Thanks in advance for any assistance. I've been houding the internet for hours looking for answers and found many tips/items to note but nothing that has worked for me.
Setup:
- Domain Controller = Windows 2008 R2
- Client machine = Windows 7 Pro x64 SP1
I have a GPO that is applied to a user and 2 machines. The GPO executes 2 logon scripts.
One of the scripts is used to mount drives. It works perfectly on one client machine, but not on another, with the same user.
NOTE: This task must be accomplished with a logon script. The built in drive mount GPO has caused random credential cache loss through reboots/etc that cause my users much frustration and I've long since fought it. This logon script is working perfectly on one of my clients so I know this can be solved on the other client.
Scenario / Problem:
I can confirm the scripts execute on the clients due to gpresult /r /v output - I get a proper "last ran" timestamp for both scripts which proves they executed.
1 of the scripts works properly. It does some .reg imports and a couple other tasks.
The 2nd script is used to mount drives and does NOT work.
However, it DOES work when running the .bat manually from the user desktop. Proving the script syntax works, and the user has permissions.
Here is the script contents:
@echo off
timeout /t 3
net use * /delete /yes
timeout /t 3
net use I: \\10.10.6.13\Share0 /user:DOM\myuser F@kePass1 /p:YES
net use \\10.10.6.13\Share1 /user:DOM\myuser F@kePass1 /p:YES
Note that I've intentionally left off the drive letter for the second mount.
Some things I've tried:
- Disabled Fast Logon:
Administrative Templates\System\Logon\Always wait for the network at computer startup and logon = Enabled
- Disabled UAC
- Recreated the GPO
- Put the script into an isolated GPO that only performs the script execution
- Various "enforced" on/off variations
- Various "timeout" settings in the script to force waits, etc.
- Forced to "Run Logon Scripts synchronously"
- Enabled "Run logon scripts visible" - However I don't ever see anything.
Some key items of note:
- I can confirm the script executes on the client due to
gpresult /r /v
output - I get a proper "last ran" timestamp for both scripts. - OTHER scripts execute properly, it's only the drive mount that doesn't work.
- Running the exact same script (.bat file) from the desktop of the logged in user will work properly.
- The client that isn't working is a Virtual Machine, the other is a hardware desktop. I don't think that would matter. The VM is in our dedicated ESX farm that houses many other nodes on the same subnet. I know the networking config is proper on the hypervisor.
- I'm running
gpupdate /force
each time I make a GPO change and ensuring it applied withgpresult /r /v
- Then at least logging off and often rebooting between policy changes.
I'm thinking of perhaps landing the file on the target machines, then creating a task to run it after login. However, in order to place the file on each client, they'll need access to the share, which is what I'm trying to accomplish.