Is it possible that I could setup a GPO list for newly installed computers with many batch files (mainly file moving) and these would run only once and never again?

I am beginner on this and I haven't found any good solutions on this. Every help count:) Thanks

  • 3
    If you must do this with group policies: use the GPP method proposed by john. Still, whenever I see someone asking "how can I run a group policy just once after a fresh install" my immediate first question is: why can't you include this step in your deployment setup? Oct 27, 2012 at 14:04
  • +1 @AnsgarWiechers I completely agree. Check your deployment solution, and if you're still using ghost images take a look at Microsoft Deployment Toolkit.
    – john
    Nov 2, 2012 at 15:10

3 Answers 3


The HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce registry key would be the most natural place to put items you only want to run once, because a command is deleted from this list when it runs. However, editing the registry using group policy preferences can be somewhat cumbersome.

You could also use Group Policy Preferences to deploy an Immediate (Scheduled) Task that runs once and is then deleted. An immediate task is just like a standard scheduled task so can run multiple actions in one task. There is a checkbox called 'Apply once and don't reapply' which enforces that it can only be applied (and therefore exist) once.

Configure a registry item: http://technet.microsoft.com/en-us/library/cc753092.aspx

Configure an immediate task: http://technet.microsoft.com/en-us/library/dd851779.aspx

Additional note

This is only a suitable option on client versions of Windows Vista and above, and for Windows XP clients with the GPP client side extensions patch installed. I would highly recommend using it.

  • You can also use GPP to update that registry key :)
    – MDMarra
    Oct 26, 2012 at 22:15
  • Ah yes, I was implying preferences, but didn't specify. I have updated my answer.
    – john
    Oct 26, 2012 at 22:16
  • +1 Between this and the trapdoor GPO/group membership/script mess, this is definitely the superior option, at least where avaiable. And thankfully, most environments can handle GPPs these days. I remember the days EvanAnderson speaks of, and they were dark days indeed. Oct 27, 2012 at 0:13
  • I don't see how the registry fix would work in this situation. The gpo will apply the registry setting, the computer will run the command, delete the key, and when the group policy is refreshed the key will be reapplied in an endless cycle, no? The scheduled task though seems like a great option.
    – user315229
    Oct 6, 2015 at 20:02
  • @user315229: when adding a registry key by using a Group Policy Preference, there is an option named "apply once and do not reapply". when enabled, this item of the GPP will only apply once for a given user and/or computer, thus the RunOnce registry key would be updated only once, effectively running the given script once. Apr 25, 2017 at 13:22

I refer to this kind of thing as a "trapdoor" GPO and I do it reasonably frequently (for things like working over newly domain-joined computers). If I have script that I want to execute once and only once on clients I'll typically do this:

  • Create a group in AD "Trapdoor Script Already Executed", and grant "Domain Computers" rights allow them "All Validated Writes" and to "Write members" (a property-specific permission).

  • Create my startup script and add a net group "Trapdoor Script Already Executed" /domain /add %computername%$ at the end of the script

  • Create a GPO referencing my startup script and add the permission "Trapdoor Script Already Executed" / "Deny Apply Group Policy" to the GPO.

This causes the machines to add themselves to the "Trapdoor Script Already Executed" group after they've executed the script and on future boots they are denied the right to execute the script again.


This strategy works exceedingly poorly when client computers aren't removed from the groups but are otherwise re-worked or re-purposed and need to run the "trapdoor" script again.

In those cases, I opt to write a "canary" value to the registry that the script can check with a simply REG QUERY and bail on errorlevel if the value is found. The down-side to doing it that way is that the script executes on every boot (whereas, restricting GPO application via group membership prevents the script executing from occurring, and taking time, on each boot). In theory you can use WMI filtering to target GPOs based on registry values but, in the past, the performance of registry value-based WMI filtering was HORRIBLE.

I've had success with the "trapdoor group" strategy when I can get technicians to delete computers from AD and re-join them when "re-working" them, instead of just persisting the computer object and its group memberships. It's a challenge, but the only way that I could devise that didn't incur a script execution penalty on each boot.

  • How does this work in a deployment scenario, when a client is refreshed but already joined to the trapdoor group from a previous incarnation?
    – john
    Oct 26, 2012 at 22:48
  • @john: It works badly. I'll drop on an edit to talk about that. Oct 26, 2012 at 22:49
  • I'm actually curious as to when, or why, this would ever be preferable over dropping the script into the RunOnce reg key. (Or does my Windows experince maybe postdate the addition of that key?) Oct 27, 2012 at 0:17
  • @HopelessN00b: I'm working from a perspective that there may be clients that don't support Group Policy Preference and its (to me, at least) voodoo "Apply only once" functionality. While I don't think anybody should be deploying Windows XP or Windows Server 2003 anymore, a stock load of either one won't have GPP. Oct 27, 2012 at 7:22
  • For some reason I am debugging, net group add command doesn’t work i.e. computer fails to add it self, despite group’s security is lowered to full control for Everyone. But I like this method the most. Other proposed method — Dropping reg value to RunOnce only one time is for me poses the same challenge as running the batch only one...
    – satoc
    Feb 1, 2020 at 3:28

please first read this article full.

Note1: Download and install GPMC and

Note 2: another answer that is usefull only in windows 8 here : Import and Export Starter GPOs

  • 1
    Sorry, but I am confused about how this helps.
    – Zoredache
    Oct 28, 2012 at 0:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.