Search the Community

Good afternoon I am trying to empty our staff network user download area on log off however i just cant get the script to run I have a created a .bat file which i have setup in the group policy under logoff however it runs but doesn't clear , if i run the .bat file on my desktop it works have tries powershell also "%HOMEDRIVE%%HOMEPATH%\downloads\*..."pushd "%HOMEDRIVE%%HOMEPATH%\downloads"for /d %%a in (*) do rd /s /q "%%a"del /s /q "*.*"popd Regards Peter

Hi all. Had a breakthrough today. Went full azure, Intune and autopilot last year. All has been good apart from one thing... no native logon script support. We've tried all the janky methods and settled on Task Scheduler for some time, but it's unreliable. Queue last week, I thought 'There must be a better way!' Lo and behold, there is. I've also not seen anyone else try this, not even in obscure forums deep on the internet (I tried everything to find a good method before!) so this may be the first documented method for this and it's also the BEST way hands down. 1. Firstly, you need to configure Logon Scripts in Local Group Policy on a test/admin PC, by going to: User Configuration > Policies > Windows Settings > Scripts. 2. Add all your logon scripts in here, the same way you used to when you managed your site with Group Policy (except locally) then hit apply. 3. Once you manually add those logon scripts via local GP on a test machine, it will create and populate a folder in "C:\Windows\System32" called "GroupPolicy" 4. Copy the entire "GroupPolicy" folder somewhere else. I copied to Desktop and put it into a folder called "LogonScriptsApp" 5. Open the "GroupPolicy" folder you copied off and make sure the scripts you added can be found in "GroupPolicy\User\Scripts\Logon" if not, move them into this folder. 6. If you had to manually add the scripts to the "Logon" folder, navigate to "GroupPolicy\User\Scripts" and open the file "psscripts.ini" 7. Ensure the .ini file is laid out in this format (I have called the scripts "yourscript1" and "yourscript2" for the purpose of the demonstration): [Logon]0CmdLine=yourscript1.ps10Parameters=1CmdLine=yourscript2.ps11Parameters= 8. As you can see, it should just say CmdLine=*scriptname* - if it has a path before the name of the script, it's not looking in the "Logon" folder discussed above. It must be looking in the Logon directory because we are going to wrap all of this into a Win32 app. 9. If you need to, once those scripts are copied into the "Logon" folder, edit the .ini file and ensure there isn't a path string before the script name and then save the .ini file. 10. Now, you need to make a PowerShell script that will copy all the files from the script root into the "Windows\System32" folder and create/replace the "GroupPolicy" folder and all it's contents, taking ownership of it and setting permissions to allow the file replace to take place. Here is the script below I used to do this, you can copy this exactly as is: # Take ownership and set full control permissions for 'Everyone' on the GroupPolicy folder$destinationFolder = "$env:windir\System32\GroupPolicy"takeown /f $destinationFolder /r /d yicacls $destinationFolder /grant Everyone:(OI)(CI)F /t# Define the source folder based on the script's location$sourceFolder = Join-Path -Path $PSScriptRoot -ChildPath "GroupPolicy"# Use robocopy to mirror the directory structure and files, replacing the destination contentsrobocopy $sourceFolder $destinationFolder /MIR /COPYALL /R:5 /W:1$GroupPolicyFolder = "C:\Windows\System32\GroupPolicy"$acl = Get-Acl $GroupPolicyFolder$perms = New-Object System.Security.AccessControl.FileSystemAccessRule("Everyone","FullControl","Allow")$acl.SetAccessRule($perms)$perms = New-Object System.Security.AccessControl.FileSystemAccessRule("Administrators","FullControl","Allow")$acl.SetAccessRule($perms)$perms = New-Object System.Security.AccessControl.FileSystemAccessRule("SYSTEM","FullControl","Allow")$acl.SetAccessRule($perms)Set-Acl $GroupPolicyFolder $acl 11. Save this script as "install.ps1" and put it into the "LogonScriptsApp" folder on the Desktop (Which should also contain the copied off "GroupPolicy" folder and all it's contents as discussed earlier) 12. Now use the win32 app packaging tool to package the app. The source folder is the "LogonScriptsApp" folder on the Desktop and the setup file is the script we just saved as "install.ps1" 13. Upload the new app to Intune, name it etc. and then use this for the install command: %windir%\Sysnative\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "install.ps1" This is super important because if you don't run PowerShell from the "sysnative" directory, the script will run and move the files into the SysWOW64 folder instead of System32 because of file redirection restrictions in Windows. 14. Ensure you deploy in system context and not user and also in the 64 bit context, then use one of the script files in the "Logon" folder as the detection rule. 15. You will now have fully native logon scripts using local GP on every machine you deploy to. This method simply uses the native logon scripts functionality from Local Group Policy/Group Policy and so is very reliable. So far, for us it has worked every single time. I really hope this helps somebody and if you have any questions please ask.

Hi. I need ur help in this one... My folder structure looks like this: Mustermann.Max Desktop Anwendungsdaten ... Example.Daniel Desktop Anwendungsdaten ... Test.Susan Desktop Anwendungsdaten ... Thats some regular Home-Drives. As my schools storage space is nearly full we decided to reset all folders and files to 0 until we can afford more HDDs (Austrian school budgets are really bad). My goal is now to keep the folder in example "Mustermann.Max" since it has all the right privileges set and i only want to delete everthing in it. I have more than 1800 Accounts so i don't want to do it by hand. Deleting the Profiles is no problem since the folders create itself with the right attributes when logging on. Does anyone have a handy script or knows a tool that is able to do what i want. Thanks in Advance Ban4na

Greetings, We are a former MacAdministrator school (their lack of support for 10.6 being the primary reason). In it's place, we're planning on using Mac OSX Server and ARD to manage clients, authenticating through Active Directory. We'd like to emulate how MacAdmin functions for a few features. One is the static home folder for all users. We've been successful setting that up so that a new user is presented with a fully customized starting environment, dock layout and first application runs already in place. We used this walkthrough to achieve these results. "Michael's Mac - Create a Custom Environment for Leopard's New Guest User" We have run into some issues that we are close to solving but are hoping someone has run into and can help us resolve. The login.keychain file need to be deleted on logout otherwise the next user gets a keychain error on login. (Continue to login, Change Keychain PW, and Use new Keychain are options on error window) We think creating a logout hook to delete this and any other files we want replaced with defaults is possible, however we have not found out how to implement this yet. We have seen scripts that destroy the user on logout however we would like some persistence of files so that if a user inadvertently forgets to backup files they would be able to get it off the local machine after a reasonable amount of time. We have found the following resources on logout/login hooks but could use a bit more hand holding in creation and editing of these scripts. At this point we don't know how to get the scripts into the machine so they run on logout as well as the exact wording of the scripts. "System Startup Programming Topics: Customizing Login and Logout" "Bombich.com: Mac OS X Management Custom Shell Script Library" "Bombich.com: Implementing Login and Logout hooks for System Management" Thanks! Stephen Bailey Media Services Coordinator, School of the Museum of Fine Arts

Hi, I have inherited an older system that has not been maintained for a number of years, and appears to have been hacked around a bit. Three servers running Win 2k3 1=AD plus Exchange plus plus plus plus bits 2=AD plus SMS 3=Terminal Server There are around 75 plus workstations ranging from laptops to desktops and a mixture of student and teacher configurations The login script is using something called kixstart and is full of errors and registry hacks. There is very little in teh way of GPO settings The AD is poorly organised and not making efficient use of OUG's Where do I start? I am no expert, just well informed, so I would need a lot of asssistance. The first thing I want to be able to do is stop students from launching any applications/scripts/batch files from anywhere accept the authorised locations such as C drive etc. How do I do that? Second, I want to re rationalise policies/profiles and login scripts. At the moment each logon creates a profile on teh machine which slowly fills the local machines hard drive and kills it. Would Mandatory Profiles stop this or not? I want to be able to first lock the system down for students and also for some staff who are useless at security to protect the sytsme from hackers and wasteful malicious pranks. Also would like to expand in the future to add student laptops with a variety of OS's and capablities Also would like to know how subnetting could work, as we are only using one domain and if that could have subnets as we are running out of IP address! I appreciate your help in advance Jim

Hi All, I have a user provisioning issue. I need to see if the new Year 7s have been created in AD. however i'm not sure on what OU or containers they will have been placed into. does anyone have a script that i can run that will return a list of users that were created on a certain date? hope this makes sense. Ryan

How would I make changed to the registry in a script? Also can I use .reg files to add things to the registry in a scrip. Thanks

Hi, the netbooks at our college are loosing the correct time and date after the batteries are empty.I am trying to get the right time/date without replacing the CMOS battery. I am trying to find a script to run on the admin side and correct the time and date the same format as in windows 7 ie. dd/mm/yyyy. Many thanks.

Hi I'm trying to avoid having to manually install pack for Ableton I have been using the following script # Specify the path to the Ableton program folder $AbletonProgramPath = "C:\ProgramData\Ableton\Live 10 Suite\Program\Ableton Live 10 Suite.exe" # Check if the folder exists if (Test-Path -Path $AbletonProgramPath -PathType Container) { # Folder exists, so run the .alp file $AlpFilePath = "\\Servername\Abbleton$\Packs\OrchestralBrass_r46420_v9.0.alp" Start-Process -FilePath $AlpFilePath Write-Host "Running OrchestralBrass_r46420_v9.0.alp from network location." } else { Write-Host "Ableton program folder does not exist." } This script work fine if I run it directly from a device I want the pack installed, so I uploaded the script to Intune and applied it to a test group with a PC that has Ableton installed but its deleting the folder structure within C:\Programdata\Ableton\Live 10 Suite.

Is this possible? Shockingly in my LA we have 5,000 client PC's all imaged off a few image, that no one ever bothered to sysprep or newsid. In March we switch to AD and obviously this is a problem. Our able but anti AD / AD project leader says he's scripting the creation of new SIDs on all 5,000 PC's, and it doesn't sweem right to me, having run newsid and seen how it takes at least 3 minutes to execute, obviously needing elevated privileges.

I am trying to simplify pulling directory ACLs. We have thousands of them and so I'd like to adjust this script I have so that it asks me what directory I'd like to check the ACLs for. Where it stands now the script must be edited manually when you run it on each machine. You have to change the directory name. So I'd like to turn the directory name in a variable and put the variable in the folder path. I appreciate the help as it will save so much time for me. It exports it to a .csv file where I can then import it into Excel and sort the tables accordingly. Here is what I have: powershell C:\GetDirectoryACls\GetDirectoryACLs.ps1 Get-childitem D:\Inetpub -recurse | where{$_.psiscontainer} | Get-Acl | % { $path = $_.Path $_.Access | % { New-Object PSObject -Property @{ Folder = $path.Replace("Microsoft.PowerShell.Core\FileSystem::","") Access = $_.FileSystemRights Control = $_.AccessControlType User = $_.IdentityReference Inheritance = $_.IsInherited } } } | ? {-not $_.Inheritance} | export-csv C:\GetDirectoryACLs\Get_Directory_ACLs_Output.csv -force

Hello everyone, We have a startup script applied to a set of laptops via group policy which is used to copy a start menu structure from the network to the local machine. It deletes the contents of the current start menu structure on the local machine and then copies the start menu from the network. The problem that we are having is that the startup script does not run at startup and I am thinking that this is because the wireless connection is not connecting quickly enough and so the startup scripts are being skipped. Am I right with this assumption? Also, we use WPA-PSK not RADIUS. My question is, is there anyway of getting the laptops to wait for a network connection so that the startup scripts are executed as appropriate. Thanks in advance, J.Worth.

Currently we are creating a repair script which cleans up Dns and installs certain pieces of software but encountered a problem. We need our script to run sims upgrade then close the dialog windows for sims.net then carry on with our script. we currently have it so it runs the script but we cant manage to close the dialog we have tried taskkill /IM pulsar.exe /f But we have to manually close the dialog box and help would be much appreciated

Hi all, I'm having a bit of a nightmare getting Wicd to run a script on connection to the school network. I have two scripts, proxy_on and proxy_off that (you guessed it) turn on/off the proxy rspectively, with the idea being that Wicd will activate the proxy settings when it connects to school network and deactivate them when it disconnects so I can use the netbook at home without fiddling around with settings every time (I'm lazy, but if the feature is there why not use it!) Both scripts run perfectly when manually executed so I know they do what I want them to (and yes I am using "su -c" to apply settings to the current user as it is a Ubuntu distro I'm using) but I can't for the life of me figure out how to make Wicd run them and there seems to be no documentation available. So my question is, how do I do it?

With the demise of the RM forums (at least I assume so - it stopped working for me a long time ago), I've lost contact with everyone who had a copy of my script to flush the contents of the Start Menu cache folders on CC4. Can anyone who sees this and wants the latest version please get in touch with me. This version (now v2.2) is a significant improvement to the version that people have had already. For clarification, this script is for those occasions where shortcuts are corrupted in the Start Menu cache folders, which results in the shortcuts not being delivered to users' profiles. To the best of my knowledge, nobody has managed to get RM to accept that there is a problem that needs fixing here, so I created the script to provide a workaround which helps to avoid otherwise unnecessary rebuilds. I share this with others for free, but I do like to have an idea of how many people out there have it and a way of contacting them in case I update it, which is why I haven't put a direct download link here.

Hi all. I would to run a script on my domain controller at just before lunch that we inform / remind the teacher to turn off the projectors. The trick is I want to use net send to an OU (just the teachers only) Plenty of googling has given me some scripts to do this - but I cant get them working. Has any one done this before? Thanks Stephen

Hi I am wanting to change the xp pro login screen background to a custom image. I only want to chnage the login screen and not the background after the user has loggerd in. Does anyone know how to do this? regards