Powershell script on remote computer not running a

问题:

I have a script on my domain stored on the Active Directory server. every machine on the domain has a task that when fired, calls this script to run.

Running the task from the AD server works. Running the task from another machine doesn't work. However, running the command that is triggered from cmd manually on the remote computer works?

Could anyone shine some light on this. Basically I call it like this so that the trigger is set up like...

Action: PowerShell.exe

Arguments: -noprofile –ExecutionPolicy Bypass -File "\\<>NameOfADServer<>\C$\Tasks\script.ps1" "Argument 1" "Argument 2"

回答1:

Running as SYSTEM is probably your issue - it wont have any access outside of the PC its running on.

When you run it manually youll have the access.

回答2:

There's several problems here.

1. You're running the task as the local SYSTEM accounts. SYSTEM generally does not have access to any network resources.
2. You're using the administrative share (\\<servername>\C$) to share the script. Only users that have Administrator access to the server can access the administrative shares. Administrative shares are heavily restricted by design and you cannot modify the access on them.

My guess is that the script works when you run it manually is because it's using the current user's credentials for network access when you do that, but don't quote me on that.

The simplest solution with the least amount of change is to do this:

1. Create a group in Active Directory. Add the Computer accounts, or, preferably, groups with Computer accounts which you want to be able to run the script to this new group. If you really want any SYSTEM account on any computer in the domain to be able to run the script, you can add the "Domain Computers" group to the group.
2. Create a folder on the server. Put the script in the folder. Don't put anything in this folder you don't want your users to read. Assign the "Read" NTFS permission to the group created above to the folder.
3. Share the folder out. Grant the group you just created the "Full Control" share access. If you want, you can make it a hidden share by adding a dollar sign to the end of the name.
4. Update your scheduled tasks to use \\<servername>\<sharename>\script.ps1.

This is almost certainly not the best method to accomplish what you're actually trying to do, but this is probably the best way to use scheduled tasks running scripts on a network share with the SYSTEM account.