Troubleshooting Logon Script Problems

Introduction to Troubleshooting Logon Script Problems

Are you too intelligent for your own good?   When you tackle a logon script problem do you change several variables at once and carry lots of information in your head?   Or are you organized, and change only one step at a time and write down what you do.  What we need is a check list, a progression of practical tasks.  Where possible, each task or test should divide the search area in half.

Topics for Troubleshooting Logon Script Problems


Basic Principles of Troubleshooting VBScripts

What I like to do when troubleshooting is keep halving the search area until I see the problem.  The way I narrow the search area is to ask a series of questions, for example, is the error a syntax error or a logical error.  A logical error would be trying to connect to a server or share that does not exist, whereas a syntax error would be a missing bracket or ampersand.

Here are pairs of questions each of which narrow the search area.  The problem is ‘Why does my logon script not work?

  • Should we look at the VBscript or to Group Policy settings.
  • Is the problem Logical or Syntax.
  • Server or Client.
  • Is the error consistent or intermittent.

Another of my troubleshooting strategies is to go back to basics.  Build your script in section.  Get each scriplet working, then bolt all the parts together and so re-create the final script.  If you embrace this this strategy, then find a similar script on the web (this site) copy and paste the script, tune to your circumstances then get that section working before moving to the next section.

Always remember that scripts mimic real life.  Run through the actions mapping a drive, or creating a network printer, as you run through the task manually make a note of the precise steps.  Then go back to the script, can you find a missing item.

Simple Tests for VBScripts

Can you run the script successfully on the very Windows 2003 server?
Simply double click the VBScript in isolation, away from a Group Policy.  This test will determine if your facing a pure VBScript problem, or if the error is assigning the script via Active Directory Users and Computers.

In terms of strategy, break the script down into sections.  Get each section working in isolation, then paste all the sections together and so build the final script.

If absolutely nothing happens, check the file extension.  You need to save as with a .VBS extension.   Is security so tight that VBScript files are forbidden from executing?

After you get the script working on the server, the next step it to run the script on the client.  Does it work on an Vista Client?  Is the fault only with XP machines?

Do you get an error message in a  Windows Script Host box?
Troubleshooting windows logon script error messagesWhen the VBScript fails, research each of the clues supplied in the message box.  Read the Error: message. 
Check the Line number in the message against the line number in your script.  Count all blank lines and comments. 
For a short term fix, add this command to your script:
On Error Resume Next.

To determine the underlying cause the Code Number is the key, for example Code 800708CA in the screen shot.  Lookup YOUR error Code: 800 number here

Guy Recommends: WMI Monitor and It’s Free!Solarwinds Free WMI Monitor

Windows Management Instrumentation (WMI) is one of the hidden treasures of Microsoft’s operating systems.  Fortunately, SolarWinds have created a Free WMI Monitor so that you can discover these gems of performance information, and thus improve your scripts.

Take the guess work out of which WMI counters to use when scripting the operating system, Active Directory or Exchange Server. Give this WMI monitor a try – it’s free.

Download your free copy of WMI Monitor

Three VBScript Troubleshooting Commands

On Error Resume Next
For a quick fix, try adding the command ‘On Error Resume Next’.  This tells the script to ignore the error and continue.  In my opinion this is seldom a permanent solution, however it will allow the script to get past the fault and possibly execute useful commands.  One possible use would be mapping zillions of network drives, if the script maps all the drives except one then you may have a satisfactory outcome.

Option Explicit
This command forces you declare all variables.  Where Option Explicit helps with troubleshooting is where you misspell a variable later in the script.  For example you start off calling it strUser, then call it strUserS. 

Err.number is the first stage in introducing proper error correcting code.  Combined with If ..then… End If, Err.number offers real solutions to your problem.  The only trouble is that you need experience both of the If ..then structures and the possible logical outcomes.  Perhaps my ideas for err.number are best explained by an example:

‘ Sub Routine
Sub GuyCase()
‘ Select Case (Not Case Select!)
errLogonScript = err.number
Select Case errLogonScript
Case vbEmpty strError = "No Problem "
Case -2147024811 strError = "Drive already in use "
Case -2147023665 strError = "Check server name "
Case -2147023693 strError = "Check share name "
Case -2147024829 strError = "Another share name problem "
‘ Finish with Case Else in order to catch exceptions
Case Else strError = "Research this number: "
End Select
WScript.Echo strError & err.number
‘ Wscript.Echo "Errors = " ‘& err.count
err.number = vbEmpty
End Sub

Guy Recommends SolarWinds’ Free Network MonitorSolarwinds Network Device Monitor

Thus utility makes it easy to check the health of a router or firewall.  Check the real-time performance, and availability statistics, for any device on your network.  Get started with an extensive collection of "out-of-the-box" monitors for popular network devices. Give Network Monitor a whirl – it’s free. Download your free Network Device Monitor

If you need more comprehensive network analysis software:
Download a free trial of NPM (Network Performance Monitor)

Assign Scripts in Active Directory

Symptoms that point to a problem at the Active Directory end, the script produces the desired result when you double click the .vbs file.  However, when you assign the Windows logon script via an Active Directory Group Policy it does not execute at all, or does not execute properly.

Wrong OU Trap
Make sure that the Group Policy is applied to the user who you are testing.  The commonest error is that you apply the Group Policy to one OU, but the user who test the script in a different OU.  Two variations of this trap are, firstly, the computer account is not in the OU where you assign the policy.  Secondly, you are applying a script to the computer section of the Group Policy, not the user section of the policy.

Gpupdate (Or Secedit)
It’s always worth a refreshing the Group Policy with Gpupdate /force or the older Secedit command.  This is more likely to solve the problem when the script works on the server but not on the client.  If you have numerous domain controllers then you may get latency problems if the domain controller that holds the PDC emulator is a long way from the machine you are testing.

Try Remote Desktop
I always like to logon at the very Windows server.  If necessary, I connect via remote desktop, or terminal services.  Then I double click the .vbs if it runs as expected, I progress to assigning the logon script to the administrator.

Intermittent Problems – Add WScript.sleep
You always hope that intermittent problems will just go away, but they never do.  One fix is to add a delay at the start of the script with WSCript.Sleep 20000.  This command instructs the script to wait 20 seconds.  My idea is to give the time for the client to initialise properly, and only then to attempt to map the network drive, or what ever the VBScript instructions demand.Assigning windows logon scripts via Active Directory Group Policy

Assigning the logon script via Group Policy
As I mentioned earlier, always check that you are starting from the correct place in Active Directory Users and Computers.  Only you know if you should be at the Domain level, or the OU level.  Once you have navigated to the appropriate part of Active Directory then created a Group Policy.  If you are truly stuck then it is worth starting from scratch.  Create a new user in a new OU, then assign them a new Group Policy

To find the logon script settings start by clicking Edit, then navigate to the User Configuration, expand the Windows Settings folder, Scripts and Logon.  Now for my secret ingredient; my top tip is to copy your logon script into memory, so that it is ready to paste.

From the Logon Scripts window, click Add, in the Script Name dialog box, click Browse.  Now for the crucial part, right-click and Paste.  Your script should now appear in the window.  My point is that by assigning the script using this technique the VBScript ends up in the correct folder.  If you examine that long path seen from the Look in: dialog box you should see your VBScript.

What this Paste method does is make sure that domain controllers can replicate the logon script because it’s in the correct folder.  If you simply add a script using a local path, I doubt that your VBScript will be replicated to other domain controllers.

See more on the modern Group Policy method Drive Maps.

SysVol folder.  Script Path for Logon Scripts in Group PolicyVBScripts in the Correct Path
Observe the Polices folder structure on the domain controller.  The screen shot was taken from under the %windir%\sysvol\ folder.  Strangely, there are two sysvol folders.  Under the second sysvol you will see your domain name, and further down the actual group policies.  Each policy has sub menus with its templates and scripts.

Concentrate on the folders called Scripts.  Do not worry about the {AC17C } hex names.  Check that your VBScripts are in the respective Logon or Startup folders. 

Earlier I said observe because I do not want you to rename the group policies with Windows Explorer.  If you change those strange hex names, the policies will not work and the new names will give you nothing but grief.

Add another Group Policy
Whilst in the overall strategy, I believe in keeping troubleshooting simple, in terms of tactics, I have one extra suggestion for you to try.  Create an ordinary Group Policy, for example, disable the Run command.  My thinking is that if client obeys disable the Run command part of the policy, but not the logon script part of the same Group Policy, then you have narrowed your search for the problem.  If even the disable the Run command does not work, then you maybe logging on as a user in the wrong OU.

Guy Recommends:  SolarWinds’ Free Bulk Import ToolFree Download Solarwinds Bulk Import Tool

Import users from a spreadsheet.  Just provide a list of the users with their fields in the top row, and save as .csv file.  Then launch this FREE utility and match your fields with AD’s attributes, click and import the users.

Optionally, you can provide the name of the OU where the new accounts will be born. Download your FREE bulk import tool.

If you need more comprehensive software, download a free trial of SAM (Server & Application Monitor)

Assigning Windows Logon Scripts via Properties page, Profile TabAssign the logon script the NT 4.0 way
To short circuit Active Directory Group Policy, assign the logon through the user’s properties sheet, Profile tab.  I don’t like this old NT 4.0 method as the final solution, but it narrows down the problem when you are troubleshooting logon scripts. 

Incidentally, Profiles tab method is the only way to get logons scripts to work for Windows 9x clients.

Troubleshooting Logon Scripts Summary

Be, methodical, be disciplined and try only one remedy at a time.  Above all start simply, get the basic logon script working, then add complexity to get to the final production script.


Download my Logon Script eBook for only $6.25

Logon ScriptThe extra features you get in your eBook include, more pages full of detailed examples.  Also, ten ‘how to…’ sections, with screen shots showing which menus to use.  Go for Guy’s eBook – and get a printable version with copy enabled and no expiry date.

  Jumbo Script 7 Package

See Also

Logon Script Home