Thursday, April 30, 2009

FSRM - "The command specified is under an insecure folder path"

Windows 2003 R2 and 2008 have a very cool feature - Quotas. Quotas have been around since NT4 on Windows Server but were always a bit rubbish - you had to set them by the volume and they didn't do much other than restrict file usage. 2003 R2 changed this with the File Server Resource Manager, included in 2008. FSRM is great - you can have "soft" quotas, essentially useful for reporting without restricting people, you can set different quotas on different folders, generate reports, launch programs, its great. I've been lobbying for it on the file servers at my current place since I arrived and it's making a big difference now they're in.

Saying that, I've just spent an outrageous amount of time getting quotas in FSRM to do something very basic - launch a program when a set percentage of a quota is hit. Whatever I selected I get the error "The command specified is under an insecure folder path". Google gave me nothing, something that really worried me! The program was just to send a message to HP OpenView to say there was a quota issue.

Turns out it was a couple of things. Firstly I was running the command as Local Service, which is nice and secure as it can't cause much damage but also didn't have file permission to the program it was launching. Sorted that and it still didn't work, so I directed it at a batch file intended to call the actual program and got the same error. Cue about an hour of changing permissions, running from different folders, hitting the screen, etc.

Finally on an obscure forum post I found the answer - I was calling the batch file wrong. You call CMD.exe and pass the name of the batch file as an argument, followed by any other arguments you want. It still won't look at the .exe under c:\program files but the batch file it looks at does it for it, including the arguments:

call opcmsg.exe %1 %2 %3 %4 %5 %6

Anyway, thought I should write this up in case someone else has the same issue, this took far too long! I get the impression not many people use the Command feature of FSRM, or if they do they found it a lot less fiddly than me...

5 comments:

  1. Thank you!

    I've been toying with getting quotas implemented without buying a software solution for some time now. My users (students) don't have e-mail addresses, so sending them e-mails about exceeding quotas wasn't possible. Finally figured I'd have the Command section trigger the appropriate script warning them and BAM - There's the "command specified is under an insecure folder path" message. Which I'll be honest - I'd not have come to the correct solution on myself for a good while longer.

    Only problem I have left with this is getting the event to trigger on every log in until resolved as most students here ignore any errors and blindly click through.

    Thanks for the write-up!

    ~A

    ReplyDelete
  2. Your article saved me lot of time! One remark: I had to use cmd.exe /c

    Thanks!

    MichielV

    ReplyDelete
  3. I moved my .bat file to the %windir% and used the value "%windir%\myBatchFile.bat" as the Run command. That also worked.

    ReplyDelete
  4. thanx a lot !! This saved me a lot of time. Allready spent 4 hours with no results!

    Very usefull!

    ReplyDelete
  5. Fantastic, thank you! This saved me hours worth of troubleshooting :)

    ReplyDelete