DUA System Account

[Richard]

Do I understand it correctly that DUA using the system account can not run
execute process, but it will under the administrator account?

Reason asking, None of my executeprocesses ever get executed. Looking in
the event log, well, that tells me allot...just not sure what it is..

Event 105 and Event 125 shows under DUA in the application Log.


COPYFILE,,,d:\updates\CSI_logo2.dxf,,c:\duawork\CSI_logo2.dxf,DANO
COPYFILE,,,d:\updates\KillProg.exe,,c:\duawork\KillProg.exe,DANO

MOVEFILE,,,c:\duawork\CSI_logo2.dxf,,c:\CSI_logo2.dxf,DAMOVEFILE_REPLACE_EXI
STING
MOVEFILE,,,c:\duawork\KillProg.exe,,c:\windows\system32\KillProg.exe,DAMOVEF
ILE_REPLACE_EXISTING|DAMOVEFILE_DELAY_UNTIL_REBOOT
EXECUTEPROCESS,,,,c:\windows\system32\KillProg.exe,,killprog
/SHELL,DAYES,4294967295,,DASEC_REV,,,,DASEC_REV,,,,,,c:\windows\system32,1,,
WinSta0\Default


KillProg /SHELL does a shutdown of my custom shell.

If I use this from a cmd prompt it works fine, but not in a DUA Script.

 

[Slobodan Brcin \(eMVP\)]

Hi Richard,

It might be a problem with implementation of killprog program what ever it is.
Probably it expect to be executed under the session and account of your shell.

For instance on XP you can have more than one account/shell started at same time. When you start from cmd prompt killprog it knows
to which shell it belong and what to do with it.
But if you execute it from system account, this program should either somehow kill all shells (which is unlikely) or fail to kill
any shell at all (which is the case).

Please tell us why do you need to do this. And your exact setup.

Regards,
Slobodan

 

[Richard]

Killprog is a small application I wrote, which kills the shell and main
application so I can upgrade them.
It works fine using it from a cmd prompt on the target, just not from the
DUA script.

I changed the DUA in TD to run as admin instead of system. Now, it doesn't
even poll my usb device.
It doesn't appear to even be running as a service, however I do not have
taskmanager so I don't know if it's running or not.
When configured to run a system, everything worked fine but it did not want
to Execute...

In a winlogin type build, I do an autologin as administrator, so which way
should I configure DUA to run as?

Richard

Hi Richard,

It might be a problem with implementation of killprog program what ever it is.
Probably it expect to be executed under the session and account of your shell.

For instance on XP you can have more than one account/shell started at

same time. When you start from cmd prompt killprog it knows

to which shell it belong and what to do with it.
But if you execute it from system account, this program should either

somehow kill all shells (which is unlikely) or fail to kill

 

[Richard]

Here are a few more details. I'm running a Winlogin image and I do have the
following in TD.
Registry Editor, Event Log, Administrator Account, Automatic Login

DUA at least works when I have it configured for the System Account, it just
doesn do Execute Process. After much reading, I read that if you have
Winlogin, then you want DUA to use the Administrator account.

I change that setting in TD and rebuilt my image.
Now DUA never does anything. I do not have Task Manager to view the
processes and services, so I did the following:

Net start "Device Update Agent" and it returns an error stating the Service
can not start due to Logon problems.

Then I try to view the event log by typing eventvwr at the command line like
the MS Site says. Well, that surely doesn't work.

So I looked at the Application Event logs offline and there are no entries
for DUA in there, like the service did not ever start.


So my question is, in Target Designer, does DUA need to be set for the Admin
account, and if so, then what am I doing wrong. All the reg entries look
correct and are basically the same as they were before when it was set as
System account.

Please help,
Richard

 

[Slobodan Brcin \(eMVP\)]

Hi Richard,

Your application. Well that is good to hear.
You can put debug outputs throughout your application so you can look at remote debugger output from you application and reports
what exactly failed. It would be highly unusual that app did not even started, but if it is started then you will need to find out
what API function failed and to read about requirements of that function.

BTW: You can always use "runas" so if you know acoont name and password you can launch any application under its content.

Regards,
Slobodan

 

[KM]

Richard,

Just a few quick suggestions that may help you to narrow down the problem:

- Use sc.exe instead of net.exe to start and view the DUA service parameters and etc. It will certainly give you more info.

- Under [HKLM\SYSTEM\CurrentControlSet\Services\XPEAgent\Parameters\Config] key add "Logging"=dword:1 value. This should turn on
the DUA verbose mode and you will see more info in Event viewer log.

- When you switched to Admin account for DUA service. Try to use the Admin account for EXECUTE command
(MachineName\Administrator, Password).

KM

 

[Richard]

Thanks KM,

Just a few quick suggestions that may help you to narrow down the problem:

- Under

[HKLM\SYSTEM\CurrentControlSet\Services\XPEAgent\Parameters\Config] key add
"Logging"=dword:1 value. This should turn on

the DUA verbose mode and you will see more info in Event viewer log.

I have this already done, but I can't view the logs on the target because
eventvwr and MMC is not in the image, viewing logs remotely show just the
event number and thats it.

- When you switched to Admin account for DUA service. Try to use the

Admin account for EXECUTE command

(MachineName\Administrator, Password).

Well, that is the thing, when switching DUA to Admin account, it never polls
or and will not run the most simple script without execute, so that is why I
think it never starts the service. No mention in the event log at all about
DUA.

Now, if I simply change it back to run as system in TD, everything works
fine but the Execute and Execute Process.

I did see another thread about this same exact thing, but the thread was so
long and the person tried SO many things, it was unclear what actually fixed
it.

I will play with it some more today to see what is going on.

 

[Richard]

I got it. Still running under the system account and my executeprocess is
working fine. I needed to add a few delays in there and now it works.

Thanks for the help. Never could get anything to work under the
Administrator Account though. Hopefully this doesn't come back to huant me.

Richard

 

[KM]

Richard,

Seems like you fixed you problems.

But I just wanted to give you some more info in case you someday move to admin account.

To view Event Viewer Log without Event Viewer Log Snap-in in the image you can use PsLogList tool of PsTools packages from
www.sysinternals.com.

Also, when you switch to Admin account for DUA you first have to verify the DUA service is running. It is strange if it does not but
then you can debug it more carefully.

--
Regards,
KM, BSquare Corp.

Thanks KM,

Just a few quick suggestions that may help you to narrow down the problem:

- Under

[HKLM\SYSTEM\CurrentControlSet\Services\XPEAgent\Parameters\Config] key add
"Logging"=dword:1 value. This should turn on

the DUA verbose mode and you will see more info in Event viewer log.

I have this already done, but I can't view the logs on the target because
eventvwr and MMC is not in the image, viewing logs remotely show just the
event number and thats it.

- When you switched to Admin account for DUA service. Try to use the

Admin account for EXECUTE command

(MachineName\Administrator, Password).

Well, that is the thing, when switching DUA to Admin account, it never polls
or and will not run the most simple script without execute, so that is why I
think it never starts the service. No mention in the event log at all about
DUA.

Now, if I simply change it back to run as system in TD, everything works
fine but the Execute and Execute Process.

I did see another thread about this same exact thing, but the thread was so
long and the person tried SO many things, it was unclear what actually fixed
it.

I will play with it some more today to see what is going on.

 

[Richard]

Thanks KM

Richard,

Seems like you fixed you problems.

But I just wanted to give you some more info in case you someday move to admin account.

To view Event Viewer Log without Event Viewer Log Snap-in in the image you

can use PsLogList tool of PsTools packages from

www.sysinternals.com.

Also, when you switch to Admin account for DUA you first have to verify

the DUA service is running. It is strange if it does not but

then you can debug it more carefully.

--
Regards,
KM, BSquare Corp.

Thanks KM,

Just a few quick suggestions that may help you to narrow down the

problem:

- Under

[HKLM\SYSTEM\CurrentControlSet\Services\XPEAgent\Parameters\Config] key add
"Logging"=dword:1 value. This should turn on

the DUA verbose mode and you will see more info in Event viewer log.

I have this already done, but I can't view the logs on the target because
eventvwr and MMC is not in the image, viewing logs remotely show just the
event number and thats it.

- When you switched to Admin account for DUA service. Try to use

the
Admin account for EXECUTE command

(MachineName\Administrator, Password).

Well, that is the thing, when switching DUA to Admin account, it never polls
or and will not run the most simple script without execute, so that is why I
think it never starts the service. No mention in the event log at all about
DUA.

Now, if I simply change it back to run as system in TD, everything works
fine but the Execute and Execute Process.

I did see another thread about this same exact thing, but the thread was so
long and the person tried SO many things, it was unclear what actually fixed
it.

I will play with it some more today to see what is going on.