Snapin execution questions

[ayashkam]

Hello everyone,

I am trying to use Snapins to execute some scripts on the client machine and I am running into following issues:

1. One of the scripts should be downloading some files from web, but it complains that “remote name cannot be resolved”, even though I can access it from both client machine and FOG server. So my question would be: is it more likely to be an issue with my script, or do snapins in general lack functionality of accessing web?

2. Other script that I am triggering with snapins is supposed to be setting environmental variables, but it doesn’t. I am guessing it is because snapins are run from SYSTEM user account? Is there any work around you could recommend? I’ve tried using runAs, but it freezes because of prompts for password (the account on client machine does not have any password), so only way would be to disable a UAC, which I would rather avoid doing.

3. Last script should be accessing HKLM/SOFTWARE and setting values there, but it cannot. Again, I’m guessing it is because of the SYSTEM account?

I apologize if those questions are trivial or have been asked before(though I could not find anything similar on the forum).
Thanks!

[Daniel Miller]

@ayashkam
The SYSTEM account is generally able to access network resources, but you can not assume any credentials would be correctly impersonated. Is there a proxy in the mix?

How are you attempting to set these variables and in which context are you attempting to set them? You are likely going to be constrained to setting them at the machine level.

HKLM should be accessible. How are you attempting to set the values.

If it doesn’t come out in the hows, some basic additional information:
Which scripting environment are you using?
Which version(s) of (I assume) Windows are these being executed against?

[ayashkam]

@Daniel-Miller
Thanks for such a quick reply!

1. Yes, there is a proxy on both server and client. Fixed this one now!
2. Script is trying to set environmental variables using [Environment]::SetEnvironmentVariable Method for “Process”, “User” and “Machines”. I see, so there is no way I can set it at the machine using snapins?
3. Script is using New-ItemProperty method in powershell. I forgot to mention that it succeeds in setting values in HKLM:\SYSTEM (but not HKLM:\SOFTWARE).

I am mainly using powershell scripts and some batch scripts that trigger other powershell scripts. It is run on Windows 10.

[Sebastian Roth]

@ayashkam Though I am not sure this is related you might want to read through this. Talks about powershell snapins and execution restriction issues: https://forums.fogproject.org/topic/13860/please-help-me-understand-how-snapins-work-and-why-mine-aren-t-working

[Daniel Miller]

@ayashkam

2. I would not say there is no way, but depending on what your goals are, you may not be able to do so directly from that context. You may want to look at alternative setting mechanisms, such as setx, for setting System environment variables and user variables for the SYSTEM account. If you are attempting to set environment variables for end user accounts, you could look at setting that during login as a scheduled task or with a logon script.

3. SYSTEM should generally have full control over the HKLM\SOFTWARE hive, but there isn’t anything preventing things from changing the permissions of keys. You may want to verify the permissions for the key you are attempting to modify haven’t been set by the application you are attempting to manage.

It may be helpful to have an interactive environment for testing. I have found Sysinternals PSExec to be very useful for setting that up (psexec.exe -s -i <environment binary>).

[ayashkam]

@Sebastian-Roth thanks, I’ll take a look!

[ayashkam]

@Daniel-Miller it was indeed some permission issue coming from the application. I will try to manually reset it and see if it works. Thanks a lot for your help!