Domain Users - CMD window at login

[robyholmes]

Hi All,

 

I'm support a school which has an odd problem I can't get to the bottom of. Both staff and students get a CMD window appear once they've logged on. It states command prompt is disabled so they can't do anything with it but I can't trace where its coming from.

 

They don't run any scripts (Or at least group policy doesn't show any and neither does rsop.msc) and I can't see anything in the start up on the machines. Admin account don't display it but that might be because its already run by the time the desktop is shown. It also doesn't happen every time, it seems random.

 

I'm looking for tips on tracing where this can be coming from? Is there anyway to trace the program which opened the window? Task Manager just shows it as a cmd window?

 

Thank you, Rob

[MatthewL]

Check task scheduler on the PC but also the profile tab on the user, is there any login scripts set there and if you have copied and pasted users it could have transferred from one to the other.

[Arthur]

Is there anyway to trace the program which opened the window?

You may be able to identify what is causing the cmd window to open with Autoruns.

[robyholmes]

Check task scheduler on the PC but also the profile tab on the user, is there any login scripts set there and if you have copied and pasted users it could have transferred from one to the other.

User accounts are clear of login scripts, I did check that.

[BOOT]

If you're using local profiles, check the registry:

HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components

[round2it]

Sounds like a script running

 

Is it a fresh vanilla install of Windows as it might be some pre installed junk from the manufacturer.

 

Could try enable command prompt and see what it is trying to do.

[robyholmes]

Sounds like a script running

 

Is it a fresh vanilla install of Windows as it might be some pre installed junk from the manufacturer.

 

Could try enable command prompt and see what it is trying to do.

 

Its happening on new installs and old. I don't think its any locally installed software as it happens on a number of machines but not all the time. I did think about enabling it but then I think it runs on admin but during login so you don't see it.

[E_G_R2]

Check your Group Policies in case there is a script running through one of them?

 

Does it run every time (I don't think so) or just a first login when the profile is created?

Edited September 12, 2019 by E_G_R2

[robyholmes]

Check your Group Policies in case there is a script running through one of them?

 

Can't find anything and RSOP doesn't show any. There was some in the SYSVOL folder which I've moved to make sure they couldn't be run.

[BOOT]

Is it popping up before the taskbar?

[Arthur]

Did you find anything with Autoruns? Could it be caused by some software that is only installed on specific PCs?

[howartp]

We have the same.

 

I’ve not checked for scripts but I don’t recall setting any as I know they can’t run!

[Steve21]

Are you running o365 on the machines (rather than Office 2016/19 etc)? We got them when testing it out after everytime it runs an upgrade, and it seems to continue until effectively an admin account logs on so it actually completes the tasks it was after (Seems to be like a re-register/one drive install etc)

 

Steve

[robyholmes]

No Office 365.

 

Ive not managed to run autoruns yet as I'm only onsite for a few hours a week. If also not seen it happen when onsite this week. I'll update what I find, if I find it again!

[FragglePete]

Have you got an older version of the OneDrive client on the PCs? I had this a while back and noticed the version bundled with that particular version of Windows initiated a few cmd prompts when our staff logged in as I wanted to start put OneDrive into play. The earlier version was doing a few icalcs commands to set permissions. Originally I had just knobbled the client through a registry tweak not to run, but when enabled I noticed this behaviour. The newer client does not do this and we've now got that rolled out across the domain for this year (Sync on Demand).

 

Hope it helps?

 

Pete