Login Scripts wont run on clients

[dvannoy]

I have created some simple vb scripts which I want to run when users login. Now, The scripts work if I login from the server or any other server in the domain. They donot run from the client workstation. I have assigned GPO to the OU where the users are located and did a gpupdate /force. I can't get the scripts to run on a client machine. I have tried different pc's and no luck. I get no errors either.

Any help would be appreciated

thanks

 

[markdmac]

Check the bottom of my FAQ faq329-5798 for some tips on implementing scripts in GPO.

So you added the script at login script right?
Any security configured on the GPO?

Users are in the OU you applied the script to?

Have you installed GPMC to do some modeling? Have you tried using GPRESULT to see what policies are applied? Did you verify the policy is replicating among your DCs?

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

 

[dvannoy]

I ran GPRESULT and did not see the po.icy name I created.

 

[weatherspec]

do you have the scripts in:
C:\WINDOWS\sysvol\sysvol\elmtraf.com\scripts

 

[weatherspec]

do you have the scripts in:
C:\WINDOWS\sysvol\sysvol\scripts

 

[dvannoy]

markdmac,
i followed your instructions in your faq and now when i run gpresult i see the following

the following gpo's were not applied because they were filtered out.

login script

 

[markdmac]

OK, so that lets you know you have a security issue of some kind. You need to start looking at GPO inherritance and other GPO security.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

 

[dvannoy]

OK, now this is getting to me.. the gpo's I created wont run!! I started from scratch and created a simple gpo to disable add and remove programs. added domain users to the security of the gpo. did a gpupdate /force and gpresult and the gpo I created wont even show up....

what am i doing wrong??

thansk

 

[markdmac]

You will need to give us ore to work with. Describe your OU structure and indicate where you have imlemented the GPO. List all appropirate security settings.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

 

[ncotton]

You shouldn't need to add users to the security settings of a GPO. If you want to apply the policy, therefore the script to all users in the OU, you just need to link the GPO to the OU. Leave the security filter to "Authorised Users".

Check
------
>The OU you are wanting to affect contains the USERS and NOT the COMPUTERS.

>Make sure the USERS are in a proper OU, NOT the default "Users" container, unless you are applying it to the domain root level.

>Make sure that you are actually running a USER SETTINGS/LOGON SCRIPT and not a COMPUTER SETTINGS/START UP SCRIPT. If you have set USER LOGON SCRIPTS and applied it to an OU that contains COMPUTER ACCOUNTS AND NO USER ACCOUNTS (or not the users you want), then the policy settings will not be applied, even if the users are logging on the machines in that OU.

>Remove any Group Filtering changed you've made and reinstate the Authenticated Users group. (YOU HAVE TO REINSTATE THIS Authenticated Users GROUP OTHERWISE NOTHING WILL GET THE POLICY.

Download the Group Policy Management Console from here - GPMC and run the Group Policy Modelling Wizard. Make sure you enter the exact User Account and Computer Account to run the modelling on, and don't use the default WHOLE CONTAINERS. This will help you drill down the exact problem. If you need help with the Modelling wizard, let us know, its pretty self explanitory. Don't change any of the settings in it though, just the user and computer (PS. you need to enter the domain\user and domain\computer).

I really do advise not using Security Group filtering if you don't have a good grasp of the processing of group policy. Start will it without any security group filtering, just link it to the OUs, then if you want to drill down further, go back and add the security.


Hope this Helps.

Neil J Cotton
njc Information Systems
Systems Consultant

 

[jakess]

If you use the same GPO on various OU's how will the updating to the other OU's take place if you make changes to the GPO on a specific OU?

 

[ncotton]

You dont make changes to a "Gpo on a specific OU".

When you edit a GPO, you edit a single object "MyGPO".
You then link the MyGPO object to OU1 and OU2.

OU1 looks at MyGPO
OU2 looks at MyGPO the exact same object.

it is NOT OU1\MyGPO (object1) and OU2\MyGPO (object2)

Changes made in the GPO are reflected in every OU

Does that make sence?

Hope this Helps.

Neil J Cotton
njc Information Systems
Systems Consultant

 

[dvannoy]

ok, my structure is as follows

DN.local
OU = Site
OU = First Bldg

now, the OU first bldg has the users that are located in that first bldg.

I am trying to create a GPO for that First Bldg.

if I create a GPO off of dn.local then do a gpupdate /force then gpresult, I then see the policy gets added, but then never applies to the user. So, I think theres a couple of thigs here. first why wont a gpo created under OU first bldg get applied? second why does the GPO not get applied to the client?

thanks

 

[dvannoy]

OK now something interesting..

I still can't get the OU gpo's to even get reconized.

but, I have been playing around with the default gpo and on the client side, the gpo nly gets applied when I specify the dns server in the ip config.

why is that?

 

[58sniper]

Well, all of your workstations should have the AD DNS server(s) configured in their IP properties. AND ONLY THOSE SERVERS. Do not specify ANY third party DNS servers on the workstations.

Pat Richard, MCSE(2) MCSA:Messaging, CNA(2)

 

[dvannoy]

thread931-1233662

you posted the above

 

[dvannoy]

what properties do I configure? I have alot of laptops that I cannot hard code the dns address in there. how and what do I configure for this?

thanks

 

[markdmac]

Use DHCP to push out DNS settings.

Server NIC needs to have its own IP as DNS
DHCP Scope needs to list server IP for DNS
All static IPs configure server DNS only, no ISP DNS.

DNS Server Snap In configure ISP DNS on the forwarders tab.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

 

[dvannoy]

our corporate office handles dhcp.

what other options do I have?

Thanks

 

[markdmac]

You need to speak with corporate. If your DHCP is configured to push out the wrong DNS server information you are affectively crippling your AD.

This is basic network design and should not be looked at as something you want to circumvent. You might as well yank out AD if you can't get DNS properly configured because of political battles.

If you are a seperate physical site then I would recommend you should have DNS and DHCP local. You can setup corporate DNS on the forwarders tab in DNS Snap In at the top of the list.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript