Search the Community

Hi all. Had a breakthrough today. Went full azure, Intune and autopilot last year. All has been good apart from one thing... no native logon script support. We've tried all the janky methods and settled on Task Scheduler for some time, but it's unreliable. Queue last week, I thought 'There must be a better way!' Lo and behold, there is. I've also not seen anyone else try this, not even in obscure forums deep on the internet (I tried everything to find a good method before!) so this may be the first documented method for this and it's also the BEST way hands down. 1. Firstly, you need to configure Logon Scripts in Local Group Policy on a test/admin PC, by going to: User Configuration > Policies > Windows Settings > Scripts. 2. Add all your logon scripts in here, the same way you used to when you managed your site with Group Policy (except locally) then hit apply. 3. Once you manually add those logon scripts via local GP on a test machine, it will create and populate a folder in "C:\Windows\System32" called "GroupPolicy" 4. Copy the entire "GroupPolicy" folder somewhere else. I copied to Desktop and put it into a folder called "LogonScriptsApp" 5. Open the "GroupPolicy" folder you copied off and make sure the scripts you added can be found in "GroupPolicy\User\Scripts\Logon" if not, move them into this folder. 6. If you had to manually add the scripts to the "Logon" folder, navigate to "GroupPolicy\User\Scripts" and open the file "psscripts.ini" 7. Ensure the .ini file is laid out in this format (I have called the scripts "yourscript1" and "yourscript2" for the purpose of the demonstration): [Logon]0CmdLine=yourscript1.ps10Parameters=1CmdLine=yourscript2.ps11Parameters= 8. As you can see, it should just say CmdLine=*scriptname* - if it has a path before the name of the script, it's not looking in the "Logon" folder discussed above. It must be looking in the Logon directory because we are going to wrap all of this into a Win32 app. 9. If you need to, once those scripts are copied into the "Logon" folder, edit the .ini file and ensure there isn't a path string before the script name and then save the .ini file. 10. Now, you need to make a PowerShell script that will copy all the files from the script root into the "Windows\System32" folder and create/replace the "GroupPolicy" folder and all it's contents, taking ownership of it and setting permissions to allow the file replace to take place. Here is the script below I used to do this, you can copy this exactly as is: # Take ownership and set full control permissions for 'Everyone' on the GroupPolicy folder$destinationFolder = "$env:windir\System32\GroupPolicy"takeown /f $destinationFolder /r /d yicacls $destinationFolder /grant Everyone:(OI)(CI)F /t# Define the source folder based on the script's location$sourceFolder = Join-Path -Path $PSScriptRoot -ChildPath "GroupPolicy"# Use robocopy to mirror the directory structure and files, replacing the destination contentsrobocopy $sourceFolder $destinationFolder /MIR /COPYALL /R:5 /W:1$GroupPolicyFolder = "C:\Windows\System32\GroupPolicy"$acl = Get-Acl $GroupPolicyFolder$perms = New-Object System.Security.AccessControl.FileSystemAccessRule("Everyone","FullControl","Allow")$acl.SetAccessRule($perms)$perms = New-Object System.Security.AccessControl.FileSystemAccessRule("Administrators","FullControl","Allow")$acl.SetAccessRule($perms)$perms = New-Object System.Security.AccessControl.FileSystemAccessRule("SYSTEM","FullControl","Allow")$acl.SetAccessRule($perms)Set-Acl $GroupPolicyFolder $acl 11. Save this script as "install.ps1" and put it into the "LogonScriptsApp" folder on the Desktop (Which should also contain the copied off "GroupPolicy" folder and all it's contents as discussed earlier) 12. Now use the win32 app packaging tool to package the app. The source folder is the "LogonScriptsApp" folder on the Desktop and the setup file is the script we just saved as "install.ps1" 13. Upload the new app to Intune, name it etc. and then use this for the install command: %windir%\Sysnative\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "install.ps1" This is super important because if you don't run PowerShell from the "sysnative" directory, the script will run and move the files into the SysWOW64 folder instead of System32 because of file redirection restrictions in Windows. 14. Ensure you deploy in system context and not user and also in the 64 bit context, then use one of the script files in the "Logon" folder as the detection rule. 15. You will now have fully native logon scripts using local GP on every machine you deploy to. This method simply uses the native logon scripts functionality from Local Group Policy/Group Policy and so is very reliable. So far, for us it has worked every single time. I really hope this helps somebody and if you have any questions please ask.

After a short argument with Vista about mapping printers on a certain station and some research I found a solution to allow you to map printers via VBS logon scripts without UAC getting in the way. It turns out that there is a group policy setting for Vista SP1 that suppresses the warnings and just allows the printer to map silently as it should. You will need 2008 server or RSAT installed on a Vista SP1 client to set it up. User Configuration -> Policies -> Administrative Templates -> Control Panel -> Printers : Point and Print Restrictions Setting: Enabled In its Config Tab: Do not specify any servers to restrict Point and Print to so it will continue to work for any server without specifying every one Security Prompts: When Installing drivers for a new connection: -Do not show warning or elevation prompt -Show warning and elevation prompt When updating drivers for an existing connection: -Do not show warning or elevation prompt -Show warning and elevation prompt -Show warning only EDIT: Since Windows 7 and Vista service pack 2 a new policy has been implemented as below which also needs to be set to work with these newer clients. You need to be using Windows 7 RSAT or have updated the ADMX files in your domain central store to see these options. Computer Configuration -> Policies -> Administrative Templates -> Printers : Point and Print Restrictions Setting: Enabled In its Config Tab: Do not specify any servers to restrict Point and Print to so it will continue to work for any server without specifying every one Security Prompts: When Installing drivers for a new connection: -Do not show warning or elevation prompt -Show warning and elevation prompt When updating drivers for an existing connection: -Do not show warning or elevation prompt -Show warning and elevation prompt -Show warning only Problems solved, simple solution too. As it happens someone else had actually posted this solution here earlier but I had not noticed it and only found it when looking for any duplicate posts of the same information. The first mention of this method on this site is here.

Hi, I may be going completely mad but I've been trying to deploy Pcounter Popup using a vbs as Group Policy User Logon Script for some time and can't get it working! I created a vbs script which runs fine if I run it by double clicking but when I tried deploying it with Group Policy something odd started happening. I could see the icon in the task bar appear and then disappear. Trying to get to the bottom of the problem, I have pared back my script so it just runs the popup.exe from the c:\ drive and put in a message so that I can see the script has run. Now I can see that the script runs but when it closes, the application closes too . I then tried running a different app (notepad and then calculator), the same happens, script runs and when it closes, the app closes too. Does anyone have any idea what is wrong??

Hi. Got a confusing one for you now. Trying to setup BGinfo to show the computer name at the logon screen. I'm eventually going to set it up using a logon script, but now I'm just trying to test it out. What happens is: I run BGinfo from the command line using a modification of Michael's script: @ECHO OFF REM * Sets Logon Desktop Background * copy \\server\netlogon\BGINFO\BGINFO.EXE %SYSTEMROOT% /Y %SYSTEMROOT%\bginfo.exe /I"\\server\netlogon\bginfo\computer.bgi" /timer:0 /nolicprompt It runs, generates the bginfo.bmp and sets it as the background, but it is compleatly blank. It only has the green background we set, but no information, not even the static text I entered. I am very puzzelled by this one. Its obviously not a permissions issue, and the script is deffinately running because it creates the file. Any thoughts would be very much appreciated. Thanks, David

Ive set the option in group policy to hide the legacy logon scipts. So our students wont see the script running but its not working. It works fine for network admin staff and teachers but not for students. I can make it work if I add the students to the administrators group but for obvious reasons I dont want to do that. I think it is not working because there is something on the local machine that needs changing that students dont have permission to access. If this is the case is there an easy way to change it on all of our computers without going round them one by one? Anyone out there got any ideas on how to solve this one?

In the sphere of Intune device management, effectively and seamlessly deploying logon scripts has always been a challenge, until now. I'm thrilled to unveil a pioneering solution that is the first of its kind: an Intune package designed to deploy logon scripts through local group policy encapsulated within a Win32 app. This innovative approach combines the robust management capabilities of Intune with the flexibility of local group policies, offering an unprecedented level of control and customisation. Key Features of My Intune Package: Seamless Integration: Utilising local group policy within a Win32 app, this package ensures smooth and efficient deployment of logon scripts across Intune-managed devices. User Experience: Designed to be transparent to the end-user, scripts execute silently in the background, enhancing productivity without any interruptions. Customisation and Control: Tailor desktop settings, UI preferences, and system configurations with precision. From managing shortcuts and setting dark mode to optimising system performance, this package offers extensive customisation capabilities. Security and Compliance: Concluding with the setting of PowerShell execution policies to 'Restricted', this solution enhances device security, safeguarding against unauthorised script executions and potential vulnerabilities. This ground-breaking solution is the result of extensive research, development, and testing, aimed at bridging a significant gap in Intune device management. By leveraging this package, IT administrators can now enjoy a level of script deployment functionality that was previously unattainable, streamlining device setup and configuration processes, and ensuring a consistent user environment across all devices. I am proud to offer this package for download, inviting IT professionals and Intune administrators to revolutionise their device management approach. Embrace the future of Intune management with our innovative solution, and elevate your organisational device management strategy to new heights. Download: https://github.com/cdwyer-240395/Intune-Scripts-Packages Disclaimer: The information provided in this document, including the Intune package for deploying logon scripts through local group policy, is offered "as is" without any warranties or representations, express or implied. While we have made every effort to ensure the accuracy and completeness of the information contained herein, we do not guarantee that the package will function as intended in every environment or configuration. Users should exercise caution and conduct thorough testing in a controlled environment before deploying the package in a production environment. We accept no liability for any damage or loss, including but not limited to data loss, financial loss, or interruption of business activities, arising directly or indirectly from the use of this package. It is the responsibility of the user to comply with all applicable laws and regulations, including those relating to software licensing, data protection, and privacy. The use of this package may require modifications to system settings or configurations that could affect device performance or user experience. Users should ensure they have the necessary technical expertise and permissions to make such changes. By downloading or using this package, you acknowledge that you have read and understood this disclaimer, and you agree to be bound by its terms.

Morning all! I am setting up a separate network from the original school network in a new building. A very simple network, one box, a DC, Server 2008 R2 Std, 10 permanent users (as well as visiting students) and the traffic is completely disconnected with the school now. What i'd like to know is what you do for user accounts / profiles / logon scripts etc. I'm new to Server 2008 so I'm a bit confused as to where to start and if there's any new features i can use. Previously, we had the user, a redirected my documents folder (through AD home folder) and a redirected App Data (due to a large amount of settings, through GPO) as well as a logon script to map printers and a couple of network drives. Happy to do this again, but don't want to go ahead and do it if there's a simpler way of doing things etc. Cheers Stu PS - XP Clients, for now.

I'm mapping my drives with Group Policy Preferences & all seemed to be going well until... I'm trying to map a drive with a variable in the UNC. I'm trying to map drive U to \\SERVER\Users$\%LogonName% with the label "User Space" The first user I login when setting this policy works as expects. PERFECT. The next user I login, the drive maps (great) but the label is the default you'd expect on such drive "%LogonName% on SERVER\Users$" I know it's a minor issue, yet really want it sorting - as I said it works with the first user fine. This isn't profile based and it doesn't matter what user I log in first - the correct label stays for that user but none of the other users!! Quirky, anyone had this or know of how to resolve it? Time to leave the office now (yes it's annoying me that much)!! Andy