Compliance & GRCWhite paper

Run System Administration Scripts as Windows Service

Run System Administration Scripts as Windows Service

VB or JS scripting is a powerful tool used by administrators to automate administrative tasks. Smart, educated administrator can easily manage 30-50 servers without dropping balls if he uses administrative scripting…

Run System Administration Scripts as Windows ServiceVB or JS scripting is a powerful tool used by administrators to automate administrative tasks. Smart, educated administrator can easily manage 30-50 servers without dropping balls if he uses administrative scripting techniques. I would argue that Linux environment is more flexible for administrative scripting then Windows however syntax might be awkward in Unix shell scripting. Digital Edge wanted to introduce this case study to show how to overcome Windows shortage for automating administrative tasks.

Sometimes Windows system administrators have small tasks that they would like to script as a VBS and have it ran as a service. The example could be a process monitoring or simulating well known WhatsUp functionality. Let's say you have a file with IP addresses that you want to ping and send an email when the IP address is unavailable. It is easy to find a reference on the internet how to implement a VBS or JS script that would allow you to perform this task:

  • Open file (or maybe a small database);
  • Read entries in an array;
  • Loop through the array and build shell ping command;
  • Receive STDOUT in your script and parse it;
  • Send an email if there is a failure;
  • Delay for a define period of time;
  • Repeat all started from step 3.



Now the best thing for you is to run this as a service.

So when the server starts up your monitoring would be loaded in the memory.

There are 2 ways of doing it.

1. To run the script as a scheduled task. You can create a scheduled task that fires up when system starts up. You can do it through standard create task facilities clicking on Schedule task drop down on the Schedule tab and selecting "At system startup". 2. More elegant way is to run it as a service.

Windows Resource Kit provides utilities SRVANY and INSTSRV to do that.
You can reference Microsoft KB #137890 to see how it is done: http://support.microsoft.com/kb/137890
However windows service manager can start only a single executable without parameters.

You can start an executable like

c:\admin\foo.exe

But to start VBS you would need to be able to execute something like this:

cscript.exe c:\admin\foo.vbs

That cannot be done by service. To do this, you need to wrap the call in something that can be executed. Write a VB or C wrapper that would call your cscript with VBS. You also can use BAT mechanism for that. You can create your foo.bat as this:

cscript.exe c:\admin\foo.vbs>c:\admin\foo.log

Now this BAT can be executed by the service manager and you will even have a log file collecting output from your VBS script. So in the registry correspondent to your service you will be calling c:\admin\foo.bat. There is one small problem with this approach. If you open task manager you will not see the process associated with your foo.vbs. All you can see is cscript.vbs. If you have multiple vbs scripts running as service it is hard or impossible to distinguish them. To address this we suggest to copy cscript.exe from \windows\system32 directory to your admin directory and rename it lets say FOO.exe. So the foo.bat file will look like:

c:\admin\foo.exe c:\admin\foo.vbs>c:\admin\foo.log

then when you open task manager you can see task foo.exe that represents your foo.vbs running. Lastly, we suggest to use TAIL utility from Windows Resource Kit to monitor you foo.log. Good luck with you administrative scripting.

Talk to a Digital Edge expert

Book a 30-minute alignment call. We map your security and compliance gaps and show what a 30-day baseline looks like.

Keep reading

Related insights

Digital Edge and Pure Finance Group, accelerate compliance to the Graham-Leach Bliley Act.
Case studyCompliance & GRC

Digital Edge and Pure Finance Group, accelerate compliance to the Graham-Leach Bliley Act.

Pure Finance Group, an indirect home improvement lender based in Laurel, Maryland. recent engaged New York based Digital Edge to help them comply with the Graham-Leach B…

Keith J. Barry, Esq.Keith J. Barry, Esq.··2 min
CASE STUDY
Case studyCompliance & GRC

Security assurances and ISO-27001 certification with third-party MSSP, Digital Edge

Case Study - teamDigital Promotions, Inc. About Client: teamDigital Promotions is a digital marketing agency based in Bethel, Connecticut. For over 25 years, teamDigital…

Michael PetrovMichael Petrov··3 min
CASE STUDY
Case studyCompliance & GRC

Successful Case Studies: SOC2 audit

Digital Edge just guided a NASDAQ listed technology firm to SOC 2 Type 1 compliance. This client told us in late November 2021 that it was crucial that they get their SO…

Digital Edge··2 min