google / password-sync-support-tool Goto Github PK

GSPStool calls itself with an additional argument to process individual DCs.

If a DC name pulled from the AD is blank then GSPStool will loop continuously.

This would allow us to see if the service logon settings have been changed.

Expected results:

C:\>sc qc "G Suite Password Sync"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: G Suite Password Sync
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : "C:\Program Files\Google\G Suite Password Sync\password_sync_service.exe"
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : G Suite Password Sync
        DEPENDENCIES       :
        SERVICE_START_NAME : NT AUTHORITY\NetworkService

Example code:

Set shell = CreateObject("Shell.Application")
Set folder = shell.Namespace("C:\Windows")

Set file = folder.ParseName("notepad.exe")

For i = 0 to 1000
    If folder.GetDetailsOf(file, i) <> "" Then _
      Wscript.Echo i & ": " & folder.GetDetailsOf(file, i) 
Next

Based on http://stackoverflow.com/questions/2976734/how-to-retrieve-a-files-product-version-in-vbscript.

We can use https://www.7-zip.org/a/lzma1900.7z from https://www.7-zip.org/sdk.html. We need to create build.config.gspstool:

;!@Install@!UTF-8!
ExecuteFile="cmd.exe"
ExecuteParameters="/c title G Suite Password Sync diagnostics tool && cscript //nologo gspstool.vbs"
Directory="%temp%"
GUIMode="2"
Progress="no"
;!@InstallEnd@!

...and then:

"C:\Program Files\7-Zip\7z.exe" a gspstool.7z gspstool.vbs
copy /b 7zSD.sfx  + build.config.gspstool + gspstool.7z test-exe\gspstool.exe

GAPSTools should report these informations:

• the current OAuth2 type (3-legged or service-account)
• the user which is being impersonated

Command to dump all trusted certs:

for %a in (Root AuthRoot Trust CA) do certutil -store %a >> trusted-certs.txt 2>>&1

We can probably only do it for the local machine this way, but it's better than nothing.

We currently have separate log statements and messagebox statements in many places, but it would be better to also log the exact text that's shown to the user, instead of having to go to the code to correlate what's seen vs. what's logged.

...so we can make sure that Network Service has access.

What steps will reproduce the problem?
1.
2.
3.

What is the expected output? What do you see instead?


What version of the product are you using? On what operating system?


Please provide any additional information below.

Original issue reported on code.google.com by [email protected] on 27 Jan 2015 at 1:31

Attachments:

• WEBPAGE_20150125_032035.jpg
• WEBPAGE_20150125_032131.jpg

Currently, when GAPSTool fetches the configuration UI logs by assuming the path is something like C:\Users\[username], but when running on the local machine, we have a better source - %userprofile% or %localappdata%.

This is important because the user profile path doesn't always match the username.