Is there a way I can configure a GPO to NOT run the logon scripts that are defined within the AD user object?

We have a very special AD environment and I am trying to get away from the old batch logon scripts, that are huge mess here. Therefor I have configured GP-Preferences in conjunction with Item Level Targeting. But now I need to run the users in a mixed environment and therefor would like to "overload" the "logon script" field in the AD user object.

Thanks in advance


I don't know if this is possible or not, but my suggestion would be:

  • Move the Logon script to a GPO itself, that it gets executed by GPO.

This way, you can better control it, and probably achieve what you need

  • Thanks for replying. I'd love to switch everything, unfortunately this is not practical in my situation. – Matze Apr 16 '14 at 11:43
  • 1
    I mean use GPO to execute the script. The script stays the same, so you don't have to change a thing. Just the method changes, GPO executes it, instead of userinit.exe (logon script in ADUC), which should then give you better control on where to execute it (and where to block it) – MichelZ Apr 16 '14 at 11:48

I am now going to use applocker for this purpose and block the specific script from executing...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.