Run Powershell from batch file at startup

[cooper]

Hi Guy,

 

Could you have a look at this script for me?

 

I want to run this script at system startup to check to see if its been run before, if not run the Powershell InstallAll.ps1

 

But it just puts the install text file into C and does not run the Powershell.

 

Works ok if you run it manually.

 

Thanks

 

 

@echo OFF

 

IF EXIST "c:\gpoinstalled/whiteboard.txt" GOTO END

 

powershell.exe -ExecutionPolicy Bypass -File "\\fs01\SoftwareDrivers\Software\Microsoft Whiteboard\InstallAll.ps1"

 

MKdir c:\gpoinstalled

 

echo. 2> c:\gpoinstalled/whiteboard.txt

 

:END

[mavhc]

1. you have / instead of \

2. you're not using dfs for installs

3. I have exactly the same code on my system to run a ps1 file and it's working

 

Powershell.exe -executionpolicy Bypass -File "\\domain.local\share$\SoftwareInstall\choco\files\install-command.ps1"

[thimon]

@cooper We have something similar to what you want. On computer startup it checks if there's a registry key, if not it runs the exe then creates the reg key. If the reg key exists it ends the script.

 

reg query HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\OneDrive\SignedIn if %ERRORLEVEL% EQU 1 goto REGISTRY if %ERRORLEVEL% EQU 0 goto EXIT :REGISTRY ECHO Y | REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\OneDrive\SignedIn goto ONEDRIVEINSTALL :ONEDRIVEINSTALL "C:\OneDrive\OneDriveSetup.exe" /allusers /silent goto EXIT :EXIT exit

Edited January 31, 2020 by thimon

[djm968]

Try this.

 

powershell.exe -ExecutionPolicy Bypass -Command "\\fs01\SoftwareDrivers\Software\Microsoft Whiteboard\InstallAll.ps1"

[chaplic]

Also, does the computer account have read access to the share?

[HPlum78]

A few thoughts on this and these are only things to make you think not saying there is a right or wrong way. -executionpolicy Bypass and by holding your script in a \\share location that all your systems access. So I as a malicious actor gain access to your environment and with little lateral movement get the ability to edit that script that is called by all your workstations on your networks. How long before your entire environment is being run by someone else? if you are holding scripts and calling them from a central repo I would look at having some code signing, also is this the best way to deploy software is another question?

 

Again nothing more than a nudge, not saying that anyone is wrong or right here just got my security hat on.

Edited February 1, 2020 by HPlum78

[mavhc]

If you had that access you could most likely add your own gpo to run your own script anyway. Or just edit the bat file that's not signed.

[HPlum78]

@mavhc you are correct but it's about reducing your attack surface. And I ain't even mentioned the bat file as if your using PS then just use PS!

 

Also if you are not monitoring/ and using AGPM for your GPOs then I suggest you look into it.

[mavhc]

Seems like kinda of a minor thing to worry about, it's rare someone's going to bother hacking your network like that, unless you're MI5

 

Way more likely one of your users is reusing a password, or typing their password into a fake website, or installing ransomware

 

AGPM sounds like something you'd have to pay MS for over and over again.

[HPlum78]

You do know how you get compromised? So a phishing (spear or on mass) or a MIM exposes a standard users account then that account gets used to start to infiltrate the network and gain lateral and horizontal privileged access.

 

I am making an assumption that you don't allow logging into workstations and surfing the Web with any type of privileged account?

 

Its scares me that MI5 is being used as a comparison for threat! security is all about the basics it's not going to take MI5 to hack your networks if you are not doing the basics to be secure it's going to be Johnny the 8 year old that owns you.

[free780]

You can write a powershell script to sign your powershell scripts. Monitoring and forwarding the powershell logs is possible. You'll need to forward to a SQL Server ideally and Write some queries. This is for anything you are not expecting. E.g a student using test-connection to scan your server subnet. You really need to employ someone Full Time to monitor this and to patch everything. In education we seem to not have the staffing levels to have a security administrator which is why mainly these steps are not taken.

[HPlum78]

Yep absolutely security is like the forgotten child it's a tough balancing act.

[mavhc]

The whole powershell signing thing is not a security measure, it's a don't run random scripts by accident measure

 

Can always just run the same commands in a shell

[cooper]

Going back to the top of the post before it opened a can of worms.

 

Thanks for the advise given but its not working yet.

 

Works if I run it manually though.

[mavhc]

What if you copy it locally and run it from c:\... does it work then? Also did you Unblock it if it was downloaded? Right click file (on server is better, not via share), properties, at the bottom: security: unblock