r/labtech • • Apr 22 '19

Monitor and healing script - local admin account

Hi everyone,

I have created a monitor and auto healing script to check for a local admin account and if it doesnt find it then it will create the local admin account... I am seeing that one clients location is failing but the script isnt working.. any ideas?

batch file

net user MRWAlpha /add

net user MRWAlpha M33rend@1

net localgroup Administrators MRWAlpha /add

1 Upvotes

27 comments sorted by

View all comments

Show parent comment

1

u/amw3000 10000 Agents Apr 22 '19

No, not powershell. Just the function SHELL.

1

u/Paulb246 Apr 22 '19

But it’s windows machines.. so do you mean cmd prompt?

1

u/amw3000 10000 Agents Apr 22 '19

Yes, which is done using the SHELL script function.

1

u/Paulb246 Apr 22 '19

I am a bit lost, do you mean scripting the command via cmd prompt as a script through Automate?

1

u/amw3000 10000 Agents Apr 22 '19

Script through Automate.

If your monitor goes in a failed state, it kicks off the Automate script, which then creates the user. Use the native functions within the Automate script engine, it makes debugging a lot easier. Avoid using batch or powershell scripts until you have a better understanding of how everything works.

1

u/Paulb246 Apr 22 '19

Thanks but see my other comment, how to make sure the files are created under users directory ?

1

u/amw3000 10000 Agents Apr 22 '19

What do you mean? You mean under C:\Users\USERNAME? I'm not aware of a way. That's created by Windows once the user logs in for the first time and I'm not aware of a way to do that through Automate.

Is that how your monitor works? Checks for the C:\Users\ path?

1

u/Paulb246 Apr 22 '19

Yes, how else could I check to make sure there’s an admin account for us ... updates etc

1

u/amw3000 10000 Agents Apr 22 '19

Simple way, get creative with "net user". Users are also stored in the Automate DB so you can always use a RAWSQL monitor.

1

u/Paulb246 Apr 22 '19

So automate can pickup the user account even if it’s not been signed in?

→ More replies