0

I've been scratching my head with my current problem.

You see, I have this Startup Script that I pushed via GPO.

Problem is, although the script starts alright (I see the event it created when starting in the event log), it always fails when trying to enumerate and/or modify registry settings under HKU.

  1. If I login as administrator and execute the script manually, it works!
  2. If I startup a Command Prompt as SYSTEM (using the "at" workaround) and execute the script manually, it also works!
  3. If I reboot... the script always fails.

Can anyone shed a light on my problem?

Additional information: This script injects some registry values for the Local Administrator (i.e., S-1-5-21-etc etc etc-500), so I'm not sure that it's doable via GPP, not to mention that since nearly all the workstations in my domain are still using XP, so no guarantee of GPP support.

2
  • 1
    there is no hku if nobody is logged in.
    – tony roth
    Dec 14, 2012 at 16:55
  • @tonyroth Yeah, I finally figured that out, grr >.< ... I'm going to post an answer to my own question.
    – pepoluan
    Dec 14, 2012 at 17:08

1 Answer 1

3

As @tonyroth pointed out in the comment to my question, the HKU root is dynamically populated when a user logged in.

Therefore, to be able to access a subkey of HKU, I will need to manually (i.e., through the script) 'load' the proper hive onto a (temporary) subkey of HKU, edit it in place, then unload it again.

I found a nice example here: http://www.tek-tips.com/viewthread.cfm?qid=1314876

Edit: Also, to find where exactly the Hive of S-...-500 resides, I need to seek it out under HKLM as explained here: http://blogs.technet.com/b/heyscriptingguy/archive/2005/06/03/hey-scripting-guy-how-can-i-list-all-the-user-profiles-on-a-computer.aspx

4
  • Why don't you simply create a login script instead? If you have stuff that needs to happen in the system context, then break your script up into a startup and login component.
    – Zoredache
    Dec 14, 2012 at 18:23
  • @Zoredache How is it possible to apply a login script via GPO for the Local Administrator (LA) account? The LA is not part of any OU, for sure... so how do I assign a GPO that targets the LA?
    – pepoluan
    Dec 14, 2012 at 18:37
  • Not something I have actually tested, but I thought you could do this with loopback policies. With loopback you basically get the policies that are associated with the computer account. Though, that might have side effects you don't like.
    – Zoredache
    Dec 14, 2012 at 19:16
  • @Zoredache The problem with loopback policies is that all users of the computers will get the same policies applied to them. These particular set of registry injection is meant for the Local Administrator account only, not 'standard' user. And it must be injected before logging in, not after logging in.
    – pepoluan
    Dec 15, 2012 at 9:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .