Create a Shell Object in ASP

[Oliver Gräser]

Hej,


I want to run batchfiles via the Shell, but accessible in the Browser
via IIS. Actually, I'd like the server to start a command line ntbackup
if a users selects to do so on an ASP in his webbrowser. Does anyone
know how to create a shell object in an ASP?

Thanks,

Oliver

 

[Aaron [SQL Server MVP]]

You need elevated permissions: Set Shell = CreateObject("WScript.Shell")

A better plan is to store the commands in a table or text file, and have a
batch file wake up on a schedule (say every minute) and run all the tasks in
the table or file. Then you don't have to worry about making your anonymous
web user an administrator of the box... just a thought.

 

[Bob Barrows [MVP]]

Hej,


I want to run batchfiles via the Shell, but accessible in the Browser
via IIS. Actually, I'd like the server to start a command line
ntbackup if a users selects to do so on an ASP in his webbrowser.
Does anyone know how to create a shell object in an ASP?

Thanks,

Oliver

It can't be done. You can't initiate client-side programs from server-side
ASP script.

You will need to create an HTA, HTML Application, which is off-topic in this
newsgroup. Use Google to find information about it. Go to
msdn.microsoft.com/library to read about it. Client-side scripting groups
such as those with dhtml in their names, as well as the .scripting groups,
are the places to follow-up this question.

Bob Barrows

 

[Oliver Gräser]

Sorry, don't understand the elevated permissions part. As far as I got
it, I cannot create WScript Objects running the IIS because it is a
different Scripting Host. Anyway, if I have this line

<%
Set objShell = WScript.CreateObject("Wscript.Shell")
Set objExecObject = objShell.Exec("cmd /c ntbackup backup _
""@C:\total.bks"" /J ""Alles"" /F ""X:\total.bkf"" /L:s ")
%>
in an ASP at a place where it is run, nothing happens.
For the workaround: Yep, I already have some scripts in the scheduler.
But for somem occasions we need extra backups, and some prerequisites
(stopping sql server, connecting to NAS etc) done. And I thought it
would come in handy if we could just do so by opening the web browser,
clicking some buttons and voila. Because otherwise, people tend to
forget something (like mounting the correct drive etc) and then backup
fails. It is only a tiny network without access from outside, so there
shouldn't be any harm.


Regards,

Oliver

 

[Aaron [SQL Server MVP]]

Sorry, don't understand the elevated permissions part.

IIS runs using an anonymous account, IUSR_MachineName. This user, by
default, will not be able to run commands like ntbackup.

For the workaround: Yep, I already have some scripts in the scheduler.

I think you misunderstood what I meant.

But for somem occasions we need extra backups, and some prerequisites
(stopping sql server, connecting to NAS etc) done. And I thought it
would come in handy if we could just do so by opening the web browser,
clicking some buttons and voila.

What I am saying is that if the user wants to add an extra backup to the
schedule, he hits an ASP page, and the ASP page, rather than actually
performing the backup, stuffs the details of the task into a table, say.
Then, you have a different task (not a backup task!) in the scheduler, that
checks this tasks table every minute (or every hour, whatever), and if it
finds anything new, it runs it...

Because otherwise, people tend to
forget something (like mounting the correct drive etc) and then backup
fails.

Whatever task is responsible for the backup can notify appropriate people
when it fails. Do you really expect a user to sit on a web page, waiting
for a backup to complete? Do you know how HTTP works, and why this is not a
reasonable requirement?

If you want something more direct than this, look into a client-server
application, not a web page.

 

[Oliver Gräser]

IIS runs using an anonymous account, IUSR_MachineName. This user, by
default, will not be able to run commands like ntbackup.

So if I would switch that to a Backup-Operator account it would be
possible?

I think you misunderstood what I meant.

Might well be so;-) Actually I'm not really a computer guy.

What I am saying is that if the user wants to add an extra backup to the
schedule, he hits an ASP page, and the ASP page, rather than actually
performing the backup, stuffs the details of the task into a table, say.
Then, you have a different task (not a backup task!) in the scheduler, that
checks this tasks table every minute (or every hour, whatever), and if it
finds anything new, it runs it...

Sounds interesting. But I don't get the different task - not a backup
task thing. Can you give me a hint how to stuff tasks into the scheduler
or where to find more information about this? Thanks,..

Whatever task is responsible for the backup can notify appropriate people
when it fails. Do you really expect a user to sit on a web page, waiting
for a backup to complete? Do you know how HTTP works, and why this is not a
reasonable requirement?

No, a little bit, no. Actually I'm a physikcs student and don't have
more IT knowledge than I need to run my simulations. I just do this
stuff for a small company because there is noone else. But if you can
give me hint how to get informed aboput tasks,maybe you're right that
this way is more suitable.

If you want something more direct than this, look into a client-server
application, not a web page.

surely not...

 

[Aaron [SQL Server MVP]]

So if I would switch that to a Backup-Operator account it would be

possible?

Maybe. But that's kind of like giving the dog the car keys because he needs
dog food.

But I don't get the different task - not a backup
task thing.

You said you have backups and other tasks in the scheduler already, that's
all.

Can you give me a hint how to stuff tasks into the scheduler
or where to find more information about this? Thanks,..

Do you have access to a database? Here is how I would do it for SQL Server:

CREATE TABLE tasks
(
taskID INT IDENTITY(1,1) NOT NULL PRIMARY KEY,
command VARCHAR(255) NOT NULL,
entered SMALLDATETIME NOT NULL DEFAULT GETDATE(),
started SMALLDATETIME,
completed SMALLDATETIME
)

Now, when someone goes to your web page and says, "I want to backup
C:\total.bks to X:\total.bkf" they select it from the list, or type it in,
or whatever (I don't know how you limit users to certain things like
stopping SQL Server, connecting to NAS, etc but prevent them from running
format c:\ /y), you insert the following:

Now, you have a VB executable, or a VBS script, or a C# command-line app, or
whatever, that polls this table for new tasks. The code might look
something like this:

set conn = CreateObject("ADODB.Connection")
conn.open "<connection string>"
set rs = conn.execute("SELECT taskID, command FROM Tasks WHERE started IS
NULL AND completed IS NULL")
if not rs.eof then
' hey hey, we have some work to do
set wshell = CreateObject("WScript.Shell")
do while not rs.eof
taskID = rs(0): command = rs(1)
conn.execute "UPDATE tasks SET started = GETDATE() WHERE taskID = "
& taskID
wshell.run command
conn.execute "UPDATE tasks SET completed = GETDATE() WHERE taskID =
" & taskID
rs.movenext
loop
end if
' of course, might want error handling, might need to replace " in command,
etc.
' but hopefully you get the drift...

So, let's say you called it PickUpWebTasks.vbs, and put it in c:\. Now, add
a scheduled task that runs PickUpWebTasks.vbs to the scheduler, and schedule
it to run every minute, or every hour, or whatever.

I can't really do much more for you without writing the actual application
for you. And I don't do that kind of work for free, sorry.

A

 

[Aaron [SQL Server MVP]]

stopping SQL Server, connecting to NAS, etc but prevent them from running

format c:\ /y), you insert the following:

Sorry, forgot the SQL statement.

conn.execute "INSERT Tasks(command) VALUES('" &
whatever_they_selected/entered & "')"