Checking for NT admin rights from BAT file

[lenknermj]

Hey all,

I have written a batch file (to work with Batch Blitz 3.0) in which I need to check about 15,000 systems company-wide for the presence of a particular application.

Batch Blitz is simply a program which allows you to write generic BAT files using a variable for the host list, and up to 3 variables for general use, so that a single BAT file can be re-used with different arguments on multiple remote systems. It is simply a GUI interface to the command prompt, which runs BAT files by running them from a command prompt, and acts just as it would if you ran a single batch file from the command prompt itself. The only difference is that once a pass of the BAT file completes, it starts the process all over again for the next host.

It works well on machines on which my NT credentials have administrative rights. However, if I do not have admin rights, it causes Batch Blitz to hang, and the only way to resume scanning is to open the task manager and kill the NET.EXE process.

Currently, I have a routine in the BAT file using the LOCAL.EXE command from the Resource Kit which shows the group members of a remote machine. This allows me to check the local 'Administrators' group on the remote machine. This is the batch file I've written:

Note: %1 is the variable for the HOST name or IP
---------------------------------------------------------
@echo on
path=%path%;"c:\program files\resource kit"
ping %1 -n 1

goto answer%ERRORLEVEL%

:answer0
goto chk4sten


:answer1
echo Ping test FAILED on %1!!!
goto end

:chk4sten
c:
local administrators \\%1
if not errorlevel 1 goto end
net use r: \\%1\c$ /p:no
if not exist "r:\radiology\isite.bat" goto end
cd\machineswithprogram
echo %1 >> machineips.txt

goto end

:end
c:
cd\
net use r: /d /y
-------------------------------------------------

If I don't have rights, it will usually give me an "access denied" error. Since the errorlevel for a successful check is 1, an access denied will result in using the GOTO END statement.

The problem is this....for some reasons, some machines on the network will return an errorlevel of 1 (success), but my name/group is not listed in the administrators local group. This results in the command asking me for new credentials. At this time, I have to open the task manager and kill the NET.EXE process.

So, here's my question.

Is there a way I can check a remote machine from a command prompt (within a batch file) to make sure that I have administrative priveleges? As I stated, this is going to be run on over 15,000 machines every month, and I can't sit by the computer and watch it for hangups.

By the way, I'm running Windows XP Pro on my system, and (unfortunately) I'm using the Windows 2000 Server Resource Kit.

Anyone? Help?

Thanks in advance!!
- Mark

 

[lenknermj]

Bump

 

[WeeWolf]

Are these systems in the same Domain or at least in separate yet trusted domains?
If so why not use a domain administrator logon for the script? Also why rely on your current login state as opposed to using the net use command logins?
ie..
password

Specifies the password needed to access the shared resource.

*

Produces a prompt for the password. The password is not displayed when you type it at the password prompt.

/user

Specifies a different user name with which the connection is made.

domainname

Specifies another domain. For example, net use d:\\server\share /user:admin\mariel connects the user identifier mariel as if the connection were made from the admin domain. If domainname is omitted, the current logged on domain is used.

username

Specifies the user name with which to log on.

good luck

 

[lenknermj]

Weewolf,

Thanks for your help. I did find a solution that was similar to yours. My big problem was that I'm not a DOMAIN level admin, but belong to a domain group that has machine level admin rights.

I discovered, however, that simply putting my NT credentials in the command line allowed the command to fail immediately when the credentials failed, rather than sitting in limbo waiting for new credentials.

THe only thing I don't like about the solution I found is that my username and password are now contained in the batch file for anyone to see. I couldn't afford to have the file prompt me for my password each time, so using an asterisk for my password was not an option (15,000+ machines).

Also, in another thread, someone suggested putting the following IF statement in, and this did work very well.

if not exist \\%1\admin$\*.* goto end

This was a good solution, because it allowed me to check my admin rights without trying to map a drive. If I was unable to see the admin$ share on the remote system, it failed the IF statement and went to the END label. A good solution, from my perspective.

Thanks again for your time and assistance with this. I truly appreciate the ideas!!

- Mark