Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got a couple of Server 2012 instances on Amazon EC2 and I'm in the process of setting up the GPOs. All of the settings of the GPOs are being applied fine, except none of the PowerShell scripts specified on computer startup are actually being executed. The scripts are sitting on a UNC share which has Authenticated Users applied to it with full permissions. I'm assuming it probably has something to do with the Execution Policy, but I'm not sure how to automatically bypass it. I could just go in each instance and bypass the Execution Policy, but that's obviously not a good idea, plus I'm eventually going to connect Windows 7 computers that will be running the same scripts.

How can I get the scripts to actually run? Google searches hasn't yielded a whole lot...

Current Permissions

Share - Authenticated Users (Full)

NTFS - Everyone (Full); CREATOR OWNER (Special); SYSTEM (Full)

share|improve this question
    
What is the output from Get-ExecutionPolicy, and does the script run if you launch it from the shell prompt? –  Greg Askew Jun 28 '13 at 0:36
    
Because I overwrote it with a GPO, Get-ExecutionPolicy says Unrestricted. If I open PowerShell and manually run it, the script works fine. –  Alex Jun 28 '13 at 0:46
add comment

4 Answers 4

If its a computer policy, authenticated users isn't what you want. You need to give Domain Computers read access.

share|improve this answer
    
I swear I've tried that before... I'll give a shot again, brb. –  Alex Jun 27 '13 at 4:51
    
Nope, this did not work. The share permissions give Domain Users and Domain Computers full access and the NTFS permissions give CREATOR OWNER, SYSTEM, Domain Users and Domain Computers full access as well. Is there anything else? Manually running the script works fine if that matters... –  Alex Jun 27 '13 at 5:05
    
All that means is that you had more than one problem :) Are you sure your script executes correctly as SYSTEM, which is the context that it will run as in this case? Grab a copy of psexec and run psexec -s cmd and call your PS script from there. It will execute as SYSTEM and hopefully give you some useful output. –  MDMarra Jun 27 '13 at 12:41
    
So, using PSEXEC -S CMD followed by POWERSHELL -Command "Test-Path '\\2012-F-01\Software$\Scripts\Computer Startup.ps1'" results in Test-Path : Access is denied. It's gotta be permissions, but I'm not sure what else to add in the permissions... –  Alex Jun 27 '13 at 18:36
    
Changing the share permissions to Authenticated Users allows the Test-Path to work, but the script still doesn't run... –  Alex Jun 27 '13 at 18:58
show 3 more comments

You could instead store the files with the GPO files. when you go in to put in the script you should see a "show files" button. Click that to bring up the folder in which the scripts should be placed. Once in that folder you can simply click "Add" and choose the file.

Otherwise, you can add Domain Computers with read access, as the computers will be the ones authenticating against the share at startup, not the users.

share|improve this answer
add comment
up vote 0 down vote accepted

I'm giving up... I can't be that much of an idiot in getting this to work. Last thing I tried was to call the PowerShell scripts from a Batch file. Even that seems to be a hit or miss (mostly miss)...

I'm done. Like, I said, either I'm a colossal idiot or Microsoft isn't implementing their own functionality right...

share|improve this answer
add comment

I think PowerShell scripts run remotely from a Windows share are considered part of the Internet, so you have a few options:

  • The Execution Policy needs to be Remote Signed and you have to sign the scripts.
  • The Execution Policy needs to be Unrestricted.
  • Copy the script locally, at which point you can run it if your Execution Policy is Remote Signed or Unrestricted.
  • When calling powershell.exe, use the -ExecutionPolicy parameter with a value of Unrestricted
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.