VBScript Run Manually vs As Startup Script

[GeekBryanW]

I have created a script that installs the different Microsoft Office applications. Whether app A installs depends whether the computer is a member of group A. If it is, app A is installed. If the installation is successful the computer account is removed from group A and added to group A-Success. If it failed the computer account is removed from Group A and add to group A-Failed.

Everything works perfectly if I manually run the script. But if I run the script as a startup script in a GPO, the remove seems to work, but the add does not. I created a trace log and it is definitely entering my Group_AddMember function, but it is not doing the actual add.

Is there some difference in permissions between running it manually vs as a startup script.

 

[PScottC]

Yes. When you run it manually, you are running under your own credentials which has rights to the group in AD. When running as a Startup script the script runs as SYSTEM, which means that either the computer account or the Domain Computers group needs rights to make changes to the group. I'm not sure why the remove works, it may be a permissions quirk of the computer being able to modify its own account in AD.

PSC

Governments and corporations need people like you and me. We are samurai. The keyboard cowboys. And all those other people out there who have no idea what's going on are the cattle. Mooo! --Mr. The Plague, from the movie "Hackers