Ghost Solution Suite

Hi Guys,

We have Ghost Console creating a backup of several machines and then creating a restore job which will sysprep the machine and strip out the unique information so that it can be re added to our domain as a new workstation. This all works perfectly. But we are trying to automatice Windows registration as well as Office registration. But we seem to be hitting a wall in regard to the way the job runs,

From what I have read the Ghost console when running a task does so with the LocalSystem account, The scripts which are in Batch files appear to be running but not completing. If I run them when logged in as a user I get the prompts from the script (there appear mandatory but it would register windows before the prompt to click ok after doing so). But if running them when no one is logged in nothing appears to happen, Below is the script I am using,

@ECHO OFF
CLS
CD\

:WinActivation
ECHO.
ECHO.
ECHO.
ECHO -------------------------------------------------------------------
ECHO - Activate Windows...
ECHO -------------------------------------------------------------------
slmgr -ipk *product Key here*
slmgr -ato

If I run that normally nothing happens, So we believe it needs an elevated prompt to work after testing on a profile of the PC so we put in the following work around, The above script will elevate the CMD window and allow it to run. This all seems to work but only when logged in and running the task from the console.

@echo off
:: BatchGotAdmin
::-------------------------------------
REM  --> Check for permissions
>nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system"

REM --> If error flag set, we do not have admin.
if '%errorlevel%' NEQ '0' (
    echo Requesting administrative privileges...
    goto UACPrompt
) else ( goto gotAdmin )

:UACPrompt
    echo Set UAC = CreateObject^("Shell.Application"^) > "%temp%\getadmin.vbs"
    set params = %*:"=""
    echo UAC.ShellExecute "cmd.exe", "/c %~s0 %params%", "", "runas", 1 >> "%temp%\getadmin.vbs"

    "%temp%\getadmin.vbs"
    del "%temp%\getadmin.vbs"
    exit /B

:gotAdmin
    pushd "%CD%"
    CD /D "%~dp0"
::--------------------------------------

::
@ECHO OFF
CLS
CD\

:WinActivation
ECHO.
ECHO.
ECHO.
ECHO -------------------------------------------------------------------
ECHO - Activate Windows...
ECHO -------------------------------------------------------------------
slmgr -ipk product Key here
slmgr -ato
::

I am trying to work out a way we can do this without any interaction on the PC. Perhaps this is not the best way, maybe I can build an executable or something that dosnt require elevation instead? 

Looking for some ideas really on how to take this forward and save some chump having to login each week and set these up manually.

Thanks.

Been a couple of days now anyone got ideas?

Are you not using a Volume MAK key or a KMS server to handle operating system activation (I assume you mean activation rather than registration?).

Also, you need to bear in mind that the local system account has NO network privileges so is not able to access any network resources including internet access. For network access or internet access, you need to run the process using a domain user account that does have access to the external resources needed for "registration".

If you're using an volume activation key and have a kms server you can create a task using the Software and File Actions option and just tell it what commands to execute.

For example:

cscript.exe c:\windows\system32\slmgr.vbs /skms <DNS or IP:Port# of KMS>
cscript.exe c:\windows\system32\slmgr.vbs /ato
cscript.exe "C:\Program Files\Microsoft Office\Office15\ospp.vbs" /sethst:<DNS or IP of KMS>
cscript.exe "C:\Program Files\Microsoft Office\Office15\ospp.vbs" /act

OK I think that explains why it wasnt working EdT with the network access, 

Unfortunatly we dont have any KMS server or MAK keys I have had to run this project using standard windows keys for each PC which are all different. We did raise this point for making activation easier but we have not had the desired response. 

I can run a certain script with user credentials in it, I think it was cscript jltrice. But we didnt like the idea of this information being in plain text. Looking like there arent going to be a while lot of ways around this issue.

What I would add is that windows activation records parameters such as bios serial number and the NIC MAC address and no doubt other hardware features to try and lock a standard serial number to a specific machine. Consequently you should try and ensure that a specific windows serial number is always deployed to a specific machine.  Is this a training room scenario where you need to rebuild machines on a regular basis?  It might be simpler to image each machine to a USB drive or USB key separately without sysprepping and then restore the image when required, which avoids having to rejoin the domain and reregister windows and Office.  If your restore interval is more than a week, you can prevent the automatic password change for the workstation account in the domain by setting the DisablePasswordChange registry key (DWORD) from 0 to 1.  Search for it under HKLM/..../CurrentControlSet/....

Unfortunatly its a DR situation instead, it needs to be the same image as the original PC but needs a different PC name on the domain so both can function at the same time. There was no other software on the Market we could find that would enable this functionality.

Instead of running sysprep on the restored image, why not set up the machine before imaging so that when it boots after restore, it changes the computername to your DR value and forces another reboot before rejoining the domain. You can set it up to autologon using a domain admin account (for example) and carry out whatever processes you need before joining the domain.  That way there is no need to use sysprep or worry about running processes in system context. The domain admin account can be one that is only enabled during DR.