Hi All,
Firstly, yes I know this is a common question and I know there are other threads with it discussed. I’m posting this, however, as I have tried every thread and google hit I can find, but still cannot get my network to properly deploy a custom HOSTS file to the clients.
*The Setup*
I have a Windows Server 2003 machine and 27 clients, all on XP SP3. No user has administrative level rights over their own PC.
A wide range of Group Policies are applied across the domain, and all work perfectly.
In the root of my server, I have a subfolder called ‘logon$’. This folder contains various files and other data relevant to computers and/or users logging on (scripts, logos, etc.).
Share Permissions to this folder are set to a universal READ for both Everyone and Domain Computers. NTFS permissions are set to Administrators and SYSTEM having full control, with Users and Domain Computers having Read, Read and Execute and List Folder Contents rights. All rights propogate down to the objects contained inside logon$.
*The Specifics*
Right, I have an edited HOSTS file, currently stored inside logon$ that I wish to apply to users. Because they don’t have admin rights, I have decided to apply it to the PC rather than the user, and let SYSTEM run it.
There is also a very simple batch script, as follows:
@echo off
copy hosts %SYSTEMROOT%\WINDOWS\system32\drivers\etc /Y
This script is currently in the logon$ folder.
In AD I have a standard group – WebLockdown – which currently contains one PC, my test machine.
In Group Policy I have a policy called WebLock which has the WebLockdown AD group in its scope.
The settings of the GP are:
1) A computer/windows/scripts startup script link to my batch script in logon$. This is given as the UNC path (so \\SERVER\logon$\batchfile.bat).
2) A computer/security/filesystem setting that ensures SYSTEM has full and total control of the %SYSTEMROOT%\WINDOWS\system32\drivers\etc folder and its contents.
*The Problem*
Ok, I have run a lot of tests on this and carefully examined the RSoP and Application System Logs.
The result is that the computer IS running the script. It finds it, has permission to run it, and looks like it executes it (at least, the event log shows zero failures).
However, the script IS NOT taking effect. My new hosts file is not being copied to the test machine and replacing the existing hosts file.
I think the problem may be to do with UNC pathing, rather than permissions, as when I go into the server and try to run the script directly I get a ‘Cannot find the file specified’ error. Trust me, the file IS in the same folder as the script being run.
My users, whilst locked down and unable to access the Run command or command prompt do have the right to run scripts in the background (required for other applications). If I run the script from the *client* PC I get a ‘UNC paths are not supported’ error.
*Conclusion*
So, how the hell do I get this to work!? Nothing I seem to do is making a difference, and what amounts to a simple copying of a file from the server to replace a file on the local machine really should, in this day and age, be the easiest of tasks!
Can anyone please advise?