 Custom Search Guy recommends: A free desktop tool that monitors, or restarts, your VMware virtual machines. Download your free VM Console Time to write out the Logon Script?I realize that I have to handle any suggestion that people abandon their logon scripts with extreme care. Let me begin by explaining my least contentious proposal; if you really need logon scripts, for example to map printers, then do them right, that means assigning Logon Scripts via Group Policy. It’s time for one of my Litmus Tests, which are designed to distinguish between amateur and professional administrators. Best Practice Litmus Test: How do you apply logon scripts in Windows Server 2003? Amateurs configure logon scripts the NT 4.0 way. They go to Active Directory Users and Computers, then they configure logon scripts individually, via the User’s property sheet, Profile tab and Logon script dialog box. Professionals assign logon scripts via Group Policy. When you use this method, launch the GPMC (Group Policy Management Console), head for the User Configuration, Windows Setting, Scripts and select Logon. When the policy window opens, click Add and Browse for your logon script File name. I have a tip for assigning scripts via Group Policy. Before you start the above procedure, copy (ctrl c) the logon script file – not the code, then when you reach the Browse File Name dialog box, paste the file (ctrl v). What this tip does is save you browsing in the SysVol folder and getting lost amongst those folders beginning with strange hexadecimal numbers. At the bottom of this link are screen shots of my paste logon script tip. At the bottom of this link are screen shots of my paste logon script tip. To recap, the advantages of applying logon scripts via Group Policy compared to the Profile tab are as follows: 1) Central administration, configure just one setting for everyone in the OU. There is no need to visit every user’s property sheet, just because you changed the name of the logon script. In addition, you can deploy multiple logon scripts with Group Policies. 2) You can also assign scripts to the computer rather than user, these are called Start Up scripts. Incidentally, I have never seen a Profile tab for a computer object, thus you could not apply the old NT 4.0 method to computers. 3) You can use Group Policy to run Logoff or Shutdown scripts, however, I confess, I have yet to see anyone apply Shutdown scripts in real life. If you want to learn more about configuring Group Policies, then I recommend TrainSignal’s video material. At TrainSignal they divide IT training into modules. They have step-by-step instructions prepared by experienced administrators to show you how to configure the Group Policy settings. Real Life Example written by Mike G.I’ve located the VBS files for each logon script under the NETLOGON share of the DC in a folder called "Logon Scripts". The six folders underneath represent my six regions within the company. This allows me to grant NTFS permissions on each regional folder to the local IS guys so they can modify their logon scripts (only), without having to give them permissions to the DC or the directories where the group policy lives. This keeps them in a separate folder than the Group Policies that launch them (so you don’t have to know those long strange hexadecimal numbers).
We have an Intranet page where folks can go to "Map your Office Network Drive Letters". So if they do need access to their home office drives, they go to this page and select their office. It then launches the …. login script.vbs from the folder on the DC so they can map drives as they need them. (this works great for remote users on the road or at home too). Guy Recommends: A Free Trial of the Network Performance Monitor (NPM) |
I link the group policies that launch the logon scripts to the site. (this may not be right for everyone) This is because I have 60 offices and we frequently have people shift to other offices to help out. By adding them to the local office security group, they get the proper NTFS permissions on the server and the logon script launches for the office they’re in, not their home office (which would be the case if it’s linked to an OU).
