Client won't run GPO or scripts on logon

Question

I'm setting up a pair of windows 2008 servers, one handling norman endpoint security and the other handling network services. I have set up a logon script and some GPOs, but the problem is that nothing that should run on logon will run. Once the computer has started GP settings and anything I try to run work fine. However, I want the logon script to map some network drives, and GP to install office. The office install will show up in the network install dialog in control panel, and can be installed from there. I want them to run on logon, though, and have set them up to do so, but it won't run on the clients I'm testing it on. I mainly do my client-side testing on a windows 7 pro machine, but I've also tested it on a XP client, with the same results - I can run scripts manually, and GP settings kick in normally, but nothing that should run on logon will run on logon.

edit - I've tried the instructions on technet step by step, no dice. Nothing will kick in, neither on logon or on startup, and office appears in install from network in control panel regardless of what I do short of deleting the GPO.

Answer 1

Typically, you want something like Microsoft Office to be available to every user who uses a computer.

If you're installing a version of Microsoft Office that is "plain old" MSI-based (Office 2003 and 2000) you should be installing software by assigning it the computer, which causes it to install on startup.

If you're installing Office 2007 or Office 2010 you should be using a startup script to install Office. (Thanks, bundles, Microsoft for breaking "plain old" MSI-based installation in Office 2007 and Office 2010... You consistently prove that you don't actually use your own software the way real users / sysadmins do!)

The phrase "The office install will show up in the network install dialog in control panel..." makes it sound like you've "Published" the application to users via Group Policy, rather than "Assigning" it to the computers. You really want assignment to computers for MSI-based Office installs and a startup script for Office 2007 and 2010. You don't want to "Publish" any software that should appear for every user on a client computer.

re: your logon scripts - It sounds like you should make friends with the "Resultant Set of Policy" (Start / Run / RSOP.MSC) and see if the correct GPOs are applying to the client computers and user accounts.

W/o meaning to sound disrespectful, it sounds like you could use some time with a book or whitepaper about how Group Policy works and, in particular, how linking GPOs at different OUs relative to user and computer objects causes Group Policy to be applied. I think you'll find it much less frustrating if you spend some time with that kind of documentation. You can find some good resources at the Windows Server Group Policy Home on Microsoft's site.