Logon script to send an email? Works when ran 'normally'? Where am I going wrong?

[Garacesh]

We need to be able to trace when and where an account logs in, as it's an important account that shouldn't actually need to be used. Easiest way would be a logon script, and I know .BAT and .VBS can be used natively (rather than using a batch file to call a powershell script or similar). So..

I've compiled a VBScript using fragments I've found on the internet and if I run this from my desktop, it works. The two recipients get the e-mail and the username, computername and datetime are all as should be.

To test that it works properly, we applied it to one of our members of staff (as a logon script to her profile) and.... Nothing. No e-mail.

If I log on from the test account in question and navigate to netlogon and run it manually from there, it works fine. Just not as a logon script.

 

Set wshNetwork = WScript.CreateObject( "WScript.Network" )
Set objMessage = CreateObject("CDO.Message") 
objMessage.Subject = "Notification: Monitored Account Logon" 
objMessage.From = "[color="#FF0000"]Helpdesk@...[/color]" 
objMessage.To = "[color="#FF0000"]Guy1@..., Guy2@...[/color]" 
objMessage.TextBody = ("User " & wshNetwork.UserName & " logged onto workstation " & wshNetwork.ComputerName & " at " & Now)
objMessage.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2
objMessage.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserver") = "[color="#FF0000"]EMAIL SERVER[/color]"
objMessage.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25
objMessage.Configuration.Fields.Update
objMessage.Send

 

Is it something to do with the way the logon script is applied?

Did I do something wrong? Do scripts need extra lines of code for logon scripts or something?

I haven't really done anything in VBScript before, so I don't know..

Edited March 13, 2014 by Garacesh

[jamesreedersmith]

Why not just change the password to something random known only to a single person? or better get someone to type the first half and someone else type the second?

[Garacesh]

It's our "Everybody got hit by a bus" backup Domain Admin account. The credentials are envelope'd and laminated in the safe - this is to ensure we're alerted if that ever changes.

[jamesreedersmith]

Why not just change the password to something random known only to a single person? or better get someone to type the first half and someone else type the second?

 

So password in two halves in two sealed envelopes in the safe?

[Garacesh]

If somebody accesses the safe and removes that password, they will have the credentials for a domain administrator. We most likely would not be alerted to this immediately, as nobody would really know about it.

We want this logon script applied to that account so that if somebody does login to that account it informs us via email. If we've all been hit by a bus, then that's fine, the email will sit there in our accounts, likely never be read, and the new guy can rebuild the network with his shiny domain admin account. However, if we haven't all been hit by a bus, we'll see the e-mail, read it, and know that the credentials have been nicked.

 

You can fragment the password as many times as you like, a 15-character password scavenger hunt that gives you 1 letter per clue if it pleases you. The issue is we need a way to be informed ASAP if the credentials become compromised.

Edited March 13, 2014 by Garacesh

[bheadon]

Not sure if this will help, but I used a script to do exactly this too. Looking at yours I can't see anything wrong though.

 

Set objNetwork = wscript.CreateObject("wscript.network")
Set WshNetwork = WScript.CreateObject("WScript.Network")

SMTPServer = "x.x.x.x"
Recipient = "bheadon@****"
From = "alert@****"
Subject = "Alert " & objNetwork.Username & " is on " & WshNetwork.ComputerName
Message = " User " & objNetwork.Username & " has logged into " & WshNetwork.ComputerName

' To add an attachment update the full path and uncomment the line
' There is one line below that must also be uncommented


'attachment = "c: \ test.txt"


' Call Sub and pass required data
GenericSendmail SMTPserver, From, Recipient, Subject, Message 

' Begin Sub
' ------------------------------------------------------------------
' Generic function to send mail using a remote
' SMTP server. Pass SMTPserver, From address, 
' Recipient address, Subject, and Message as arguments
' ------------------------------------------------------------------
Sub GenericSendmail (SMTPserver, From, Recipient, Subject, Message) 

set msg = WScript.CreateObject("CDO.Message")
msg.From = From
msg.To = Recipient
msg.Subject = Subject
msg.TextBody = Message 

' To add an attachment uncomment this line
'msg.AddAttachment attachment

msg.Configuration.Fields ("http://schemas.microsoft.com/cdo/configuration/smtpserver") = SMTPServer
msg.Configuration.Fields("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2

msg.Configuration.Fields.Update

msg.Send

End Sub 

[Garacesh]

I'll give it a shot!

 

Question: By defining SMTPServer, Recipient, etc at the start of the script, then referring to it later, aren't you just adding extra steps where they don't need to be?

 

Would

set msg = WScript.CreateObject("CDO.Message")
msg.From = "alert@****"
msg.To = "bheadon@****"
msg.Subject = Subject
msg.TextBody = Message 
msg.Configuration.Fields ("http://schemas.microsoft.com/cdo/configuration/smtpserver") = "x.x.x.x"

not work just as well?

Edited March 20, 2014 by Garacesh

[bheadon]

I am sure you can cut it down but it just means that everything you might want to edit is up the top of the script. It just makes it a little easier to see where the changes are that you want to make. Feel free to edit it as you see fit (I only adapted it from someone else's hard work) but I do know it works for what you want it to do (I just attached it as a login script for any user we wanted to log, the script reads the login name and changes the email appropriately) .

[Garacesh]

Nope

Same situation. Works when ran from my desktop. Does not work as a logon script.

 

Set objNetwork = wscript.CreateObject("wscript.network")
Set WshNetwork = WScript.CreateObject("WScript.Network")

GenericSendmail

Sub GenericSendmail (Subject, Message) 
set msg = WScript.CreateObject("CDO.Message")
msg.From = "Helpdesk@[color="#FF0000"]...[/color]"
msg.To = "[color="#FF0000"]Guy1@...[/color], [color="#FF0000"]Guy2@...[/color]"
msg.Subject = "Notification: Monitored Account Logon"
msg.TextBody = ("User " & wshNetwork.UserName & " logged onto workstation " & wshNetwork.ComputerName & " at " & Now)
msg.Configuration.Fields("http://schemas.microsoft.com/cdo/configuration/smtpserver") = "[color="#FF0000"]SMTP IP[/color]"
msg.Configuration.Fields("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2
msg.Configuration.Fields("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25
msg.Configuration.Fields.Update
msg.Send
End Sub

[bheadon]

Sorry to hear that. It has worked for me in 3 schools now so not sure what is going on. Maybe it is worth putting something into the script so you can check it actually runs? A message box or something? Or maybe use gpresult /h to check that the script is set up to run correctly on login?

[Garacesh]

Hm. Nada. No message box popups. So it doesn't look like it's running

[jamesreedersmith]

Wheres the script located? can it be accessed by the account in question?

[bheadon]

Also maybe try running gpupdate /force to force the new policy to take effect and then run gpresult again to check it has gone through?

[Garacesh]

Script is located in NetLogon so accounts definitely have access to it.

The logon script isn't assigned to any OU, it's just assigned to the user (User Properties/Profile/Logon Script)

[bheadon]

Oh ok, when I ran mine I ran it on its own GPO under its own "Logged Users" OU. Maybe the script hasn't replicated to your other DCs yet (if you have more than one?).

[browolf]

Script is located in NetLogon so accounts definitely have access to it.

The logon script isn't assigned to any OU, it's just assigned to the user (User Properties/Profile/Logon Script)

 

try running it on your own logon script first.

[Garacesh]

Sorry @browolf I'm not quite sure what you mean by that?

[themightymrp]

Any chance its some kind of authenticated proxy issue? Your scripts refer to http://schemas.microsoft.com/cdo/configuration/ at various points - is there a chance that the scripts is trying to run before it has permission to access the t'internet?

[themightymrp]

Sorry @browolf I'm not quite sure what you mean by that?

 

He means assign it to your account before trying on another member of staff. It's likely you have more permssions and can rule out that as an issue

[Garacesh]

Oh, right! Did that - assigned it to one of the current domain admin accounts (since I don't think anyone actually remembers the 'spare' credentials - and quite rightly so!) and logged in - Nada.

Could be a proxy issue, now that you mention it. Though, I've not figured out why it needs to reference Microsoft.com.

All 3 of those links return a blank page with "The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.", but since @bheadon says it works for him, I'm guessing it's still working, just doesn't respond to a web browser request.

Apparently they don't actually go out onto the internet. It's just some kind of labelling.

 

I added a message box at the start and end of the script to see what was going on - it doesn't appear the script is starting at all.

Edited March 20, 2014 by Garacesh