Distribution area affected by "force run as user"?

Hi.
Still using ZDM 7 for the moment.
I have an AO which:
- Workstation associated.
- Distributes some registry keys (Distribution Tab).
- Copies files locally (Distribution Tab).
- Runs the files that were copied (Run Tab, Secure System User).
- Deletes the files (Termination Launch Script).
There are problems!
First of all, we are now using Microsoft file server, and the workstations do not have rights to this area (and cannot currently get rights - addressing this in another thread).
The file copy fails if I do not enable the "force run as user if workstation associated", but this is expected since the WS doesn't have rights to copy the files from the share. However, if I enable the "force run as user", the file copy works but the registry keys fail since the user running the AO is a restricted user.
Also, if I tick the "run in WS security space", and click apply ... the selection is cleared - the check box never remains on.
If I associate by user, then everything works fine.
It's as if the entire distribution section runs as user if the "force run as user" is associated. I don't really want to associate by user - I would prefer WS as this only needs to be run once per WS.
Any advice on this?
I presume the distribution section should not behave in this way?
I have created new AOs to see if these problems persist and they do!
Please let me know if you need more info.
Thanks!

Originally Posted by craig_wilson
That does not sound like proper behavior.
What agent version are you running?
>
> If I associate by user, then everything works fine.
> It's as if the entire distribution section runs as user if the "force
> run as user" is associated. I don't really want to associate by user - I
> would prefer WS as this only needs to be run once per WS.
Craig Wilson - MCNE, MCSE, CCNA
Novell Knowledge Partner
Novell does not officially monitor these forums.
Suggestions/Opinions/Statements made by me are solely my own.
These thoughts may not be shared by either Novell or any rational human.
7.0.1.0 - have been running this for some time.
I'm presuming you will say upgrade :)

Similar Messages

A force run problem

I am trying to force run an application set to make registry changes and am
having difficulities getting it to work. If I launch it from app explorer no
problems, just getting it to run upon logon. Can anyone tell me where the
snafu is?
Thanks
Mike

Is it User or WS assigned?
If WS Assigned, you may want to set it to "Force Run As User", or it will
run when the PC starts and before user logon. If doing HKCU settings, it
would not do what you wanted.
Craig Wilson - MCNE, MCSE, CCNA
Novell Support Forums Volunteer Sysop
Novell does not officially monitor these forums.
Suggestions/Opinions/Statements made by me are solely my own.
These thoughts may not be shared by either Novell or any rational human.
"Mberg" <[email protected]> wrote in message
news:DZ3ui.3758$[email protected]..
>I am trying to force run an application set to make registry changes and am
>having difficulities getting it to work. If I launch it from app explorer
>no problems, just getting it to run upon logon. Can anyone tell me where
>the snafu is?
>
> Thanks
> Mike
>

Problems Force Running a batch file

Hi There,
I am trying to force-run a batch file to copy files from a local NBO Appliance to the C:\tmp directory on the user's workstation. The batch file lives at c:\tmp\branding.bat.
I cant get the batch file to force run. Zen reporting advises that the batch file has distributed and launched successfully, however the files do not copy.
However, if i click on the icon for the batch file app - the files copy no problem. I have tried running Workstation Associated and (Unrestricted) User Associated as well as Workstation - Force Run as User.
Path to executable file:
%*WinSysDir%\cmd.exe
Parameters:
/c "c:\tmp\branding.bat"
Any ideas? The batch file has to refer to the P: drive as the application covers 40 different sites each with their own appliance containing source files.
Running NBO2 - ZFD 4 Agent 4.0.1.60 - Clientless
Desktop XP Workstations
Thanks
Thax

Have the app object copy the batch file to the hard drive from the
server and then run it locally. This should work with a Middle Tier server.
thax wrote:
> Hi there,
>
> I cant use the actual server name as this is an application which runs
> through a middle tier server for multiple NBO sites so therefore needs to
> use the P: reference...
>
>>>> kokoo<[email protected]> 9/03/2006 12:37 >>>
>
> TRY edit Scrirts:
> #\\FS_SERVER_name\VOL\BATCH.BAT
>
> edit batch file:
> xcopy "p:\nal\wxp\ZenPolicies\Branding\*.*" "C:\tmp\ZenPolicies\Branding\"
> /s /v /e /y
> ==>
> xcopy p:\nal\wxp\ZenPolicies\Branding\*.* C:\tmp\ZenPolicies\Branding\ /s
> /v /e /y
>
> "thax" <[email protected]>
> *******:[email protected]...
> Hi Jeremy,
>
> xcopy "p:\nal\wxp\ZenPolicies\Branding\*.*" "C:\tmp\ZenPolicies\Branding\"
> /s /v /e /y
> pause
>
> Thax
>
> >>> Jeremy Mlazovsky<[email protected]> 8/12/2005 00:20
>
> Can we see the contents of your batch file?
>
> thax wrote:
> > Hi There,
> >
> > I am trying to force-run a batch file to copy files from a local NBO
> > Appliance to the C:\tmp directory on the user's workstation. The batch
>
> > file lives at c:\tmp\branding.bat.
> >
> > I cant get the batch file to force run. Zen reporting advises that the
>
> > batch file has distributed and launched successfully, however the files
>
> > do not copy.
> >
> > However, if i click on the icon for the batch file app - the files copy
>
> > no problem. I have tried running Workstation Associated and
> > (Unrestricted) User Associated as well as Workstation - Force Run as
> User.
> >
> >
> > Path to executable file:
> >
> > %*WinSysDir%\cmd.exe
> >
> > Parameters:
> >
> > /c "c:\tmp\branding.bat"
> >
> > Any ideas? The batch file has to refer to the P: drive as the
> > application covers 40 different sites each with their own appliance
> > containing source files.
> >
> > Running NBO2 - ZFD 4 Agent 4.0.1.60 - Clientless
> >
> > Desktop XP Workstations
> >
> > Thanks
> >
> > Thax
> >
>
>
Jeremy Mlazovsky
Senior System Engineer - Enterprise Desktop
UDit-Central Hardware Systems & Network Storage
University of Dayton
http://forge.novell.com/modules/xfmod/project/?udimage
http://vmpconfig.sourceforge.net/
http://regeditpe.sourceforge.net

Force run for workstation associated apps

Today I tried deploying the groupwise client as an MSI app. I scheduled the app for between 5:00pm and 5:10pm (just for testing) , associated the app to a workstation with Force Run and Application Launcher enabled. I was logged into the desktop of the workstation so I could watch the process as it happened. had NAL up to make sure the application icon showed up.. it didnt show up until 5:00pm, which is fine (even though Always Show Icon is checked)... the problem was.. it didn't start installing automatically.
After messing around with different settings, it appeared the only way I could make it work was to check the "force run as user if workstation associated" box was checked. It would then seem to auto-install somewhere in the time slot.
This doesnt seem right to me... as there must be a point to the force run for a workstation association by itself. Tried bumping the version, etc..
Thanks for any tips or explanations

Shaun,
Thanks. So let me see if I understand. The workstation helper starts before you even login to the workstation.. so if you force run an app associated to a workstation, it should run at the login screen.. but only if you have the "distribute in workstation security space" is checked (because its an MSI). Right?
If its not checked, then the app wont get installed when Workstation Helper starts.. even after the user logs in, because the workstation helper has already decided it cant run it. Correct?
Thanks for your help.. so many lil quirks and want to get it right

Which user are you supposed to run jobs as in PP?

which user are you supposed to run jobs as in PP?

The traditional user for PcP version 1 xgrid jobs is pcastxgrid, an OD user.

Force Run budle on user logout

Greets.
I have a .vbs script that I need to run when a user logs out. I've created a bundle and added a Run Script launch action. When the bundle is run manually it works perfectly, however when the user logs out the script doesn't run. I've tried setting the Launch Schedule to User Logout and ZENworks - Logout, neither worked.
Any help much appreciated.

I never had much luck with any version of ZENworks, at least reliably.
Keep in mind, once you hit "Logout", Windows starts terminating all
running User Processes and blocks knew ones.
A GPO is likely to have the best success, though MS Forums will show
this has limitations as well.
On 4/4/2014 9:56 AM, acshearer wrote:
>
> Hello,
>
> I was just wondering if putting the vbs script into the GPO worked for
> everyone here. Also, why did this all work on Zen 6.5/7 but it doesn't
> work well in ZCM? In Zen 6.5 I just created a Scheduled Action policy
> and put in the script I wanted to run, and then set it to run at user
> log out. It ran every time fine with no issues. Is there a reason that
> a script at log out worked fine in Zen 6.5 but not as part of a bundle
> in ZCM?
>
> Thanks,
> Andrew
>
> bentinker;2301212 Wrote:
>> Greets.
>> I have a .vbs script that I need to run when a user logs out. I've
>> created a bundle and added a *Run Script* launch action. When the bundle
>> is run manually it works perfectly, however when the user logs out the
>> script doesn't run. I've tried setting the *Launch Schedule* to *User
>> Logout* and *ZENworks - Logout*, neither worked.
>>
>> Any help much appreciated.
>
>
Craig Wilson - MCNE, MCSE, CCNA
Novell Technical Support Engineer
Novell does not officially monitor these forums.
Suggestions/Opinions/Statements made by me are solely my own.
These thoughts may not be shared by either Novell or any rational human.

Force run apps don't deploy on some machines causing zen icons toflash at intervals

I'm having a problem lately, with new apps that I'm creating (for
example Acrobat Reader 9.4) not deploying on some machines. I have them
set to force run, user associated. They appear in application explorer,
and if I manually launch them, they will install just fine. I have
conditions for availability based on version, so if the app has been
installed, it will no longer show in application explorer.
I had this happen a few months ago, and I thought it was one particular
app I had just sent out, so I just manually ran it on the affected
workstations, but now I'm seeing the same workstations having the issue.
The workstations are running the last released ZDM 7 agent, and the
Servers are Netware 6.5 SP8 patched up to the last released Zen 7
version. (I removed the existing agent and reinstalled the latest agent
HP4, msi dated 5/14/2010)
I've deleted nalcache, and that had no effect. Naldiag shows the apps
are there and passed the tests, but I think that there is actually a
problem with another app that had been previously created that is
preventing these from working.
I'm just looking for some areas to check to figure this out. I'm not
seeing any errors, it just doesn't launch the force run apps. The vast
majority of the machines run them absolutely fine.
-------------- Update ---------------
I was waiting to post this to check one more thing, and I had to reboot
the machine. The user had gone home for the day so I logged in as a
different user and now the apps are deploying, so this appears to be
something perhaps in the registry for that user? I was afraid this
would happen.. I'll have to find another broken machine to do further
testing on.
Any ideas how to track this down? The apps that were "stuck" are new
applications, they aren't modified old applications where I would be
worried about the guid being changed or anything weird.
I'm guessing the moment I create another force run app to update
something that I am going to see the exact same problem recur.

On 11/4/2010 9:12 AM, Anders Gustafsson wrote:
> Patrick Farrell,
>> Thanks, it's very annoying as it prevents a lot of updates going out.
>> The vast majority of machines work just fine. I just can't figure out
>> why something set to force run would not, however you can install the
>> app by double clicking it in app explorer just fine, at which point the
>> refresh every 30 seconds goes away. It's hard to even look at naldiag
>> because the list starts to refresh not long after it displays.
>
> Shaun said:
> logs, and take things away until it works, then add things back until
> it breaks...
>
There's nothing of interest in the logs that I can find. As for taking
things away, I thought about that as well, however when I set up a brand
new machine and install zen, all of the applications force run just fine
and install... Very odd. What makes the workstations stop blinking is
for me to remove the force run on the new apps, or manually run them.
I guess I could take away force run on all the other stuff that's
already installed, that would be rather strange for one of those to be
the culprit.

How to restart/force run of APEX jobs?

Our development server system date was temporarily set to a period in the future, which meant that our Oracle jobs were left with their 'next date' also set to a time in the future.
For most of our jobs, we could simply log in as the schema owner and manually restart/run the affected jobs.
With the APEX-based jobs, we has a problem in that they were owned by the 'flows' user and their password was unknown/random from installation.
We got around the problem by using the 'su' method (see http://asktom.oracle.com/tkyte/Misc/su.html) to temporarily change the password.
Is there an official way of restarting/force-running APEX jobs? By default, there are the mail queue flushing and session clearing jobs but I assume that any other jobs created within APEX will have similar issues?

Hello,
This is what you can do in SM37.
Execute the list of batch jobs, when the result appears on the screen edit the ALV grid via CTRL+F7.
Now add the following columns "TargetServ" and "Executing server".
You will now have two extra columns in your result list.
TargetServr contains the value of the application server where the job should run when you have explicitely filled it in.
Often this is empty, this means that at runtime SAP will determine itself on which application server the job will run (depending of course where the BGD processes are defined).
Executing server is filled in always for all executed jobs, this is the actual application server where the job has run.
You can also add these two fields in your initial selection screen of SM37 by using the "Extended job selection" button.
I hope this isusefull.
Wim

Run with User's rights not working as expected

I have a VBscript that runs the Quest Client Profile Updating Utility for migrating Outlook e-mail profiles to a new Exchange Server. For this tool to work it must be run using the User's security context when the user is logged onto the computer.
What I have found is that the script fails to run because SCCM is running the script with elevated privileges. The program is set with 'Only when a user is logged on' and a run mode of 'Run with user's rights'. The advertisement is set to run from
a distribution point and has two mandatory re-occuring schedules (Logon, and at 6:00 a.m. every day).
To test what is happening I created a separate Program that has the same program settings but only runs 'Cmd.exe /k echo' for the command line. If I run this SCCM program as a user who is not a member of the local administrators group
I can execute privileged programs like regedit.exe. If I run the Command Prompt from the Start\Accessories folder and try to run Regedit I receive an 'Access denied' message. It appears SCCM is running with elevated privileges.
Does SCCM run a program with elevated privileges? How can I make a program run without elevated privileges.
thank you for your help.

Actually I ran into a similar issue today trying to gather info about mapped network drives and found this thread when trying to troubleshoot it. Here's a summary of what I've done:
I have an SCCM package set up to run a script to dump the users' mapped drives to a text file. The program is set to run only if a user is logged on and to run in the logged on user's context. UAC is enabled. For users who are members of
the local Administrators group, the resulting text file was empty, as if no drives were mapped. Running the script manually (not via SCCM, just double-clicking the script) populated the text file with the expected results. So the script works correctly.
I suspected SCCM was running the package elevated, since drives mapped in the non-elevated context aren't visible to the elevated context.
To test, I created another package & program that runs a command I know requires elevation (ipconfig /registerdns) and pipes the output to a text file. I configured it in the same way, and for users who are in the local admin group, the text file results
indicate that the command ran successfully (which means it ran elevated). If I take the user out of the local admin group, making no changes to the package, then run the package again, the text file results say "This command requires elevation."
So, it appears SCCM is running with the highest elevation level for which the user has rights. I guess this makes sense, and it's not doing anything the user wouldn't normally have rights to do, but it does cause a problem when a program needs to run
under the user's non-elevated token. Any suggestions?
Thanks,
Matt

"Force Run" - Ordering and avoiding conflicts

Hi folks.
This has been asked before, in different formats, but no answer I have found answers my question.
ZCM 10.3
We have quite a few "force run" bundles.
However, they may have different user or device assignments.
e.g.:
Bundle1 = MSI installation, assigned to STAFF Users, to run at login.
Bundle2 = MSI installation, assigned to ALL Devices, to run at refresh.
The installation order must be Bundle1 then Bundle2.
It should be noted that there are many more than 2 bundles, and not all are MSI.
Some may be run once, others may need to run many times.
I'm a bit confused on the best way to accomplish the order, and to avoid conflicts. For example:
If they are two separate bundles, then they may both attempt to run at the same time.
There would be an MSI error on one (as you can only run one MSI at a time).
If I create a bundle group, then I can't assign the first to run on STAFF only at login, and the second to run on ALL devices at refresh.
If I create a bundle chain (dependencies), then I can't assign the first to run at login, and the second to run on refresh.
I can't put in requirements for each bundle as they are not directly related to each other.
What is the best solution to ensure that I can have different types of force run relationships, but maintain an order?
Thanks.

Hi Clem,
Could you please Contact me Offline at [email protected]
I would like to chat about different ideas and perhaps some way some
tools may help.
On 7/20/2011 10:36 AM, ClemClark wrote:
>
> Hi folks.
> This has been asked before, in different formats, but no answer I have
> found answers my question.
>
> ZCM 10.3
>
> We have quite a few "force run" bundles.
> However, they may have different user or device assignments.
>
> e.g.:
> Bundle1 = MSI installation, assigned to STAFF Users, to run at login.
> Bundle2 = MSI installation, assigned to ALL Devices, to run at
> refresh.
> The installation order must be Bundle1 then Bundle2.
>
> It should be noted that there are many more than 2 bundles, and not all
> are MSI.
> Some may be run once, others may need to run many times.
>
>
>
> I'm a bit confused on the best way to accomplish the order, and to
> avoid conflicts. For example:
>
>
> -If they are two separate bundles, then they may both attempt
> to run at the same time.
> There would be an MSI error on one (as you can only run one MSI at a
> time).
>
> If I create a bundle group, then I can't assign the first to run on
> STAFF only at login, and the second to run on ALL devices at refresh.
>
> If I create a bundle chain (dependencies), then I can't assign the
> first to run at login, and the second to run on refresh.-
>
>
>
> I can't put in requirements for each bundle as they are not directly
> related to each other.
> What is the best solution to ensure that I can have different types of
> force run relationships, but maintain an order?
>
> Thanks.
>
>
Craig Wilson - MCNE, MCSE, CCNA
Novell Knowledge Partner
Novell does not officially monitor these forums.
Suggestions/Opinions/Statements made by me are solely my own.
These thoughts may not be shared by either Novell or any rational human.

Can not log into server computer with any accounts - "You are unable to login to the user account "abcdefg" at this time. Logging in to the account failed because an error occurred."

I have a Mac mini running the latest version of OS X and Server. Been running fine and flawlessly. However, I had a strange problem with the iCloud preferences panel crashing when I tried to access it, so I rebooted. Now I can not log into the system with any accounts. My master admin account (along with all the others) gives me the error:
You are unable to login to the user account "abcdefg" at this time. Logging in to the account failed because an error occurred."
I am able to see the server from other macs and I can log into it using the same account, but it only shows me a few of the shared folders I have access to but NOT to my main directories.
Rebooting into Command-R and doing a disk utility, I try and repair permission on that drive and get a bunch of errors like:
ACL found but not expected on Users
Repaired "Users"
ACL found but not expected on Users/.localized
Repaired "Users/.localized"
ACL found but not expected on Users/Shared
Repaired "Users/shared"
ACL found but not expected on Users/Shared/.localized
Repaired "Users/Shared/.localized"
Permissions repair complete.
But rebooting is no joy...same problem. Any idea what is going on or how to repair it? Should I do a time machine restore? Complete new OS X install? Any idea what is causing this or how to salvage it?

Got everything to re-install and it worked fine...for a few hours. Then I came in to find ALL of my network users deleted. Just GONE. Then found out the Open Directory was trashed and was unable to open, recover or restore from a backup. Looks like I may have a bad drive here.
I installed a new drive in the system, re-installed and so far (for a couple of hours anyway) the system seems to be working and stable.

Error while running AD User Target Recon

Hi,
We are getting the below error while running AD User Target Recon:
[2012-09-04T10:07:32.262-04:00] [oim_server2] [NOTIFICATION] [] [oracle.iam.features.scheduler.agentry.operations] [tid: [ACTIVE].ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: xelsysadm] [ecid: 98fe4d9aa175090d:7101298f:13991840195:-8000-0000000000000235,0] [APP: oim#11.1.2.0.0] ADP ClassLoader failed to load: Script1[[
java.lang.ClassNotFoundException: ADP ClassLoader failed to load: Script1
at com.thortech.xl.dataobj.tcADPClassLoader.findClass(tcADPClassLoader.java:229)
at java.lang.ClassLoader.loadClass(ClassLoader.java:306)
at java.lang.ClassLoader.loadClass(ClassLoader.java:247)
at java.lang.Class.forName0(Native Method)
at java.lang.Class.forName(Class.java:247)
at oracle.iam.scheduler.vo.ClassLoaderObjectInputStream.resolveClass(ClassLoaderObjectInputStream.java:72)
at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1574)
at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1495)
at java.io.ObjectInputStream.readClass(ObjectInputStream.java:1461)
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1311)
at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:1946)
at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1870)
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1752)
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1328)
at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:1946)
at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:1870)
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1752)
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1328)
at java.io.ObjectInputStream.readObject(ObjectInputStream.java:350)
at oracle.iam.scheduler.vo.JobHistory.getExceptionObject(JobHistory.java:78)
at oracle.iam.features.scheduler.agentry.operations.LookupActor.prepare(LookupActor.java:1282)
at oracle.iam.features.scheduler.agentry.operations.LookupActor.refresh(LookupActor.java:3074)
at oracle.iam.features.scheduler.agentry.operations.LookupActor.perform(LookupActor.java:2495)
at oracle.iam.consoles.faces.mvc.canonic.Model.perform(Model.java:579)
at oracle.iam.consoles.faces.mvc.admin.Model.perform(Model.java:326)
at oracle.iam.consoles.faces.mvc.canonic.Controller.doPerform(Controller.java:257)
at oracle.iam.consoles.faces.mvc.canonic.Controller.doSelectAction(Controller.java:179)
at oracle.iam.consoles.faces.event.NavigationListener.processAction(NavigationListener.java:99)
at javax.faces.event.ActionEvent.processListener(ActionEvent.java:88)
at org.apache.myfaces.trinidad.component.UIXComponentBase.broadcast(UIXComponentBase.java:675)
at org.apache.myfaces.trinidad.component.UIXCommand.broadcast(UIXCommand.java:179)
at oracle.adf.view.rich.component.fragment.ContextSwitchingComponent$1.run(ContextSwitchingComponent.java:92)
at oracle.adf.view.rich.component.fragment.ContextSwitchingComponent._processPhase(ContextSwitchingComponent.java:361)
at oracle.adf.view.rich.component.fragment.ContextSwitchingComponent.broadcast(ContextSwitchingComponent.java:96)
at oracle.adf.view.rich.component.fragment.UIXInclude.broadcast(UIXInclude.java:102)
at oracle.adf.view.rich.component.fragment.ContextSwitchingComponent$1.run(ContextSwitchingComponent.java:92)
at oracle.adf.view.rich.component.fragment.ContextSwitchingComponent._processPhase(ContextSwitchingComponent.java:361)
at oracle.adf.view.rich.component.fragment.ContextSwitchingComponent.broadcast(ContextSwitchingComponent.java:96)
at oracle.adf.view.rich.component.fragment.UIXInclude.broadcast(UIXInclude.java:96)
at javax.faces.component.UIViewRoot.broadcastEvents(UIViewRoot.java:475)
at javax.faces.component.UIViewRoot.processApplication(UIViewRoot.java:756)
at oracle.adfinternal.view.faces.lifecycle.LifecycleImpl._invokeApplication(LifecycleImpl.java:889)
at oracle.adfinternal.view.faces.lifecycle.LifecycleImpl._executePhase(LifecycleImpl.java:379)
at oracle.adfinternal.view.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:194)
at javax.faces.webapp.FacesServlet.service(FacesServlet.java:265)
at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:301)
at weblogic.servlet.internal.TailFilter.doFilter(TailFilter.java:26)
at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
at oracle.adf.model.servlet.ADFBindingFilter.doFilter(ADFBindingFilter.java:205)
at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
at oracle.adfinternal.view.faces.webapp.rich.RegistrationFilter.doFilter(RegistrationFilter.java:106)
at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl$FilterListChain.doFilter(TrinidadFilterImpl.java:446)
at oracle.adfinternal.view.faces.activedata.AdsFilter.doFilter(AdsFilter.java:60)
at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl$FilterListChain.doFilter(TrinidadFilterImpl.java:446)
at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl._doFilterImpl(TrinidadFilterImpl.java:271)
at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl.doFilter(TrinidadFilterImpl.java:177)
at org.apache.myfaces.trinidad.webapp.TrinidadFilter.doFilter(TrinidadFilter.java:92)
at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
at oracle.iam.platform.auth.web.OIMAuthContextFilter.doFilter(OIMAuthContextFilter.java:107)
at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
at oracle.adf.library.webapp.LibraryFilter.doFilter(LibraryFilter.java:179)
at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
at oracle.security.jps.ee.http.JpsAbsFilter$1.run(JpsAbsFilter.java:119)
at java.security.AccessController.doPrivileged(Native Method)
at oracle.security.jps.util.JpsSubject.doAsPrivileged(JpsSubject.java:315)
at oracle.security.jps.ee.util.JpsPlatformUtil.runJaasMode(JpsPlatformUtil.java:442)
at oracle.security.jps.ee.http.JpsAbsFilter.runJaasMode(JpsAbsFilter.java:103)
at oracle.security.jps.ee.http.JpsAbsFilter.doFilter(JpsAbsFilter.java:171)
at oracle.security.jps.ee.http.JpsFilter.doFilter(JpsFilter.java:71)
at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
at oracle.dms.servlet.DMSServletFilter.doFilter(DMSServletFilter.java:139)
at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
at weblogic.servlet.internal.RequestEventsFilter.doFilter(RequestEventsFilter.java:27)
at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.wrapRun(WebAppServletContext.java:3730)
at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3696)
at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:120)
at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2273)
at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2179)
at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1490)
at weblogic.work.ExecuteThread.execute(ExecuteThread.java:256)
at weblogic.work.ExecuteThread.run(ExecuteThread.java:221)
[2012-09-04T10:07:32.314-04:00] [oim_server2] [NOTIFICATION] [] [oracle.iam.features.scheduler.agentry.operations] [tid: [ACTIVE].ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: xelsysadm] [ecid: 98fe4d9aa175090d:7101298f:13991840195:-8000-0000000000000235,0] [APP: oim#11.1.2.0.0] [[
java.lang.NullPointerException
at java.io.ByteArrayInputStream.<init>(ByteArrayInputStream.java:89)
at oracle.iam.scheduler.vo.JobHistory.getExceptionObject(JobHistory.java:76)
at oracle.iam.features.scheduler.agentry.operations.LookupActor.prepare(LookupActor.java:1282)
at oracle.iam.features.scheduler.agentry.operations.LookupActor.refresh(LookupActor.java:3074)
at oracle.iam.features.scheduler.agentry.operations.LookupActor.perform(LookupActor.java:2495)
at oracle.iam.consoles.faces.mvc.canonic.Model.perform(Model.java:579)
at oracle.iam.consoles.faces.mvc.admin.Model.perform(Model.java:326)
at oracle.iam.consoles.faces.mvc.canonic.Controller.doPerform(Controller.java:257)
at oracle.iam.consoles.faces.mvc.canonic.Controller.doSelectAction(Controller.java:179)
at oracle.iam.consoles.faces.event.NavigationListener.processAction(NavigationListener.java:99)
at javax.faces.event.ActionEvent.processListener(ActionEvent.java:88)
at org.apache.myfaces.trinidad.component.UIXComponentBase.broadcast(UIXComponentBase.java:675)
at org.apache.myfaces.trinidad.component.UIXCommand.broadcast(UIXCommand.java:179)
at oracle.adf.view.rich.component.fragment.ContextSwitchingComponent$1.run(ContextSwitchingComponent.java:92)
at oracle.adf.view.rich.component.fragment.ContextSwitchingComponent._processPhase(ContextSwitchingComponent.java:361)
at oracle.adf.view.rich.component.fragment.ContextSwitchingComponent.broadcast(ContextSwitchingComponent.java:96)
at oracle.adf.view.rich.component.fragment.UIXInclude.broadcast(UIXInclude.java:102)
at oracle.adf.view.rich.component.fragment.ContextSwitchingComponent$1.run(ContextSwitchingComponent.java:92)
at oracle.adf.view.rich.component.fragment.ContextSwitchingComponent._processPhase(ContextSwitchingComponent.java:361)
at oracle.adf.view.rich.component.fragment.ContextSwitchingComponent.broadcast(ContextSwitchingComponent.java:96)
at oracle.adf.view.rich.component.fragment.UIXInclude.broadcast(UIXInclude.java:96)
at javax.faces.component.UIViewRoot.broadcastEvents(UIViewRoot.java:475)
at javax.faces.component.UIViewRoot.processApplication(UIViewRoot.java:756)
at oracle.adfinternal.view.faces.lifecycle.LifecycleImpl._invokeApplication(LifecycleImpl.java:889)
at oracle.adfinternal.view.faces.lifecycle.LifecycleImpl._executePhase(LifecycleImpl.java:379)
at oracle.adfinternal.view.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:194)
at javax.faces.webapp.FacesServlet.service(FacesServlet.java:265)
at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:301)
at weblogic.servlet.internal.TailFilter.doFilter(TailFilter.java:26)
at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
at oracle.adf.model.servlet.ADFBindingFilter.doFilter(ADFBindingFilter.java:205)
at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
at oracle.adfinternal.view.faces.webapp.rich.RegistrationFilter.doFilter(RegistrationFilter.java:106)
at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl$FilterListChain.doFilter(TrinidadFilterImpl.java:446)
at oracle.adfinternal.view.faces.activedata.AdsFilter.doFilter(AdsFilter.java:60)
at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl$FilterListChain.doFilter(TrinidadFilterImpl.java:446)
at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl._doFilterImpl(TrinidadFilterImpl.java:271)
at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl.doFilter(TrinidadFilterImpl.java:177)
at org.apache.myfaces.trinidad.webapp.TrinidadFilter.doFilter(TrinidadFilter.java:92)
at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
at oracle.iam.platform.auth.web.OIMAuthContextFilter.doFilter(OIMAuthContextFilter.java:107)
at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
at oracle.adf.library.webapp.LibraryFilter.doFilter(LibraryFilter.java:179)
at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
at oracle.security.jps.ee.http.JpsAbsFilter$1.run(JpsAbsFilter.java:119)
at java.security.AccessController.doPrivileged(Native Method)
at oracle.security.jps.util.JpsSubject.doAsPrivileged(JpsSubject.java:315)
at oracle.security.jps.ee.util.JpsPlatformUtil.runJaasMode(JpsPlatformUtil.java:442)
at oracle.security.jps.ee.http.JpsAbsFilter.runJaasMode(JpsAbsFilter.java:103)
at oracle.security.jps.ee.http.JpsAbsFilter.doFilter(JpsAbsFilter.java:171)
at oracle.security.jps.ee.http.JpsFilter.doFilter(JpsFilter.java:71)
at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
at oracle.dms.servlet.DMSServletFilter.doFilter(DMSServletFilter.java:139)
at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
at weblogic.servlet.internal.RequestEventsFilter.doFilter(RequestEventsFilter.java:27)
at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.wrapRun(WebAppServletContext.java:3730)
at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3696)
at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:120)
at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2273)
at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2179)
at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1490)
at weblogic.work.ExecuteThread.execute(ExecuteThread.java:256)
at weblogic.work.ExecuteThread.run(ExecuteThread.java:221)
Have anyone faced this issue ?? Any idea how to resolve this ??
Thanks,
Hrushi

920194 wrote:
Hi Bikash,
Thank you that helped a bit!! I see the same behaviour i.e., recon events are created when using displayName or givenName attribute and it does not work using "samAccountName". Were you able to find the solution for this ??The solution would have to be provided by Oracle as this looks like a bug, since the connector doc gives example of filter as samAccountName.
Also, when we reconcile using displayName/givenName attribute, even though the recon event is created, the status if the scheduler is Failed with "oracle.iam.connectors.icfcommon.exceptions.OIMException: Thor.API.Exceptions.tcAPIException: Row index out of bounds" Any idea on this ??Full stacktrace??
Thanks,
Hrushi

[Forum FAQ] Group Policy Preferences Scheduled Tasks Item not working when the option Run whether user is logged on or not is selected

Scenario:
We use one of the following Group Policy Preferences Scheduled Tasks item to deploy a task to clients:
Computer Configuration -> Control Panel Settings -> Scheduled Tasks -> New -> Scheduled Task (At least Windows 7)
Computer Configuration -> Control Panel Settings -> Scheduled Tasks -> New -> Immediate Task (At least Windows 7)
User Configuration -> Control Panel Settings -> Scheduled Tasks -> New -> Scheduled Task (At least Windows 7)
User Configuration -> Control Panel Settings -> Scheduled Tasks -> New -> Immediate Task (At least Windows 7)
(Note that on some platforms, "At least Windows 7" is replaced with "Windows Vista and later.")
After designating a user account to run the task, we select “Run whether user is logged on or not” option, and “The Do not store password…”
check box is automatically grayed out (See Figure 1).
Figure 1
After finishing configuring the task item, on a client, we run command
gpupdate/force to forcefully update group policy. However, on the client, when we check if the task is listed in Task Scheduler snap-in, the task is not displayed, and when we run
gpresult/h report.html to collect group policy result for troubleshooting, we see an error as similar as shown in the following figure (Figure 2).
Figure 2
Cause:
To make the scheduled task run whether the user is logged on or not, we need to store the password of the designated user account. However, for the content of the scheduled
task item is stored in Sysvol where it’s not safe to store passwords, this function has been deprecated.
Workaround:
We can run the task with system account
NT Authority\System, or we can use specific user accounts to run the task when the given user is logged on. (See Figure 3)
Figure 3
Reference:
MS14-025: Vulnerability in Group Policy Preferences could allow elevation of privilege: May 13, 2014
http://support.microsoft.com/kb/2962486
Please click to vote if the post helps you. This can be beneficial to other community members reading the thread.

Hello Everyone,
Succeeded !!!!!!!
Even i was struggling with this same Problem to execute a batch via Window scheduler and set the setting to "Run whether the user is logged in or not".
I tried many time but the batch runs with " Run
whether user is logged on" and not with "Run
whether user is logged on or not".
what i discovered is that there was one mapped drive
path in my batch file which was not the complete path like y:/AR.qvw actually what i did i changed that map path to the complete path like \\servnamename\d$\AR.qvw and the batch executed successfully with the setting "Run
whether user is logged on or not"
The
conclusion is that check the dependency of the script on external resources because when you check this option "Run
whether user is logged on or not" It actually conflicts. This my discovery.
If
you have any question write me on [email protected]
Thanks
& Regards,
Arun

Run with user privileges but write to restricted folder

In Windows Server 2008 R2 (and in an Active Directory domain), the login and logoff scripts are run with user privileges.
Suppose that I run script1.ps1, when user1 logs in; I need that script1.ps1 is associated to user1, because it will write some informations about that user: it modifies a log file in a folder. Anyway, script1.ps1 will be run with user1 privileges.
I obviously made that file and that folder accessible (readable/writable) to user1: but I actually don't want the user to modify that log file. I would like that
only the script could do it.
Is there a way to work around this problem? Maybe should I run script1.ps1 in a different way?

Henry. You can add a subscription to a server that subscribes t event log entries on user computers. Subscribe to the logon/logoff events. Now you have a central repository of logon and logoff events.
There is no way to accomplish what you are asking to do. Any file that can be written to in logon script or during a user session can be changed by the user.
Bil is suggesting a "startup" script that runs when the user logs on and not when the computer starts. A user startup script runs as the user and not system.
Another method is to schedule a script that run at logon. This can run as system and write to a file that the user cannot change.
¯\_(ツ)_/¯

How to see which company codes are affected by a WT

Hello Community,
Hope you all are doing well, I would like to consult you because I have this situation, I want to know what company codes are affected by a particular WT in an specific country, is there any report or Transaction or do you know a way to do it? I tried by launching the WT report in a large period for country area with the wt that I want to check but the problem with this is that it may exclude a company code that can have the wt active but was not generated under the period. Please your assistance.
Thanks in advance for your time

Efrain,
Not exactly sure your requirement, however there is a transaction code PC00_M99_DKON which will show you the wage assignment. On the selection screen enter your country code as 10 if running for USA and the wage type. Execute it.
When you run it for a particular wage type and expand the results 'source system' then you will see the associated Company code for which the wage type is applicable.
Hope it helps you.
Thx,
Ashish

Distribution area affected by "force run as user"?

Similar Messages

Maybe you are looking for