Teh Tech » Scripts

Cause a Computer to Stop Booting via Script

admin — Sat, 08 May 2010 18:26:06 +0000

Interesting simple script I wrote today to cause a computer to stop booting. When run the operating system will not load, the issue is easily reversed with a boot cd of any kind. Why would I ever want to do this you might ask. Simple I used it at the request of an employer. The boss had requested a way to see exactly what a user was doing on his work computer without a chance to clean it up. I used kaseya to push this script down and a few min later I got a call from the user saying his computer crashed. I told him to send it to IT and he did. I got the computer, renamed the file and turned it over to the boss so he could see what he wanted. He was let go a few hours later.

More or less what we are doing is renaming ntdetect.com to ntdetect.bak. When the computer reboots it will loop until you rename the file back by boot disk like bart pe.

[ad]

Script Name: Break the computer
Script Description: Causes the computer to stop booting until a file is renamed.

IF True
THEN
Execute Shell Command
Parameter 1 : attrib -H -R -S c:ntdetect.com
Parameter 2 : 0
OS Type : 0
Execute Shell Command
Parameter 1 : rename c:ntdetect.com ntdetect.bak
Parameter 2 : 0
OS Type : 0
ELSE

This can also be used in a batch file:

attrib -H -R -S c:ntdetect.com
rename c:ntdetect.com ntdetect.bak
Shutdown -r -f -t 0

Could be useful for trying to recover stolen computers, data from soon to be fired employees (not giving them the chance to delete things). Or recovering a computer to investigation. You can also use it as an excuse to go visit that cute new secretary…

[ad]

All About Internet Explorer 8 & Uninstall/Rollback Script

admin — Sun, 02 May 2010 18:19:09 +0000

Internet Explorer 8 is the newest release from Microsoft and recently left beta and hit automatic updates. I will be discussing the issues that I have encountered, and the fixes I have found. Additionally, I will include group policy templets to prevent its distribution and a uninstall script to remove it for systems. I came in Monday to find that the software was installed on a spattering of computers across sever different clients (about 250 computers). I spent most of the rest of the week fixing them.

Issues that I have had:

No reboot: This seems to be the most common issue I encountered. If the patch was installed and the computer was no rebooted you will experience things like not being able to type in text input fields. Rundll32.exe memory dumps, and missing menus and toolbars. To fix this rebooting seems to do the trick.

No Header or title in internet explorer: For some reason I have seen this a few times when the computer went from IE6 to IE8 directly. The browser window will not show any title, and will not allow you to open any menus. The fix I found for this is to give the user account local admin rights and login again. Go through the setup wizard and change the rights back again.

Internet explorer will not open after upgrade: I have seen this a few times. First try running the browser as another user. If it opens, try giving the user that is having issues local admin rights. If this does not fix it I found that recreating the user profile works ( I had to resort to this only twice out of 12 browsers that would not open)

Website Incompatibility: MANY products and websites are not compatibly with internet explorer 8. Microsoft chose not to follow internet conventions when developing the browser so there have been a ton of issues encountered. This is actually so prevalent that Microsoft introduced compatibility view to allow people to render websites in Internet Explorer 7. Check out THIS
Spybot – If you have spybot installed on your computer unfortunately it will not work with internet explorer 8. The people at spybot are working to fix this but the only solution I found as of writing this is to uninstall either IE8 or spybot.

ADP – a very common workflow and payroll management provider. If you are using IE8 you cannot log into ADP unless you view the page in Compatibility Mode.

Centricity – A common medical Practice management software, this does not seem to work at all with IE8 installed. I found uninstalling to be the only option.

Solidworks – a Design and CAD application, once installed IE8 will cause web help to stop functioning as well as some other web based services. Uninstalling IE8 seems to be the best option for this as well.

Quickbooks – IE8 will break the web-help application and case older versions of quickbooks to crash on first load. Again until there is a hotfix uninstalling IE is the best option.

General Browsing – About 2400 websites are not compatible with IE8. A bunch of banking sites and smaller sites do not work or allow for login, most of these are fixed with compatibility view. Some big name sites like amazon.com ebay.com and download.com are having issues with the browser rendering. I list of sites that are not rendered correctly is available HERE.

[ad]

Options:

Microsoft seems to have messed up again. The browser does not follow conventions, it does not have nearly all the bugs and kinks worked out. It causes a ton of applications and websites to not work, so much so they included a compatibility option out of the box. It seems hardly finished to me.

That said rollback may be a good option for you. Microsoft allows several uninstall options:

Add and remove programs wizard – This will let you remove the browser and all subsequent patches in one wizard.

Restore – Sometimes it is just too messed up, the uninstaller wont work, or something else goes wrong. By defult the install creates a restore point. This may be a option in some situations to rollback the mess.

%windir%\ie8\spuninst\spuninst.exe /quiet /norestart /log:G:\%computername%\ie8uninstall.log
Shutdown -r -f -t 30 -c “Reboot for Internet Explorer 8 Uninstall”

Kaseya – It for things like this I love kaseya.

Script Name: IE8 Uninstall
Script Description: Uninstall IE 8

IF Test File
Parameter 1 : %windir%\ie8\spuninst\spuninst.exe
Exists :
THEN
Execute File
Parameter 1 : %windir%\ie8\spuninst\spuninst.exe
Parameter 2 : /quiet /norestart /log:G:\ie8uninstall.log
Parameter 3 : 3
OS Type : 0
ELSE

Preventing the patch for reaching your system – Microsoft admits that the patch might not be for everyone. Check out THIS. It included a group policy template to prevent the update from installing via automatic updates, and a login script option that can also be used with kaseya.

Script Name: Block IE 8
Script Description: Blocks IE8 From Auto Update

IF True
THEN
Execute Shell Command
Parameter 1 : md c:\temp
Parameter 2 : 0
OS Type : 0
Execute Shell Command
Parameter 1 : md c:\temp\ie8
Parameter 2 : 0
OS Type : 0
Write File
Parameter 1 : md c:\temp\ie8\ie8block.cmd
Parameter 2 : admin\batch\IE80Blocker.cmd
OS Type : 0
Execute File
Parameter 1 : md c:\temp\ie8\ie8block.cmd
Parameter 2 : /b
Parameter 3 : 0
OS Type : 0
ELSE

[ad]

How to Add and Remove a Local Account from a Group

admin — Tue, 27 Apr 2010 20:35:25 +0000

Occasionally you may need to add a local user account to the local administrators group for a software install or temporary maintenance. The following vbs script can be used to add the local ‘user1’ account to the local ‘administrators’ group. Any user can be added to any local group, change the red to match your needs. The computer name is pulled from the workstation dynamically so this is also completely portable and can be run on any computer.

Dim objComputer, objWSHNetwork, strComputerName, objUser, objGroup
Set objWSHNetwork = WScript.CreateObject(“WScript.Network”)
strComputerName = objWSHNetwork.ComputerName
Set objComputer = GetObject(“WinNT://” & strComputerName)
Set objGroup = GetObject(“WinNT://” & strComputerName & “/Administrators“)
Set objUser = GetObject(“WinNT://” & strComputerName & “/user1“)
objGroup.Add(objUser.ADsPath)
objUser.SetInfo

To use this through Kaseya save the above as user1addadmin.vbs and upload it to the server:

Script Name: Add user1 to admin group
Script Description: Adds the local user1 account to the local admin group
IF True
THEN
Write File
Parameter 1 : c:\temp\user1addadmin.vbs
Parameter 2 : admin\VBS\user1addadmin.vbs
OS Type : 0
Execute File
Parameter 1 : c:\WINDOWS\system32\wscript.exe
Parameter 2 : c:\temp\user1addadmin.vbs
Parameter 3 : 3
OS Type : 0
ELSE

It might also come up that you may need to remove a user from a local group. The following one line batch file can be run as a login script, batch file or ran as a shell command. It will remove the local ‘user1’ account from the local ‘administrators’ group. Again this will work for any user account and any group. Just change the red to match your needs.

net localgroup administrators user1 /delete

[ad]

Through Kaseya the following script would accomplish this:

Script Name: Remove the local user1 from admin group
Script Description: removes the local user1 account from the admin group.

IF True
THEN
Execute Shell Command
Parameter 1 : NET LOCALGROUP administrators user1 /delete
Parameter 2 : 1
OS Type : 0
ELSE

[ad]

Add Date and Time to any Batch File Output

admin — Fri, 23 Apr 2010 14:59:08 +0000

This trick is useful for both troubleshooting batch file tasks and when using a batch file to create a log. For example I have a scheduled task that renames some of my backup folders at night and then moved a few files around for me. When the batch file starts I uses the below code to print the time it starts, I repeat the two lines at the end of the batch file so that I can see what time the job completed. This is useful for figuring out average time of a task so that you can schedule other things without interfering.

[ad]

Date /T >> c:\script.log
Time /T >> c:\script.log

And here is what it looks like in a actual batch file:

Echo running backup script >> G:\log\backup.log
Date /T >> G:\log\backup.log
Time /T >> G:\log\backup.log
Rename f:\backup\full f:\backup\full_old
md f:\backup\full
Move f:\backup\full_old g:\archive
Delete f:\backup\full\log.txt
Echo completed at >> G:\log\backup.log
Date /T >> G:\log\backup.log

Time /T >> G:\log\backup.log

The output would look like:

Running backup script
Thu 04/23/2009
10:53 AM
Completed at
Thu 04/23/2009
11:23 AM

[ad]

How to Rename a File Over a Network Through a Batch File

admin — Wed, 21 Apr 2010 04:12:11 +0000

Sometime you need to rename a file or a folder that does not reside on your sever. For example I run a scheduled task on one sever to rename the folder on another server so that I can automatically archive backups weekly. Batch files or command line operations do not support UNC paths like \\myserver\my_share without taking some steps first.

[ad]

For this example I have a server called “server01″ is is running a script that will rename a folder called ‘Full’ that resides in a share called backup on a server called ‘server02′. First we map to the share, perform the operation, and then unmap the session. This method does not require a drive letter and thus works well and will never cause a DLA conflict.

net use \\server02\backup
rename \\server02\backup\full \\server02\backup\archive
net use /delete \\server02\backup

Essentially the net use function allows you to then use the path in the script. Remember that if you do not have rights to the folder you are mapping to you may need to specify them in the first line.

[ad]

Scripted Enumeration of Accounts with Local Admin Rights

admin — Sun, 18 Apr 2010 16:15:39 +0000

Beefing up security on networks keeps you from having issues in the long run. An hour today can save you three later. In a effort to improve network security and individual computer security I came up with this fancy little kaseya script. It enumerates the local administrators on a computer and exports them to a text file named whatever the target computer has been named. This can also be run through a batch login script. In the example below “g:” is a admin share on my local server, you can make this what ever you want or use a get file in kaseya to snatch the text file from the computer.

[ad]

Script Name: Get Local Administrators
Script Description: Enumerates what users are members of the local admin group.
IF True
THEN
Execute Shell Command
Parameter 1 : net localgroup administrators >> gadmin_audit%computername%.txt
Parameter 2 : 1
OS Type : 0
ELSE

Here is the same thing in a batch file with mapping a share:

Net use g: \server01admin_share
net localgroup administrators >> gadmin_audit%computername%.txt
net use g: /delete

[ad]

Removing Trend Micro Client/Server Security Silently Through Kaseya or a Login Script

admin — Fri, 16 Apr 2010 15:44:44 +0000

As you might have noticed from my last post I have spent some time cleaning up Trend Micro issues on my networks this week. I have a few installs that are messed up and need a reinstall so I made this.

Script Name: Trend Micro Uninstall
Script Description: Uninstall Trend Micro client
IF True
THEN
Set Registry Value
Parameter 1 : HKEY_LOCAL_MACHINESOFTWARETrendMicroPC-cillinNTCorpCurrentVersionMisc.Allow Uninstall
Parameter 2 : 1
Parameter 3 : REG_DWORD
OS Type : 0
Execute File
Parameter 1 : c:Program FilesTrend MicroClient Server Security Agentntrmv.exe
Parameter 2 : /silent /noreboot
Parameter 3 : 0
OS Type : 0
ELSE

Essentially this will uninstall the trend client from the computer with no user interaction required. Though the silent switch is employed there is still a progress window that I can’t seem to suppress.

[ad]

This can be used as a login script by importing the registry key and then running the uninstaller. Save the below as trend.reg:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINESOFTWARETrendMicroPC-cillinNTCorpCurrentVersionMisc.]
“Allow Uninstall”=dword:00000001

And run this batch file at login, change the red to match your paths:

Regedit /s g:registrytrend.reg
c:Program FilesTrend MicroClient Server Security Agentntrmv.exe /silent /noreboot

When run on login the Trend Product will be automatically removed thus preparing the computer for a Trend reinstall, or a new anti-virus install.
[ad]

Enable and Disable UAC Via Login in Vista

admin — Wed, 14 Apr 2010 00:44:52 +0000

In Vista UAC (User Access Control) is both anoying and can prevent you for doing some tasks remotely. For example, Installing Trend Micro Client Security Agent is not possible over VNC if UAC is enabled. UAC will cause a window to pop up asking you to confirm that the drivers that the antivirus is trying to install are legitimate. When UAC is invoked you will often lose VNC to a computer, I found that this a very common issue when installing drivers in particular. In looking for a easy way to disable UAC on a few computers while doing some maintenance I found this command line chunk.

Disable UAC:

C:WindowsSystem32cmd.exe /k %windir%System32reg.exe ADD HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem /v EnableLUA /t REG_DWORD /d 0 /f

[ad]

Enable UAC:

C:WindowsSystem32cmd.exe /k %windir%System32reg.exe ADD HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem /v EnableLUA /t REG_DWORD /d 1 /f

Note that in Vista though this can be run from command line but if you make it a batch file you will have to right click and select ‘run as administrator’

[ad]

Change The Default Internet Explorer Homepage

admin — Sun, 11 Apr 2010 01:34:13 +0000

I have a chunk of registry tweaks I run on new computers, this is one of them. It changes the internet explorer homepage to www.google.com, though you can use anything you like in place of google, perhaps a intranet page?

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMain]
“Start Page”=”www.google.com“

Simple but powerful, and can be merged to the registry silently using regedit /s, or added to a list of registry hacks.

To use this with kaseya import the below script, change the red to your best practice and away you go.

Script Name: Default IE Page – google
Script Description: Set Default Page on Iternet Explorer.

IF User Is Logged In
Parameter 1 :
THEN
Set Registry Value
Parameter 1 : HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMainStart Page
Parameter 2 : http://www.google.com
Parameter 3 : REG_SZ
OS Type : 0
ELSE

[ad]

Adding ‘Lock My Computer’ Shortcut to The Desktop

admin — Fri, 09 Apr 2010 01:14:55 +0000

In a effort to increase security at one of my healthcare providers they requested a quick way their employees can lock their computers when they walk away from their computers. I found Mklnk, it is a very tiny free utility that lets you make shortcuts from command line. I decided to use this to accomplish this task. I did some research and found that the following command will lock your computer.

rundll32.exe user32.dll,LockWorkStation

So I used this with mklnk.exe to make a shortcut on the users desktop, with a lock icon. Below is the batch file I used. G: is a network share containing mklnk.exe.

g:mklnk.exe -a user32.dll,LockWorkStation -i %SystemRoot%system32SHELL32.dll -n 47 %SystemRoot%system32rundll32.exe “%ALLUSERSPROFILE%DesktopLock”

What this does it it passes the arguments user32.dll,LockWorkStation to the rundll32.exe, and the result is a shortcut on the all user desktop called “lock” that uses shell icon 47 (a cute lock graphic).

To use this with kaseya you have to upload mklnk.exe to the kserver, and then import the following script. Be sure to change the red to match the location you have uploaded mklnk.exe.

Script Name: Lock Computer Icon on Desktop
Script Description: Creates a Lock icon on the all user desktop silently

IF True
THEN
Execute Shell Command
Parameter 1 : md c:temp
Parameter 2 : 0
OS Type : 0
Write File
Parameter 1 : c:tempmklnk.exe
Parameter 2 : adminutilmklnk.exe
OS Type : 0
Execute Shell Command
Parameter 1 : c:tempmklnk.exe -a user32.dll,LockWorkStation -i %SystemRoot%system32SHELL32.dll -n 47 %SystemRoot%system32rundll32.exe “%ALLUSERSPROFILE%DesktopLock My Computer”
Parameter 2 : 1
OS Type : 0
Delete File
Parameter 1 : c:tempmklnk.exe
OS Type : 0
ELSE

[ad]