Windows 7 headache black screen on logon

[MaXiM]

Hi, up until a week ago I had been happily testing domain users logging into both XP and Windows 7 PCs with their separate roaming profiles.

 

but since a few days ago, any domain users (except administrator) when they login they get a black screen with a mouse pointer and it takes over 15 minutes before their desktop appears.

 

I looked in the eventviewer but nothing! no errors just the usual error about the login taking over 600 seconds.

 

I don't know why all of a sudden this has started happening, nothing has changed... maybe a windows update I don't know.

[MaXiM]

After uninistalling drivers / reinstalling drivers , removing windows updates , restoring previous restore points... I nearly gave up.

 

But, after playing around I removed the printer script that is invoked on user login in group policy and it worked! THis makes sense now... it was working before because the computer was in a different OU and the printers were not being applied. But since I moved the computer to the new OU it was trying to install a driver (hence the black screen).

 

To find this out I copied the .vbs script and a shortcut to cmd to the users folder and then opened cmd and ran cscript "script.vbs"... then I saw the script prompted to install a printer driver!

 

Phew... that was a bit of a headache.

[SYNACK]

http://www.edugeek.net/forums/windows-vista/22950-solution-mapping-printers-logon-scripts-vista-7-without-uac-interupting.html

 

Might help out for that OU

[MaXiM]

Thanks!! That was going to be my next question.. how to ignore UAC prompt when installing printers.

[MaXiM]

That link is great... except one small problem... its a windows 2003 domain... grrrr... this could be another headache.

[SYNACK]

That link is great... except one small problem... its a windows 2003 domain... grrrr... this could be another headache.

 

You can use a Windows 7 machine with the RSAT tools installed on it to set Windows 7 policies even if your domain is 2003. Having a 2008 server just makes it a little easier as the tools are already installed.

Download details: Remote Server Administration Tools for Windows 7 with Service Pack 1 (SP1)

 

You need to install it then add the components from the add/remove features bit in control panel to get the group policy managment bit.

[MaXiM]

You're the man.. I will try that tomorrow thanks.

[MaXiM]

So where do I set the policies though? using gpedit on the local windows 7 PC?

[SYNACK]

Once you have the RSAT tools on a domain joined workstation you log on to the workstation as a domain administrator and open up the group policy managment console which will point at the domain just like the GPMC on a 2003 server but with the ability to edit policies for Windows 7 rather than just for XP.

[MaXiM]

Hi, I did as you said, downloaded installed RSAT tools. I enabled the group policy management tools bit in the windows features. I then opened gpedit and went to the computer config -admin templates - printers point and print restrictions

opened that and enabled it and said do not warn for both.

did a gpupdate, rebooted and attempted to log in... black screen... script still waiting for user input to install printer.

Did I do something wrong?

[MaXiM]

Do I have to enable UAC on the computer before this policy would work do you think?

[MaXiM]

Well I couldn't get it to work so I tried another approach. I edited the local GP on the windows 7 PC and in the user login script added a batch file which runs con2prt.exe and added the printers that way.. it worked better than I thought!

[SYNACK]

Ah if you are using really old tools like con2prt (NT resource kit as far as I remember) then it will not work, you need to use a vbs script or something simmilar (even net use) and yes you would probably need UAC on because UAC is the thing that lets it prompt nicely if it needs elevation rather than just plain failing. Edited April 27, 2011 by SYNACK

[MaXiM]

No I was using a vbs script originally but couldn't get it to work even though i followed the instructions. I just got a black screen with the mouse pointer when logging in and had to wait 15 mins for group policy to time out before the desktop appeared.

Con2prt was my other idea which seemed to do the trick.

[Arthur]

http://www.edugeek.net/forums/windows-vista/22950-solution-mapping-printers-logon-scripts-vista-7-without-uac-interupting.html

According to Microsoft, disabling Point and Print restrictions has the same effect.

 

http://technet.microsoft.com/en-us/library/cc753269.aspx

 

To disable driver installation warning messages and elevation prompts on computers that are running Windows 7 and Windows Server 2008 R2, in the Point and Print Restrictions dialog box, click Disabled, and then click OK. This setting disables the enhanced printer driver installation security of Windows 7 and Windows Server 2008 R2.

 

The Point and Print Restrictions setting can also be found under User Configuration\Policies\Administrative Templates\Control Panel\Printers. This policy is ignored by Windows 7 and Windows Server 2008 R2, but is enforced by earlier editions of the operation system including versions Windows XP with SP1, Windows Server 2003 with SP1, and Windows Server 2008. We recommend that you change this policy setting in both locations so that all down-level clients have a consistent experience.

 

Also, why not just use Group Policy Preferences to add the shared printers? The client-side extensions install the driver on behalf of the user and item-level targeting can be used to map the printers based on a huge range of criteria...

 

http://www.msserveradmin.com/the-one-reason-you-should-use-group-policy-preferences/

[SYNACK]

According to Microsoft, disabling Point and Print restrictions has the same effect.

 

It did not work in our environment when we tried that, they may have now fixed it but those setting seemed to work on any patch level hence the guide.