Where to put Logon Scripts$

[TechSupp]

Whats the difference between the computer config section of AD and the user config section when I come to look at adding logon scripts. Mine are in the user config but wondering what the difference was if they were in the computer config section.

[srochford]

The scripts under the computer config section are computer startup scripts - they're run by the computer as it starts up; the user ones run as the user when they logon.

[TechSupp]

The scripts under the computer config section are computer startup scripts - they're run by the computer as it starts up; the user ones run as the user when they logon.

 

Does that have any effect on the permissions used by the script? i.e. one at computer start runs as an administrator whereas one run a windows logon relies on what users have admin rights? Reason is I was trying to run a program that required admin rights and just wondered if I put it in the computer config section it would get around that problem. Have sorted problem now but just wondered for future info.

[srochford]

Yes - the startup script is running (effectively) as local admin. You can use startup scripts to do things like install software, add drivers, copy files into locations a normal user can't write to etc.

 

What you can't do is make changes to a user's settings (because no user is logged on) - you can't set the user wallpaper, for example (but you can change the default wallpaper shown at logon)

[TechSupp]

Sorry to resurect this thread, just realised had not checked it for replies! Anyway, so if I want a program to install at startup (as a local admin) then I need to put it in Computer Config rather than User Config?

If you see me at BETT you have the right to slap me for asking inane questions :-)

[john]

Yup II always deploy software to the PC using that way

[TechSupp]

Leading on from that, my MSI installs I have are set up in the user settings section of the policy (as per original instructions I was given when setting them up), should I have set them up in the Computer Settings secton so that if any needed admin privilage thay would have had them?

[browolf]

usually you have software in the computer policy. that applies before logon so software inherently has local admin rights.

 

group policy *is* highly confusing.

if you look at it from ad structure first.

you have OUs that either contain computers or user objects

when you attach a policy to the ou.

if its a computer OU, only do computer settings in the policy

if its a user OU only do user settings in the policy

 

the fact that there's only 1 type of policy and it's down to you to make sure its computer settings applied to computer OUs or user settings applied to user OUs makes it more confusing than it ought to be.

 

there's 1 alternative to this picture

 

there's a computer policy option called loopback,

computer config, admin templates, system/group policy, user group policy loopback proccessing mode

set to enabled, mode=merge

 

allows you to apply user settings to computer OUs!

[TechSupp]

Right, looks like Ineed to tidy that up a bit them and move the msi installs to the computer settings, has worked 'mainly' so far for the small amount of msi's we have but I have tried some and they failed and that I think explains why! We already have loopback enabled as I remember that being an issue when the original installers set it up and were trying to get a global desktop working (it was not set).