Logoff Windows to Bootpicker

[stu1892]

We have bootcamped our new iMacs.

Now we need to have XP restarting when the user selects logoff.

 

I have followed the following directions

Configuring Windows to reboot on logout

 

Fundamental to the utility of BootPicker is getting a machine to always return to the BootPicker screen when a user is finished using Mac OS X or Windows. Many labs maintain a policy that users must log off of the computer before leaving to protect their data and identity. By enforcing this type of policy, lab managers can leverage this opportunity to reboot Windows to Mac OS X.

 

To reboot Windows at log off time, do the following:

 

1. Create a plain text file named "logoff-restart.cmd" with the contents "shutdown -r -f -t 0". Save it to the Desktop (for now).

2. Choose "Run" from the Start menu, type "gpedit.msc" and hit return.

3. Navigate to User Configuration > Windows Settings > Scripts

4. Double-click on the "Logoff" item in the pane on the right.

5. Click the "Add..." button, then click the "Browse" button.

6. Drag the logoff-restart.cmd file into the Browse window. That should copy the file to C:\WINDOWS\system32\Group Policy\User\Scripts\Logoff.

7. Select the logoff-restart file in the browse window and click "Open". Click "OK" to dismiss the "Add a script" window.

8. Click "Apply", then click "OK". Log off to test that the script applied.

 

 

The script works fine if i run it manually. However, when i log a user off it just flashes up 'Running logoff scripts' and doesn't reboot, it just logs off as usual.

 

Any ideas? I've also gave "Force shutdown from a remote system" access to 'INTERACTIVE' as suggested in another forum.

 

So, the script works fine, the local GPO doesn't want to run it despite it apparantly trying...

[Michael]

Why not remove the logoff option altogther using GPOs?

[stu1892]

Why not remove the logoff option altogther using GPOs?

 

 

And then only leave a restart button?

 

It's a possible solution, especially if you can just leave the restart button there.

[Michael]

Well thinking about it, you can remove both Logoff and Shutdown from the Start Menu using GPOs.

 

Logon to XP, right click the desktop and choose New > Shortcut

 

Enter this path: C:\WINDOWS\system32\shutdown.exe

 

Click Next > and the name the shortcut Restart then click Finish

 

Right click the shortcut and choose Properties

 

The target will read: C:\WINDOWS\system32\shutdown.exe

 

Update it so it reads: C:\WINDOWS\system32\shutdown.exe -r -t 01

 

If you like, you can also give it a nicer icon, by clicking Change Icon. Now if you double click this shortcut, Windows will automatically restart for you. Hope this helps.

[FN-GM]

You can remove the logoff option using group policy but then you will need shutdown and on that menu is a logoff option.

 

What you could do is remove logoff and shutdown and place this VBS script in netlogon and place a shortcut in the start menu. Just a note if you are in the staff group it will log you off instead.

 

On error resume next

 

Dim objNetwork '[Object] WScript.Network object

Dim check, sComputer, strlogoffuser, objUser

 

Set objNetwork = CreateObject("Wscript.Network")

sComputer = objNetwork.computername

 

Set OpSysSet = GetObject("winmgmts:{(Shutdown)}//" & sComputer & "/root/cimv2").ExecQuery("select * from Win32_OperatingSystem"_

& " where Primary=true")

 

':::::::::::::::::::::::::::::::::::::::::::::::

'::: Use LDAP to find out account details :::

':::::::::::::::::::::::::::::::::::::::::::::::

Set objSystemInfo = CreateObject ("AdSystemInfo")

Err.Clear

Set objUser = GetObject ("LDAP://" & objSystemInfo.UserName)

If Err.Number <> 0 Then

MsgBox Err.Number & vbTab & Err.Description

End If

 

'::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

':: DO A USER OR COMPUTER NAME CHECK TO DETERMINE LOGOFF STATE ::

'::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

 

strlogoffuser = "CN=Staff"

If IsMember (strlogoffuser) Then call logoffonly

strlogoffuser = "CN=AdminDriveSet"

If IsMember (strlogoffuser) Then call logoffonly

 

check = UCASE(sComputer)

if check ="HC-EREG-ROOMA2" then call logoffonly

if check ="HC-NETMANLAP" then call logoffonly

 

':::::::::::::::::::::

':: Reboot Computer ::

':::::::::::::::::::::

'Call WMI query to collect parameters for reboot action

Const EWX_LOGOFF = 0

Const EWX_SHUTDOWN = 1

Const EWX_REBOOT = 2

Const EWX_FORCE = 4

Const EWX_POWEROFF = 8

 

For each OpSys in OpSysSet

opSys.win32shutdown EWX_REBOOT + EWX_FORCE

Next

 

Wscript.Quit

 

'::::::::::::::::::::

'::: Log off Only :::

'::::::::::::::::::::

sub logoffonly

'Call WMI query to collect parameters for reboot action

Const EWX_LOGOFF = 0

Const EWX_SHUTDOWN = 1

Const EWX_REBOOT = 2

Const EWX_FORCE = 4

Const EWX_POWEROFF = 8

 

For each OpSys in OpSysSet

opSys.win32shutdown EWX_LOGOFF + EWX_FORCE

Next

 

Wscript.Quit

end sub

 

':::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

'::: CHECK WHETHER USER IS A MEMBER OF A CERTAIN GROUP :::

':::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

Function IsMember (strGroup)

 

Dim objGroup

IsMember = FALSE

For Each objGroup In objUser.Groups

strThisGroup = Replace (objGroup.Name, "CN=\", "")

If strThisGroup = strGroup Then

 

IsMember = TRUE

Exit For

End If

Next

End Function

[srochford]

Could it be that because this machine is a member of the domain (is it??) that the domain policies are kicking out the local machine policies?

 

Not sure if there's anything about XP running on a Mac which you can pick up in a script (but you could name them things like MAC01 etc or set an environment variable) but if you can identify it then you could just add something to your standard logoff script which checks to see if the machine is a Mac and, if so, runs the shutdown command you already have.

[stu1892]

Thanks all, i'll look into each of the solutions above.

 

@srochford

They are part of the domain, yes. I've searched for GPOs that might be running and are stopping this script, however, the machine is in a new OU and only has a domain policy which doesn't have anything running and the users that i'm testing with don't seem to have anything that would stop, either.

 

We don't use logoff scripts, unless the previous technician has them hidden away somewhere, somehow (which wouldn't be the first time!).