> For the complete documentation index, see [llms.txt](https://help.security.gallagher.com/knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.security.gallagher.com/knowledge-hub/products/cc-software/configure/server-configuration/server-using-a-macro-to-run-an-applica.md). # Using a macro to run an application Command Centre can do many things, but sometimes a site needs functions the software cannot do natively, such as running an application at the press of a tile or when an alarm occurs, playing a sound, or launching a web page. This is where a macro comes in. A macro's command lines run under a specified Windows account. Each command line runs in one of two modes: **Run only when the user is logged on** (any GUI is visible) or **Run whether the user is logged on or not** (background, no GUI). Playing a sound without a GUI needs VLC. To run applications reliably, the Windows accounts involved must hold the **Replace a process level token** user right in Group Policy, and that list must include the account running the Command Centre Service. > **These can only be configured from within Configuration Client.** ## Playing a sound from a macro without a GUI This cannot be done with the built-in Windows media player without invoking the GUI, but VLC achieves it easily. You need a batch file located on the workstation or server, for example: ``` "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" -I dummy --dummy-quiet "C:\Program Files (x86)\Gallagher\Command Centre\sound.wav" ``` The VLC executable can be in a different install location depending on how it was installed. The sound file just needs to be something VLC can process. ![Command Centre macro Command Lines tab for a SOUND macro, running C:\Sounds\Sound.bat under a Windows account, with "Run whether user is logged on or not" selected](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-358abd40583169cb7bfcf097b5bd4ea199a04a44%2FSECHUB-CCS-SRV-17-macro-sound-config.png?alt=media) ### The two run modes The macro's command lines run under a specified Windows account, with one of two modes: * **Run only when the user is logged on**: runs the command lines only if you are actively logged into Windows when the macro executes. If a command line has a GUI component, it is visible. > ⚠️ This mode only works if the Command Centre service is running as **"Local System"**, which is not the best option security-wise. Changing it could affect other operations (recovery code, SQL access). * **Run whether the user is logged on or not**: runs the command lines regardless of whether you are logged into Windows, but all commands run in the background (any GUI component is not visible). ## Opening an application from a macro Point the macro's command line at a batch file that launches the application or web page. In this example, a `WebPage.bat` file launches a browser: ![Command Centre macro Command Lines tab for a WebPage macro, running WebPage.bat under a Windows account with "Run only when user is logged on" selected](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-12f9c767869cd9da92af2daeec7bd6f23af4a645%2FSECHUB-CCS-SRV-18-macro-run-app-config-1.png?alt=media) ![The WebPage.bat batch file open in Notepad, containing "@ECHO OFF" and "start firefox https://www.google.com/"](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-1b7c7887d548597f0d550d172e9d938f6b39c165%2FSECHUB-CCS-SRV-19-macro-run-app-config-2.png?alt=media) ## Ensuring operators and users have permission to run applications Windows often requires special privileges of the Windows operator for the Windows API to run applications. To ensure the user accounts have the correct privileges, use the **Group Policy editor**. ![Group Policy editor showing User Rights Assignment with the "Replace a process level token" setting](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-ac7d8222181064ad58f3fbdb2dbc011e29d68f0d%2FSECHUB-CCS-SRV-20-group-policy-editor-rights.jpg?alt=media) Go to **User Rights Assignment** and the setting **Replace a process level token**, and ensure the Windows operators used to run the macro or application are included. > **Note:** the list must include the Windows account that is running the Command Centre Service. In the source example, the Command Centre Services run as a Windows user called `Gallagher`, and the Windows account `test` is used to run the application, so both are listed (alongside the machine name). ![Group Policy editor showing the user list for "Replace a process level token", including the Command Centre service account and the application account](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-b7f534d623dce60951d5f0d8ac66234d271889d5%2FSECHUB-CCS-SRV-21-group-policy-editor-users.jpg?alt=media) ## Worked example: a typical macro configuration A typical macro configuration looks like this (here, a "Move Cardholders" macro running `MoveCardholders.exe` with access-zone and operator arguments): ![Command Centre macro Command Lines tab for a "Move Cardholders" macro, running MoveCardholders.exe with arguments "Access Zone 1" "Access Zone 2" "Operator" "Gallagher", under the "test" Windows account](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-8b78a31e4d099fde7a76286ccf2ed5b0ed6b271c%2FSECHUB-CCS-SRV-22-macro-typical-config.jpg?alt=media) With those settings, the following events show up in the Event Viewer (the cardholders were in Access Zone 1 previously): ![Command Centre Event Viewer showing the events generated when the Move Cardholders macro runs](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-8587f9491654e80ea014c91f63f74cda0e8941c9%2FSECHUB-CCS-SRV-23-macro-event-viewer-results.jpg?alt=media) *** 🔗 **Related** * [Command Centre - Move Cardholder Utility](https://github.com/GGLSecDev/gitbook-spaces/tree/main/tech-support/installs-and-downloads/tools-and-utilities/command-centre-move-cardholder-utility.md). The utility invoked in the worked example. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://help.security.gallagher.com/knowledge-hub/products/cc-software/configure/server-configuration/server-using-a-macro-to-run-an-applica.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.