Have you ever wondered why your logon script fails to map network drives when an Administrative user logs onto a computer with User Account Control (UAC) enabled; even though the drive mapping process completes successfully?<\/p>\n
To understand this you need to read the section from \u201cGroup Policy Scripts can fail due to User Account Control\u201d here: http:\/\/technet.microsoft.com\/en-us\/library\/cc766208(WS.10).aspx<\/a><\/p>\n And here are a couple of nice blogs on the issue:<\/p>\n Even though there are several versions and examples of this script available, none of them did the job perfectly. So I took the one written by Michael Murgolo from Microsoft and enhanced it with feedback and information from the comments and other scripts, as well as addressing some of the reliability concerns with the code.<\/p>\n This script is currently in place in a large University and working perfectly.<\/p>\n When a user logs in it checks for two well-known SIDs in the elevated user token:<\/p>\n If a user is a member of both groups, a Scheduled Task is created that\u00a0triggers\u00a0immediately to execute the main logon (map drives) script in the context of their\u00a0limited user token. Otherwise it launches the main logon (map drives) script directly. By default, the Scheduled Task will delete itself after 1 minute.<\/p>\n The script must be launched with a parameter, which is the pointer to the main logon (map drives) script.<\/p>\n If you have weakened Windows security by implementing the unsupported EnableLinkedConnections registry value as per KB937624<\/a>, shame on you! Implement this script and remove the\u00a0EnableLinkedConnections registry value immediately.<\/p>\n Here is the LaunchApp.cmd<\/a>\u00a0Script<\/p>\n Here is the Launchapp.wsf<\/a>\u00a0script<\/p>\n Enjoy!<\/p>\n","protected":false},"excerpt":{"rendered":" Have you ever wondered why your logon script fails to map network drives when an Administrative user logs onto a computer with User Account Control (UAC) enabled; even though the drive mapping process completes successfully? To understand this you need to read the section from \u201cGroup Policy Scripts can fail due to User Account Control\u201d … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"footnotes":""},"categories":[202,60,5,222],"tags":[225,224,223],"class_list":["post-838","post","type-post","status-publish","format-standard","hentry","category-active-directory","category-group-policy","category-scripting","category-windows-7","tag-enablelinkedconnections","tag-launchapp-vbs","tag-launchapp-wsf"],"aioseo_notices":[],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/posts\/838","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/comments?post=838"}],"version-history":[{"count":9,"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/posts\/838\/revisions"}],"predecessor-version":[{"id":847,"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/posts\/838\/revisions\/847"}],"wp:attachment":[{"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/media?parent=838"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/categories?post=838"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.jhouseconsulting.com\/jhouseconsulting\/wp-json\/wp\/v2\/tags?post=838"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\n
\n
\r\n\r\n@Echo off\r\ncls\r\nEcho Running the LaunchApp process to verify local Admin and UAC state...\r\n\r\n:: Map the Drives\r\ncscript.exe \/\/nologo "%~dp0LaunchApp.wsf" "%~dp0LogonScripts.cmd"\r\n\r\nExit \/b 0\r\n\r\n<\/pre>\n
\r\n\r\n<job>\r\n\r\n<script language="VBScript">\r\n\r\n'********************************************************************\r\n'*\r\n'* File: Launchapp.wsf\r\n'* Version: 1.0.4\r\n'* Date: 06\/26\/2012\r\n'*\r\n'* Modified by Jeremy@jhouseconsulting.com 18th June 2012.\r\n'*\r\n'* Version 1.0.2 of this script written by Michael Murgolo from Microsoft and posted here:\r\n'* http:\/\/blogs.technet.com\/b\/elevationpowertoys\/archive\/2010\/05\/25\/uac-logon-scripts-and-the-launchapp-wsf-workaround.aspx\r\n'*\r\n'* Main Function: This sample launches the application as interactive user.\r\n'* Originaly from:\r\n'* - Deploying Group Policy Using Windows Vista\r\n'* http:\/\/technet.microsoft.com\/en-us\/library\/cc766208(WS.10).aspx\r\n'*\r\n'* Usage: cscript launchapp.wsf <AppPath> <Arguments> <WorkingDirectory>\r\n'* Note that <Arguments> and <WorkingDirectory> are optional.\r\n'*\r\n'* Revisions:\r\n'* 1.0.0 Original script from TechNet.\r\n'* 1.0.1 05\/25\/2010 Modified using code from:\r\n'* - How to detect UAC elevation from VBScript\r\n'* http:\/\/blogs.technet.com\/jhoward\/archive\/2008\/11\/19\/how-to-detect-uac-elevation-from-vbscript.aspx.\r\n'* 1.0.2 08\/21\/2010 Added logic to handle running on legacy (pre-Vista) OS.\r\n'* http:\/\/blogs.technet.com\/b\/elevationpowertoys\/archive\/2010\/05\/25\/uac-logon-scripts-and-the-launchapp-wsf-workaround.aspx.\r\n'* 1.0.3 06\/18\/2012 Enhanced script: Jeremy@jhouseconsulting.com\r\n'* - Reviewed another version of this script written by "Patters" posted here:\r\n'* http:\/\/pcloadletter.co.uk\/2010\/05\/15\/missing-network-drives\/\r\n'* - Added the isTerminalServer function to detect if running in a Terminal Services (RDS) Session.\r\n'* - Added the isRemoteSession function to detect if running in a remote (RDP or ICA) Session.\r\n'* - Cleaned up untidy code.\r\n'* - Note: The .UserId property is not a supported property type of TriggerTypeRegistration. It\r\n'* - is supported by TriggerTypeLogon (runs At log on), Whereas the TriggerTypeRegistration\r\n'* - executes at task creation, so it does not require a UserID.\r\n'* 1.0.4 06\/26\/2012 Enhanced script based on client feedback: Jeremy@jhouseconsulting.com\r\n'* - Added the blnUseScheduledTaskIfApplicable boolean variable.\r\n'* - Added the OSBuildNumber function.\r\n'* - Removed the redundant GetWmiPropertyValue and WMIDateStringToDate functions.\r\n'* - Enhanced the validation of the IsElevated function.\r\n'* - Cleaned up the instr() logic in the IsElevated function. It was working, but it wasn't setup as per best practice.\r\n'* http:\/\/saltwetbytes.wordpress.com\/2007\/11\/20\/vbscript-if-instrmytext-searchtext-then\/\r\n'* - Added the GetExpiryTime and TwoDigit functions derived from another version of this script written by Jarvis Davis posted here:\r\n'* http:\/\/verbalprocessor.com\/2008\/03\/27\/vista-logon-scripts-launchappwsf\/\r\n'*\r\n'********************************************************************\r\n\r\nOption Explicit\r\n\r\nDim intOSBuildNumber, blnDebug, strAppPath, strArguments\r\nDim strWorkingDirectory, blnUseScheduledTaskIfApplicable\r\nDim intExpireTaskAfter\r\n\r\n'********************** Variables to set ****************************\r\n\r\n' Set to True to use a Scheduled Task if applicable\r\n' Set to False to launch directly regardless of the local Administrative permissions and UAC\r\nblnUseScheduledTaskIfApplicable = True\r\n\r\n' Set the number of minutes to wait before expiring the task.\r\n' The task will be deleted after it expires.\r\nintExpireTaskAfter = 1\r\n\r\nblnDebug = False\r\n\r\n'********************************************************************\r\n\r\nIf WScript.Arguments.Length <> 1 Then\r\n WScript.Echo "Usage: cscript launchapp.wsf <AppPath> <Arguments> <WorkingDirectory>" & _\r\n vbcrlf & "Note that <Arguments> and <WorkingDirectory> are optional."\r\n' WScript.Quit(0)\r\nEnd If\r\n\r\nIf WScript.Arguments.Length = 1 Then\r\n strAppPath = WScript.Arguments(0)\r\n strArguments = ""\r\n strWorkingDirectory = ""\r\nElseIf WScript.Arguments.Length = 2 Then\r\n strAppPath = WScript.Arguments(0)\r\n strArguments = WScript.Arguments(1)\r\n strWorkingDirectory = ""\r\nElseIf WScript.Arguments.Length = 3 Then\r\n strAppPath = WScript.Arguments(0)\r\n strArguments = WScript.Arguments(1)\r\n strWorkingDirectory = WScript.Arguments(2)\r\nEnd If\r\n\r\nintOSBuildNumber = OSBuildNumber()\r\n\r\nIf intOSBuildNumber >= 6000 Then\r\n ' Running on Vista or higher.\r\n ' Check if elevated. ie. Running as an Administrative user and UAC is enabled.\r\n If IsElevated AND blnUseScheduledTaskIfApplicable Then\r\n If blnDebug Then\r\n wscript.echo "Launch As Scheduled Task"\r\n End If\r\n LaunchAsScheduledTask strAppPath, strArguments, strWorkingDirectory, intExpireTaskAfter\r\n Else\r\n If blnDebug Then\r\n wscript.echo "Launch Directly"\r\n End If\r\n LaunchDirectly strAppPath, strArguments\r\n End If\r\nElse\r\n ' Running on legacy OS (XP\/2003 or lower).\r\n If blnDebug Then\r\n wscript.echo "Launch Directly"\r\n End If\r\n LaunchDirectly strAppPath, strArguments\r\nEnd If\r\n\r\nwscript.quit(0)\r\nSub LaunchAsScheduledTask(strAppPath, strArguments, strWorkingDirectory, intExpireTaskAfter)\r\n Dim service, strTaskName, rootFolder, taskDefinition\r\n Dim triggers, trigger, Action, Settings, blnDebug\r\n Dim objNetwork, strUser, strDomain, dtmExpiryTime\r\n\r\nblnDebug = False\r\n\r\nSet objNetwork = CreateObject("WScript.Network")\r\n strUser = objNetwork.UserName\r\n strDomain = objNetwork.UserDomain\r\n\r\ndtmExpiryTime = GetExpiryTime(intExpireTaskAfter)\r\n\r\n'***********************************************************\r\n ' Create Scheduled Task to launch app.\r\n '***********************************************************\r\n ' A constant that specifies a registration trigger.\r\n const TriggerTypeRegistration = 7\r\n\r\n' A constant that specifies an executable action.\r\n const ActionTypeExecutable = 0\r\n\r\n' A constant that specifies the flag in RegisterTaskDefinition.\r\n const FlagTaskCreate = 2\r\n\r\n' A constant that specifies an executable action.\r\n const LogonTypeInteractive = 3\r\n\r\n'********************************************************\r\n ' Create the TaskService object.\r\n '********************************************************\r\n Set service = CreateObject("Schedule.Service")\r\n call service.Connect()\r\n If NOT isTerminalServer(intOSBuildNumber) Then\r\n strTaskName = "Launch App As Interactive User"\r\n Else\r\n strTaskName = "Launch App As Interactive User - " & strUser & " from the " & strDomain & " domain"\r\n End If\r\n\r\n'********************************************************\r\n ' Get a folder to create a task definition in.\r\n '********************************************************\r\n Set rootFolder = service.GetFolder("\\")\r\n\r\n'Delete the task if already present\r\n On Error Resume Next\r\n call rootFolder.DeleteTask(strTaskName, 0)\r\n Err.Clear\r\n On Error Goto 0\r\n\r\n'********************************************************\r\n ' Create the new task\r\n '********************************************************\r\n Set taskDefinition = service.NewTask(0)\r\n\r\n'********************************************************\r\n ' Create a registration trigger.\r\n '********************************************************\r\n Set triggers = taskDefinition.Triggers\r\n\r\nSet trigger = triggers.Create(TriggerTypeRegistration)\r\n ' Set the task to expire so it can be deleted automatically\r\n trigger.EndBoundary = dtmExpiryTime\r\n\r\n'***********************************************************\r\n ' Create the action for the task to execute.\r\n '***********************************************************\r\n ' Add an action to the task. The action executes the app.\r\n Set Action = taskDefinition.Actions.Create( ActionTypeExecutable )\r\n Action.Path = strAppPath\r\n If strArguments <> "" Then\r\n Action.Arguments = strArguments\r\n End If\r\n If strWorkingDirectory <> "" Then\r\n Action.WorkingDirectory = strWorkingDirectory\r\n End If\r\n If blnDebug Then\r\n WScript.Echo "Task definition created. About to submit the task..."\r\n End If\r\n\r\n'***********************************************************\r\n ' Set the settings for the task\r\n '***********************************************************\r\n Set Settings = taskDefinition.Settings\r\n ' Delete the task immediately after the trigger expires\r\n Settings.DeleteExpiredTaskAfter = "PT0M"\r\n\r\n'***********************************************************\r\n ' Register (create) the task.\r\n '***********************************************************\r\n ' Note that the task is created as an XML file under the\r\n ' %SystemRoot%\\System32\\Tasks folder\r\n call rootFolder.RegisterTaskDefinition(strTaskName, taskDefinition, FlagTaskCreate, ,, LogonTypeInteractive)\r\n If blnDebug Then\r\n WScript.Echo "Task submitted."\r\n End If\r\n\r\nSet service = Nothing\r\n Set rootFolder = Nothing\r\n Set taskDefinition = Nothing\r\n Set triggers = Nothing\r\n Set trigger = Nothing\r\n Set Action = Nothing\r\n Set Settings = Nothing\r\n Set objNetwork = Nothing\r\n\r\nEnd Sub\r\nSub LaunchDirectly(strAppPath, strArguments)\r\n '***********************************************************\r\n ' Running as standard user or on legacy OS. Directly launch app.\r\n '***********************************************************\r\n Dim oShell, strCommandLine, Return\r\n ' intWindowStyle for WshShell.Run\r\n Const WINDOW_STYLE_HIDE = 0\r\n Const WINDOW_STYLE_ACTIVATE_DISPLAY = 1\r\n Const WINDOW_STYLE_ACTIVATE_MINIMIZE = 2\r\n Const WINDOW_STYLE_ACTIVATE_MAXIMIZE = 3\r\n Const WINDOW_STYLE_RECENT = 4\r\n Const WINDOW_STYLE_ACTIVATE_CURRENT = 5\r\n Const WINDOW_STYLE_MINIMIZE_ACTIVATE_NEXT = 6\r\n Const WINDOW_STYLE_MINIMIZE = 7\r\n Const WINDOW_STYLE_CURRENT = 8\r\n Const WINDOW_STYLE_ACTIVATE_RESTORE = 9\r\n Const WINDOW_STYLE_FROM_PARENT = 10\r\n\r\nSet oShell = WScript.CreateObject("WScript.Shell")\r\n\r\nIf strArguments = "" Then\r\n strCommandLine = strAppPath\r\n Else\r\n strCommandLine = strAppPath & " " & strArguments\r\n End If\r\n\r\nReturn = oShell.Run(strCommandLine, WINDOW_STYLE_ACTIVATE_DISPLAY, true)\r\n\r\nSet oShell = Nothing\r\n\r\nEnd Sub\r\n'***********************************************************\r\n' Function to detect whether script in running elevated.\r\n'***********************************************************\r\nFunction IsElevated()\r\n\r\nIsElevated = False\r\n\r\nDim oShell, oExec, szStdOut, cnWshRunning, blnDebug\r\n\r\nblnDebug = False\r\n szStdOut = ""\r\n Set oShell = CreateObject("WScript.Shell")\r\n Set oExec = oShell.Exec("whoami \/groups")\r\n\r\nDo While (oExec.Status = cnWshRunning)\r\n WScript.Sleep 100\r\n if not oExec.StdOut.AtEndOfStream then\r\n szStdOut = szStdOut & oExec.StdOut.ReadAll\r\n end if\r\n Loop\r\n\r\nselect case oExec.ExitCode\r\n case 0\r\n if not oExec.StdOut.AtEndOfStream then\r\n szStdOut = szStdOut & oExec.StdOut.ReadAll\r\n end if\r\n ' S-1-16-1228 is the SID for High Mandatory Level (ie. an elevated administrative account)\r\n ' S-1-5-32-544 is the SID for members of the BUILTIN Administrators group\r\n ' We check for both SIDs to be 100% sure\r\n if instr(1,szStdOut,"S-1-16-12288",1) > 0 AND instr(1,szStdOut,"S-1-5-32-544",1) > 0 Then\r\n If blnDebug Then\r\n wscript.echo "Elevated"\r\n End If\r\n IsElevated = True\r\n else\r\n If blnDebug Then\r\n wscript.echo "Not Elevated"\r\n End If\r\n end if\r\n case else\r\n if not oExec.StdErr.AtEndOfStream then\r\n If blnDebug Then\r\n wscript.echo oExec.StdErr.ReadAll\r\n End If\r\n end if\r\n end select\r\n\r\nSet oShell = Nothing\r\n Set oExec = Nothing\r\n\r\nEnd Function\r\n'***********************************************************\r\n' Function to retrieve The OS BuildNumber.\r\n'***********************************************************\r\nFunction OSBuildNumber()\r\n Dim strComputer, oWMIService, colOSInfo, oOSProperty\r\n strComputer = "."\r\n Set oWMIService = GetObject("winmgmts:\\\\" & strComputer & "\\root\\cimv2")\r\n Set colOSInfo = oWMIService.ExecQuery("Select * from Win32_OperatingSystem",,48)\r\n For Each oOSProperty in colOSInfo\r\n OSBuildNumber = oOSProperty.BuildNumber\r\n Next\r\n Set oWMIService = Nothing\r\n Set colOSInfo = Nothing\r\nEnd Function\r\n'********************************************************\r\n' Function to add time intExpireTaskAfter to the current date\/time\r\n' to be used to set an expiration to the scheduled task.\r\n '********************************************************\r\nFunction GetExpiryTime(intExpireTaskAfter)\r\n Dim objShell, strActiveTimeBias, intoffset, intoffsetHour\r\n Dim intoffsetMin, stroffset, dtmNewTime\r\n Set objShell = CreateObject("WScript.Shell")\r\n strActiveTimeBias = "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\TimeZoneInformation\\ActiveTimeBias"\r\n ' Get the time offset from the registry and convert it into the hour offset.\r\n ' This may need modification for non-US locales\r\n intoffset = objShell.RegRead(strActiveTimeBias) \/ 60\r\n intoffsetHour = intoffset Mod 60\r\n intoffsetMin = intoffset \\ 60\r\n If intoffset < 0 Then\r\n stroffset = "+" & TwoDigit(intoffsetHour) & ":" & TwoDigit(intoffsetMin)\r\n Else\r\n strOffset = "-" & TwoDigit(intoffsetHour) & ":" & TwoDigit(intoffsetMin)\r\n End If\r\n ' Add time to the current date and time so we can set the trigger expiration to that\r\n dtmNewTime = DateAdd("n",intExpireTaskAfter,Now())\r\n GetExpiryTime = Year(dtmNewTime) & "-" & TwoDigit(Month(dtmNewTime)) & "-" & TwoDigit(Day(dtmNewTime)) & _\r\n "T" & TwoDigit(Hour(dtmNewTime)) & ":" & TwoDigit(Minute(dtmNewTime)) & ":" & _\r\n TwoDigit(Second(dtmNewTime)) & strOffset\r\n Set objShell = Nothing\r\nEnd Function\r\n'********************************************************\r\n' Function to makes single digit numbers have a leading 0\r\n' and return only positive values\r\n'********************************************************\r\nFunction TwoDigit(vExpression)\r\n If Abs(vExpression) < 10 Then\r\n TwoDigit = "0" & Abs(vExpression)\r\n Else\r\n TwoDigit = Abs(vExpression)\r\n End If\r\nEnd Function\r\n'***********************************************************\r\n' Function to detect whether script is running on a Terminal\r\n' (RDS) Server. This will also cover a Citrix XenApp server.\r\n'***********************************************************\r\nFunction isTerminalServer(intOSBuildNumber)\r\n Dim WshShell, strComputer, strNameSpace, objWMIService, colItems\r\n Dim objItem, blnEventLog, strService, strState\r\n Const EVENT_SUCCESS = 0\r\n blnEventLog = False\r\n set WshShell = WScript.CreateObject("WScript.Shell")\r\n strComputer = "."\r\n If intOSBuildNumber >= 6000 Then\r\n strNameSpace = "\\root\\cimv2\\TerminalServices"\r\n Else\r\n strNameSpace = "\\root\\cimv2"\r\n End If\r\n Set objWMIService = GetObject("winmgmts:" _\r\n & "{impersonationLevel=impersonate}!\\\\" & strComputer & strNameSpace)\r\n Set colItems = objWMIService.ExecQuery _\r\n ("Select * from Win32_TerminalServiceSetting",,48)\r\n For Each objItem in colItems\r\n Select Case objItem.LicensingType\r\n Case "1" ' Remote Administration\r\n isTerminalServer = False\r\n Case "2" ' Per Device\r\n isTerminalServer = True\r\n Case "4" ' Per User\r\n isTerminalServer = True\r\n Case "5" ' Not configured yet\r\n isTerminalServer = True\r\n Case Else\r\n isTerminalServer = False\r\n If blnEventLog Then\r\n' Even if it is a Terminal Server, the LicensingType will return an empty value if the\r\n' "Terminal Services" (TermService) service is in a Stopped state.\r\n WshShell.LogEvent EVENT_SUCCESS, Wscript.ScriptName & ": The terminal server licensing type is: " & objItem.LicensingType\r\n strService = "TermService"\r\n strState = CheckServiceState(strService)\r\n WshShell.LogEvent EVENT_SUCCESS, Wscript.ScriptName & ": The " & strService & " is : " & strState\r\n End If\r\n End Select\r\n Next\r\n set WshShell = Nothing\r\n Set objWMIService = Nothing\r\n Set colItems = Nothing\r\nEnd Function\r\n'***********************************************************\r\n' Function to detect whether script is running in an remote\r\n' session. ie. an RDP or ICA Session.\r\n'***********************************************************\r\nFunction isRemoteSession()\r\n Dim objShell, strSessionName, blnDebug\r\n blnDebug = False\r\n Set objShell = CreateObject("WScript.Shell")\r\n strSessionName = objShell.ExpandEnvironmentStrings("%SESSIONNAME%")\r\n If strComp(strSessionName,"Console",1) = 0 then\r\n isRemoteSession = False\r\n If blnDebug Then\r\n wscript.echo "You are running directly on the console session!"\r\n End If\r\n Else\r\n If instr(1,strSessionName,"RDP-TCP",1) = 1 Then\r\n isRemoteSession = True\r\n If blnDebug Then\r\n wscript.echo "You are in a Remote Desktop (RDP) Session!"\r\n End If\r\n End If\r\n If instr(1,strSessionName,"ICA-TCP",1) = 1 Then\r\n isRemoteSession = True\r\n If blnDebug Then\r\n wscript.echo "You are in a Citrix (ICA) Session!"\r\n End If\r\n End If\r\n End If\r\n Set objShell = Nothing\r\nEnd Function\r\n<\/script>\r\n\r\n<\/job>\r\n\r\n<\/pre>\n