Creating and Assigning Logon Scripts – Windows Server 2008

By Joe Piggee, MCSE

The whole idea of Logon scripts has changed a bit since the NT 4.0 days. I have received quite a few questions from people concerning this, and will, in the simplest manner, explain the tasks of:

· Creating a Logon script

· Assigning a logon script

o Active Directory, Users and Computers (ADUC)

o Group Policy (GPO)

First a little background:

The logon script is the file that does the actual action. It could be almost any action, as noted above. So we'll start by creating that script. Unlike the "old fashioned" method of using ADUC and the Profile tab of the users' account properties, the default location for GPO-initiated logon scripts is the deep within the SYSVOL special folder, which, by default, is shared on all Domain Controllers in an Active Directory forest, and is located in the following folder:

%SystemRoot%\SYSVOL\sysvol\<domain DNS name>\Policies\{GUID}\User\Scripts\Logon

Where %SystemRoot% is usually “C:\Windows”, <domain DNS name> is the DNS name of the domain, similar to “Yourdomain.local”, and {GUID} is a hexadecimal string representing the GUID (unique identifier) of the specific Group Policy Object in use. This folder, which is a part of the SYSVOL special folder, is replicated to all the Domain Controllers in the domain. Each GPO has its own internal User and Machine subfolders, and under them it has, if used, a Logon, Logoff, Startup and Shutdown subfolder where appropriate. Logon scripts are scripts files such as, logon.bat, logon.vbs, logon.cmd. They can be named whatever you like, but should have a commonly descriptive name. When using GPO’s you’ll eventually find out they depending on your schema, you may actually accomplish many user and computer settings without writing a single line of code. I would also recommend setting up your resources in Active Directory for the sake of Administration ease.Since, that goes beyond the scope of this; we’ll go more in depth at another time.

Let’s Roll-up Our Sleeves. The steps involved include:

1. Create the Script

2. Test the Script

3. Place the script in the appropriate location.(The Netlogon Share)

4. Assign the script to a user, group, or Organizational Unit

Setting up a Logon Script through Active Directory Users and Computers in Windows

The following sample code will map a network drive to a shared folder on my test server. Feel free to copy and use. All you’d need to do is change the UNC path to match your environment. ** Also, note that using this method, you may assign the logon script to only ONE user at a time.**

Step 1. Create the Script.

a. Open Notepad, or any text editor and save in on your desktop as logon.vbs $Text Box: ' sample logon script ' first let's create the objects we'll be using dim objShell, objNetwork set objShell = WScript.CreateObject("WScript.Shell") set objNetwork = WScript.CreateObject("WScript.Network") ‘We’ll map the M: drive to a network location objNetwork.MapNetworkDrive "M:", "\\MyServerName\ShareName"$

b. Edit the last line to match your environment, and save

Step 2. Test it by double clicking, and review your drive mappings.

Step 3. Now copy the file to your netlogon share.

Step 4. Open ADUC\ Active Directory, Users and Computers. Click Start->Run-> Type dsa.msc .Press enter

Step 5. Navigate to the user you want to assign the script to, as I have done: Click Right-> Select Properties

Step 6. Select the profile tab, and type the name of the logon script inside the logon script textbox.

Step 7. Click Ok. Replicate your Domain Controllers if necessary.

Step 8. Log-off and reboot the user’s computer and logon. That’s it!!

Setting up a Logon Script through GPO in Windows Server 2008

This is the recommended Method of assigning logon scripts.

Step 1. Create the Script.

b. Edit the last line to match your environment, and save

Step 2. Test it by double clicking, and review your drive mappings.

Step 3. Now copy the file to your netlogon share.

Step 4. Open the Group Policy Management Console, Select Start-> Run-> gpmc.msc.

Step 5. Navigate to the container where your user\users are, that you’ll want to assign the script to.

Step 6. Right Click the Container and Select “Create a New GPO in this Domain, and Link it Here” . Give it a descriptive name. Click Ok

Step 7. Now right click the GPO, and select edit.

Step 8. Now, navigate to User Configuration->Policies->Windows Settings->Scripts

Step 9. Double Click “Logon”, and Click “Add”.

Step 10. As long as you saved the script in the correct location, all you need to do type the name of the script. Or to be sure, click Browse, and type the unc. In my case \\joleycompserver\netlogon. Type the UNC inside the address bar