Script Host: Permission Denied: 'GetObject'

Discussion in 'Web Design & Coding' started by Punkrulz, Mar 13, 2007.

  1. Punkrulz

    Punkrulz Somewhat eXPerienced

    Messages:
    790
    Location:
    Woodbury, NJ
    Hey guys,

    New Script host coming up, but we haven't had any changes made to this file. The error is as follows:

    Code:
    Script: ********\legalnotice.vbs
    Line: 15
    Char: 1
    Error: Permission Denied: 'GetObject'
    Code: 800A0046
    Source: Microsoft VBScript Runtime Error
    
    Now I've opened up legalnotice.vbs. Here is what line 15 is. Bear in mind, nothing has changed recently to my knowledge so I don't know what it is.

    Code:
    Set objReg = GetObject("winmgmts:\\" & strComputer & "\root\default:StdRegProv")
    
    Any ideas?
     
  2. fitz

    fitz Just Floating Along Staff Member Political User Folding Team

    Messages:
    4,076
    Location:
    Chicagoland
    it means you don't have permissions on the computer. Generally means you are not an admin on the box referenced in the variable "strComputer"
     
  3. Punkrulz

    Punkrulz Somewhat eXPerienced

    Messages:
    790
    Location:
    Woodbury, NJ
    Fitz,

    Is there anything that can be done about this? I do believe though that this is not the case. This error message is happening on a computer where 1) The user who's logging in is a domain admin. 2) Another computer this is happening on, the user is in fact a local administrator.

    What would have changed? The most recent change I think that has been made is that my co-worker was trying to install something called "SpiceWorks". They needed him to make a GP change that involves WMI. Is it possible that is the case?
     
  4. fitz

    fitz Just Floating Along Staff Member Political User Folding Team

    Messages:
    4,076
    Location:
    Chicagoland
    yes if his changes to the policy involved changing permissions for remote WMI.

    Also, Spiceworks is free network management utility.. inventory and monitoring of hardware and the like. I played with it for a while but didn't like it much..
     
  5. Punkrulz

    Punkrulz Somewhat eXPerienced

    Messages:
    790
    Location:
    Woodbury, NJ
    Yeah, we're trying to find a utility (Free!) that will go and scan every computer so we can perform a good inventory on the machines... any ideas?

    Also, I undid his changes previously. Now yesterday one of the users was reporting to me that after I reverted back to old settings with the GP, replicated the settings, and had him gpupdate /force, that the error didn't popup. I still have to ask if it came up again. But now it's happening for the Captain of Police. What else can I check?
     
  6. fitz

    fitz Just Floating Along Staff Member Political User Folding Team

    Messages:
    4,076
    Location:
    Chicagoland
    What kind of inventory? Software/Hardware? Are you wanting to run reports off the data? Do you want to push the data into a database for persistence? How often will you run the inventory?

    If you are going to ask for project advice, you would need parameters for the project. :)

    All that being said, I gave on finding a utility and am in the process of writing my own scripts to pull hardware/software info into an XML file that gets pushed to a central repository. The scripts will be part of the login scripts and will run only if it hasn't run on that computer within the last month.

    There is another process that will suck all the XML data into a SQL backend that we can run reports off of.. old info will get purged each month based on the age of the last report in date (haven't determined a purge cutoff yet).

    This might be more than you are willing to do (or more advanced than what you can handle) in which case.. you can look at Spiceworks

    There is also:
    MS Software Inventory Analyzer - not bad for smaller shops
    LanSweeper - probably what I would be using if I needed a free utility and wasn't rolling my own
    WinVentory - Soon to be called Open-AudIT
    Or any number of 3rd party utilities (SMS, etc)
    So.. you undid the policy changes and now one of the users that HAD the error before now does not get it but someone that didn't have the error is not getting the error? Have you tried to reboot/refresh the policy on that computer?
    what is your full code look like?
     
  7. Punkrulz

    Punkrulz Somewhat eXPerienced

    Messages:
    790
    Location:
    Woodbury, NJ
    Let's discuss the project via PM, that way we don't tick others off. :)

    Code of the script in question:

    Code:
    Option Explicit
    
    ' Constants
    Const HKEY_LOCAL_MACHINE = &H80000002
    
    ' Variable Declarations
    Dim strComputer
    Dim objReg
    Dim strKeyPath
    Dim strValueName
    Dim strValue
    
    ' Variable Initialisations
    strComputer = "."
    Set objReg = GetObject("winmgmts:\\" & strComputer & "\root\default:StdRegProv")
    strKeyPath = "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
    
    ' Construct the LegalNoticeCaption and set the value
    strValueName = "LegalNoticeCaption"
    strValue = "WARNING!!!"
    objReg.SetStringValue HKEY_LOCAL_MACHINE, strKeyPath, strValueName, strValue
    
    ' Construct the LegalNoticeText and set the value
    strValueName = "LegalNoticeText"
    strValue = "This system is the property of the **************  and established for the sole use of authorized users for official business only. You have no expectation of privacy in its use. To protect the system from unauthorized use and to ensure that the system is functioning properly, individuals using this computer system are subject to having all of their activities on this system monitored and recorded. Anyone using this system expressly consents to such monitoring."
    strValue = strValue & vbCrLf & vbCrLf
    strValue = strValue & "By continuing to use this system you indicate your awareness of and consent to these terms and conditions of use. LOG OFF IMMEDIATELY if you do not agree to the conditions stated in this warning."
    objReg.SetStringValue HKEY_LOCAL_MACHINE, strKeyPath, strValueName, strValue
    
    ' Construct the LogonPrompt and set the value
    strValueName = "LogonPrompt"
    strValue = "Any unauthorized access of this system or unauthorized use of the information                on this system by authorized users or others is prohibited."
    objReg.SetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue
    
    ' Construct the Welcome and set the value
    strValueName = "Welcome"
    strValue = "                                                     DTPD - 1*"
    objReg.SetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue
    
    ' Tidy up and quit
    Set objReg = Nothing
    WScript.Quit
     
  8. fitz

    fitz Just Floating Along Staff Member Political User Folding Team

    Messages:
    4,076
    Location:
    Chicagoland
    umm.. why not just set this via group policy?

    Under the Computer Settings:
    Windows Settings/Security Settings/Local Policies/Security Options. There are options for "Message text for users attempting to log on" and a "Message title for users attempting to log on"
     
  9. Punkrulz

    Punkrulz Somewhat eXPerienced

    Messages:
    790
    Location:
    Woodbury, NJ
    I went through this previously, I forget what post... but the reason this isn't set via GPO is because we cannot achieve the desired results and display of all of this as opposed to using it with GP... basically involves spacing and formatting, and also I know one of the things being set here can't be set in GP, it's only registry. :)
     
  10. albybum

    albybum Penguin Rancher

    Messages:
    280
    Location:
    Elizabethton, TN
  11. Punkrulz

    Punkrulz Somewhat eXPerienced

    Messages:
    790
    Location:
    Woodbury, NJ
    Negative Albybum, they are using Windows XP SP2 here. :(
     
  12. fitz

    fitz Just Floating Along Staff Member Political User Folding Team

    Messages:
    4,076
    Location:
    Chicagoland
    You never answered my other question if you chef's machine had the policy refreshed after you reverted the policy changes.

    edit:
    And was this assertion correct?
    What policy was changed before?

    edit2:
    Ok.. so the user logging in, I'm assuming has admin rights?
    Is this script running through the login script? computer startup script? Run Remotely under different credentials?
    Have you checked WMI Permissions (run wmimgmt.msc, right-click on the computer and select properties, under the security tab, check the security for the CIMV2)

    on a side note, you may want to look into error traping so end users don't get errors and the rest of the script can continue to run if necessary.
     
    Last edited: Mar 14, 2007
  13. Punkrulz

    Punkrulz Somewhat eXPerienced

    Messages:
    790
    Location:
    Woodbury, NJ
    Damn, I think I was replying to this when I got a fire call and had to leave my computer!

    - After I reverted the WMI policy back to it's original state (Not Configured), I had the person I was talking to refresh his computer policy. When he logged back in, he stated he did not get the error again.
    * Note: Numerous users are reporting a very long login time than it used to be.

    The policy changed:
    I'm not quite sure where the policy is. I can't find it on my laptop. I think it was:
    Computer Config -> Windows Settings -> Security Settings -> System Services -> WMI Performance Adapter -> I think the service was set to Automatic, and the security was set so that Administrators and Everyone could look at it? I don't know, but I think that was the problem.

    - The user logging in who has the problem now; Yes, he does have administrative rights.
    - The script is a Computer Startup script that runs on it's own that only sets the Logon Messages.
    - I have not checked the WMI Permissions, I have never done that before... I'll check them but the most I can do is report back to you what they are, because frankly I wouldn't understand em.
    - Error Trapping, how do you set that up?