Jump to content

Group Policy scripts not running

Sheridan

By Sheridan
in Windows 10

 Share

Recommended Posts

Sheridan

Sheridan

Posted
Posted (edited)

On our W10 machines we have a handful of .bat and some .vbs scripts for startup/shutdown and login/logoff. However we've just noticed none of thes are working. As usual they work fine on the Win7 machines!

 

The errors being logged are either:

 

The system cannot find the file specified

 

or (more commonly)

 

This program is blocked by group policy. For more information, contact your system administrator

 

Neither of which is actually true. The PCs can resolve the paths in the first instance, and we're not blocking anything with group policy. We do use Applocker but that isn't logging anything as blocked.

 

I'm rather worried now that W10 is making a right balls up of applying GPOs, as the deeper I look the more issues I seem to find!

 

Is anyone else running scripts in GPO's with W10? I'm not sure why it thinks .bat .vbs are blocked by GP when I haven't actually got a policy that does that.

 

Looks like I might have bigger problems, each one is also logging this on boot:

 

This computer was not able to set up a secure session with a domain controller in domain due to the following:

There are currently no logon servers available to service the logon request.

 

Everyone can still login though, and they're all 1Gb connections so I'm not sure why they can't pull down policies or scripts.

Edited by Sheridan
mrwoberts

mrwoberts

Posted
Posted (edited)

Might not be related at all, but I had similar problems when I tried running a script during GPO - said it couldn't find the file specified, even though when I typed the exact same 'launch command' from post-login it worked without issues. For me, it came down to who was really running the script when it was being launched, as I was referring to a drive letter, rather than a full UNC path. School boy error! Detention for me.

 

Edit: If it helps, you could try running your script as the SYSTEM user, just to see if it is an access/permission problem...

Edited by mrwoberts
Sheridan

Sheridan

Posted
  • Author
Posted

The scripts run ok when run manually - and the paths are always unc\shares. I know the paths are correct as they are working on 100's of W7 machines and haven't been changed.

 

It seems to be a pattern of Netlogon not seeing a domain controller, then not applying GPOs, then the GPOs logging the error that the script path wasn't found.

 

I.e First error:

This computer was not able to set up a secure session with a domain controller in domain due to the following:

There are currently no logon servers available to service the logon request.

 

Then:

 

The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy has successfully processed. If you do not see a success message for several hours, then contact your administrator.

 

Followed by an error for each GPO that has a startup script:

 

Startup script failed.The system cannot find the file specified

 

Which in itself is contradictory - if it can't see a DC and can't apply GPOs, then how it is finding the GPOs with scripts to 'not find' the paths! Stupid W10

mrwoberts

mrwoberts

Posted
Posted
Do these machines have SSDs ? as I keep seeing a trend of posts whereby things are run too quickly and possibly bypassed as a result of the OS wanting to get to the login/desktop...
timbo343

timbo343

Posted
Posted
On our W10 machines we have a handful of .bat and some .vbs scripts for startup/shutdown and login/logoff. However we've just noticed none of thes are working. As usual they work fine on the Win7 machines!

 

The errors being logged are either:

 

 

 

or (more commonly)

 

 

 

Neither of which is actually true. The PCs can resolve the paths in the first instance, and we're not blocking anything with group policy. We do use Applocker but that isn't logging anything as blocked.

 

I'm rather worried now that W10 is making a right balls up of applying GPOs, as the deeper I look the more issues I seem to find!

 

Is anyone else running scripts in GPO's with W10? I'm not sure why it thinks .bat .vbs are blocked by GP when I haven't actually got a policy that does that.

 

Looks like I might have bigger problems, each one is also logging this on boot:

 

 

 

Everyone can still login though, and they're all 1Gb connections so I'm not sure why they can't pull down policies or scripts.

 

 

Someone else who has the issues im having with random machines on Windows 10 and i'm talking about the NETLOGON issues with the error This computer was not able to set up a secure session with a domain controller in domain due to the following:

There are currently no logon servers available to service the logon request.

 

and This computer was not able to set up a secure session with a domain controller in domain due to the following:

There are currently no logon servers available to service the logon request.

 

I've tried setting in group policy under Computer Config \ admin templates\ System \ Group Policy

* Specify Start up policy processing wait time = 60 seconds

* Specify workplace connectivity wait time for policy = 60 seconds

 

I read that sometimes the NETLOGON error that we are seeing is due to NETLOGON running before the NIC drivers have fired up. I've thought about setting the NETLOGON service to Automatic delayed.

 

Most of our machines in our IT Rooms all have full fat spinning Hard Drives.

 

We are also seeing some users who come to us to get a password, when they go back and login and reset their password, they get a message "password cannot be changed at this time." even though we know the password as been reset. Restarting the machine is only way to get the new password to work on that machine.

  • Thanks 2
mrwoberts

mrwoberts

Posted
Posted

I like the idea of the auto-delayed service startup. I've actually done that for a handful of other services that I know can handle that kind of change and it certainly does speed things up just a little.

Thanks gents

timbo343

timbo343

Posted
Posted

Another thought... what's your domain function level? Mines 2008R2 at the moment as i've still got a couple of 2008R2 DCs. Also, 3 of my DCs are virtual with the minimum resources possible. I wonder if this is causing an issue too.

 

Changing NETLOGON to Delayed can be done via the registry...

 

Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Netlogon and locate Start registry key

 

Change Startup type :

 

Automatic - 2

Manual - 3

Disabled - 4

Automatic (Delayed Start) - 2

 

Note: When you change to Automatic (Delayed Start) a new key DelayedAutostart is created with value 1.

When you change to Automatic from Automatic (Delayed Start), DelayedAutostart change value to 0.

  • Thanks 2
Sheridan

Sheridan

Posted
  • Author
Posted

Yes, all of these PCs are running SSDs - some are very new, some are old upgraded PCs.

 

Using scheduled tasks might address some issues, but we run a script to delete old profiles on boot - we would have to schedule this out of hours.

 

Saying startup scripts are dead seems to be MS's way of saying 'we can't get W10 to work on a domain properly' :rolleyes:

 

We're at 2008 R2 functional level, probably will move up this summer but I can't see that fixing anything. It does seem likely that the PC is booted up before the NIC is fully ready so delaying the netlogon service is worth a try. This is very frustrating as I would have assumed that W10 could cope with SSD and GB NICs! Obviously designed for the home market to show a 'fast boot' when really half the services aren't ready.

 

We've also had the password issue - if you create a new user and set their passwords to be changed on first logon, it doesn't work on any W10 machines as it says their password is invalid -they have to use a W7 machine for their first login!

timbo343

timbo343

Posted
Posted (edited)
Permissions.... Have you granted Domain Computers read access to the GPO? (a Windows Update a few months ago caused havoc with this for us)

I dont suppose you know the update do you?

 

We've only got authenicated users listed in the security filtering.

 

EDIT: Would it be this one? https://blogs.technet.microsoft.com/askds/2016/06/22/deploying-group-policy-security-update-ms16-072-kb3163622/

 

Look at my Group Policy everything is ok and here are a few articles

 

http://windowsitpro.com/patch-tuesday/update-kb3163622-breaks-group-policy-it-s-not-me-it-s-you

 

http://rickardnobel.se/ms16-072-breaks-group-policy/

Edited by timbo343
timbo343

timbo343

Posted
Posted (edited)

Looked on the thread that @kearton referenced and mine looks good. Authenticated users are on each and every policy.

 

EDIT.. also running thepowershell script says everything is good

Edited by timbo343
GuyJD

GuyJD

Posted
Posted (edited)

Have you got Hardened UNC paths set and Slow link detection enabled?

 

I think the problem is that Windows 10 tries to be so quick to boot that it's trying to do things before the hardware is fully initialised and so it fails to do a lot of things on boot especially if you are connecting over wifi, not so much of a problem with normal GPO's that can run after the machine is logged on but scripts have to be run on boot.

 

there is also a GPO to wait for network on boot that should slow things down so it all runs correctly.

 

I've got several scrips that run on my Win 10 machines to install things that can't be installed via GP Software distribution.

Edited by GuyJD
Sheridan

Sheridan

Posted
  • Author
Posted

We've got hardened paths set to the RequireMutualAuthentication=0 and RequireIntegrity=0 for SYSVOL and NETLOGON. Slow link detection is disabled on our network.

 

I ran the script to check our GPOs and that didn't find anything to report.

 

Its odd, in a room of 10, 3 will regularly generate these errors, however the others will be fine for days then generate them.

 

One thing I have noticed is that if you reboot on of these machines, whilst running a ping test, the PC will be at the login screen for a good while (30 seconds at least) until the ping actually starts to reply! And the IP address hasn't changed as the DHCP lease is still at 1 day. So it does suggest the PC has booted up but isn't network ready. So much of this points to the poor support of W10 on a domain.

mrwoberts

mrwoberts

Posted
Posted

IIRC I have set these services to automatic - they were manual...

 

REM Netman (Network Connections)
sc config Netman start= auto

REM Network List Service
sc config netprofm start= auto

  • Thanks 2
psydii

psydii

Posted
Posted
We've got hardened paths set to the RequireMutualAuthentication=0 and RequireIntegrity=0 for SYSVOL and NETLOGON. Slow link detection is disabled on our network.

 

I ran the script to check our GPOs and that didn't find anything to report.

 

Its odd, in a room of 10, 3 will regularly generate these errors, however the others will be fine for days then generate them.

 

One thing I have noticed is that if you reboot on of these machines, whilst running a ping test, the PC will be at the login screen for a good while (30 seconds at least) until the ping actually starts to reply! And the IP address hasn't changed as the DHCP lease is still at 1 day. So it does suggest the PC has booted up but isn't network ready. So much of this points to the poor support of W10 on a domain.

 

That has got to be worth 200gbp for a call to Microsoft. It has to be a bug.

 

(Though have you tried a different model of switch, say a simple one without spanning tree / vlan support? It might be a driver/nic/switch interaction issue.)

timbo343

timbo343

Posted
Posted
IIRC I have set these services to automatic - they were manual...

 

REM Netman (Network Connections)
sc config Netman start= auto

REM Network List Service
sc config netprofm start= auto

 

I've just set this in our Services GPO to see what happens.

 

MS need a rep on here to see how bad Win10 is on a domain.

Sheridan

Sheridan

Posted
  • Author
Posted
That has got to be worth 200gbp for a call to Microsoft. It has to be a bug.

 

(Though have you tried a different model of switch, say a simple one without spanning tree / vlan support? It might be a driver/nic/switch interaction issue.)

 

We have actually moved one of them onto another switch and it made no difference. With this being SSD based PCs I reckon W10 is just all about show - i.e look like its booted in seconds when in reality its not ready.

 

Again, W10 seems to be home use ready but not domain use ready. I'd rather a 2 minute boot time and the PC be ready, than a 10 second boot that isn't loading scripts etc.

mrwoberts

mrwoberts

Posted
Posted
look like its booted in seconds when in reality its not ready.

... I'd rather a 2 minute boot time and the PC be ready, than a 10 second boot that isn't loading scripts etc.

 

That's actually a good point, and I'm now wondering whether to leave 'Fast boot' disabled. This kind of defeats the purpose of a supposedly positive feature of W10, but as you say, I'd rather a working setup than constantly making allowances for its shortcomings.

 

That said, disabling fast boot may not solve problems like this, and it seems to be fairly random, but I'm due to rollout this Summer so I'd like to see solutions to these problems asap...

 

I did wonder whether to disable fast boot purley on the grounds of being able to access the partition externally - if I ever needed to. Apparently the system partition isn't readily accessible offline with fast boot enabled.

Sheridan

Sheridan

Posted
  • Author
Posted
We have the issue across 5 different IT rooms with different switches, different machines. Its a bit lile roulette but for users.

 

We're not that far ahead with our W10 rollout so its only in 2 areas at the moment, I aborted our W10 rollout months ago when I realised the core aspects were unreliable (start menu, printers gpo's applying, IE working, admx templates incomplete for Edge, applocker very flakey etc etc the list goes on)

 

It seems like MS have given up trying with W10 as far as the workplace operating system.

  • Thanks 1
psydii

psydii

Posted
Posted

 

It seems like MS have given up trying with W10 as far as the workplace operating system.

 

The messaging I am seeing is that they've basically given up on the set of technologies that were once back in 1998 branded as "IntelliMirror". Enterprise can stick happily with Windows 7 and Group Policy until such time as cloud management and services can offer capabilities that meet business requirements.

 

Don't forget that many of us are trying to make the new stuff do things the old way, whereas in reality we need to step back, learn about the cloud management and storage and figure out how to make that work for our organisations. If we try to re-implement the old way using the new tools we are fighting against the tech and we will find it will never work. Nobody is trying to make Andriod or IOS or Chromebooks work like a Unix networked workstation, and they work (within their context) very well. We need to stop trying to make Windows 10 behave like Windows 2000/XP, and figure out the new right way of doing things that will work for the next 10-15 years.

 

https://books.google.co.uk/books?id=vTsEAAAAMBAJ&pg=PA14&lpg=PA14&dq=Intellimirror+1998&source=bl&ots=XUS2od4UVt&sig=wP-gNosFWp512AyKcjfqFTSes9U&hl=en&sa=X&ved=0ahUKEwj1soOard3RAhVkC8AKHSkWB1AQ6AEILTAD#v=onepage&q=Intellimirror%201998&f=false

 

https://news.microsoft.com/1998/08/18/microsoft-delivers-windows-nt-5-0-beta-2-to-more-than-250000-testers/#sm.001ga051w17ones4u1s145vtwgg5m

 

https://technet.microsoft.com/en-us/library/hh848267(v=ws.11).aspx

 

https://technet.microsoft.com/en-gb/itpro/windows/manage/index

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing


×
×
  • Create New...