Logon Script

Logon Script FAQ

Frequently Asked Questions About Logon Scripts:

1. How do I setup Logon scripts in a domain with Active Directory?
2. Why would I choose one method over another?
3. Can I use both methods to assign Logon scripts?
4. How do I setup Logon scripts so they support all of my clients?
5. How do I configure a Logon script for a user on the "Profile" tab in AD Users & Computers?
6. What languages can I use for Logon scripts?
7. Can I use a VBScript program for a Logon script on all clients in my domain?
8. How do I configure a Logon script with Group Policy?
9. What about Logoff, Startup, and Shutdown scripts in Group Policy?
10. What permissions are required for Logon scripts to run?
11. What can be done with a batch file Logon script, besides launch a VBScript program?
12. What about Logon scripts in an NT domain?

1. How do I setup Logon scripts in a domain with Active Directory?

There are two ways to assign Logon scripts. First, you can specify the Logon script on the "Profile" tab of the user properties dialog in the Active Directory Users and Computers MMC. Second, you can specify a Logon script in Group Policy.

2. Why would I choose one method over another?

You would assign a Logon script on the "Profile" tab of the user properties if you have client computers with Windows 95, Windows 98, Windows ME, or Windows NT. Group Policy is not applied on computers with these operating systems. If all of your clients have at least Windows 2000, you could use Group Policy to assign Logon scripts.

3. Can I use both methods to assign Logon scripts?

You can, but if a user logs on to a computer with Windows 2000 or above, both Logon scripts will run.

4. How do I setup Logon scripts so they support all of my clients?

If your users can Logon to both older clients (like Windows 95, Windows 98, Windows ME, or Windows NT) and the newer clients (like Windows 2000 and Windows XP), you should assign a batch file as the Logon script on the "Profile" tab for each user in the Active Directory Users and Computers MMC. The batch file can launch a VBScript program, as explained below. Once all of your clients are at least Windows 2000, you can use a VBScript program as the Logon script, and use Group Policy to assign Logon scripts to all users in a domain, site, or organizational unit.

5. How do I configure a Logon script for a user on the "Profile" tab in AD Users & Computers?

The field labeled "Logon script" on the "Profile" tab of the user properties dialog in the Active Directory Users and Computers MMC corresponds to the "scriptPath" attribute of the user object. The default location for Logon scripts specified by this attribute is the NetLogon share. By default, all users have read access to this share. The NetLogon share on the Domain Controller is located in the following folder:

%SystemRoot%\sysvol\sysvol\\scripts

where %SystemRoot% is usually "c:\winnt" and is the DNS name of the domain, similar to "MyDomain.com". This folder is replicated to all Domain Controllers in the domain. The usual practice is to enter the name of the Logon script, for example "NetLogon.bat", in the field labeled "Logon script" on the "Profile" tab for the user and place this file in the NetLogon share. The Logon script will run for the user when they Logon to any computer that is joined to the domain. You can also enter a UNC path in the "Logon script" field and place the file in another location. However, this location should be one that is replicated to all Domain Controllers. Alternatively, you can use a script or utility to assign the Logon script to the "scriptPath" attribute of the user object in Active Directory. A VBScript program to assign a value to this attribute for many users in bulk would be much faster than manually entering values for users one at a time in the MMC.