I have a Microsoft domain (mostly 2008r2\7).
I looking for a way to run a script immediately after (the restart after) joining a domain (without requiring user login), and so far I've failed.

Also, I want it to run only once, so scheduling a repeated task is not an option.
It just seem to me a waste to let it run over and over again.

I've tried a GPO with startup script, but when the computer receives the GPO it's way after the startup.
I've also tried a GPO with a scheduled task (with different triggers), but they didn't work too:
"At startup" trigger fails same as the startup script.
"At Task creation" fails, I guess because it's not created the usual way.
"At schedule" is irrelevant, because I need it to run right after joining (and setting a date that had already passed didn't work).
Couldn't find any relevant registry keys, but I assume they would have the same problem as the GPO startup script.

The only idea that might do what I need is attaching a task to the relevant event on the DCs, and run the script remotely.

Any better suggestions?

By the answers (which are great, but doesn't quite cut it), I have a few points to add:
1. The question applies to both servers (2008r2\2012\2012r2), though I've tested only on 2012r2.
2. I'm looking for a more runonce-like solution, meaning I don't want it to run endlessly until some condition is fulfilled.
3. We use images to deploy servers and workstations, but I can't use a solution that involves editing them because a) That would require me to update them each time I need to change something in my script b) BYODs.
4. We don't use a joining script (we simply don't need one...), so starting to use one seem to me a waste. Also, there are a few problem with it (e.g. where should I put it? in the image? in a shared location? what with BYODs? that would defeat point 3).


4 Answers 4


Add a custom registry key to your build image, just a simple '1' value somewhere.
Add a scheduled task that checks for the registry key value to the build image, add checks for your domain name in this registry key


If it finds both run your script, then change the custom registry key to 0 on complete. Have this task run at startup.

You can either then leave this task in place as is, or have a gpo that deletes the scheduled task. However if you leave it in place and you ever need to rerun the script you can just change the registry key back to 1 and reboot.

Slight security concern is the scheduled task will need to run as a local administrator account.


Don't you need to reboot after joining the domain anyway? If you created a startup script, it would apply right after that reboot, when it loads the other group policy objects.

How are you joining the domain now? You could also integrate joining the domain into your script. With Powershell this is done with Add-Computer, from the command-line you can use netdom.

Usually you would integrate this into your task sequence, if you are using a configuration management tool.

  • 1
    The Powershell command for joining a computer to a domain is Add-Computer.
    – Daniel
    May 19, 2015 at 8:14
  • 1. If I wasn't clear, then let me clarify - I reboot once of course, and the GPO is applied correctly, but since the "Startup" phase already passed the scripts (either from GPO startup scripts or startup scheduled task) won't run. 2. We don't use a script to join (also, using one wouldn't help, as I'll need to update the deployment image each time I need to change this scripts). 3. We have SCCM, but as far as I understand, it has the same options like scheduled tasks, in regards with my question.
    – EliadTech
    May 19, 2015 at 8:50

How is the join being performed? Manual GUI interaction or via a script? If a script, add a line to the join script to have your 2nd script run via the RunOnce registry key.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce https://msdn.microsoft.com/en-us/library/windows/desktop/aa376977%28v=vs.85%29.aspx

Doh! Right

Thinking about your comment on the GPO apply being delayed... I work primarily on Server OS which does Synchronous GPO processing. Workstations do async. Try this to get async:

In your build process/image try disabling "Fast Logon Optimization" https://technet.microsoft.com/en-us/magazine/gg486839.aspx
Computer Configuration\Administrative Templates\System\Logon
Always wait for the network at computer startup and logon = Enabled

Create a GPO Startup Script GPO:
Computer Config/Policies/Windows Settings/Scripts/Startup

Inside of the script you define there, use this code:

$built = gwmi Win32_OperatingSystem | foreach {[System.Management.ManagementDateTimeconverter]::ToDateTime($_.InstallDate)}
if ($built -gt (get-date).addHours(-4)) {
    "do something"
  • The join is done manually, and the key you suggested runs only when a user logs in.
    – EliadTech
    May 19, 2015 at 15:25
  • Actually, I did all my tests with server 2012r2... and it didn't work. Also, I prefer something that is forced in the domain level, otherwise I'll get stuck with BYODs...
    – EliadTech
    May 20, 2015 at 7:14

I used to work in schools.

And we automate the join and scripting process (Having a perfect image to deploy that last over years maybe utopic). So we used WDS/MDT to depoy.

We filled the .xml answer file, so our multicast images deployed are join in an OU (Organisational Unit) Install and we applied GPO for final scripting and move out of the OU Install.

That way we only have to rename the workstation with the right name, place in the right OU.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.