1

I'm managing Windows VMs in AWS ASGs that are not attached to a domain. I want to run a script at shutdown (not logoff) to remove these nodes from Chef, and I want to create/register the scripts using Chef. I have the removal script ready, it's getting them to run at shutdown that I cannot find an implementation for.

I can do it manually via gpedit.msc Local Computer Policy -> Computer Configuration -> Windows Settings -> Scripts (Start/Shutdown) -> Shutdown. This places the scripts in C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Shutdown. Unfortunately:

  • It looks like the scripts directories are only created when gpedit.msc is first run, and it's unclear if creating them manually is valid
  • Just placing scripts there does not on its own seem to register them - they don't show up in gpedit.msc
  • Placing the script and running gpupdate /force (as suggested here) also doesn't cause it to show up in gpedit, though gpupdate did suggest a reboot may be required to apply some changes - that's not an option as a reboot in an ASG may cause instance termination and replacement

I'm aware of a possible use of Task Scheduler to run a script at shutdown, but (from my research at least) it seems that the key difference is that a task scheduler shutdown script only has as much time to run as the system takes to shutdown, whereas a GPO shutdown script will postpone shutdown until it finishes.

So, the question is: is there a way, via Chef (i.e. via PowerShell, DSC, or batch script) to register a GPO shutdown script on a machine not attached to AD without rebooting?

2 Answers 2

1

Try using this LGPO utility. You should be able to use the GUI to config the shutdown script on a pilot machine, back it up with LGPO, and then use LGPO to import it onto newly built systems.

https://blogs.technet.microsoft.com/secguide/2016/01/21/lgpo-exe-local-group-policy-object-utility-v1-0/

3
  • Restoring the backup doesn't seem to be sufficient to enable the script, even after manually writing the script to the dir - any ideas why or how to make it happen?
    – Adrian
    Aug 9, 2017 at 19:52
  • Sorry for the false lead. Despite what the doc says, the backups from LGPO seem to be more focused on Local Security and Audit settings. I could not get it to work on 2012 R2 for shutdown scripts. I also tried manual registry & file copies described here While they may work on XP (how the post is tagged) they did not work for me on 2012 R2.
    – Clayton
    Aug 10, 2017 at 14:58
  • Reading through some other answers and the dump from LGPO got me there - I'll post an answer that worked for me on Win2016.
    – Adrian
    Aug 10, 2017 at 15:00
1

Thanks to insight from @Clayton's answer and from this answer to another question, I was able to get it working on Win2016. I had to create C:\Windows\System32\GroupPolicy\Machine\Scripts\psscripts.ini:

[Startup]
0CmdLine=C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Shutdown\seppuku.ps1
0Parameters=

As well as set a slew of registry keys:

  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0
  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\0
  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown\0
  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown\0\0
  • HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown\0
  • HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown\0\0

Those ending in \Shutdown\0 get policy values:

"GPO-ID"="LocalGPO"
"SOM-ID"="Local"
"FileSysPath"="C:\\Windows\\System32\\GroupPolicy\\Machine"
"DisplayName"="Local Group Policy"
"GPOName"="Local Group Policy"
"PSScriptOrder"=dword:00000001

Those ending in \Shutdown\0\0 get script values:

"Script"="C:\\WINDOWS\\System32\\GroupPolicy\\Machine\\Scripts\\Shutdown\\seppuku.ps1"
"Parameters"=""
"IsPowershell"=dword:00000001
"ExecTime"=hex(b):00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00

This is for a PowerShell shutdown script located at C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Shutdown\seppuku.ps1. Setting all this is a pain but entirely possible using Chef, and after a converge, I see the script registered in gpedit.msc. I have yet to fully confirm the script actually executes at shutdown, that's my next step, but I believe it should.

4
  • What should psscripts.ini look like? I seem to only be able to edit this file in windows explorer...
    – jjxtra
    Feb 19, 2018 at 2:30
  • It's in the linked answer, but I'll copy it to mine.
    – Adrian
    Feb 19, 2018 at 13:20
  • Thanks! How did you create the psscripts.ini file, it seems that this is read-only? Even run as admin and saving does not seem to actually save anything, it stays blank. I'm hoping to do all of this in a script or C# program...
    – jjxtra
    Feb 19, 2018 at 18:51
  • I've not had that problem, I was able to write the file from a Chef recipe (which runs as administrator) on Windows Server 2016.
    – Adrian
    Feb 19, 2018 at 19:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .