Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


xpd

xpd

Geek of Coastguard
14115 posts

Uber Geek
+1 received by user: 4574

Retired Mod
ID Verified
Trusted
Lifetime subscriber

#305727 31-May-2023 12:21
Send private message

GPO etc is not my area of expertise, hence my query :)

 

I have a powershell script that I run manually to obtain asset details from systems, which works (usually) well.

 

I figured lets try adding it to grou policy to run on each system upon login.

 

So have added to GP, linked it to a test OU where my system resides.

 

According to a GPResult, the GPO is being applied, but Im not seeing any output etc on the desktop or an end result (which should be an email)

 

Now, Im guessing that its something to do with the powershell script itself that is the issue, something in it dosent play with GP and it just is not running.

 

 

 

Ideas/advice/tips welcome :D

 

 

 

Set-ExecutionPolicy Bypass -Scope Process
echo ""
echo ""
echo "Asset Identification Script now running....... please wait."
echo "This window will close automatically"

 


$mailParams = @{
    SmtpServer                 = 'xxxxxxmail.protection.outlook.com'
    Port                       = '25'
    UseSSL                     = $true   
    From                       = 'xxxxxx@coastguard.nz'
    To                         = 'xxxxxxxx@coastguard.nz'
    Subject                    = "Email from $($env:COMPUTERNAME) at $(Get-Date)"
    Body                       =  "This is an automated email sent from $($env:COMPUTERNAME) at $(Get-Date) with Serial Number $(Get-WmiObject win32_bios | select Serialnumber) by $($env:UserName)"
DeliveryNotificationOption = 'OnFailure'
}

 

## Send the email
Send-MailMessage @mailParams





XPD / Gavin

 

LinkTree

 

 

 


Create new topic
mentalinc
3384 posts

Uber Geek
+1 received by user: 1023

Trusted

  #3082741 31-May-2023 12:46
Send private message

Powershell execution policy issue?





CPU: AMD 5900x | RAM: GSKILL Trident Z Neo RGB F4-3600C16D-32GTZNC-32-GB | MB:  Asus X570-E | GFX: EVGA FTW3 Ultra RTX 3080Ti| Monitor: LG 27GL850-B 2560x1440

 

Quic: https://account.quic.nz/refer/473833 R473833EQKIBX 




evilonenz
/dev/urandom
291 posts

Ultimate Geek
+1 received by user: 152

ID Verified
Trusted
Lifetime subscriber

  #3082744 31-May-2023 12:48
Send private message

I'd be setting the execution policy outside of the script itself, preferably in the command/argument that is launching powershell at logon.

 

Really does depend on how you've got the GPO configured, many ways to skin this cat.





Smokeping

 

Referral Links:

 

Quic - Use code R536299EPGOCN at checkout for free setup
Contact Energy - Use code FRTQDXB for $100 credit


xpd

xpd

Geek of Coastguard
14115 posts

Uber Geek
+1 received by user: 4574

Retired Mod
ID Verified
Trusted
Lifetime subscriber

  #3082762 31-May-2023 13:24
Send private message

Thanks, will look at the execution :) Think you're probably onto something :D

 

 





XPD / Gavin

 

LinkTree

 

 

 




Tockly
353 posts

Ultimate Geek
+1 received by user: 88


  #3082771 31-May-2023 13:39
Send private message

Also one thing to check is that the information is available at the point the GPO runs. They tend to run very early in the logon process and the services that provide the info you're after may have not started yet. I've tended in the past to put a 30 second sleep in these types of scripts.

 

And maybe check that the System account can access the info as well. The GPO maybe running under the System account rather than the account you're logging in with.





 


Ruphus
469 posts

Ultimate Geek
+1 received by user: 181


  #3082798 31-May-2023 14:49
Send private message

Out of curiosity, where are you expecting to see the output?

If this is a computer based login script, then the script will run before the login screen appears. Output windows are suppressed at that stage.

MadEngineer
4591 posts

Uber Geek
+1 received by user: 2570

Trusted

  #3082937 31-May-2023 17:44
Send private message

Permissions on the destination share?




You're not on Atlantis anymore, Duncan Idaho.

 
 
 
 

Shop now for Dell laptops and other devices (affiliate link).

xpd

xpd

Geek of Coastguard
14115 posts

Uber Geek
+1 received by user: 4574

Retired Mod
ID Verified
Trusted
Lifetime subscriber

  #3082948 31-May-2023 18:17
Send private message

Ruphus: Out of curiosity, where are you expecting to see the output?

If this is a computer based login script, then the script will run before the login screen appears. Output windows are suppressed at that stage.

 

Script generates an email to a specific account - so output window not required, but when run on its own it does have one.

 

 





XPD / Gavin

 

LinkTree

 

 

 


xpd

xpd

Geek of Coastguard
14115 posts

Uber Geek
+1 received by user: 4574

Retired Mod
ID Verified
Trusted
Lifetime subscriber

  #3082950 31-May-2023 18:17
Send private message

MadEngineer: Permissions on the destination share?

 

Shares all good with permissions etc

 

 





XPD / Gavin

 

LinkTree

 

 

 


Oblivian
7345 posts

Uber Geek
+1 received by user: 2117

ID Verified

  #3082951 31-May-2023 18:21
Send private message

Or massage it into creating/updating a new scheduled task run as system at login/unlock

Saves any sorta gpo delays or issues.

jnimmo
1098 posts

Uber Geek
+1 received by user: 255


  #3083043 31-May-2023 22:13
Send private message

You could consider enrolling devices into an MDM type product too which would provide additional functionality, like InTune if licensing allows or something free like Fleet/osquery How to install osquery and enroll Windows devices into Fleet | Fleet for osquery (fleetdm.com)


xpd

xpd

Geek of Coastguard
14115 posts

Uber Geek
+1 received by user: 4574

Retired Mod
ID Verified
Trusted
Lifetime subscriber

  #3083069 1-Jun-2023 06:26
Send private message

Thats a project thats underway atm, but I need the details "now" :D 





XPD / Gavin

 

LinkTree

 

 

 


 
 
 

Shop now at Mighty Ape (affiliate link).
systemd
32 posts

Geek
+1 received by user: 22

Trusted

  #3083071 1-Jun-2023 06:56
Send private message

+1 on using a scheduled task to run on user logon.

 

I recently ran into the same issues you have encountered, but managed to get the script to run with a user policy that creates/updates a scheduled task for any interactive user logon.

 

As a bonus the powershell window is not visible to the user when passing -windowstyle hidden to the trigger:

 

powershell.exe -ex bypass -windowstyle hidden -file "path to your script"

 

 

 

Would be interested to hear if you have any success with other methods as it feels quite "hacky" to push scripts this way :)


FatCheque
1 post

Wannabe Geek
+1 received by user: 1


  #3083144 1-Jun-2023 08:58
Send private message

Hi 

 

How about creating a log file e.g.

 

$username = $env:username
$date = get-date -Format yyyy-MM-dd_HH-mm
$logpath = "\\server\sharename\audit_$username"  + "_" + $date +".txt"

 

start-transcript -path $logpath

 

Your code here

 

stop-transcript

 

 

 

I dont think you need the set-executionpolicy in your code. GPOs run with -executionpolicy bypass already e.g. a transcript from my gpo shows

 

Windows PowerShell transcript start
Start time: 20230601084412
Username: XXXXX
RunAs User: XXXX
Machine: XXX (Microsoft Windows NT 6.3.9600.0)
Host Application:  -ExecutionPolicy ByPass -File xxxxxxxxxx

 

 

 

D./


ANglEAUT
altered-ego
2436 posts

Uber Geek
+1 received by user: 841

Trusted
Lifetime subscriber

  #3083190 1-Jun-2023 10:46
Send private message

xpd:

 

MadEngineer: Permissions on the destination share?

 

Shares all good with permissions etc

 

 

Just something to remember, if this scrip is targeted as computer objects, they need access to the share, not the user object.





Please keep this GZ community vibrant by contributing in a constructive & respectful manner.


Create new topic








Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.