Win32_Process.Create question

[kanthrc]

Hi all,

I am posting this question again as I haven't got any response to my
previous post. I am hoping to get some solution to my problem at least
this time. Check out this script:

'**************************************************************
Starts Here
'**************************************************************
Set objSWbemLocator = CreateObject("WbemScripting.SWbemLocator")
Set objSWbemServices = objSwbemLocator.ConnectServer _
("120.18.10.11","root\cimv2","administrator","xyz_123","MS_409","",128)
Set objCreateProc = objSWbemServices.Get("Win32_Process")
int errReturn = objCreateProc.Create("cmd /c net use z:
\\120.18.10.1\miscbuilds /user:administrator Cool1@34",
Null,Null,intProcID)
Select Case errReturn
Case 0 WScript.Echo "Command successfully completed " _ & "Process ID:
" & intProcID
Case 2 WScript.Echo "Access Denied"
Case 3 WScript.Echo "INsufficient Privilege"
Case 8 WScript.Echo "Unknown Failure"
Case 9 WScript.Echo "Path not found"
Case 21 WScript.Echo "Invalid Parameter"
End Select
'**************************************************************
Ends Here
'**************************************************************
I have also created two event monitors to monitor process creation and
deletion events on the remote machine.

When I execute the above script, my process creation monitor script
displays two PIDs (one for CMD.exe & one for NET.exe). After a while,
process deletion monitor script displays the same PIDs as in the
process creation monitor window. But when I check the remote machine,
there wouldn't be any drive mapping (.

If I remove "cmd /c" from the command-line within objCreateProc.Create,
NO process gets created on the remote machine (as per the create
process monitor). But one funny thing here is objCreateProc.Create
returns the newly created PID and errReturn has a value "0" )

Now, if I replace the entire "net use...." by "notepad.exe" notepad
process gets created and the PID is returned by both
objCreateProc.Create & my create process monitor.

Your help would be greatly appreciated.

Thanks in advance,
RK

 

[kanthrc]

I have an update...!!

Drive mapping gets created when I use the script as shown in the
initial post. But it wouldn't be visible in explorer and accessible
using the drive letter mentioned. But I can see the drive mapping when
I right click on "My Computer" and select "Disconnect Network Drives"

One more thing I found out is.....Win32_Process.Create is returning 0
irrespective of the command which means the value of errReturn is 0
even if the command-line "somecrap.exe"

Any ideas??

RK