Recipe 10.10. Running a Task via Group Policy

Problem

You want to configure Group Policy in an Active Directory environment so that a task runs at system startup or shutdown or when a user logs on or off.

Solution

Using a graphical user interface

1. Open the Group Policy Management Console (gpmc.msc).

2. In the left pane, browse to the Group Policy Object you want to edit.

3. Right-click on it and select Edit. This will launch the Group Policy Object Editor.

4. If you want a task to run during user logon or logoff:

   1. Expand User Configuration Windows Settings and click on the Scripts icon.

   2. In the right pane, double-click on Logon to configure a script to run at user logon or Logoff to configure a script to run at user logoff.

      If you want a task to run during system startup or shutdown:

   3. Expand Computer Configuration Windows Settings and click on the Scripts icon.

   4. In the right pane, double-click on Startup to configure a script to run at system start or Shutdown to configure a script to run at system shut down.

5. Click the Add button.

6. Fill in Script Name and Script Parameters and click OK.

7. Click OK.

Discussion

You have two options for storing the scripts or commands you run via Group Policy. One option is to specify a UNC path to the script (this could reference a remote file server), in the Script Name field. The key here is that all users that the Group Policy applies to must have at least read-only access to the script with their domain account. The second method is to copy the script to the folder within the Group Policy template on the file system of a domain controller (you can see this by clicking Browse on the Add screen). If you do this, the script will be copied automatically via the File Replication Service (FRS) to all domain controllers in the domain. This is the more efficient option in terms of client performance. If you use a UNC path, the client has to access the file on a remote server that may not be geographically close to it.

And just as we described in Recipe 6.4, scripts specified in Group Policy can be a Windows batch file (.bat extension) or anything supported by Windows Scripting Host on the system that runs the script. By default, this includes VBScript and JScript.

See Also

MS KB 198642, "Overview of Logon, Logoff, Startup, and Shutdown Scripts in Windows 2000," and MS KB 322241, "HOW TO: Assign Scripts in Windows 2000"