Solved Logoff Script failing to run for local users.

[palahniuks]

Hey everyone.

We've been experimenting with running a batch script to backup incremental files for users within our domain. We've found that, when the script is run using an Admin account, or by adding the local user to the Admin's group, the script will kick off and run as it should during the Log Off phase.
However, due to security issues, we cannot have all the users having full administration credentials on the systems, so we cannot go down this path.

The Local user account, when the batch script is run manually, runs, and back's up the files as it should. But on Log off, the script doesn't even run, within the log files, there is an Access Denied 5 error 0x0000005.

Now, whilst I can tell this is user permissions error, I've fiddled around with configurations and settings on the local device, the target device on the network and even user accounts, yet, I cannot seem to get this script to execute, as it should, on Logoff, using a standard user account.

Folder permissions are all setup so that the users can read/write and there is no issues with either, as the script will run manually with no output errors and all files successfully copy over.


I am absolutely stumped at the moment, as everything I have tried, does not seem to solve the issue. Only using admin credentials seems to work and due to policies, we cannot allow the users to have Admin rights.

I'm assuming I've missed something simple, so if anyone could point me in the right direction, that would be awesome!

If you need any further info, please let me know...

thanks,

Ry

 

[Pyprohly]

Hi Ry,

If you suspect something is amiss with this batch file of yours, we could take a look at it. You'll need to post snippet of this script first (preferably the lines that you think are the cause) for us to view.

 

[palahniuks]

Hi Pyprohly,

I don't believe the issue is with the script as it will run automatically using an admin account, or using a normal user account when they are added to the admin groups...
I'll upload the script shortly for you to analyse, I was more thinking it was along the lines of a permission setting somewhere on the local device perhaps?

I'll follow this up shortly with the script

Cheers,
Ryan

 

[palahniuks]

Hi all,

Just FYI, we have solved this issue.

The cause:

In the system32, Group Policy, Users, Scripts, Log Off >> it creates the batch file and a batch backup log file. These two files are read only by standard users, so allowing these files to have full access to all user groups, the script executes as it should on log off...