1

I'm not sure if I am asking this in the right spot or not, sorry if I am wrong.

I would like to know please, SCCM is currently operational in our school, and we use it to install software across our network.

I have a piece of software that requires a different channel for each room or staff laptop that it is installed in.

I have managed to set up a powershell script that polls a csv for the channel that should be assigned to each room, and when the script it run, it pulls that channel and installs the software with that channel assigned.

What I am having trouble with now, is that SCCM installs the software using the local system account, and the csv is located on a network share. When the System account goes to poll the csv file it gets an access denied error, even though System has full control of the csv and directory that the csv is located in.

Is it just me not understanding the permissions that System has, or can System not interact with other devices over the network, I assumed that being system on both devices, it would be able to cross to another device and impersonate system on that device.

Is there a way around this?

Thanks for any feedback.

3
  • Just out of curiousity... LanSchool? Sep 4, 2014 at 0:35
  • Yes Patrick, correct, haha, good guess, are you having issues also?
    – Random206
    Sep 4, 2014 at 0:45
  • No, but we use it in a VDI environment, not on real computers. Sep 6, 2014 at 13:42

3 Answers 3

1

LocalSystem account

  • Name: .\LocalSystem (can also use LocalSystem or ComputerName\LocalSystem)
  • the account has no password (any password information you provide is ignored)
  • HKCU represents the default user (LocalSystem has no profile of its own)
  • has extensive privileges on the local computer
  • presents the computer's credentials to remote servers

Completely trusted account, moreso than the administrator account. There is nothing on a single box that this account can not do and it has the right to access the network as the machine (this requires Active Directory and granting the machine account permissions to something).

Source/More info at this StackOverflow answer: https://stackoverflow.com/a/510225/225906

3
  • So if I were to add 'everyone' with read/write permissions to the particular files, I would be able to access it using the System Account?
    – Random206
    Sep 4, 2014 at 0:31
  • Don't do that :) Sep 4, 2014 at 2:00
  • No it's OK I have added Domain Computers to the permissions list, and assigned that Read/Write permissions.
    – Random206
    Sep 4, 2014 at 2:32
1

By adding 'Domain Computers' to the files permissions list, I am able to allow the System Account to access the file, and use the permissions assigned to Domain Computers.

0

@Techie007 is is correct. What you want to do to get this to work is create a domain account that has permission to just read that network share, and then use something like "net use \server\share /user:domain\user password" to map to that share as that user with permissions. Just make sure the user isn't a member of domain users or doesn't have log on rights or something to prevent that fairly well known credentials then being used for anything.

1
  • Or a local account on each computer, though that's more management and harder to repudiate if there's a security problem. Sep 4, 2014 at 2:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .