]

remove the @ in front of net

after the script runs, is the drive mapping still available?

append @pause to the end of the file to interrupt execution.

add net use z: /delete to remove the drive mapping after the script runs.

 

[mpiersant]

The @ isnt the issue... @ means do not echo this line in the console, which is rather vital as we do not want users to know the password to the entire domain tree.

Upon reviewing this further I found a security hole when this script is ran. Seeing as the user logs in with thier credentials and then the script uses the admin credentials, even when the drive is unmapped, the user inherits the admin rights until he logs out. This can not be allowed to happen.

It looks like I will have to write a script that effects the Local Machine GPO, rather then the domain GPO (which I do not have athourity to alter), to give the user write rights to the system32 folder to then copy the host file from the DC, and then revert them back to thier previous GPO settings.

LOL, having said that, I still don't know quite how to do that. I know what I need the script to do, I have just never changed a GPO from a script.

I'm researching this now, but please feel free to comment.

-mpiersant@itt-tech.edu

 

[office politics]

gpo wont allow you to give file perms to the folder. you would have to modify the folder's ACL. cacls.exe may be able to achieve this.

i would try writing a batch that copies the file and execute it by using runas.

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/runas.mspx

Runas

Allows a user to run specific tools and programs with different permissions than the user's current logon provides.

Syntax
runas [{/profile|/noprofile}] [/env] [/netonly] [/smartcard] [/showtrustlevels] [/trustlevel] /user:UserAccountName program

alternatively, you could setup a scheduled task to run the batch and set it to run under a local admin account.