Registra task su utente corrente

README.md

@@ -179,6 +179,18 @@ powershell -ExecutionPolicy Bypass -File .\scripts\Register-BakRestTask.ps1 -Tas
 powershell -ExecutionPolicy Bypass -File .\scripts\Register-BakRestTask.ps1 -Task BackupOnLogoff
 ```
 
+Per registrare il task di backup sull'utente corrente invece che sul gruppo `Users`:
+
+```powershell
+powershell -ExecutionPolicy Bypass -File .\scripts\Register-BakRestTask.ps1 -Task BackupOnLogoff -RunAsCurrentUser
+```
+
+Per debug senza spegnimento:
+
+```powershell
+powershell -ExecutionPolicy Bypass -File .\scripts\Register-BakRestTask.ps1 -Task BackupOnLogoff -RunAsCurrentUser -NoShutdown
+```
+
 Il task di backup usa l'evento Security `4647`, cioe' logoff/disconnessione iniziata dall'utente. Se sulla macchina questo evento non viene scritto, bisogna abilitare l'audit logoff oppure useremo un trigger alternativo.
 
 Il task notifier usa un trigger al logon e un trigger giornaliero con ripetizione `PT30M`, quindi avvisa durante la giornata anche se non viene usata la tray app.

scripts/Register-BakRestTask.ps1

@@ -3,7 +3,11 @@ param(
     [ValidateSet("Notifier", "BackupOnLogoff")]
     [string]$Task,
 
-    [string]$TaskFolder = "BakRest"
+    [string]$TaskFolder = "BakRest",
+
+    [switch]$RunAsCurrentUser,
+
+    [switch]$NoShutdown
 )
 
 $ErrorActionPreference = "Stop"
@@ -37,6 +41,30 @@ $xml = $xml -replace 'encoding="UTF-8"', 'encoding="UTF-16"'
 $xml = $xml -replace '<Command>.*?</Command>', ('<Command>{0}</Command>' -f [System.Security.SecurityElement]::Escape($pythonExe))
 $xml = $xml -replace '<WorkingDirectory>.*?</WorkingDirectory>', ('<WorkingDirectory>{0}</WorkingDirectory>' -f [System.Security.SecurityElement]::Escape($repoRoot))
 
+if ($NoShutdown -and $Task -eq "BackupOnLogoff") {
+    $xml = $xml -replace '<Arguments>-m bakrest\.tray_app --nogui</Arguments>', '<Arguments>-m bakrest.tray_app --nogui --no-shutdown</Arguments>'
+}
+
+if ($RunAsCurrentUser) {
+    $currentIdentity = [System.Security.Principal.WindowsIdentity]::GetCurrent()
+    $currentSid = $currentIdentity.User.Value
+    $principalXml = @"
+<Principals>
+    <Principal id="Author">
+      <UserId>$currentSid</UserId>
+      <LogonType>InteractiveToken</LogonType>
+      <RunLevel>LeastPrivilege</RunLevel>
+    </Principal>
+  </Principals>
+"@
+    $xml = [regex]::Replace(
+        $xml,
+        '<Principals>.*?</Principals>',
+        $principalXml,
+        [System.Text.RegularExpressions.RegexOptions]::Singleline
+    )
+}
+
 $tempXml = Join-Path $env:TEMP ("bakrest-task-{0}.xml" -f ([Guid]::NewGuid()))
 [System.IO.File]::WriteAllText($tempXml, $xml, [System.Text.Encoding]::Unicode)
 
@@ -48,6 +76,12 @@ try {
     Write-Host "Registered task: $taskName"
     Write-Host "Python: $pythonExe"
     Write-Host "WorkingDirectory: $repoRoot"
+    if ($RunAsCurrentUser) {
+        Write-Host "RunAs: $($currentIdentity.Name)"
+    }
+    if ($NoShutdown -and $Task -eq "BackupOnLogoff") {
+        Write-Host "BackupOnLogoff registered in debug mode: --no-shutdown"
+    }
 } finally {
     Remove-Item -LiteralPath $tempXml -Force -ErrorAction SilentlyContinue
 }