RunLogonScriptSync not obeyed when running logon scripts from domain policy

[Rob Nicholson]

We've currently designing and building a pilot AD infrastructure and my
attention has turned to logon scripts. The issue of running logon scripts
asynchronously is still an issue as we're likely to map drives in the logon
script.

On NT 4, we had to set the RunLogonScriptSync registry setting manually in
the login script to cause Windows XP to wait until the logon script had
executed before loading the desktop/running the application.

This registry setting still works fine in AD when you specific a logon
script against the user on the "Profile Tab". The example logon script just
does this:

@echo off
echo Master logon script here.
pause

AD group policy makes the manual setting of RunLogonScriptSync redundant we
there is a policy setting to do this. This works a treat. Enable the setting
and Windows XP waits until a key is pressed during logon before the desktop
is displayed.

But I'd like to be able to use logon scripts against the group policy. This
will allow use to customise them for the various organisational units etc
etc.

So I've set-up an identical logon script against the domain policy. At first
I didn't think it was running but then noticed the "Run logon scripts
visibly" and turned this on and my domain logon script ran as expected.

Except Windows XP didn't wait for the domain logon script to finish before
displaying the desktop. It waited for the user profile one, but not the
domain one.

Is this a known quirk or is there another way of getting Windows XP to wait
until the domain logon scripts have executed?

Thanks, Rob.

[Rob Nicholson]

Post by Rob Nicholson
Is this a known quirk or is there another way of getting Windows XP to
wait until the domain logon scripts have executed?

I've found the equivalent setting in the computer side of the policy and
I've enabled "Run logon scripts synchronously" but that didn't make any
difference.

What is strange is that sometimes Windows does wait for the domain policy
logon script to complete but it doesn't at other times.

Cheers, Rob.

[Rob Nicholson]

Post by Rob Nicholson
Is this a known quirk or is there another way of getting Windows XP to
wait until the domain logon scripts have executed?

Found the answer!

----cut here---
When you enable the Run logon scripts synchronously policy in Windows XP,
the desktop loads before the logon script finishes?

Windows XP enables a logon performance enhancement by default, which causes
your computer to not wait for Group Policy processing before initializing
the user environment.

To work around this feature, enable the Always wait for the network at
computer startup and logon Group Policy:

1. Open the appropriate GPO.

2. Expand Computer Configuration / Administrative Templates / System / Logon

3. Double-click Always wait for the network at computer startup and logon.

4. Enable the policy and press OK.
----cut here----

Works a treat now. You have to remember to make logon scripts visible in the
user side of the GPO otherwise you won't see any "pause" commands you have
in your logon script.

Cheers, Rob.