Any ideas?

[E_G_R2]

OK I have a very annoying problem that I can't get to the bottom of.

 

Server 2008R2 Domain

Windows 7 Workstations

 

On some PC's but not all when a pupil logs in they fail to map their network drives and I get the following error in the attached document. Checking System Log shows the other errors.

 

If I map the drives manually in Explorer they work!

 

The user can log onto another PC and dodsn't get the error.

 

I've re imaged a PC and it still happens.

 

I've refreshed the DHCP and DNS on the machine and it still happens.

 

Give the pupil as staff logon script (as a test) it dosn't happen which makes me think logon script except it will work on a different PC.

 

Must be missing somethin obvious?

error.docx

[eyetea]

Take a PC that does work and a PC that doesn't work - are they in the same OU with the same GPOs being applied?

[Norphy]

That's not the script that's failing, it's the script host, i.e. the executable that runs the script.

 

Do you have any software restriction or Applocker policies in place which could be blocking it? Are scripts disabled by a Group Policy?

 

Could you move away from logon scripts and go to Group Policy Preferences for what they do? That's the sanctioned method these days and works very well.

[E_G_R2]

Take a PC that does work and a PC that doesn't work - are they in the same OU with the same GPOs being applied?

 

No they can be in different OU and the login will work on one pc in the ou but not another.

[E_G_R2]

That's not the script that's failing, it's the script host, i.e. the executable that runs the script.

 

Do you have any software restriction or Applocker policies in place which could be blocking it? Are scripts disabled by a Group Policy?

 

Could you move away from logon scripts and go to Group Policy Preferences for what they do? That's the sanctioned method these days and works very well.

 

I've tried it in an OU without any software restrictions and it still happens on the PC.

 

Any way of testing the host executable?

 

Re immage PC and it still happens.

[Norphy]

Assuming it's a VBScript, it'll either be c:\windows\system32\wscript.exe or (more likely) C:\windows\system32\cscript.exe

 

You could try running those and see what happens.

 

This really does sound like a group policy. Just because you move a PC out of an OU doesn't immediately mean that the policies that were applied to it disappear. Can you build a PC outside of the OU structure?

[E_G_R2]

Assuming it's a VBScript, it'll either be c:\windows\system32\wscript.exe or (more likely) C:\windows\system32\cscript.exe

 

You could try running those and see what happens.

 

This really does sound like a group policy. Just because you move a PC out of an OU doesn't immediately mean that the policies that were applied to it disappear. Can you build a PC outside of the OU structure?

 

I was just thinking that, put a new build in an OU without any GP's applied to it. Also wondering about AV as a possible cause.

 

What gets me is that on the same PC someone else (i.e staff memebr) can log on and it dosn't happen, only happening for the pupils which made me think about the login (vbs) script.

Edited June 15, 2016 by E_G_R2

[EvLPhenom]

I was just thinking that, put a new build in an OU without any GP's applied to it. Also wondering about AV as a possible cause.

 

What gets me is that on the same PC someone else (i.e staff memebr) can log on and it dosn't happen, only happening for the pupils which made me think about the login (vbs) script.

 

I would think that it is something being blocked by policy. One that has more restrictions on...student and less...staff member. Staff aren't affected because they have more access.

 

I would do as suggested above, new build outside of any OU that has policies applying to it and then slowly introduce until you find the offending policy. Slow and tedious but the only way that your likely to find it.

[E_G_R2]

Fixed!!!!

 

Thanks for your hints, I'd got so wrapped up in the problem the answer was easy.

 

Group policy applied to students object didn't have the correct entry for the DC (2008) so it was trying to apply from the other DC (2003) which didn't have the Windows 7 templates so the folder re direction was not applying if that makes sense.

 

Oh well only 4 weeks till the end of term and I then get shut of the remaining 2003 server.