windows – How to Empty User’s Downloads Folder at Login

active-directorywindowswindows-server-2019

Seems like a simple task but none of my solutions have worked.
Regular AD domain with regular users. We use terminal servers with non-roaming profiles so everything is stored on the TS disk. We want to empty their downloads folder at login because they never do it themselves and we're tired of having the disks fill up.

So, naturally I make a simple powershell script and create a GPO to run it at logon.
Problem is, the ps script required elevation, and logon scripts run at that user's permission level and cannot be elevated.

Here's the PS line:

Get-ChildItem C:\Users\*\Downloads\* | Remove-Item -Force

Works great if you manually run it from an elevated powershell instance.

Ok so no GPO. Next thought is to create a scheduled task on each terminal server and run with a service account that has admin privilege.

Problem there is that it doesn't work to empty each user's download folder… only the service account's.

So- I don't want to statically type each and every user's download folder path into the .ps1 file, because obviously that would be a management nightmare.

So does anybody know:

A way to empty the download folder on user login through a GPO without running a script to do it.
or
A way to improve the script to recursively look through each user's folder, find the downloads folder, and empty it.. without having to specify the name of each user.

How can this easily be done?
Thanks

Best Answer

Your problem with that user logon script is that you were trying to delete ALL users' Download contents, if that's the command you were using.

You want to delete each specific user's Downloads, surely. So if Downloads is in their profile directory:

Get-ChildItem $env:USERPROFILE\downloads | Remove-Item -recurse

You may need to sign your script or set -ExecutionPolicy Bypass depending on the execution policy you have for Powershell. There's plenty of advice out there on how to run Powershell in a logon script.

If you're doing it in ye olde batch file, it's simply:

rd /s /q %USERPROFILE%\Downloads\*
del /q  %USERPROFILE%\Downloads\*.*

First Option

This method works quite well for us, however your needs may be different. Have multiple OU's and Sub-OU's and apply different GPO's with linked logon scripts further down the chain.

Take the following OU structure - I have a Global Logon Script GPO linked at Acme Widgets, an Internal Logon Script GPO linked at Internal and various department-specific logon scripts below that. Actually, I have multiple logon scripts linked at Acme Widgets and Internal for XP, Vista and 7 which are applied according to an OS version WMI filter on the GPO.

Acme Widgets 
  Internal
    Finance
    Human Resources
    IT
    Sales

Second Option

This sounds like it is more similar to what you're after. Create your GPO's, add your logon scripts to them and link them all to an appropriate OU. Modify the permissions of the GPO so that only members of a specific group have permission to read the GPO, and apply it.

As for why the script isn't applying, here's my usual troubleshooting steps.

The Group Policy client does log some things in the event log. Check for any warnings or errors that may be preventing your scripts from running.
Run the script interactively after logging on (i.e go to \\SVR\Scripts\Logon.vbs and execute it). If you suppress errors or warnings, enable them before you run the script. Also, run this as a standard user - not an administrative one.
For Windows XP, run gpresult > GP.txt and check what policies you are being given, what are being filtered out etc. The /v switch (verbose) can also be useful, and if you really want information overload try the /z (super-verbose) switch.
For Windows Vista and above, use gpresult /h GP.html to create a much nicer output of the Group Policies you are getting. It opens in Internet Explorer and is pretty much the same as the RSOP summary you get in the Group Policy Management Console.
If you're on a laptop, the wireless may not be connecting immediately and may only do so upon logon, and after the logon scripts are supposed to have run. Maybe check for updated wireless drivers, but you may be stuck with this one. I know I have some laptops which don't work wirelessly very well unless you connect with the Intel crapplet they provide, which only connects after logon.

Best Answer

Related Solutions

Windows – Useful Command-line Commands on Windows

Can you create multiple separate Active Directory GPO Logon Scripts

First Option

Second Option

Related Topic