BAT files - checking remote machine for admin rights

[lenknermj]

Hey all,

I have written a batch file (to work with Batch Blitz 3.0) in which I need to check about 15,000 systems company-wide for the presence of a particular application.

Batch Blitz is simply a program which allows you to write generic BAT files using a variable for the host list, and up to 3 variables for general use, so that a single BAT file can be re-used with different arguments on multiple remote systems. It is simply a GUI interface to the command prompt, which runs BAT files by running them from a command prompt, and acts just as it would if you ran a single batch file from the command prompt itself. The only difference is that once a pass of the BAT file completes, it starts the process all over again for the next host.

It works well on machines on which my NT credentials have administrative rights. However, if I do not have admin rights, it causes Batch Blitz to hang, and the only way to resume scanning is to open the task manager and kill the NET.EXE process.

Currently, I have a routine in the BAT file using the LOCAL.EXE command from the Resource Kit which shows the group members of a remote machine. This allows me to check the local 'Administrators' group on the remote machine. This is the batch file I've written:

Note: %1 is the variable for the HOST name or IP
---------------------------------------------------------
@echo on
path=%path%;"c:\program files\resource kit"
ping %1 -n 1

goto answer%ERRORLEVEL%

:answer0
goto chk4sten


:answer1
echo Ping test FAILED on %1!!!
goto end

:chk4sten
c:
local administrators \\%1
if not errorlevel 1 goto end
net use r: \\%1\c$ /p:no
if not exist "r:\radiology\isite.bat" goto end
cd\machineswithprogram
echo %1 >> machineips.txt

goto end

:end
c:
cd\
net use r: /d /y
-------------------------------------------------

If I don't have rights, it will usually give me an "access denied" error. Since the errorlevel for a successful check is 1, an access denied will result in using the GOTO END statement.

The problem is this....for some reasons, some machines on the network will return an errorlevel of 1 (success), but my name/group is not listed in the administrators local group. This results in the command asking me for new credentials. At this time, I have to open the task manager and kill the NET.EXE process.

So, here's my question.

Is there a way I can check a remote machine from a command prompt (within a batch file) to make sure that I have administrative priveleges? As I stated, this is going to be run on over 15,000 machines every month, and I can't sit by the computer and watch it for hangups.

By the way, I'm running Windows XP Pro on my system, and (unfortunately) I'm using the Windows 2000 Server Resource Kit.

Anyone? Help?

Thanks in advance!!
- Mark

 

[kranky]

Does this work?

if exist \\%computername%\admin$\*.* echo Admin rights OK

 

[lenknermj]

Yes, that worked pretty well. I actually used it as follows:

if not exist \\%1\admin$\*.* goto end

Additionally, since I posted this message, I discovered that something as simple as putting my NT credentials in the command line would cause it to error out after trying to map the drive, and then continue past it.

It's always the simple things, isn't it?

Thank YOU for the good workaround... really worked well.

- Mark

 

[skace]

---------------------------------------------
@echo on
if "%1"=="" goto :eof
for /f "tokens=2,3,4 delims=/ " %%a in ('date /t') do set datetmp=%%a-%%c
ping %1 -n 1
if "%errorlevel%"=="1" echo %1 >> "%datetmp% Ping Failures.txt"& goto :eof
if not exist "\\%1\admin$" echo %1 >> "%datetmp% Admn Failures.txt"& goto :eof
if not exist "\\%1\c$\radiology\isite.bat" echo %1 >> "%datetmp% App Missing.txt"& goto :eof
if exist "\\%1\c$\radiology\isite.bat" echo %1 >> "%datetmp% App Found.txt"& goto :eof
echo %1 >> "%datetmp% Unknowns.txt"
---------------------------------------------

You shouldn't need to use the resource kit or put your credentials in at the command line. There are more advanced commands for checking who exactly has permissions (showacls / etc), but I did some limited testing with these exist statements and they seem to be accurate. Also, I don't think that path part of your script works (but I could be wrong). It usually requires a relogon before path variable changes take affect, plus everytime you run it you are adding to the variable...

I was bored and thought I would throw this out there, I ripped your admin$ off, Kranky (Wasn't my innitial approach upon reading the first post).

I assumed the ping errorlevel was accurate from your original script, Mark and didn't bother verifying. I am not sure whether ping has multiple error levels (ie: if the machine is unreachable versus if the machine does not exist at all).

The for loop will provide you with the current date in a file-friendly format. This way your logs don't continually fill up. The format would be Month-Year (IE: 06-2003). %%b would give the day should you choose to use it (in the for loop).

I don't care if you use any of this or not... just waiting to go home on a Monday afternoon...

Dunno why you use @echo on... the console output must be nasty.

 

[lenknermj]

Skace,

Thanks a ton! Although I will admit, being a support person (mostly hardware), that I didn't understand most of what you typed. I believe I recognize this as NT Batch script, though. I may pursue this in the future, but as of now, my project is complete.

I do have a few questions/comments on your post, though.

1> Ping error levels - I don't know what the error levels are for PING either. However, I DO know that as it is in the script, it worked. I could probably use IF NOT for more accuracy, but that will be a future consideration.

2> Path statement - Don't really know why I did this...probably inserted as a result of working on it WAY too late in the day on a weekend from home. =)

3> Console output due to echo on - Batch Blitz (the program which runs these BAT's) outputs to single or multiple log files. I prefer the multiple log method and, in the past, I found it easier to search the log files for various indicators of success or failure for parts or the script. I search them with the Windows search utility, and choosing definitive words (such as REQUEST TIMED OUT or REPLY FROM) shows me, by IP or NetBIOS name, which PC's failed and which did not. Even after running the above script on 11,301 machines, I only have 8.83MB of log files. =)

Again, thanks for your time and help. I will probably start looking into scripting with NT commands. But for now, I'm just going to keep it simple. =)

Thanks,
- Mark