Mein Script sieht so aus:
Code: Alles auswählen
[DosInAnIcon_Set_Admin_Background]
reg load HKLM\TEMP_HIVE c:\Users\Administrator\ntuser.dat
reg add "HKLM\TEMP_HIVE\Software\Sysinternals\BgInfo" /v EulaAccepted /t REG_DWORD /d 1 /f
reg add "HKLM\TEMP_HIVE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Set_Admin_Background" /t REG_SZ /F /D "\"%ProgramFiles%\Docemus\BgInfo.exe\" \"%ProgramFiles%\Docemus\AdminBackground.bgi\" /timer:0"
reg unload HKLM\TEMP_HIVE
Code: Alles auswählen
(951) [5] [2021-11-16 09:46:47.014] [docemus-branding] Execution of: DosInAnIcon_Set_Admin_Background /sysnative
(952) [7] [2021-11-16 09:46:47.018] [docemus-branding] Save to file with encoding: system
(953) [7] [2021-11-16 09:46:47.019] [docemus-branding] Executing "C:\WINDOWS\system32\\cmd.exe" /C c:\opsi.org\tmp\_opsiscript_4GsXL6wf33.cmd /sysnative
(954) [6] [2021-11-16 09:46:47.019] [docemus-branding] Start process as invoker: SYSTEM
(955) [6] [2021-11-16 09:46:47.025] [docemus-branding] Started process "C:\WINDOWS\system32\\cmd.exe" with Opt: /C\r\nc:\opsi.org\tmp\_opsiscript_4GsXL6wf33.cmd\r\n/sysnative
(956) [7] [2021-11-16 09:46:47.250] [docemus-branding]
(957) [7] [2021-11-16 09:46:47.250] [docemus-branding] output:
(958) [7] [2021-11-16 09:46:47.250] [docemus-branding] --------------
(959) [7] [2021-11-16 09:46:47.250] [docemus-branding]
(960) [7] [2021-11-16 09:46:47.250] [docemus-branding] C:\WINDOWS\system32>reg load HKLM\TEMP_HIVE c:\Users\Administrator\ntuser.dat
(961) [7] [2021-11-16 09:46:47.250] [docemus-branding] Der Vorgang wurde erfolgreich beendet.
(962) [7] [2021-11-16 09:46:47.250] [docemus-branding]
(963) [7] [2021-11-16 09:46:47.250] [docemus-branding]
(964) [7] [2021-11-16 09:46:47.250] [docemus-branding] C:\WINDOWS\system32>reg add "HKLM\TEMP_HIVE\Software\Sysinternals\BgInfo" /v EulaAccepted /t REG_DWORD /d 1 /f
(965) [7] [2021-11-16 09:46:47.250] [docemus-branding] Der Vorgang wurde erfolgreich beendet.
(966) [7] [2021-11-16 09:46:47.250] [docemus-branding]
(967) [7] [2021-11-16 09:46:47.250] [docemus-branding]
(968) [7] [2021-11-16 09:46:47.250] [docemus-branding] C:\WINDOWS\system32>reg add "HKLM\TEMP_HIVE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Set_Admin_Background" /t REG_SZ /F /D "\"C:\Program Files (x86)\Docemus\BgInfo.exe\" \"C:\Program Files (x86)\Docemus\AdminBackground.bgi\" /timer:0"
(969) [7] [2021-11-16 09:46:47.250] [docemus-branding] Der Vorgang wurde erfolgreich beendet.
(970) [7] [2021-11-16 09:46:47.250] [docemus-branding]
(971) [7] [2021-11-16 09:46:47.250] [docemus-branding]
(972) [7] [2021-11-16 09:46:47.250] [docemus-branding] C:\WINDOWS\system32>reg unload HKLM\TEMP_HIVE
(973) [7] [2021-11-16 09:46:47.250] [docemus-branding] Der Vorgang wurde erfolgreich beendet.
(974) [7] [2021-11-16 09:46:47.250] [docemus-branding]
(975) [7] [2021-11-16 09:46:47.250] [docemus-branding]
(976) [7] [2021-11-16 09:46:47.250] [docemus-branding] The file: c:\opsi.org\tmp\_opsiscript_4GsXL6wf33.cmd has been deleted
(977) [6] [2021-11-16 09:46:47.251] [docemus-branding] Search "c:\opsi.org\tmp\_opsiscript_*"
(978) [6] [2021-11-16 09:46:47.257] [docemus-branding] EndCase
(979) [6] [2021-11-16 09:46:47.258] [docemus-branding] EndSwitch