CommodoreS Posted January 16, 2015 Posted January 16, 2015 The Windows Error Recovery screen which defaults to Launch Startup Repair (rather than Start Windows Normally) is annoying. I found this thread on how to disable this: https://social.msdn.microsoft.com/Forums/en-US/12806c89-3592-4748-83dd-5b55eabec5a1/disabling-windows-error-recovery-on-startup?forum=quebecmisc But would rather just make it default to Start Windows Normally. Does anyone know if there is a way to do this (or disable it through GPO) rather than having to enter the command on each machine?
burgemaster Posted January 16, 2015 Posted January 16, 2015 Hi mate, If you can wait till tomorrow I have a startup script running that disables it. ?
CommodoreS Posted January 16, 2015 Author Posted January 16, 2015 Thank you for this - tomorrow is fine. I am guessing it can be placed in a Computer\Machine startup GPO rather than a user one requiring Admin Permissions?
fairm010 Posted January 16, 2015 Posted January 16, 2015 Please see this post of mine, it is how I achieved this. http://www.edugeek.net/showpost.php?p=1232355 1
burgemaster Posted January 16, 2015 Posted January 16, 2015 (edited) Hi mate, Please test before deploying!!! Tim if exist c:\windows\suroff.txt goto end bcdedit /set {default} recoveryenabled No bcdedit /set {default} bootstatuspolicy ignoreallfailures copy \\server\netlogon\scripts\suroff.txt c:\windows\suroff.txt :end Edited January 16, 2015 by burgemaster 1
CommodoreS Posted January 22, 2015 Author Posted January 22, 2015 I am guessing this is a .BAT rather than a .VBS script. Please can you let me know what area of GPO has this script been added? Can it be added as a computer script and applied pre-logon? I would have thought the command would need administrator rights to run, but could be wrong. I am also unsure how I would test this has worked - perhaps by shutting down a PC while windows is rebooting? (although doing that does not always make this screen appear).
fairm010 Posted January 22, 2015 Posted January 22, 2015 Run this as a .bat and run it as a Startup (Computer) script. Scripts that run as start-up always use the local machines (Admin) privileges. Scripts that run at logon use the users privileges. Id start a machine, wait till it gets to "Starting Windows" with the Windows 7 Flag then pull the power. Start it back up and see what happens.
Koldov Posted January 23, 2015 Posted January 23, 2015 (edited) Hi All, Yesterday I had the embarrassing situation where just before assembly our hall pc decided to launch Startup Repair... Cue me standing there for 10 minutes like an idiot while Windows did it's thing up on the big projector screen with the whole school sitting in front of me! So I have done a quick search and ended up here. Just checking... This text (saved as a .bat): if exist c:\windows\suroff.txt goto end bcdedit /set {default} recoveryenabled No bcdedit /set {default} bootstatuspolicy ignoreallfailures copy \\server\netlogon\scripts\suroff.txt c:\windows\suroff.txt :end Placed in Sysvol and called from the Default Domain Policy GPO > Computer Configuration > Policies > Windows Settings > Scripts (Startup/Shutdown) > Startup With a blank 'suroff.txt' in \\server\netlogon\scripts\ to be copied down to C:\ Is there no GPP to do this? Kol. - - - Updated - - - Edited January 23, 2015 by Koldov
Koldov Posted January 23, 2015 Posted January 23, 2015 Can't get this to work! Anyone got any ideas why? Permissions? .bat scripts disabled?
Muz Posted January 23, 2015 Posted January 23, 2015 Hi All, Yesterday I had the embarrassing situation where just before assembly our hall pc decided to launch Startup Repair... Cue me standing there for 10 minutes like an idiot while Windows did it's thing up on the big projector screen with the whole school sitting in front of me! So I have done a quick search and ended up here. Just checking... This text (saved as a .bat): if exist c:\windows\suroff.txt goto end bcdedit /set {default} recoveryenabled No bcdedit /set {default} bootstatuspolicy ignoreallfailures copy \\server\netlogon\scripts\suroff.txt c:\windows\suroff.txt :end Placed in Sysvol and called from the Default Domain Policy GPO > Computer Configuration > Policies > Windows Settings > Scripts (Startup/Shutdown) > Startup With a blank 'suroff.txt' in \\server\netlogon\scripts\ to be copied down to C:\ Is there no GPP to do this? Kol. - - - Updated - - - Yes there is a way to replace / create files through group policy. Computer Configuration > User Configuration > Preferences > Windows Setting > (Files)
Arthur Posted January 24, 2015 Posted January 24, 2015 (edited) Anyone got any ideas why? The quotes are missing around {default}. i.e. bcdedit /set '{default}' recoveryenabled No Can't get this to work! You may want to give this a try instead... www.edugeek.net/forums/security/143729-interesting-hack-today-2.html#post1270039 Edited January 24, 2015 by Arthur
CommodoreS Posted January 25, 2015 Author Posted January 25, 2015 Please can someone confirm whether or not this does need quotes as every thread and post has listed the command without quotes... Even in the link you posted: http://www.edugeek.net/forums/security/143729-interesting-hack-today-3.html#post1239167 The BAT file solution does not mention quotes, and only the PowerShell startup script shows the quotes. Typing the command manually also does not need quotes. I could be wrong, but my guess it could be something to do with: Computer Config>Admin Templates>System>Scripts> Run startup scripts asynchronously From memory, I had problems with Office and .NET Framework 4 installing pre-logon until I had enabled this policy.
CommodoreS Posted January 25, 2015 Author Posted January 25, 2015 Yes there is a way to replace / create files through group policy. Computer Configuration > User Configuration > Preferences > Windows Setting > (Files) I think the OP meant a way for GPP to apply these two commands to fix the problem, rather than the part of the script which creates a blank file to skip running the script once it has been run once. If that is the case, then like most things Microsoft - No there is no GPP to apply those two commands to stop this happening.
Arthur Posted January 25, 2015 Posted January 25, 2015 (edited) Please can someone confirm whether or not this does need quotes as every thread and post has listed the command without quotes... I did a bit more testing. If you are running the bcdedit command via the Command Prompt (or a batch file) you don't need any quotes, whereas if you run the command via PowerShell, PowerShell ISE or a .ps1 script you do need single quotes around {default}. Ignore what I said in post #11. I was thinking of PowerShell at the time. Edited January 25, 2015 by Arthur
burgemaster Posted January 25, 2015 Posted January 25, 2015 Please can someone confirm whether or not this does need quotes as every thread and post has listed the command without quotes... Even in the link you posted: http://www.edugeek.net/forums/security/143729-interesting-hack-today-3.html#post1239167 I could be wrong, but my guess it could be something to do with: Computer Config>Admin Templates>System>Scripts> Run startup scripts asynchronously From memory, I had problems with Office and .NET Framework 4 installing pre-logon until I had enabled this policy.That rings a bell, but I think this is needed only for Terminal services 2012 to stop the new 60sec delay before applying logon scripts??
Koldov Posted January 27, 2015 Posted January 27, 2015 Yeah I remembered seeing this: • Beginning in Windows Vista, startup scripts are run asynchronously, by default. This is a different behavior from earlier operating systems. Source: https://technet.microsoft.com/en-us/library/cc770556.aspx I've checked in the location mentioned, but everything there is 'Not Configured' seems strange to have a 'default' behaviour and then have a GP to enable it... Anyway, I am still not getting this to work! Even on my test server!! The script will run and copy the file over when run as an administrator from the desktop, it says in RSOP that it is seeing the GPO and the startup script... It gives me 'access denied' as a normal user (however the SYSTEM account should circumvent this) the only thing that concerns me is when looking at the GPO where it says show files, nothing comes up, but I'm not sure if this matters or not? Kol.
CommodoreS Posted January 27, 2015 Author Posted January 27, 2015 the only thing that concerns me is when looking at the GPO where it says show files, nothing comes up, but I'm not sure if this matters or not? Should not matter if you have included the \\server\netlogon\file.bat in the script name. You could also add the files to show files then click on browse to select the BAT file. Its just a second way of doing it - I think most people link to the scripts in Netlogon rather then adding it to the GPO, but it might be worth trying this if something to do with the Netlogon share is giving the Access Denied error.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now