I'm testing out upgrading to Windows 10 on our domain, which is currently based on a Windows Server 2012 DC and all Windows 7 workstations. I was never able to make it work on Windows 7 so I gave up since I didn't really need it, but with Windows 10, I do need it. I've spent hours and days trying to figure it out, but I'm out of ideas. Here's my current GPO setup, in order of inheritance (abbreviating names to keep the post shorter):

Forest Computers (Computer Configuration)

  1. Policies > Windows > Security > Windows Firewall
    • Domain = Off
    • Private = Off
    • Public = Off
  2. Policies > Admin Templates > Network/Network Connections/Windows Firewall
    • Domain Profile > Protect all network connections = Disabled
    • Standard Profile > Protect all network connections = Disabled
  3. Policies > Admin Templates > System/Group Policy
    • Slow link detection = Disabled
    • Logon script delay = Disabled
    • Scripts policy processing = Enabled, allow across slow network = Enabled
    • Startup policy processing wait time = Disabled
  4. Policies > Admin Templates > System/Logon
    • Always wait for the network at computer startup and logon = Enabled
  5. Policies > Admin Templates > System/Scripts
    • Allow logon scripts when NetBIOS or WINS is disabled = Enabled
    • Run logon scripts synchronously = Enabled
    • Run startup scripts asynchronously = Disabled
    • Run Windows PowerShell scripts first at computer startup, shutdown = Enabled
    • Run Windows PowerShell scripts first at user logon, logoff = Enabled
    • Maximum wait time for GP scripts = Enabled, seconds = 0

Forest Workstations (Computer Configuration)

  1. Policies > Windows > Scripts
    • Startup = %SystemDrive%\Tools\Configuration.ps1 -WorkstationStartup
  2. Policies > Admin Templates > Windows Components/Windows PowerShell
    • Turn on Script Execution = Enabled, Allow all scripts
  3. Preferences > Windows Settings > Registry
    • DisableDHCPMediaSense = 1
    • DependOnService = LanmanWorkstation, LanmanServer, Netman

Forest Users (User Configuration)

  1. Policies > Scripts
    • Logon = %SystemDrive%\Tools\Configuration.ps1 -UserLogon
    • Logoff = %SystemDrive%\Tools\Configuration.ps1 -UserLogoff

The workstation specific portion of the script runs perfectly fine, but the user portion doesn't. As far as I can tell from the event log (the script writes to a custom event log), the user's portion isn't being called at all. I thought that it may have been because it was on a share, so I copied it to the local system drive, but that did nothing. As you can see all firewalls are disabled, but it has no effect.

The domain and forest functional level is Windows Server 2012, if it matters. I should also note that the PowerShell execution policy is set to Unrestricted.

I don't know what else to do to make the logon (and by extension logoff) scripts to run when they're supposed to. I ask for you help.


So, digging around more and I ran RSoP on the client where I found something peculiar, or rather, I didn't find it. There were no Logon/Logoff settings defined for the User Configuration. In fact a lot of the settings I expected to be there weren't. Instead the settings that are applied are the one's specific for the domain admins only. So it looks like the GPO inheritance is not working? The domain/OUs are configured like this:

enter image description here

And here's the GP inheritance:

enter image description here

So, for whatever reason the Forest Users policy is not being applied? I thought the GPs were applied in cascading order?

  • 1
    Why would you think the Windows Firewall has anything to do with it?
    – joeqwerty
    May 24, 2016 at 21:17
  • Because the Windows Firewall has caused me lots of headaches in the past, so I took it out as a potential source the last time I was trying to get logon scripts to work two years ago.
    – Gup3rSuR4c
    May 24, 2016 at 21:20
  • Are the user accounts in the Windows 10 OU? If not, then that's the problem. The user accounts are outside of the Scope of Management (SOM) of the GPO if they're not in the Windows 10 OU.
    – joeqwerty
    May 24, 2016 at 22:50
  • Turns out that was it. Since I'm using the Administrator account I can't quite move it to the correct OU, so instead I applied the Logon/Logoff scripts to its' GPO. The scripts work perfectly now, and it gave me the chance to force one-off configurations to be ran under the admin account instead of the user's account (where they never complete because of permissions). Testing them on a regular user also yields what I expect, so I'm calling it good. @joeqwerty, please leave an answer so I can give you the credit.
    – Gup3rSuR4c
    May 25, 2016 at 1:02

1 Answer 1


Are the user accounts in the Windows 10 OU? If not, then that's the problem. The user accounts are outside of the Scope of Management (SOM) of the GPO if they're not in the Windows 10 OU.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .