End User Support:Windows NT
Web at
support.microsoft.com/sup
port/kb/articles/q19 6/7/31.asp
).
For each logical network in use on the
For another interface to the AT
command and schedule service see the
LAN (LANAs in Microsoft network
section on SOON below.
Browser Monitor/Domain Monitor
terminology) Browser Monitor reports
These two GUI applications per
the current Master Browser for each
form similar functions in a Microsoft
networking environment. For each
transport in use on the network segment.
logical network in use on the LAN
(LANAs in Microsoft network termi
nology) Browser Monitor reports the
current Master Browser for each trans
the standard NT GUI equivalents, but
you will usually find that it doesn't
port in use on the network segment
have the obvious benefit that they can
work.
(see Figure 1). This tool is very useful
be called from scripts and passed argu
I have not yet found documentation
for diagnosing resource location prob
ments from other scripts; and the extra
for this, but it is an established part of
lems due to browser wars (constant
GUI tools which tap into areas of func
NT folklore that the only way of run
browser elections).
tionality not exposed by the standard
ning a program successfully using the
Domain Monitor lists the Primary
NT user interface. Without further ado
Schedule service is to wrap it in a script.
Domain Controller for visible domains
let's dive in and look at some of the
Furthermore, you must invoke the
and the domains with which it has
ones I use most often.
script with an explicit launch of a com
established trust relationships see
mand shell, passing it the name of the
Figure 2.
GUI Tools
script as a command line argument:
Command Line Tools
NT provides facilities for automat
CMD /C C:\MyPath\MyCmd.cmd
ically running programs or scripts at
ADDUSERS, NTRIGHTS, XCACLS,
certain times of day via the Schedule
Another
reason
for
programs
GLOBAL and LOCAL are command
service (equivalent to Unix's cron
scheduled with WinAT or even the AT
line equivalents to User Manager (for
daemon) and the AT command, which
command to fail is if Microsoft Internet
Domains) and the Permissions tab of
provides a command line interface to
Explorer 4 or 5 has been installed on
the NTFS properties dialog.
the service, using which the system
the computer in question. IE replaces
administrator can schedule jobs for
the native NT ATSVC.EXE with its
ADDUSERS
later execution.
own schedule service MSTASK.EXE,
ADDUSERS takes a specially for
However, many system adminis
which is incompatible with AT and
matted text file as input and creates
trators have found AT's syntax diffi
WinAT. Microsoft KnowledgeBase ar
user accounts, complete with home di
cult, and therefore Microsoft has
ticle Q196731 describes how to rectify
rectories and the connections to logon
provided a graphical interface to the
the situation (this can be found on the
scripts and profiles. [Note that the for
schedule service in WinAT.
WinAT
REM Script to demonstrate use of command line security tools
If you installed the Resource Kit
REM Dump all users from Domain Users
utilities with the CD's SETUP program
REM Assumes that Resource Kit security utilities are on the path
you will find WinAT under Start\Pro
IF EXIST DU.TXT DEL DU.TXT
grams[common group]\Resource Kit
GLOBAL Domain Users MYDOMAIN > DU.TXT
4.0\Configuration\Command Sched
REM Now open the file and pass each entry as an argument to NTRIGHTS
uler. Running it for the first time opens
REM Revoke the right to log on at the Domain Controller
a blank scheduler document repre
FOR /F tokens=1 %%A IN (DU.TXT) DO NTRIGHTS r SeInteractiveLogonRight
senting a single computer (like most
u %%A
NT utilities, WinAT can work on a re
REM more restrictions of undesirable rights here
mote NT computer as easily as on the
REM set some file permissions, starting with revocation of the ability to
local one).
write to the Windows System32 directory
To create a new scheduled job,
FOR /F tokens=1 %%A IN (DU.TXT) DO XCACLS %SYSTEMROOT%\SYSTEM32 /E /R
choose Edit/Add and type the path
%%A:W;W
and command line to the script you
...etc....
want to execute. You may be tempted
to put the name of a binary executable
Figure 3 A script to reset the security properties of users
on this command line, but if you do
to a known base level.
File: E1716.2
Issue 116 (March 2000) page 8
PC Network Advisor
<< < GO > >>
New! The best sites for quality inkjet printer cartridges and the best sites for cheap inkjet cartridges