W
William
Guest
hi,
i have perfmon alerts config'd to monitor disk space, memory, and many other
counters. i have created a regular (non admin) user that the alert runs as.
all of the perfmon alerts start just fine and run appropriately UNTIL an
alert is fired and it has to execute a batch file with "cscript
sendemail.vbs ...." in it. i have even altered batch file to simply "echo
test > c:\scripts\test.txt" (without quotes) and that won't even work
the alert is never fired and of course i never receive alerts.
user has
been granted logon locally rights in sec pol, and i assigned user the logon
as batch file rights in sec pol. i have also granted the builtin batch user
read/execute on the cmd.exe file in %systemroot%\system32 (KB867466).
the only way alert works is if i add user to loca local administrators group
which i cannot do. i even tried adding user to profile system performance
sec pol and to both perfmon local groups and that doesn't make a difference.
user has full control over the c:\scripts directory (where batch file and
sendemail.vbs script resides).
if i log on to box locally with user configured as run as in alert, i am
able to execute the batch file which executes vbsscript with no issue and
e-mail is sent.
the app log reports following event when it attempts to execute cmd
associated with alert:
Source: SysmonLog
Type: Warning
Event ID: 2038
User: N/A
Description: Unable to execute command " for the High Disk Activity alert.
The alert will continue as scheduled. The error code returned is in the
data.
Data (words): 00000005
any help appreciated getting this to work. since i have changed batch file
to something simple as echo piped to text file that still doesn't work so it
is something with permissions as stated in event above (00000005).
thank you.
i have perfmon alerts config'd to monitor disk space, memory, and many other
counters. i have created a regular (non admin) user that the alert runs as.
all of the perfmon alerts start just fine and run appropriately UNTIL an
alert is fired and it has to execute a batch file with "cscript
sendemail.vbs ...." in it. i have even altered batch file to simply "echo
test > c:\scripts\test.txt" (without quotes) and that won't even work
the alert is never fired and of course i never receive alerts.
user has been granted logon locally rights in sec pol, and i assigned user the logon
as batch file rights in sec pol. i have also granted the builtin batch user
read/execute on the cmd.exe file in %systemroot%\system32 (KB867466).
the only way alert works is if i add user to loca local administrators group
which i cannot do. i even tried adding user to profile system performance
sec pol and to both perfmon local groups and that doesn't make a difference.
user has full control over the c:\scripts directory (where batch file and
sendemail.vbs script resides).
if i log on to box locally with user configured as run as in alert, i am
able to execute the batch file which executes vbsscript with no issue and
e-mail is sent.
the app log reports following event when it attempts to execute cmd
associated with alert:
Source: SysmonLog
Type: Warning
Event ID: 2038
User: N/A
Description: Unable to execute command " for the High Disk Activity alert.
The alert will continue as scheduled. The error code returned is in the
data.
Data (words): 00000005
any help appreciated getting this to work. since i have changed batch file
to something simple as echo piped to text file that still doesn't work so it
is something with permissions as stated in event above (00000005).
thank you.