Powershell – When do the user logon scripts run

logon-scriptspowershellwindows-server-2008-r2

I have several user logon scripts defined in active directory. These are batch scripts as well as powershell scripts.

When do these actually run? Does the user see "black terminal boxes" when he logs on, or do the scripts run while he sees the login screen?

Edit for clarification:
I am speaking of logon scripts, defined in GPO and I am running Windows Server 2008 R2.

Best Answer

Logon scripts don't display a command prompt window whilst they are running by default, however it is possible to enable this behaviour via a GPO.

The logon scripts will run whilst the explorer shell is loading.

You can test the exact timing of this by adding the following to one of your scripts, which will record the time the script is run in a log file.

echo %date% %time% > %TEMP%\logon.log

Related Solutions

Windows – NETLOGON scripts not being executed

The first way you tried, specifying the script name with "%username%" in it probably won't fly. I'm fairly certain that environment variable expansion inside the "Scripts" Group Policy Client Side Extension (CSE) won't work. I don't have any documentation that says one way or the other, but I'd find it highly dubious.

The second way you're trying, calling a "logon.bat" from the CSE and, in that script, calling "%username%.bat" should work, provided you can get the path to "%username%.bat" right. I'd call it like so:

call %0\..\%username%.bat

That ought to get the "%username%.bat" file located in the same directory as the "logon.bat" script to execute.

Finally, be sure that your users don't have "Administrator" rights if you're running Windows Vista or Windows 7 on your client computers. If you are, and they do, then drives that are "mapped" during the logon script won't be visible in Explorer by default. (You can get some background on that here: Networkmapping script (VBS) Vista doesn't work, XP does)

Can you create multiple separate Active Directory GPO Logon Scripts

Yes it's entirely possible to have multiple logon scripts run in multiple GPO's, but maybe not quite in the way you want.

First Option

This method works quite well for us, however your needs may be different. Have multiple OU's and Sub-OU's and apply different GPO's with linked logon scripts further down the chain.

Take the following OU structure - I have a Global Logon Script GPO linked at Acme Widgets, an Internal Logon Script GPO linked at Internal and various department-specific logon scripts below that. Actually, I have multiple logon scripts linked at Acme Widgets and Internal for XP, Vista and 7 which are applied according to an OS version WMI filter on the GPO.

Acme Widgets 
  Internal
    Finance
    Human Resources
    IT
    Sales

Second Option

This sounds like it is more similar to what you're after. Create your GPO's, add your logon scripts to them and link them all to an appropriate OU. Modify the permissions of the GPO so that only members of a specific group have permission to read the GPO, and apply it.

As for why the script isn't applying, here's my usual troubleshooting steps.

The Group Policy client does log some things in the event log. Check for any warnings or errors that may be preventing your scripts from running.
Run the script interactively after logging on (i.e go to \\SVR\Scripts\Logon.vbs and execute it). If you suppress errors or warnings, enable them before you run the script. Also, run this as a standard user - not an administrative one.
For Windows XP, run gpresult > GP.txt and check what policies you are being given, what are being filtered out etc. The /v switch (verbose) can also be useful, and if you really want information overload try the /z (super-verbose) switch.
For Windows Vista and above, use gpresult /h GP.html to create a much nicer output of the Group Policies you are getting. It opens in Internet Explorer and is pretty much the same as the RSOP summary you get in the Group Policy Management Console.
If you're on a laptop, the wireless may not be connecting immediately and may only do so upon logon, and after the logon scripts are supposed to have run. Maybe check for updated wireless drivers, but you may be stuck with this one. I know I have some laptops which don't work wirelessly very well unless you connect with the Intel crapplet they provide, which only connects after logon.