Windows 2003 Group Policy Computer Logon Script Help!!!!!!


R

Rob Humphrey

About 4 weeks ago we upgraded our NT 4 domain to Windows 2003. We
have about 1500 users and a IS department of 30 individuals. In the
past almost every member of our department was a Domain Admin, no
matter what their skill set. We know this is a problem and we would
like to fix it. So, after our in-place upgrade I created new OUs to
move our computer accounts, user accounts, servers, and groups into.
I also created a new group called IS Support that I would like to move
all of our techs (who actually do desktop support) into. We have
worked out almost every problem with them not being domain admins
anymore, but we would like them to be local admins of each computer
they visit without having to logon locally and add themselves
manually. We created a .vbs script that works exactly as we want it
and adds the group locally to each machine. Now here is the problem.
The script when placed in the Group Policy MC(on the OU in which our
test computer accounts reside) -> Computer Configuration -> Windows
Settings -> Scripts -> Startup - only works on our Windows XP clients.
We created a test OU and applied the Group Policy on only the few
objects in the OU and still only the XP machine actually runs the
script. The majority of our machines run Windows 2000 and the script
never runs or gives any kind of error. It seems as though nothing
happens at all. If we manually run the script on the Windows 2000
clients it runs fine. We have verified permissions on the share
holding the script and everyone including local system accounts have
access. All clients in this OU our pointed to our DNS servers and
have no other problems. I would greatly appreciate any suggestions or
help if anyone has seen this problem or something similiar.

Thanks,

Rob
 
Ad

Advertisements

E

Eric Shen [MSFT]

Hi Rob,

It is possible that the client does not receive the script or it does not
run it. Please try the following to narrow down the cause.

1. Check GPResult to see if the script successfully arrives at the client.

You can run GPResult /s > C:\suppergp.txt under Command Prompt to collect
this information.

321709 HOW TO: Use the Group Policy Results Tool in Windows 2000
http://support.microsoft.com/?id=321709

2. Check the userenv.log.

221833 How to Enable User Environment Debug Logging in Retail Builds of
Windows
http://support.microsoft.com/?id=221833

For more information, check out the following article:

250842 Troubleshooting Group Policy Application Problems
http://support.microsoft.com/?id=250842

You can send the logs (gpresult and userenv.log) to me
([email protected]) for troubleshooting. If you encounter any
difficulties, please feel free to let me know. I look forward to hearing
from you.

Regards,

Eric Shen
Product Support Services
Microsoft Corporation

This posting is provided "AS IS" with no warranties, and confers no rights.

Get Secure! - www.microsoft.com/security
 
E

Eric Shen [MSFT]

Hi Rob,

Please run Gpresult from a client to see the group policy information.
Meanwhile, I am unable to see the information you attached. Could you
resend?

Regards,

Eric Shen
Product Support Services
Microsoft Corporation

This posting is provided "AS IS" with no warranties, and confers no rights.

Get Secure! - www.microsoft.com/security

-----Original Message-----
From: Rob Humphrey [mailto:[email protected]]
Sent: Tuesday, November 04, 2003 10:42 PM
To: Eric Shen
Subject: RE: Windows 2003 Group Policy Computer Logon Script Help!!!!!!

Eric,

Thanks for the reply and the help. We can't get the gpresult tool to
display any valid information. The win2ktest is obviously running Windows
2000 SP4, while the IS-Laptop is running Windows XP. We haven't raised our
functional level from our upgrade from NT, could this be a problem? We are
running the tool from one of our domain controllers and we keep getting
these errors:

<<...OLE_Obj...>>

Thanks again for the help.

Rob Humphrey
 
R

Rob Humphrey

Eric,

I sent you the 2 logs that you requested via your email.

Thanks,
Rob
 
Ad

Advertisements

E

Eric Shen [MSFT]

Hi Rob,

According to the gpresult output, the client does not receive the logon
script. You can search it for this script. Please check the following:

1. Please verify if this computer is in the correct OU which has this
computer logon script?

2. I suggest you try to create a new group policy for this domain and
assign this logon script to this policy. Then check if it applies to this
client.

Please check the above and then let me know the results. I hope to hear
from you soon.

Regards,

Eric Shen
Product Support Services
Microsoft Corporation

This posting is provided "AS IS" with no warranties, and confers no rights.

Get Secure! - www.microsoft.com/security
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top