Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible that I could setup a GPO list for newly installed computers with many batch files (mainly file moving) and these would run only once and never again?

I am beginner on this and I haven't found any good solutions on this. Every help count:) Thanks

share|improve this question
2  
If you must do this with group policies: use the GPP method proposed by john. Still, whenever I see someone asking "how can I run a group policy just once after a fresh install" my immediate first question is: why can't you include this step in your deployment setup? –  Ansgar Wiechers Oct 27 '12 at 14:04
    
+1 @AnsgarWiechers I completely agree. Check your deployment solution, and if you're still using ghost images take a look at Microsoft Deployment Toolkit. –  john Nov 2 '12 at 15:10
add comment

3 Answers 3

The HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce registry key would be the most natural place to put items you only want to run once, because a command is deleted from this list when it runs. However, editing the registry using group policy preferences can be somewhat cumbersome.

You could also use Group Policy Preferences to deploy an Immediate (Scheduled) Task that runs once and is then deleted. An immediate task is just like a standard scheduled task so can run multiple actions in one task. There is a checkbox called 'Apply once and don't reapply' which enforces that it can only be applied (and therefore exist) once.


Configure a registry item: http://technet.microsoft.com/en-us/library/cc753092.aspx

Configure an immediate task: http://technet.microsoft.com/en-us/library/dd851779.aspx


Additional note

This is only a suitable option on client versions of Windows Vista and above, and for Windows XP clients with the GPP client side extensions patch installed. I would highly recommend using it.

share|improve this answer
    
You can also use GPP to update that registry key :) –  MDMarra Oct 26 '12 at 22:15
    
Ah yes, I was implying preferences, but didn't specify. I have updated my answer. –  john Oct 26 '12 at 22:16
    
+1 Between this and the trapdoor GPO/group membership/script mess, this is definitely the superior option, at least where avaiable. And thankfully, most environments can handle GPPs these days. I remember the days EvanAnderson speaks of, and they were dark days indeed. –  HopelessN00b Oct 27 '12 at 0:13
add comment

I refer to this kind of thing as a "trapdoor" GPO and I do it reasonably frequently (for things like working over newly domain-joined computers). If I have script that I want to execute once and only once on clients I'll typically do this:

  • Create a group in AD "Trapdoor Script Already Executed", and grant "Domain Computers" rights allow them "All Validated Writes" and to "Write members" (a property-specific permission).

  • Create my startup script and add a net group "Trapdoor Script Already Executed" /domain /add %computername%$ at the end of the script

  • Create a GPO referencing my startup script and add the permission "Trapdoor Script Already Executed" / "Deny Apply Group Policy" to the GPO.

This causes the machines to add themselves to the "Trapdoor Script Already Executed" group after they've executed the script and on future boots they are denied the right to execute the script again.

Edit:

This strategy works exceedingly poorly when client computers aren't removed from the groups but are otherwise re-worked or re-purposed and need to run the "trapdoor" script again.

In those cases, I opt to write a "canary" value to the registry that the script can check with a simply REG QUERY and bail on errorlevel if the value is found. The down-side to doing it that way is that the script executes on every boot (whereas, restricting GPO application via group membership prevents the script executing from occurring, and taking time, on each boot). In theory you can use WMI filtering to target GPOs based on registry values but, in the past, the performance of registry value-based WMI filtering was HORRIBLE.

I've had success with the "trapdoor group" strategy when I can get technicians to delete computers from AD and re-join them when "re-working" them, instead of just persisting the computer object and its group memberships. It's a challenge, but the only way that I could devise that didn't incur a script execution penalty on each boot.

share|improve this answer
    
How does this work in a deployment scenario, when a client is refreshed but already joined to the trapdoor group from a previous incarnation? –  john Oct 26 '12 at 22:48
    
@john: It works badly. I'll drop on an edit to talk about that. –  Evan Anderson Oct 26 '12 at 22:49
    
I'm actually curious as to when, or why, this would ever be preferable over dropping the script into the RunOnce reg key. (Or does my Windows experince maybe postdate the addition of that key?) –  HopelessN00b Oct 27 '12 at 0:17
    
@HopelessN00b: I'm working from a perspective that there may be clients that don't support Group Policy Preference and its (to me, at least) voodoo "Apply only once" functionality. While I don't think anybody should be deploying Windows XP or Windows Server 2003 anymore, a stock load of either one won't have GPP. –  Evan Anderson Oct 27 '12 at 7:22
add comment

please first read this article full.

Note1: Download and install GPMC and

Note 2: another answer that is usefull only in windows 8 here : Import and Export Starter GPOs

share|improve this answer
    
Sorry, but I am confused about how this helps. –  Zoredache Oct 28 '12 at 0:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.