GRANT LOGON TO SERVICE RIGHTS TO A USER REMOTELY

Hi all,
I have 20 Windows 2008 servers running an application
I want to grant logon to service rights to a particular domain user on all these 10 servers. I have three services in which the user needs to be granted logon to service permission.
Can I achieve this with a powershell script / psexec
I have domain admin rights to all the server
pumping_iron

Hi pumping_iron,
Please provide more detailed information about the setting you want to set.
If you mean the policy "Log on as a service", as Jrv suggested, you can also use GPO to deploy this setting on bulk computers.
In addition, if you want to achieve this via Powershell, you check the script posted by STscripter, and use Powershell remoting to deploy this script remotely like "Invoke-Command -ComputerName remotePC -FilePath d:\remotescript.ps1".
To use Powershell remoting, you also need to configure Winrm firstly on these computers:
[Forum FAQ] Introduce Windows Powershell
Remoting
If there is anything else regarding this issue, please feel free to post back.
If you have any feedback on our support, please click here.
Best Regards,
Anna Wang
TechNet Community Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact
[email protected]

Similar Messages

Vbscript to remove user from "Logon as service right"

Hi Everybody,
I need a VBscript that will remove service account from “Log on as a service” from the local computer.
Thanks.
Emese,

Hi Emese,
In the script repository there are plenty of scripts for local user account management, maybe check those out, whether one of those will meet your needs. If not ... well, good luck learning scripting. There's a whole section dedicated to this in the script
center (check the tabs at the head of the website).
Contrary to some rumors, this forum is for professionals exchanging advice on specific scripting issues, not a script-on-demand service. If however you learn to script, try to do it yourself and stumble across a specific problem with your attempt, feel free
to come back, post your current status and thought, and we'll be glad to help.
Cheers,
Fred
Ps.: Are you limited to VBS or is it just the tool you heard of? Maybe Powershell would work out better for you.
There's no place like 127.0.0.1

How to grant LOGON ONLY Rights to two users (no domain admins) on Domain Controllers

Dear Techies,
I wish to grant LOGON ONLY Rights to two users, who are not the members of Domain Admins, on Domain Controllers.
Can someone please suggest the best and easiest possible way to do this keeping up with Compliance?
Regards
Amit Kumar

I think it is by design, the readers don't have access to the operations and application management section. If you look at the URL's you will notice they are of the form http://servername:portnumber/_admin/operations.aspx and http://servername:portnumber/_admin/applications.aspx. Giving read only access to these pages means, they will be not able to modify the settings on these pages.
Looks like it is not possible to give read only access.
Thanks,
Prashanth

"logon as service " user when i join on domain

i need to join several server in a new domain
some of the as a service that start using local user as " logon as service"
whats happen when i join this server on new domain ?
my service contine tu run ?

Hi,
You must confirm your old service logon credential can be authenticated in the new domain and have the equal permission on the server same with the old domain. To authentication
the other domain credential you must have the domain trust setting.
More information:
Configure a Service Item
http://technet.microsoft.com/en-us/library/cc732482.aspx
Add the Log on as a service right to an account
http://technet.microsoft.com/en-us/library/cc739424(v=ws.10).aspx
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

How to create and add a logon/logoff script to populate last user into the computer field in AD

Hi All,
Bit stuck here,
Not sure what forum to put this is as it involves different subjects,
I work in a Server 2008 RT environment and have access to Active Directory etc.
I saw this a few weeks ago - http://ivan.dretvic.com/2012/10/automatically-generate-description-field-for-computers-in-active-directory/
Now, I'm not particularly sure what to do here, I don't know how to create a group policy etc. How to implement it in a test environment etc. Never done this before.
Can somebody give me a step by step guide on literally everything that would be involved in this?
Or any links that may be able to help?
I basically want the AD to show who was the last user that logged into a specific client when the client named is searched for in the Computers OU, and if possible being able to pull the make/model and serial number from the client aswell.
If possible there should be a way of including this with the existing login script that we already have, how can I do this?
I've tried a few so far and got stuck, I have domain admin priveledges also.
Thanks,
Regards, Max.

Hi Max,
Please refer to the following article to learn how to create a logon/logoff script via GPO:
Assign User Logon Scripts
Assign User Logoff Scripts
As for the issues about script, this is the forum to discuss questions about driectory service, better to post your question to the forum for Script:
http://social.msdn.microsoft.com/Forums/en-US/home?forum=scripting
The reason why we recommend posting appropriately is you will get the most qualified pool of respondents, and other partners who read the forums regularly can either share their knowledge or
learn from your interaction with us.
Thank you for your understanding.
Regards,
Lany Zhang

How to create a new user aaa with same rights as existing user bbb ?

Assume user bbb already exists in Oracla 10g database.
How can I create a new user aaa with the same rights/permissions as the old user bbb?
Is this procedure/command also working if the old user is user "system" (=dbadmin)?

There is some possibilty to generate a EXPDP dump file which contains only DDL statements related to account and
privileges: EXCLUDE/INCLUDE parameter can help.
For example, following EXPDP statements seem to work with SYSTEM account:
expdp / schemas=system content=metadata_only exclude=table,sequence,package,function,procedure,synonym,,type view dumpfile=DPD:system.dmp logfile=DPD:system.log
Export: Release 10.2.0.2.0 - Production on Thursday, 14 February, 2008 9:41:36
Copyright (c) 2003, 2005, Oracle. All rights reserved.
Connected to: Oracle Database 10g Enterprise Edition Release 10.2.0.2.0 - Produc
tion
With the Partitioning, OLAP and Data Mining options
Starting "OPS$XXX"."SYS_EXPORT_SCHEMA_01": /******** schemas=system con
tent=metadata_only exclude=table,sequence,package,function,procedure,synonym,type view dumpfile=DPD:system.dmp logfile=DPD:system.log
Processing object type SCHEMA_EXPORT/USER
Processing object type SCHEMA_EXPORT/SYSTEM_GRANT
Processing object type SCHEMA_EXPORT/ROLE_GRANT
Processing object type SCHEMA_EXPORT/DEFAULT_ROLE
Processing object type SCHEMA_EXPORT/PRE_SCHEMA/PROCACT_SCHEMA
Processing object type SCHEMA_EXPORT/POST_SCHEMA/PROCACT_SCHEMA
Master table "OPS$XXX"."SYS_EXPORT_SCHEMA_01" successfully loaded/unload
ed
Dump file set for OPS$XXX.SYS_EXPORT_SCHEMA_01 is:
C:\TEMP\SYSTEM.DMP
Job "OPS$XXX"."SYS_EXPORT_SCHEMA_01" successfully completed at 09:41:41
impdp / sqlfile=dpd:system.sql dumpfile=DPD:system.dmp logfile=DPD:system.logImport: Release 10.2.0.2.0 - Production on Thursday, 14 February, 2008 9:42:46
Copyright (c) 2003, 2005, Oracle. All rights reserved.
Connected to: Oracle Database 10g Enterprise Edition Release 10.2.0.2.0 - Produc
tion
With the Partitioning, OLAP and Data Mining options
Master table "OPS$XXX"."SYS_SQL_FILE_FULL_05" successfully loaded/unload
ed
Starting "OPS$XXX"."SYS_SQL_FILE_FULL_05": /******** sqlfile=dpd:system
.sql dumpfile=DPD:system.dmp logfile=DPD:system.log
Processing object type SCHEMA_EXPORT/USER
Processing object type SCHEMA_EXPORT/SYSTEM_GRANT
Processing object type SCHEMA_EXPORT/ROLE_GRANT
Processing object type SCHEMA_EXPORT/DEFAULT_ROLE
Processing object type SCHEMA_EXPORT/PRE_SCHEMA/PROCACT_SCHEMA
Processing object type SCHEMA_EXPORT/POST_SCHEMA/PROCACT_SCHEMA
Job "OPS$XXX"."SYS_SQL_FILE_FULL_05" successfully completed at 09:42:50and system.sql is:
-- CONNECT OPS$XXX
-- new object type path is: SCHEMA_EXPORT/USER
-- CONNECT SYSTEM
ALTER USER "SYSTEM" IDENTIFIED BY VALUES '970BAA5B81930A40'
TEMPORARY TABLESPACE "TEMP";
-- new object type path is: SCHEMA_EXPORT/SYSTEM_GRANT
GRANT GLOBAL QUERY REWRITE TO "SYSTEM";
GRANT CREATE MATERIALIZED VIEW TO "SYSTEM";
GRANT SELECT ANY TABLE TO "SYSTEM";
GRANT CREATE TABLE TO "SYSTEM";
GRANT UNLIMITED TABLESPACE TO "SYSTEM" WITH ADMIN OPTION;
-- new object type path is: SCHEMA_EXPORT/ROLE_GRANT
GRANT "DBA" TO "SYSTEM" WITH ADMIN OPTION;
GRANT "AQ_ADMINISTRATOR_ROLE" TO "SYSTEM" WITH ADMIN OPTION;
GRANT "MGMT_USER" TO "SYSTEM";
-- new object type path is: SCHEMA_EXPORT/DEFAULT_ROLE
ALTER USER "SYSTEM" DEFAULT ROLE ALL;
-- new object type path is: SCHEMA_EXPORT/PRE_SCHEMA/PROCACT_SCHEMA
BEGIN
sys.dbms_logrep_imp.instantiate_schema(schema_name=>SYS_CONTEXT('USERENV','CURRENT_SCHEMA'), export_db_name=>'BAS002.REGRESS.RDBMS.DEV.US.ORACLE.COM', inst_scn=>'1456160');
COMMIT;
END;
-- new object type path is: SCHEMA_EXPORT/POST_SCHEMA/PROCACT_SCHEMA
BEGIN
SYS.DBMS_AQ_IMP_INTERNAL.CLEANUP_SCHEMA_IMPORT;
COMMIT;
END;
/ These export and import steps don't take into account privileges granted on schema objects belonging to another user likely due to to the EXCLUDE statements.
Message was edited by:
Pierre Forstmann

AFP logon window takes 60 - 90 seconds for remote users

We have a 10.4.11 server running AFP and multiple other services. About 25 users connect to the AFP sharepoints via the internal network and the login window appears immediately. Another 25 users connect through a hardware VPN from another office and their login screen appears immediately as well. We have another set of 25 users who connect directly over the internet, and only recently, it is taking 60 - 90 seconds for the logon window to appear. Once it does appear, the connection runs at normal speed.
It makes no difference whether the address is specified as FQDN or IP address. I've tried turning off Bonjour, and adding the host domain name to the search domains, but this made no difference either.
This problem did not exist until recently. It may have been about the same time as the 10.5.4 update, but I can't be sure.
Also, our ISP is known to play with "Shaping" although we did have AFP set to high priority and Port 548 is not restricted.
Is there another service that Apple uses to bring up the logon window? If so perhaps our provider is restricting bandwidth on that.
- Tim

This problem related to AFP requesting a "Service Record" first and waiting until that timed out before requesting the "A" record for the site. It seems to be an issue with OS X 10.5.4 and OpenDNS. Hopefully they will sort it out soon.

Rights to general users

When I grant manage rights to PUBLIC user, they can change everything for others and for themselves. By default the setting is set to 'Others'. Can I change that to 'Myself' by default. In which tables this information is stored.. Is there any API availabe for this.
null

*crickets*
and this ladies and gentlemen, is why Apple loses in the business world.

Find membership and associated rights of particular user in exchange 2010 / 2013 ?

Assuming we have two users -say U1 and U2 and we need to map U1's access to U2 for a particular exchange 2010 conference room mailbox . is there a cmdlet or a way out to find membership and associated rights of 'U1' in exchange so that we may grant
similar access and rights for U2. Please suggest.
Aditya Mediratta

Associated rights can be granted at two levels, one on mailbox which can be found using below cmdlet...
Get-MailboxPermission RoomName| Where {$_.user -notlike "NT AUTHORITY\SELF" -and $_.IsInherited -eq $false -and $_.user -like "*U1*"} | FL Identity,User,@{Name='Access Rights';Expression={[String]::join(`, `,$_.AccessRights)}}
Second at individual folder level inside the mailbox so for Room mailbox calendar is the only thing you would need to check... You can check via Powershell but you need to open Shell with RunAs that user and while AD account for the Room is disabled you
can not do that so I would suggest you to verify by opening mailbox in Outllook as its just one Mailbox and see if U1 has permission on it or not....

HT204053 Dear Support Team, every time i tried to logon Icloud its gives me wrong user name or password and at the end it show me error " This Apple ID is valid but is not an ICloud Account" then how can i use one account for same Apple ID and ICloud???

Dear Support Team,
Every time i tried to logon Icloud its gives me wrong user name or password and at the end it show me error " This Apple ID is valid but is not an ICloud Account" then how can i use one account for same Apple ID and ICloud?
Thanks

It is not possible to create a new iCloud account using a Windows machine. You must create the account using a Mac (10.7.5 or more) or an IOS device (iPhone etc). Once that is done you can sign into and use the account on your Windows machine.

My iphone 4S is constantly on 3g service instead of 4g ...how do i get it to stay on 4g service? My other phone is showing 4g service right next to each other so i know i am in a 4g service area.

My iphone 4S is constantly on 3g service instead of 4g ...how do i get it to stay on 4g service? My other phone is showing 4g service right next to each other so i know i am in a 4g service area.

THe 4s is 3G device, it can't get 4g service.

Analytical Services failed to get user's parent group tree with Error

Hi,
We have a frequent errror during our weekly batch for an application.
The context:
- Essbase Administration Services we are using is version is 9.3.1.
- 8 applications are calculated during the week-end. The scripts executed are exactly the same for the 8 applications.
- For example let's say that 5 scripts are launched during the night in the batch for each application (script 1, script 2 ... script 5)
- App1 and App2 are launched alone and before the 6 others applications as these applications database are 3 x bigger (App1 is calculated alone, then app2 is calculated alone, then app3 to app8 scripts are launched in the same time).
The issue :
- We don't see any issue for app3 to app8, the calculation are executed without any problem from script1 to script5.
- But we have an error in App1 and App2 log when the bath execute script 4 and we see the following error in the server log **
"Analytical Services failed to get user's parent group tree with Error".
(** : we don't see any log for script 4 in the application log - it's like the server bypass script 4 to go directly from script 3 to script 5 )
Nothing special is done in script 4 but just an aggregation of the Year dimension (using a @SUM(@RELATIVE(Year,0)) calculation.
I think that there is may be a synchronization error with Shared Services but what is strange is that it's always for the same script 4 and the batch is launched at different time every week-end.
Can the issue be linked to the size of the database of applications (8 Gb) and difficulties for the processor to executes aggregation in a large database volume ?

Hi,
According to your description, my understanding is that the error occurred when sending an email to the user in workflow.
Did you delete the existing Connections before setting NetBiosDomainNamesEnabled?
If not, I recommend to delete and recreate your AD connections, then set NetBiosDomainNamesEnabled to true.
Or you can delete the original User Profile Service Application and create a new one, then set the NetBiosDomainNamesEnabled to true and start the User Profile Service Application
synchronization.
More reference:
http://social.technet.microsoft.com/wiki/contents/articles/18060.sharepoint-20xx-what-if-the-domain-netbios-name-is-different-than-the-fqdn-of-the-domain-with-user-profile.aspx
Best regards.
Thanks
Victoria Xia
TechNet Community Support

How to use logon ticket in case of different user id with SAP R3

Hi.
I try to login from EP to SAP R/3 using Logon Ticket but
My problem is that EP, R/3 user id is different.
Is there any method to login SAP R/3 using Logon
Ticket in case of different user ID ?
Regards, Arnold.

Hi Arnold,
SAP Logon Tickets issued by the Portal contain two user ids, basically one for Java Systems and one for ABAP systems. See also note 843061 for details.
You do not need passwords for the reference system, if the user mapping is maintained by the user administrator, and the UM property ume.usermapping
.admin.pwdprotection is set to false, see http://help.sap.com/saphelp_nw04/helpdata/en/fe/d22a41b108f523e10000000a155106/frameset.htm. If you set the mapped user id programmatically, or if you retrieve it from an LDAP server, you also do not need to verify the ABAP password of the user (see https://media.sdn.sap.com/javadocs/NW04/SP12/ume/index.html and http://help.sap.com/saphelp_nw04/helpdata/en/0b/d82c4142aef623e10000000a155106/frameset.htm).
Best regards,
Joerg

Service Packages are changing users default calendars

I'm currently testing Communications Suite 5 cal server 6.2 schema 2. I have everything up and running but I'm running into an issue with with assigning service packages to users though.
I created all the users from the command line and I used -k legacy option for the calendar. At this point everything is working fine the user calendars I imported from Cal server 6.0 schema 1 all show up and work like they should. Once I assign a service package to a user account it changes their default calendar to the hosted format. Now my users have two calendars their default (hosted format) which is blank and their imported (legacy format) that has all the calendar entries.
I've changed /opt/SUNWcomm/data/WEB-INF/classes/sun/comm/cli/server/servlet/ resource.properties from switch-caltype=hosted to switch-caltype=legacy and restarted the web container but no luck.
Thanks for any help
Josh

Coolhands_99 wrote:
I created all the users from the command line and I used -k legacy option for the calendar. At this point everything is working fine the user calendars I imported from Cal server 6.0 schema 1 all show up and work like they should. Once I assign a service package to a user account it changes their default calendar to the hosted format. Now my users have two calendars their default (hosted format) which is blank and their imported (legacy format) that has all the calendar entries. It sounds like you missed this step during your move to calendar server 6.2/schema 2:
http://docs.sun.com/app/docs/doc/819-2656/6n4ua512a?a=view
"Configuring Calendar Server for Hosted Domain Support"
I've changed /opt/SUNWcomm/data/WEB-INF/classes/sun/comm/cli/server/servlet/ resource.properties from switch-caltype=hosted to switch-caltype=legacy and restarted the web container but no luck.These settings control how UWC log's into calendar server, i.e. as uid (legacy) or [email protected] (hosted) - it sounds that your problem is related to how calendar server stores to data instead.
Regards,
Shane.

GRANT EXECUTE ON SCHEMA.PACKAGE.PROCEDURE TO USER

Hi,
GRANT EXECUTE ON SCHEMA.PACKAGE.PROCEDURE TO USER
returns:
ORA-00905, do you know why? Can I grant privileges on procedure inside package?
thanks

As per my knowledge of oracle, we cannot grant privileges on procedure inside a package.
 
Raj 
www.oraclebrains.com<a>
 POWERED by the people, to the people and for the people WHERE ORACLE IS PASSION.
 
Sorry Leonardo Horikian & Kamal Kishore, I was late and didn't know that you guys have already posted the answer.
Message was edited by:
rajs

GRANT LOGON TO SERVICE RIGHTS TO A USER REMOTELY

Similar Messages

Maybe you are looking for