Login script, intermittently not running

[smurfomatic]

We have a peculiar issue (aren't they all?) with the login script not running sometimes. It's stored in \\server\netlogon and the users all have it in their AD profiles. However, if a class of 20 children log in, about a third will not run the script (which then means they have no access to network drives or printers). It's definitely not specific to certain users or computers, as for the junior end of school we have one login for the whole year, and the same issue will occur on seemingly random machines in the IT suite. Same issues apply to laptops as well.

 

What I've tried (group policy refresh is set to 60 minutes so should have filtered through by now...):

 

Permissions - folder is set to give everyone access

 

Group policy - Scripts set to run on slow link detection

 

Domain Security Policy - allowed "everyone" permissions to anonymous login, set NETLOGON to be one of the shares that allows anonymous login

 

A few other things that don't come to mind

 

This is getting frustrating as I can't find any reason why child A will login fine, but child B on an identical machine, account etc. logs in next to them and has a problem!

[smurfomatic]

Still hoping someone out there can (a) decipher wht I've written and (b) offer a solution - it's driving me nuts having to manually install printers for half of a class!

[Steve21]

Group policy - Scripts set to run on slow link detection

 

Whats your "connection speed" and "Scripts policy processing" set to?

 

Steve

[smurfomatic]

Steve - "connection speed" is 0 (so all connections are now "fast") and "script policy processing" is enabled with the slow network connection option ticked. As I understand things, that means the script runs whatever happens. But they don't!

[sukh]

Hi

 

Please descirble your setup.

Clients OS and SP level

Server OS and SP1

Domain Fun

 

Sukh

[smurfomatic]

Sukh - Clients are Win XP SP2/3

 

Server is Win 2003 Server R2 SP2

 

Domain fun? I don't understand, sorry.

[sukh]

Hi

 

Domain functionality.

 

Can you reproduce the issue?

Do you get any errors in the Windows Event Logs when login script fails?

Is the login script a bat/vbs file? What is the script compiled with? Dos? VB?

 

Sukh

[smurfomatic]

Sorry - it's Win 2000 mixed.

 

The issue reproduces itself at random - identical computers will have the problem one day, but not the next. Different users will login and have the problem (or not) on the same PC.

 

No errors in the logs when it fails.

 

It's a BAT file pointing to a KIX32 file, no VBS involved. Here's a sample:

 

IF INGROUP("Printer_SchoolOffice")

USE H: @HOMESHR

USE S: "\\server2\shared$"

shell "\\server2\netlogon\con2prt /f"

shell "\\server2\netlogon\con2prt /c \\server\StaffCopier1"

shell "\\server2\netlogon\con2prt /c \\server\StaffCopier2"

shell "\\server2\netlogon\con2prt /c \\server\PrePrep"

shell "\\server2\netlogon\con2prt /cd \\server\Office"

 

ENDIF

 

(there's more network drives and printers, just trimmed it)

 

One strange thing I just spotted on a computer with the issue - it seems to run an old version of the script (different printer names showed up). This version of the file donesn't exist any more, so it must be cached somewhere. I'm guessing this is the same on other computers when the problem occurs - as the script only appears for a few seconds it's difficult to tell!

 

Any way I can find where it's running the "old" script? Again, there's no apparent logic to which computers and users have this problem.

[sukh]

Hi

 

When you say it runs the old version of a script, does the script actually execute?

Do the printers which you see get deployed?

What do you mean by different computer names show up?

Check you bat BAT file if it has any refrences to the old KIX32 file?

Check the Netlogon share for the old KIX32 file?

Check Logon computer startup scripts (if used)?

 

Can you reproduce the old login script issue? If so, we may be able to use some sysinternall tools to monitor/log.

 

Try to logon/logoff multiple times to try and reproduce the issue.

 

Sukh

[smurfomatic]

The "old" script executes, comes up with loads of "printer not found" errors (not surprising, they don't exist any more!) - I'd expect they would deploy properly if they were still there.

 

Didn't mention different computer names, only printers.

 

The BAT file hasn't changed, the KIX32 file is the same file it was, just edited to be the "new" script - so the "old" one doesn't exist in the share (or anywhere else as far as I know).

 

We don't use logon startup scripts, but if we did it would point to the same place.

 

Can't reproduce the problem, as it's happening on random logins and computers.

 

Logging in and out tends to solve the problem, it's probably happening about 30% of the time and I can't recall seeing it happen on the same computer twice in a row, though that doesn't mean it doesn't happen.

[sukh]

Hi

 

Can you reproduce the old script execution?

 

Sukh

[smurfomatic]

Not on demand - it seems to do it when it wants...

[zippo]

Common problem - you need to check to make sure that your PDC's netlogon folders are syncronised and contain the same login scripts.

 

Basically if they are out of sync (not replicating) - then you get this sort of problem as users will connect to any netlogon folder that pops up first and it it just happens to be one that hasn't replicated and contains older scripts .... it can be confusing!

[smurfomatic]

Thanks zippo - hadn't realised the second server had a netlogon folder, with scripts that are about three years out of date! Hopefully that will solve the problem.

[djm968]

Beat me to it Zippo, found this out the hard way myself not much hair left now due to the amount of head scratching caused!

[sukh]

Hi

 

As zippo stated, if your DC's are not replicating the Netlogon share correctly then this can be the case. I would recommend that you check your Netlogon replication and confirm all is working as expected. Removing the old script mat resolve one issue but I would also be very concerned about Netlogon replication as this can cause other issue too.

 

Sukh

[zippo]

The more complex thing is to now fix the replication problem! Manually copying scripts between servers is just a temp fix

[sukh]

Hi

 

To get you started, run dcdiag /test:netlogons on each of your DC's and check the event logs. See link below for reference.

 

Check the status of the shared SYSVOL: Active Directory

 

Sukh

[smurfomatic]

djm - I haven't got much hair left either, but that's not just the head scratching...

[smurfomatic]

I'm happy to manually update the login script. There's only two servers and the scripts rarely change. I will look into the replication issue when I get a free moment. September 2013 is looking like it's not that busy...

[SpuffMonkey]

Don't know if you're using the script to set printers? We had this when we removed printing permissions from a few printers for maintenance - the script failed when trying to set the default and fell through...

[smurfomatic]

Premissions on the printers weke OK spuffmonkey. The replication issue seems to have sorted it - the whole ICT suite logged on all day with no problem. Fingers crossed that means it's gone for good. Thanks to everyone for their help and suggestions.