Script to remote lock a screen under Windows 7

Question

I was pointed in this direction by the author of a script I've been using for a couple of years now.

It allows the remote locking of a desktop, and works fine locally and remotely under Windows XP, and works fine locally under Windows 7, but when trying to use it remotely against a Windows 7 machine it fails to work. It's been great for a few years now and has been very useful, but we've recently started to deploy Windows 7 machines on site and once the upgrade is fully completed I won't be able to use this anymore.

The same question that I have was posed a couple of years back, but went unanswered.
Here is the VBS code:

' StartProcess.vbs
' Sample VBScript to start a process. Inputbox for name
' Author Guy Thomas http://computerperformance.co.uk/
' Version 2.2 - December 2005
' -------------------------------------------------------'
Option Explicit
Dim objWMIService, objProcess
Dim strShell, objProgram, strComputer, strExe, strInput
strExe = "rundll32.exe user32.dll,LockWorkStation"
' Input Box to get name of machine to run the process
Do
strComputer = (InputBox(" ComputerName to Run Script",_
"Computer Name"))
If strComputer <> "" Then
strInput = True
End if
Loop until strInput = True

' Connect to WMI
set objWMIService = getobject("winmgmts://"_
& strComputer & "/root/cimv2")
' Obtain the Win32_Process class of object.
Set objProcess = objWMIService.Get("Win32_Process")
Set objProgram = objProcess.Methods_( _
"Create").InParameters.SpawnInstance_
objProgram.CommandLine = strExe

'Execute the program now at the command line.
Set strShell = objWMIService.ExecMethod( _
"Win32_Process", "Create", objProgram)

'WScript.echo "Created: " & strExe & " on " & strComputer
WSCript.Quit
' End of Example of a Process VBScript

Solution 1

Running rundll32.exe user32.dll,LockWorkStation on my Win7 64 bit locks the screen, so this seems quite OK. But when looking at http://msdn.microsoft.com/en-us/library/windows/desktop/aa376875(v=vs.85).aspx I read

The LockWorkStation function is callable only by processes running on the interactive desktop. In addition, the user must be logged on, and the workstation cannot already be locked.

I have no experience with WMI but I assume that WMI does not run rundll32.exe on the interactive desktop!?

Solution 2

This is working for me with remote Windows 7 x64 systems :

psexec.exe -accepteula \\REMOTECOMPUTERNAME -i -s %windir%\system32\rundll32.exe user32.dll,LockWorkStation

Regards

Comments

[Cody Gray]

That VBS code never really "worked" in the first place. Rundll32.exe was never intended to call the LockWorkStation function, as it has the wrong signature. Now is as good a time as any to fix it.

[Pingu_Pi]

Thanks for the link and edit Cody, I had seen people saying calling rundll32 for this wasn't a good idea but didn't understand why until now.

[Werner Henze]

@Cody Gray: LockWorkStation does not require any parameters, so it wouldn't mind if rundll32.exe passes more parameters than required.

[Nilpo]

I'm going to agree in principle that the rundll32 method is not a proper solution. However, I do consider it usable in practice. And Microsoft themselves have recommended several times. technet.microsoft.com/en-us/library/cc750823.aspx blogs.technet.com/b/heyscriptingguy/archive/2004/11/15/…

[Cody Gray]

"Microsoft themselves" (whatever that means, as if they're some sort of entity that speaks with a singular voice in every published code sample and blog) might have recommended it, but it's still wrong. The fact that it "works" is because of the tireless effort of the backwards compatibility camps. It doesn't do a lot of good to "agree in principle" with something, but then do it anyway. It's a broken, brain-dead solution, and if you understand why it doesn't work (i.e., read the article I linked to initially), then you won't want to use it. It's disappointing to read ignorant comments.

[Cody Gray]

The real solution is not really attainable from VBScript (I don't think, I could be wrong) because you can't call Windows API functions from VBScript (this I know for certain). The best thing that you could do would be to write a small wrapper program in another language, and just execute that. It wouldn't be as easy to modify as the script, but why would you need to ever do that? If you know C++ or C#, those would be fine choices. But if you only know VBScript, you could also write it in VB 6—the syntax is nearly identical. Write once, use many times. Perfectly legal, and it always works.

[Pingu_Pi]

Even running the rundll32.exe user32.dll,LockWorkStation command via psexec doesn't work remotely, yet locally it's fine.

[Nilpo]

The rundll32.exe command needs to be executed locally. Copying a script or batch file to the remote machine and executing it will work.

[Pingu_Pi]

I copied the script to the target machine, and using psexec \\targetmachine cmd I executed it as if from the machine and under Windows 7 it doesn't work, but XP is fine.

[Werner Henze]

psexec installs a Windows Service at the target machine and the service runs the rundll32.exe. Since Vista services cannot connect to the interactive desktop. LockWorkStation must be called by a process running on the interactive deskop. So I wouldn't expect psexec to help here.

[Pingu_Pi]

Thanks for the explanation Werner, I was wondering why it wasn't working even with the -i to psexec to run it in session 0 when specified, and now I know :)

[Werner Henze]

@Pingu_Pi: If you think my answer is the right one for your question, it is good style to accept it. Of course it's also a good idea to give others some time to come up with a better answer.

[Pingu_Pi]

I was going to leave it a bit originally but within the context of a vbs script, or modifying the existing one you seem to be correct and it can't be achieved. Happily setting your answer as correct :) thanks again for the help Werner and Cody, much appreciated!