Logoff Script Problem

[nevets2001uk]

I have a weird problem with my logoff script that disables our proxy setting in IE. The script runs because the popup dialog is displayed at logoff but the proxy is enabled even when logging in outside of the domain.

However if I manually run the script it removes the settings which remains unchecked when outside of the domain (as we would like to occur).

Scipts below...


LOGON SCRIPT

Option Explicit
On Error Resume Next

'DECLARE VARAIBLES
Dim objWshShell
Set objWshShell = CreateObject("WScript.Shell")

'<<<<< PROXY >>>>>>>

objWshShell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable",1,"REG_DWORD"
objWshShell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer","ukproxy1.utc.com:8080" 
objWshShell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride","<local>"

Set objWshShell = Nothing

WScript.Quit

LOGOFF SCRIPT

Option Explicit
On Error Resume Next

'DECLARE VARAIBLES
Dim objWshShell
Set objWshShell = CreateObject("WScript.Shell")

'DISABLE PROXY
objWshShell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable",0,"REG_DWORD"
objWshShell.Popup "Script",, "Script Complete", 48

Set objWshShell = Nothing
WScript.Quit

Is there something obvious I'm missing?

Steve G (MCSE / MCSA:Messaging)

 

[tfg13]

Please clarify "off the domain". Are you referring to users logging in to a domain account, but they are hooked to a network that is not part of the domain, or are you referring to users logging on as a local user?

 

[nevets2001uk]

Sorry I'm referring to users logging into the domain account while outside of our network (Cached credentials).

Steve G (MCSE / MCSA:Messaging)

 

[w33mhz]

How are you applying the logon/logoff scripts? Via a site/domain/ou GPO or a local GPO?

 

[nevets2001uk]

The GPO is linked to the users OU and applies both the login and logoff scripts.

Steve G (MCSE / MCSA:Messaging)

 

[DTracy]

Try disabling the lines: On Error Resume Next

Run the scripts as usual and see if there is an instruction that is not being executed or is causing a problem.

With the error trap lines in place the program will simply disregard any problem and execute the next line of code.

David.

 

[w33mhz]

Well I guess I am confused, why are you removing the proxy setting when they log off?

 

[elmurado]

Try posting this in the vbscript forum instead.
Are the users local admins?

 

[nevets2001uk]

Thanks for all of the responses.

Firstly - I've run the script without the error trapping and it runs without a problem. Doesn't stop on any lines.

Users are have User rights locally but I've run the script manually as the user and it takes effect, it only seems to be a problem applying when applied via GPO. The popup states that the script has run but the proxxy is still enabled after logging in with cached credentials.

We are in an environment where two things need to be achieved. We need to be able to enabled / disable Internet access for users on the fly and also allow laptop users to connect to our proxy when in the company but through a regaular ISP when they are out. Some can't seem to follow simple instructions so we wanted to automate it.

I don't think it's a script problem as it runs outside of the GPO properly, but just doesn't apply when run from the GPO. The script to apply the proxy settings works fine though!

Steve G (MCSE / MCSA:Messaging)

 

[nevets2001uk]

An update on this issue. After further testing it appears that the reason the proxy is still available is that somehow the login script is running even with cached credentials which reapplies my proxy settings.

Is there a way to ensure scripts only run directly from the network if available and do not run when logging in with cached credentials?

Steve G (MCSE / MCSA:Messaging)

 

[tfg13]

I was afraid this might be the issue. There are a couple things you might try, and I'm not sure that they will be successful.

1. Do not cache credentials. This now causes users to not be able to logon. Defeats the purpose.

2. Use local accounts. This could be useful, but now users have to remember 2 different accounts, and you, the administrators, have to maintain those 2 accounts. Easiest solution, but could be more of a pain than it's worth (user forgetting to change the domain to computer and vice versa, and locking themselves out)

3. Use "if" statements in your script. As long as you cannot ping your DC outside of the domain, an if statement in the script stating "if response, then" would work for setting the proxy. However, this still can cause some issues. If you decide to do something like this, the guys over at the VBScript forum might be of better help.

 

[nevets2001uk]

Thanks tfg. I'll give option 3 a go and see how that works. It's not a critical thing to get working, but certainly a nice to have.

Steve G (MCSE / MCSA:Messaging)