logoff script not running

[clareq]

I have a vbs script running at log-off that removes any printers. This works well on Windows 7. Testing on Windows 10 the script fails to run, with the message in event log that it is blocked by Group Policy. The software restriction policy for both OS is almost the same - with the exception of a couple of rules blocking some Win10 apps. It definitely allows scripts to run from \\%userdnsdomain%\sysvol

 

Any idea what I'm missing?

[Safa]

Have you tried this yet?

 

so with windows 10 there is a problem like windows 8.1, I had the same issue but with mapped drives.

what you need to do is this as most likely not all of your GPO's are not going through.

 

on the machine itself you need to:

 

1 - launch gpedit.msc

2 - Local Computer Policy --> Computer Configuration --> Administrative Templates --> Network --> Network Provider --> Hardened UNC Paths

 

 

copy this image and then here are the things you need to paste in:

 

\\*\NETLOGON

 

 

\\*\SYSVOL

 

 

RequireMutualAuthentication=0, RequireIntegrity=0

 

 

Save the information and then restart the PC

 

let me know if anything has changed and everything will hopefully redirect correctly

[clareq]

No joy I'm afraid.

[DJ-1701]

I had something weird like that happen. In end I changed the script from running from \\SCH.internal\Netlogon to \\SCH\Netlogon and added that to the allowed paths... don't ask me why but it just seemed to work for me after that.

[clareq]

Is there any way, other than removing all GPOs and adding them back in one at a time, that I can find out which GPO is blocking the script from running?

[Safa]

Im assuming you have tried

 

gpresult /h C:\errorGPO.html

 

in cmd to check what else could be getting blocked

[clareq]

yes, tried that - it tells me the GPO containing the script is running, it's the script itself that's apparently blocked by Group Policy. Its only the *.vbs scripts that are blocked - the *.cmd scripts I have run with no problem.

[DJ-1701]

Unfortunately I think the only way is one by one testing. Have you got a screenshot of the file types you have blocked and the paths you have got blocked? One of us might be able to help track a possible conflict down for you.