So currently our senior VP in IT has a single log on script that is run via ADUC and does things like install 3rd party updates, maps networked drives, inventories computers, copies files to desktop, among other things.

I'm looking for some solid reasons/examples of why these things would be better off done in group policy. Along with anything else you can and should do in group policy that I haven't thought of.

Some of my reasoning was that you could split up tasks. 3rd party updates could be done on log off so that users aren't waiting for these to finish when logging in. As well as pushing new installs. As well as adding the logon script to Group Policy instead of running it from ADUC would mean you don't have to make sure it's on each user profile and it would be applied to everyone.


Aside from improving logon times, manageability and removing a potential security issue (depending on where the script is stored etc). I can't imagine why you'd ever want to change to group policy and group policy preferences and WMI. I don't know about you but watching that logon script window makes me feel like Matthew Broderick in War Games

In all seriousness if a SR VP in IT has nothing better to do than worry that a logon script (probably built in the XP, NT4 timeframe) is used, you have much larger problems as well. You are correct that all of those functions can and should be done in group policy. It's likely however that your problem is more politics than technical.

  • Oh absolutely it's more political. My intent is just to find ammo on why we should be implementing GP more. Whenever I bring up doing something in GP my managers response is "oh well VP has his logon script..." and that's the end of the conversation. – Ericrobert Mar 16 '15 at 17:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.