Logon scripts not running

[AnnDroyd]

We're in the process of introducing Windows 7 in our school. Most of the initial problems seem to have been ironed out, but we're left with one stumbling block that we don't seem to be able to resolve: Login scripts don't run for users who aren't local administrators.

 

We are using traditional .bat files to map a few drives and import printer settings. It works fine as an administrator bit not as a normal user. If a standard user logs on, the scripts can be executed manually and all is well, but they don't run as part of the logon process.

 

We've tried the "EnableLinkedConnections" registry fix but that doesn't seem to make any difference. We've tried specifying and locating the scripts within group policies and the netlogon share, but again, nothing seems to work.

 

We'd like to avoid the possibly inevitabale workaround of making students local administrators, but can't find any alternative solutions at present. Has anyone else experience this and found a solution?

 

*Edit: we have also turned off User access control

Edited October 4, 2011 by AnnDroyd

[Michael]

Make sure the following policy is set correctly:

 

Policies > User Config > Admin Templates > System - Prevent access to the command prompt - Enabled and then specify No to 'Disable the command prompt script processing also?'

 

I would also look at deploying network drives and printers via GPO. It works well when it's setup Have a look here

[AnnDroyd]

Unfortunately I've already ruled out anything to do with policy restrictions. Moving a test user into an OU with no restrictions applied doesn't work. However, making the same user a local admin, even with the same policies applied does work.

Even if I could get round the drive mapping problem, we still need the scripts to run for other things.

[Michael]

Could you post an example of your script?

 

The only scripts I use in my Windows 7/2008 R2 domains are Startup scripts for deploying wireless settings and to check/install anti-virus software if it's not there and that's it. Everything else is GPO.

[Michael]

The only other GPO I can think of is:

 

Policies > Computer Config > Windows Settings > Security Settings > Local Policies > User Rights Assignment - Log on as a batch job

[AnnDroyd]

Yes, here you go:

 

net use n: \\server1\users\students\%username% /persistent:no

net use o: \\server3\applications /persistent:no

NET TIME \\server4 /SET /YES

 

if exist \\server4\netlogon\screenres\%computername%.bat call \\server4\netlogon\screenres\%computername%.bat

if not exist \\server4\netlogon\screenres\%computername%.bat call \\server4\netlogon\screenres\default.bat

 

reg delete "HKCU\printers\connections" /f

if exist \\server4\netlogon\printers\%computername%.reg regedit /s \\server4\netlogon\printers\%computername%.reg

if not exist \\server4\netlogon\printers\%computername%.reg regedit /s \\server4\netlogon\printers\allprinters.reg

[sted]

Well net time needs admin but net use should be ok

 

Is UAC on if so might be worth testing with it off

[Michael]

The script looks OK to me also, but clearly Windows doesn't like something. I noticed however that you have what appears to be 4 servers. Are all these DCs as I wonder if it's a possible DNS issue.

 

Most (from what I can see) of what you have in your script could be achieved by GPO. Presumably you control everything else with GPOs, so it makes sense drive maps and printers are deployed this way too.

 

The only part I am unsure about is your screenres code, which I presume is setting the resolution at logon?

 

As you have three paragraphs of script, try experimenting and run each paragraph in turn. Does Windows still not process on all three?

[AnnDroyd]

We seem to have sorted this by putting the logon scripts in the profile in the start menu>programs>startup folder. Not an ideal solution, but it gets it working without having to make everyone local admins.

[MatthewL]

What about putting it in the NETLOGON folder and in each user profile specifying it in there?

[AnnDroyd]

What about putting it in the NETLOGON folder and in each user profile specifying it in there?

 

When you say specifying it in the profile, do you mean by creating a shortcut? If so, I tried that, but you get a security messages asking you if you want to run the file. By putting the script itself there, you don't get any warnings.

[MatthewL]

Sorry in AD on the profile tab I think it is you can specify a login script, so if you dump it in the NETLOGON folder and its called user.bat just type in user.bat

[ricki]

Hi

 

You can map drives through group policy see Using Group Policy Preferences to Map Drives Based on Group Membership - Ask the Directory Services Team - Site Home - TechNet Blogs

 

Time servers can be set in gpo see Setting the Authoritative Time Server on the PDC Emulator Using Group Policy

 

Scripts to set resolution can be put in startup scripts linked the room ou.

 

Printers can be deployed in gpo with print management and if you have a windows 2008 domain you can set the default printer. see Print Management Step-by-Step Guide

 

I hope this helps.

 

Richard

[ricki]

Hi

 

I have had another thought do the students have the right to run scripts and edit the registry. Both of these can be disabled in gpo.

 

Are there any clues in the eventlog?

 

Richard

[AnnDroyd]

Sorry in AD on the profile tab I think it is you can specify a login script, so if you dump it in the NETLOGON folder and its called user.bat just type in user.bat

 

I see what you mean. Yes, I tried that as well, and the scripts still didn't run!

[AnnDroyd]

Hi

 

I have had another thought do the students have the right to run scripts and edit the registry. Both of these can be disabled in gpo.

 

Are there any clues in the eventlog?

 

Richard

 

Yes, I have allowed them access to run scripts and edit the registry. This must be ok as the script works if run manually after logon. Good point regarding the event logs though. I'll have a look at that tomorrow. Thanks

[Nexarius]

I had this problem and tried all the usual fixes to no avail. Just when I was about to launch the computer through the window, I noticed that it only affected users with mandatory profiles (ie, all our student accounts!). Without the profiles the logon scripts ran, with them they didn't.

 

It turned out to be a permissions problem on the registry hive on the mandatory profile. I'd already set it so that Authenticated Users had permissions over the hive, but I hadn't propagated that change through the hive in the usual NTFS-y way. I did that with regedit and now the scripts run - Hooray!

[AnnDroyd]

This didn't seem to work for us but thanks for the suggestion. Fortunately we've just about got everything configured through policies and profiles now, so its not too much of a problem.

[gshaw]

It turned out to be a permissions problem on the registry hive on the mandatory profile. I'd already set it so that Authenticated Users had permissions over the hive, but I hadn't propagated that change through the hive in the usual NTFS-y way. I did that with regedit and now the scripts run - Hooray!

 

Was that doing mandatory profiles the MS-supported way with sysprep or a workaround method btw?

[SYNACK]

Look at transitioning to VBS or GPP, bat is getting quite old. It will be choking at the reg del bit as you need admin approval for stuff like that and there are cleaner (if slower) methods. I would not recommend removing UAC as it is a major security feature and can cause unforseen side effects in the future.

[Patrickv]

Have you checked the stupid "User Account Control Settings". User Account Control Settings has some good things and some bad things when give system admins nightmares. This was the cause when I had a vb script to map my drives. Try turning it off to see if this helps.

[Arthur]

Look at transitioning to VBS or GPP, bat is getting quite old. I would not recommend removing UAC as it is a major security feature and can cause unforseen side effects in the future.

^ This. I can't see any reason to continue using batch files when you have Group Policy Preferences. Also, turning off UAC creates more problems than it solves.

[AnnDroyd]

Have you checked the stupid "User Account Control Settings". User Account Control Settings has some good things and some bad things when give system admins nightmares. This was the cause when I had a vb script to map my drives. Try turning it off to see if this helps.

 

Just checked that and tried again this morning and the scripts still don't run unless you log on as a user who has at least local admin rights. Putting the scripts in the user profile under startmenu>programs>startup works fine though, but the script runs visable once the user logs on.

[Patrickv]

hmm, I am assuming that you are storing the batch script you are trying to run in the netlogon folder and Server4 is your primary domain controller.

 

if this is your script, then try and add "Pause" without quotes at the end of it. This just pauses the script and waits for user action. If nothing shows up then i can figure out further what your problem is. The netlogon share should allow you run batch scripts regards less if they are admin or not.

 

net use n: \\server1\users\students\%username% /persistent:no

net use o: \\server3\applications /persistent:no

NET TIME \\server4 /SET /YES

 

if exist \\server4\netlogon\screenres\%computername%.bat call \\server4\netlogon\screenres\%computername%.bat

if not exist \\server4\netlogon\screenres\%computername%.bat call \\server4\netlogon\screenres\default.bat

 

reg delete "HKCU\printers\connections" /f

if exist \\server4\netlogon\printers\%computername%.reg regedit /s \\server4\netlogon\printers\%computername%.reg

if not exist \\server4\netlogon\printers\%computername%.reg regedit /s \\server4\netlogon\printers\allprinters.reg

[ccamel]

I had a similar problem today and resolved it by adding the domain to the intranet zone in IE config. (This happened after I changed the location of a logon script from a specific server to the domain.)