Group Policy woes

[rlgaooa]

OK, I'm stumped. I need to place an executable file on the desktop of specific computers. I have written a batch file that copies the .exe file to C:\documents and settings\all users\desktop. When I click on this batch file, it works. When I apply it in group policy as a logon script under Computer configuration, Windows settings, Startup, it fails. This OU contains the computers that this script needs to run on. It does not contain any users. The only other group policy applied to this OU is the Windows Update service and that is working. I have rebooted and run secedit. During the boot process I can see it try to run the startup scripts, but when I check the event logs I get: Windows could not execute laptop.bat due to the following error. Access is denied.

 

[swabs]

make sure that the source file (.bat file) is being accessed from a unc share \\computername\share and not from a drive letter (ie c:\file). Also make sure the system has permission to access the share and file.

 

[rlgaooa]

The .bat file is on a network share, I have given full control to both the system container in active directory and the specific machine account to no avail. I still get the error message Access is denied. It's almost as if it's trying to run the script before the machine is authenticated to the network.

 

[TheMac28nearly]

Do other machine settings work in the OU, if not, or if this is the only one, have you added the machine account permission so it will apply the group policy to the machine.

Also try rebooting the machine as this is like a logon/logoff for a user for the machine

 

[swabs]

I am not sure what your file does but it sounds like it should be under the user settings as a logon script instead of under computer settings as a startup script.

 

[rlgaooa]

In answer to Mac28nearly, windows update service is applied in the software settings for the machines in this OU. So I know group policy does apply to the machines.

In answer to Swabs, this has to be applied to specific machines throughout the domain. It's purpose is to load software updates and apply scripts to the machine. If it were applied to the user account they could load this software onto any machine they log on. I cannot create a msi as I have several different machine types and images. The simplest method seems to be to apply a batch file during startup that would place an exeacutable file on the all users desktop that would launch the customized scripts that I have prepared to install the programs.