I've been scratching my head with my current problem.

You see, I have this Startup Script that I pushed via GPO.

Problem is, although the script starts alright (I see the event it created when starting in the event log), it always fails when trying to enumerate and/or modify registry settings under HKU.

  1. If I login as administrator and execute the script manually, it works!
  2. If I startup a Command Prompt as SYSTEM (using the "at" workaround) and execute the script manually, it also works!
  3. If I reboot... the script always fails.

Can anyone shed a light on my problem?

Additional information: This script injects some registry values for the Local Administrator (i.e., S-1-5-21-etc etc etc-500), so I'm not sure that it's doable via GPP, not to mention that since nearly all the workstations in my domain are still using XP, so no guarantee of GPP support.

  • 1
    there is no hku if nobody is logged in. – tony roth Dec 14 '12 at 16:55
  • @tonyroth Yeah, I finally figured that out, grr >.< ... I'm going to post an answer to my own question. – pepoluan Dec 14 '12 at 17:08

As @tonyroth pointed out in the comment to my question, the HKU root is dynamically populated when a user logged in.

Therefore, to be able to access a subkey of HKU, I will need to manually (i.e., through the script) 'load' the proper hive onto a (temporary) subkey of HKU, edit it in place, then unload it again.

I found a nice example here: http://www.tek-tips.com/viewthread.cfm?qid=1314876

Edit: Also, to find where exactly the Hive of S-...-500 resides, I need to seek it out under HKLM as explained here: http://blogs.technet.com/b/heyscriptingguy/archive/2005/06/03/hey-scripting-guy-how-can-i-list-all-the-user-profiles-on-a-computer.aspx

| improve this answer | |
  • Why don't you simply create a login script instead? If you have stuff that needs to happen in the system context, then break your script up into a startup and login component. – Zoredache Dec 14 '12 at 18:23
  • @Zoredache How is it possible to apply a login script via GPO for the Local Administrator (LA) account? The LA is not part of any OU, for sure... so how do I assign a GPO that targets the LA? – pepoluan Dec 14 '12 at 18:37
  • Not something I have actually tested, but I thought you could do this with loopback policies. With loopback you basically get the policies that are associated with the computer account. Though, that might have side effects you don't like. – Zoredache Dec 14 '12 at 19:16
  • @Zoredache The problem with loopback policies is that all users of the computers will get the same policies applied to them. These particular set of registry injection is meant for the Local Administrator account only, not 'standard' user. And it must be injected before logging in, not after logging in. – pepoluan Dec 15 '12 at 9:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.