can anyone tell me how to configure/set a login script for users in a AD?

here is what I tryed: - in the default "NETLOGON" shared folder, I created a logon.bat (containing cmd.exe, just for test) - (for a test user) in user's profile/user profile/logon script I put logon.bat and nothing happens :(

(i'm new in Active Directory)

  • Create a logon.cmd instead of logon.bat (".bat" is so 20th century) and don't have it calling cmd.exe, map a network drive or copy some files around instead. Also check the event logs on the PC in case anything in there indicates a problem. Oct 31, 2009 at 0:11
  • The extension is very, very nearly irrelevant when comparing .BAT and .CMD. There is a slight difference in how CMD.EXE processes the file, but for all practical intents and purposes they are the same. serverfault.com/questions/17899/… Nov 9, 2009 at 2:09

5 Answers 5


The NETLOGON share is a special one that already exists not one that you create.

It is usually in C:\WINDOWS\sysvol\sysvol\*yourdomain*\scripts on the domain controller

  • Agreed - if you needed to manually create a NETLOGON share, something's wrong. Each domain controller in your domain should have one created automatically following dcpromo.
    – EEAA
    Oct 30, 2009 at 17:32
  • I use the default one, like "...\sysvol*yourdomain*\scripts"
    – Remus Rigo
    Oct 30, 2009 at 17:36
  • If the share doesn't exist by default you have problems. I would recommend running replmon to check for AD replication errors.
    – ITGuy24
    Oct 30, 2009 at 17:39
  • the folder exists by default (I set it as c:\Cfg\SYSVOL\sysvol\mydomain\scripts)
    – Remus Rigo
    Oct 30, 2009 at 17:48
  • @Remus - you shouldn't be setting this folder location
    – tomjedrz
    Oct 30, 2009 at 23:49

I don't think you have the correct folder. As EK noted, the NETLOGON share is created and shared by default. You should not have to do anything, and if you changed anything this is likely what is not working.

1- Make sure that the NETLOGON share is pointing to %SystemRoot%\sysvol\sysvol\\scripts. Check all of the Domain Controllers.

2- Make sure that the clients can see that share and the contents, including the script. Check all of the Domain Controllers.

3- Double click on the script, and make sure it runs. Troubleshoot any issues.

NOTE: I asked in a comment to the question about why you aren't using Group Policy. I would recommend using GPO for this instead of the user property page. It is far easier to manage and to deploy.

  • i used GPO for the local computer, set in User Configuration/Administrative Templates/System/Logon/Run these programs at user logon, restarted and it loads the specified logon.bat, but when I tryed the same thing for Default Domain Policy [my domanin], it doesn't work... (after server/clent pc restart)
    – Remus Rigo
    Oct 30, 2009 at 20:39
  • That's not the correct place for a logon script. See my answer. Oct 30, 2009 at 23:39
  • @mh - I agree that the location specified is not correct if GPO login scripts are used. But it is the correct place if the login script on the AD user property page is used, which was the original question. I also recommended that GPO is a better choice.
    – tomjedrz
    Oct 30, 2009 at 23:53
  • @Remus - mh gives a good start on using the GPO.
    – tomjedrz
    Oct 30, 2009 at 23:55
  • @tomjedrz: Not your answer, sorry; I meant "User Configuration/Administrative Templates/System/Logon/Run these programs at user logon" from the OP's comment. Oct 30, 2009 at 23:56

On the client open up a command prompt and enter the following:

gpupdate /force

That will force a Group Policy update. Restart and see if that helps.

Also, you might want to have the script do something else, such as create a text file on their Desktop, just to make sure the script itself isn't to blame.


Rather than running cmd.exe test it with something you know for sure will not be running during logon. Notepad.exe is a popular choice for this. Then, after logging on, don't just look to see if it's on the screen. Use the Task Manager to see if it's running.


Firstly, have a read of KB322241 for the official "how to" of logon scripts, including the correct place to put a logon script in a GPO. I am of the opinion that you should be using GPO logon scripts rather than the NETLOGON share because they give additional flexibility and reduced admin overhead; others prefer NETLOGON for reasons of their own, but let's start with GPO.

Follow the steps in the article I linked, making sure that you pay particular attention to getting the location right. The "Show Files" button is very handy here.

You're creating a user logon script, so ignore everything under Computer Configuration and go to User Configuration instead.

alt text
(source: computerperformance.co.uk)

Make sure you assign the logon script to a GPO which is linked to an OU which actually has users in it, otherwise it won't be applied. Default Domain Policy is OK for testing, but when you do it for real you probably won't want to put one there.

You should then use the Modelling or Results Wizard in the Group Policy Management Console to determine what policies are being applied to a given PC for a given user.

  • @mh - you commented in my answer about the script location. My answer is correct if the AD user login script is used.
    – tomjedrz
    Oct 30, 2009 at 23:50
  • @tomjedrz: Not your answer, sorry; I meant "User Configuration/Administrative Templates/System/Logon/Run these programs at user logon" from the OP's comment. Oct 30, 2009 at 23:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.