Recipe5.5.Running a Task via Group Policy

Recipe 5.5. Running a Task via Group Policy

Problem

You want to configure Group Policy so that a task runs at system startup or shutdown or when a user logs on or off.

Solution

Using a graphical user interface

1. Open the Group Policy Management Console (gpmc.msc).

2. In the left pane, browse to the Group Policy Object you want to edit.

3. Right-click on it and select Edit. This will launch the Group Policy Object Editor.

4. If you want a task to run during user logon or logoff:

   1. Expand User Configuration Scripts icon.

   2. In the right pane, double-click on Logon to configure a script to run at user logon or double-click Logoff to configure a script to run at user logoff.

   If you want a task to run during system startup or shutdown:

   1. Expand Computer Configuration Scripts icon.

   2. In the right pane, double-click on Startup to configure a script to run at system start or double-click Shutdown to configure a script to run at system shutdown.

5. Click the Add button.

6. Fill in Script Name and Script Parameters and click OK.

7. Click OK.

Discussion

You have two options for where you can store the scripts or commands you run via group policy. One option is to specify a UNC path to the script (this could reference a remote file server), in the Script Name field. The key here is that all users that the Group Policy applies to must have at least read-only access to the script with their domain account. The second method is to copy the script to the folder within the Group Policy template on the file system of a domain controller (you can see this by clicking Browse on the Add screen.) If you do this, the script will be copied automatically via the File Replication Service (FRS) to all domain controllers in the domain. This is the more efficient option in terms of client performance. If you use a UNC path, the client has to access the file on a remote server, which may not be geographically close to it.

And as I described in Recipe 5.4, scripts specified in Group Policy can be a Windows batch file (.bat extension) or anything supported by Windows Scripting Host on the system that runs the script. By default, this includes VBScript and JScript.

With a startup script, the credentials of the computer account are used when running the script. With a login script, the credentials of the user are used.

See Also

MS KB 198642 (Overview of Logon, Logoff, Startup, and Shutdown Scripts in Windows 2000) and MS KB 322241 (HOW TO: Assign Scripts in Windows 2000)