Logon/Logoff scripts running when disconnected from domain controller

Question

I have a windows 7 system that is part of a domain. When it is unable to access the domain controller, will it still run logon scripts? Right now, we have a local script that is launched from the run section of the registry that checks for connectivity. If it can't talk to the server, it modifies some settings that prevent major bugs while using the machine.

This is probably the worst way to do this, but it's what a previous tech setup. What are some best practices for setting up logon scripts with GPO's and active directory? Whatever I set still needs to be able to run when the system is off the network.

Thanks

score 1 · Accepted Answer · answered May 09 '17 at 18:20

1

You could use group policy to setup a scheduled task. This way the task will run regardless of a domain connection. You'll just need to make sure whatever action you setup does not require some kind of network resource (ie. a batch file located on a network share)

answered May 09 '17 at 18:20

LSxCPU

61
2

1

If the task is scheduled "on startup" or "on login" and the script is saved locally (perhaps refreshed via the same GPO that maintains the scheduled task) then it will run on Windows startup or user login. You may have to set up a service account with appropriate creds, if you don't want to run it via the Administrator account (SYSTEM doesn't always work for user login tasks). – George Erhard May 09 '17 at 18:37

score 0 · Answer 2 · answered Jun 08 '12 at 16:58

0

Logon scripts are generally located on the DC, so if you loose connectivity to DC you loose the logon scripts.

answered Jun 08 '12 at 16:58

George

500
4
18
40

1

Do you know of any mechanisms to cache the scripts on the local machine? – Doltknuckle Jun 08 '12 at 17:02
@Doltknuckle I don't think you can, since they are being pushed down from the server. – George Jun 08 '12 at 17:03
Logon scripts don't have to be on the DC, they can be on another server or on the local disk. Just specify the full path. However, I don't know whether or not they will run if no DC can be contacted. – Harry Johnston Jun 08 '12 at 23:53

score 0 · Answer 3 · answered Jun 08 '12 at 17:38

I think it depends on how you have deployed the logon script. if you have the user account in AD defined to run script, it shouldn't run if the machine is off the network. if however, the script is specified in group policy, it may very well run.

you could mark the syvol directory as "always available off-line" if that's where you have your scripts stored.

Logon/Logoff scripts running when disconnected from domain controller

3 Answers3