5

I have a batch file set to run via Task Scheduler in Windows Server 2008 R2. The batch file is being used to rotate and compress MySQL logs, and the folder containing these logs is encrypted using the Windows built in EFS encryption. I found a VBS script which will compress (zip) a folder, and I'm using this to compress the old log file(s) after rotation. The batch file runs fine if I run it at the command line.

The problem is when I try to have Task scheduler run it. I have it set to run once a day, and is running as myself (I have access and can view the encrypted log files, etc). But when the task runs (either at the scheduled time or if I manually run the task) it chokes when running the VBS script, saying it's unauthorized. When the batch file calls CScript to run the VBS script, is CScript running as the same user (myself)? I'm just calling it from the batch file as follows:

CScript  zipIt.vbs  %TEMPDIR%  %ARCHIVEDIR%\%TARGETZIP%

Here are the contents of the VBS script:

Set objArgs = WScript.Arguments
InputFolder = objArgs(0)
ZipFile = objArgs(1)
CreateObject("Scripting.FileSystemObject").CreateTextFile(ZipFile, True).Write "PK" ^& Chr(5) ^& Chr(6) ^& String(18, vbNullChar)
Set objShell = CreateObject("Shell.Application")
Set source = objShell.NameSpace(InputFolder).Items
objShell.NameSpace(ZipFile).CopyHere(source)
wScript.Sleep 2000

I'm not very knowledgeable with VBS or Windows administration in general, but I'm guessing that this script is having trouble creating a new file in the encrypted folder. Because when I turn off the folder encryption it works ok from Task Scheduler. I was thinking of calling CScript using "Runas" with my own credentials, but I wouldn't want to have my password stored in the batch file in the clear, since other users have access to these files (DatabaseAdmin, etc). In Task Scheduler, there is an option to "Run with highest privileges". Would this fix the problem? I was avoiding this because I figured I should try to figure out how to get it to work with the least privileges possible.

UPDATE: While poking around, I found that I actually do NOT have ability to unencrypt the MySQL log file, even though I DO have that ability for the containing folder (verified by cipher.exe /c). The only account with unencrypt permission was SYSTEM. This might be because the MySQL log is created by the tool "MySQLAdmin flush-logs". As I understand it, files created by applications are owned by SYSTEM (not 100% sure on that). Maybe I have to call MySQLAdmin flush-logs in my script by using "runas". But then I have the same problem of not wanting to store my credentials in the batch file in clear text. Will test when I can.

Any help is appreciated.

zako42
  • 173
  • 5
  • "Run with highest privileges" may be necessary as I understand it "runs as Administrator" which is needed for certain tasks. – sec_goat Nov 18 '13 at 21:06

1 Answers1

0

If this log file never gets removed or renamed, then you can attempt to add EFS access for your account by using SysInternals' PsExec tool running cipher as the system account. Something like:

psexec -s cipher /adduser ...

If, however, this is a rotating file that gets replaced, then you will encounter this problem with every file that MySQL creates since it is running under the system account. If that is the case, then you should consider running the MySQL server as a specific user account with a known password and an EFS certificate, whether it be your own account or a dedicated account. This is the same account that you will need to use to run your scheduled script.

GuitarPicker
  • 394
  • 1
  • 8