RSEE Not Working Properly

[peter_mclean@dodo.com.au]

Primalscript Remote Script Execution Engine DOES NOT work

Primalscript 6.0.171
Windows XP SP 3
Windows 7 Ultimate

After following the instructions as per the Sapien Document Explore, Chapter 14 - The Remote Script Execution
Engine, I can not get a response from the remote hosts.

Here is what i have done:

- Created an AD domain account called

[Alexander Riedel]

I took a brand new Windows 7 VM and installed the RSEE service, running just under the default system account.

Connected from another machine using PrimalScript and ran a
WScript.Echo "Hello World"
script and got the expected result back.

Since you are getting ******** Output from RSEE on machine... in the output window we know you port communication is working because this is sent from the RSEE service.

RSEE writes your VBScript to a temporary file and executes cmd.exe with the proper cscript.exe line and a redirection to get the output to a file. this file is then read and sent back to the corresponding instance of PrimalScript.
My guess is that the user and policies you added do not have enough permission to create files in the folder returned by CSIDL_COMMON_APPDATA

I would suggest to run the service under the default system account to verify normal operation. Then inspect your user settings and permissions to find out where the break is.

[peter_mclean@dodo.com.au]

Hi again Alex,

Thank you for your prompt and informative response.

When I run the RSEE service under the domain account it appears that although I use this domain
account as the credentials to connect to the remote machine, the script is not created in the
CSIDL_COMMON_APPDATA folder at all on the remote machines.

However, when I change the RSEE service to run under the local system account on both the XP Desktop and the
W7 Labtop, the vbs scripts are being created in the C:Documents and SettingsAll UsersApplication Data for
XP and C:ProgramData for W7, folders.

However the response I now get when remoting from either machine is "Cannot run Script, error: Access is denied".

I have ensured that both the C:Documents and SettingsAll UsersApplication Data folder and the C:ProgramData
folder allow full access to the System Account and also to the account that is used as the credentials for the
remote connections.

Can you please tell me where the output file that is read and sent back to the coresponding instance of
Primalscript is created as I can not find any evidence of the output file on either machine.

Any other thoughts?

[Alexander Riedel]

When you run the script from PrimalScript, are you supplying additional credentials? If so, try to leave the fields empty to execute the script under the system account and see if that works.

[peter_mclean@dodo.com.au]

Thanks heaps Alex. Your continued help is much appreciated. If I do not provide any username and password credentials when running remotely from either machine, the script now works in both directions, i.e. XP to W7 and W7 to XP. If this is the case then how does the security work, ie what mechanism ensures that I have or do not access to run the script remotely on either machine? I thought that you would need to provide credentials that allow administrator or the like permissions on the remote machine. Does the script run under the local system account on the remote machine since the RSEE service is running under the local system account, or does the script run under the credentials of the user that runs the script from Primalscript om the callng machine? For example if I am logged in as user fred@abc.com.au on the XP machine, and I run the script remotely via Primalscript does RSEE on the W7 machine impersonate fred@abc.com when running the script and passing the output back to me on the XP machine?

[Alexander Riedel]

It seems that after this mechanism was devised several things in the OS have changed. For one a service can no longer launch another process with different credentials.

While we review this, the safest way is to :

a) supply credentials to the service as needed if
the system account is not sufficient or desired.

b) Do not use alternate credentials in RSEE calls from
the client side.

That way the script you submit will always run with the credentials you specified for the service.
Alexander Riedel2012-04-12 12:54:42

[peter_mclean@dodo.com.au]

Thanks Alex. Your response as usual is always much appreciated. Option 1 does not work as I have tried it, ie both using local system account on RSEE and connecting with privileged domain account or privileged local account, and also using privileged domain account on RSEE and connecting using the same privileged domain account. Option 2 does work, ie using local system account on RSEE and not using any credentials at all when connecting. Please let me know if this in not correct or if you find a more secure way of doing this.