VBS Script issue with VVEngine under Vista ?

Guest

Hello,

I trying to send e-mail notifications with ViceVersa Pro scheduled by VVEngine under Vista.

In order to do this, I downloaded your VBS script (tgrmn.com/web/kb/item67.htm)

Each time that ViceVersa.exe is run by VVEngine no e-mail notifications are sent !!!
But If I run the same VV Profile (.fsf) in command-line e-mail notification is correctly sent ! Of course I've checked that VVEnginge and ViceVersa was running under the same account.

More strange : in the log file, ouputs are strictly the sames :
"
2008-04-19 10:42:15 : Exit Code: 0. OK.
2008-04-19 10:42:15 : Running script X:\profilename_end.vbs
2008-04-19 10:42:16 : Script Output:
2008-04-19 10:42:16 : Microsoft (R) Windows Script Host Version 5.7
2008-04-19 10:42:16 : Copyright (C) Microsoft Corporation 1996-2001. Tous droits r‚serv‚s.
2008-04-19 10:42:16 : User Name: usertest
2008-04-19 10:42:16 : Password: passwordtest
2008-04-19 10:42:16 : From E-Mail: xxxx@domaintest.net
2008-04-19 10:42:16 : To E-Mail: xxxx@domaintest.net
2008-04-19 10:42:16 : SMTP Server: smtp.provider.net
2008-04-19 10:42:16 : Send only if error: False
2008-04-19 10:42:16 : Port: 25
2008-04-19 10:42:16 : Ssl: Faux
2008-04-19 10:42:16 : Sending e-mail message to 'xxxx@domaintest.net' from 'xxxx@domaintest.net'
2008-04-19 10:42:16 : DONE.
2008-04-19 10:42:16 : End Script Output
2008-04-19 10:42:16 : Script return code: 0
"

In both case, there is no error message : it is as if everything was normal.

I checked network traffic on the network interface card in order to be sure: no smtp traffic when the profile is run through VVEngine ! [And classic SMTP traffic when the profile is run form a the SAME command line by myself : "C:\Program Files\ViceVersa Pro 2\ViceVersa.exe" "X:\profilename.fsf" /hiddenautosync /vveng]

Have you already test your VBS script to send notifications by e-mail under Windows Vista SP1 ?

I would appreciate any help or advice Wink

Regards,

TGRMN Software · Site Admin Joined: 10 Jan 2005 Posts: 8763

Is VVEngine running as a service? Or just as a normal program?
How about elevation, is it running with elevated admin rights?
thanks!
_________________
--
TGRMN Software Support
http://www.tgrmn.com
http://www.compareandmerge.com

Guest · Posted: Sat Apr 19, 2008 1:02 pm Post subject:

VVEngine is running as Service.

I try several configuration :
- Running as Administrator (with a full Administrator account)
- Running as the same user that I use when I'm logging and when I run VV manually

In both case : vbs script is executed without error as you can see on the log lines below (see Script Output in Log below).

TGRMN Software · Site Admin Joined: 10 Jan 2005 Posts: 8763

It must be something related to the new service security in Windows Vista :
http://technet.microsoft.com/en-us/magazine/cc162523.aspx
_________________
--
TGRMN Software Support
http://www.tgrmn.com
http://www.compareandmerge.com

Guest · Posted: Sat Apr 19, 2008 6:46 pm Post subject:

Services in Windows Vista are implemented and executed differently than in Windows XP. Services in Windows Vista are runned in session 0 (without user session interface interraction).

I think that my issue with your vbs script is due to Vista, but I didn't find the solution !!!

So if someone have already use VBS Email notification with ViceVersa run by VVEngine as a Service I would appreciate his (or her) help Wink

TGRMN Software · Site Admin Joined: 10 Jan 2005 Posts: 8763

Try also this:

http://blogs.msdn.com/vistacompatteam/archive/2006/10/19/impact-of-least-privilege-in-system-services.aspx

and especially the document mentioned in the blog post.

With the command SC and qprivs you should be able to query which privileges the VVEngine service has been given by Windows Vista.

thanks,
_________________
--
TGRMN Software Support
http://www.tgrmn.com
http://www.compareandmerge.com

Guest · Posted: Tue Apr 22, 2008 7:11 pm Post subject:

I tried to add many privileges by using this kind of cmd line :
sc.exe privs VVEngine SeBackupPrivilege/SeRestorePrivilege/SeIncreaseQuotaPrivilege/SeIncreaseBasePriorityPrivilege/SeTcbPrivilege/SeDebugPrivilege/SeSecurityPrivilege/SeAuditPrivilege/SeImpersonatePrivilege/SeChangeNotifyPrivilege/SeIncreaseWorkingSetPrivilege/SeManageVolumePrivilege

But always the same problem : vbs are well executed (cf log output) but email are not send ;-(

Guest · Posted: Wed Apr 23, 2008 6:00 pm Post subject:

Finaly I was forced to remove VVEngine as Service ;-(

Maybe that in the future your team will develop a new VVEngine with more Installation Options, and a best management of VVEngigne as Service under Vista.

Regards,

TGRMN Software · Site Admin Joined: 10 Jan 2005 Posts: 8763

I was wondering if you tried already changing the account used to run the VVEngine service. That is:

Local System account
The Local System account is a predefined local account that can start a service and provide the security context for that service. It is a powerful account that has full access to the computer, including the directory service when used for services running on domain controllers. The account acts as the host computer account on the network and as such has access to network resources just like any other domain account. On the network, this account appears as DOMAIN\<machine name>$. If a service logs on using the Local System account on a domain controller, it has Local System access on the domain controller itself, which, if compromised, could allow malicious users to change anything in the domain they wanted. Windows Server 2003 configures some services to log on as the Local System account by default. The actual name of the account is NT AUTHORITY\System, and it does not have a password that an administrator needs to manage.

Local Service account
The Local Service account is a special built-in account that has reduced privileges similar to an authenticated local user account. This limited access helps safeguard the computer if an attacker compromises individual services or processes. A service that runs as the Local Service account accesses network resources as a null session; that is, it uses anonymous credentials. The actual name of the account is NT AUTHORITY\LocalService, and it does not have a password that an administrator needs to manage.

Network Service account
The Network Service account is a special built-in account that has reduced privileges similar to an authenticated user account. This limited access helps safeguard the computer if an attacker compromises individual services or processes. A service that runs as the Network Service account accesses network resources using the credentials of the computer account in the same manner as a Local System service does. The actual name of the account is NT AUTHORITY\NetworkService, and it does not have a password that an administrator needs to manage.

Did you try using these accounts? thanks!
_________________
--
TGRMN Software Support
http://www.tgrmn.com
http://www.compareandmerge.com

Guest · Posted: Sat Apr 26, 2008 9:34 am Post subject:

I try to run run VVEngine Service with these 3 internal accounts and also with the Administrator account : always the same result