Group Policy logon scripts blocked by "Run only specified Windows applications"

[DHCoops]

Hi, Apologies if I've missed this being discussed elsewhere.

 

The group policy "Run only specified Windows applications" (in use here for a specific user account to create a heavily locked down exam account) appears to be preventing user logon scrips from running. Please can anyone help tell me what applications need to be allowed to let the logon scripts run successfully?

 

I have confirmed that when the "Run only specified Windows applications" policy is disabled the scripts (some .cmd and some .bat) run correctly. I've also confirmed that the following exe's are allowed by the policy;

 

cmd.exe

powershell.exe

powershell_ise.exe

gpscript.exe

 

Thanks in advance for all/any suggestions.

[Oaktech]

What do you need the account to do that is being done by script? could it be done another way such as by GPO registry or GPP?

[DHCoops]

Hi Oaktech, Thanks for the reply. The two key scrips are both to do with printing. One to call the PaperCut Client and the other to run a delayed GPUpdate after the login completes which we use to get the printers to update to make sure the right ones are available from the PC even if the user has roamed location. This setup is in place for all other users and works well so I'm not keen to change it unless absolutely necessary.

[strawberry]

have you set the papercut client and update as a specified windows app?

[DHCoops]

I have pc-client.exe and pc-client-local-cache.exe, but I'm not aware of an update.exe to add?