I am new to group policy, so there might be something simple that I'm missing here.

I've created a policy at the User configuration level which calls a VBScript that pushes out a customized hosts file to all users in a particular Organizational Unit. It works fine with Admin Users, but doesn't work with Non-Admin Users.

I have changed the setting under the User Configuration as opposed to the Computer Configuration because I want users to have access to the customized hosts file on whatever computer they log into. Different departments in the organization use separate hosts files.

User configuration-> Windows Settings-> Scripts (Logon/Logoff) - > Logon ... [Run VBS file]

Note: I can't edit a hosts file manually using notepad when log on as a non-admin user. So I guess what I'm asking is if there is a way to get around this permissions issue with Group Policy.

3 Answers 3


I hate telling you this, because you anything you think you should be using using HOSTS files for should really be done with DNS.

Having said that, a non-Administrator user can't modify the HOSTS file (and you've figured that out already). A logon script runs under the context of the user logging-on, so if the user can't do something a logon script running under their context can't do it either.

A Startup Script, assigned to the computer via a GPO applying to the computer object, runs as LocalSystem and can do anything to the local computer. Run your HOSTS file distribution script there and you'll find that it works fine.

Having said all that, please, please, please, please, please think about using DNS to do what you're trying to do rather than using a HOSTS file. There's no valid reason that anyone can come up with for using a mass-distributed HOSTS file to accomplish anything. It's just The Wrong WayTM to accomplish anything.

  • It does work under the Computer context. I don't know much about how to change the DNS settings. Can you apply different settings depending on the user with that approach? Jun 23, 2010 at 13:57
  • @SuperFurryToad: What are you trying to accomplish by having the same hostname resolve differently for different "classes" of users or computers? Jun 23, 2010 at 17:58
  • We want to block them from accessing certain websites. I know there are other ways of achieving this, but this is the method we have decided to go with. Jun 24, 2010 at 8:36

My first guess would be permissions to update the hosts file. I'm 100% certain our users would not have the required permissions.

  • 1
    Also, my Antivirus throws a wobbler if you try to go changing the hosts file - it might be that which is objecting too. Jun 22, 2010 at 9:30

Go into the computer configuration part and run the policy in loop back mode. This will cause the VBscript to run as the user logs on but imitates the computer account which should give permission to copy the file to the location. This will work if you truly want it for the User logon instead of startup.

Computer configuration > Policies > administrative Templates > system > group policy > User Group Policy Loopback Processing mode

I do not recommend this see the post about DNS but it should work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.