I have a PowerShell .PS1 script that I am trying to get to apply via a logon script with Group Policy. Here is the .PS1 script (very simple, just adds the user to RD Users group):

net localgroup "Remote Desktop Users" "$env:USERDOMAIN\$env:USERNAME" /add

According to RSoP.msc and GPresult, the GPO is getting applied without issue. I can run the PS1 manually and it works (albeit as Admin and with Set-ExecutionPolicy Unrestricted). However, the script is not working, because the user logging in never gets added to the "Remote Desktop Users" group.

In RSoP.msc under "last executed" time it is blank for the script. I'd like to look in Event Viewer to get a better idea of why the script isn't working, but am not sure what to look for exactly.

EDIT: Apparently the logon script must run as the logged on user, so it inherits whatever permissions said user has (or rather, does not have). I am going to try and run the script computer-side to see if it will work without the end-user having local admin rights since it will be using a system account.

  • What's the script execution policy?
    – Davidw
    Jul 18, 2017 at 17:14
  • 1
    Try using &"net localgroup "Remote Desktop Users" "$env:USERDOMAIN\$env:USERNAME" /add" in the script. That will invoke it as cmd.exe, rather than Powershell.
    – Davidw
    Jul 18, 2017 at 21:16
  • 1
    make it a start up script won't work either unless you know which user to add (i.e. hardcoding user name).
    – strongline
    Jul 21, 2017 at 17:21
  • 1
    I'm trying a slightly different tack, running it from a scheduled task using group policy.
    – Davidw
    Jul 24, 2017 at 16:56
  • 1
    It appears that it's not working as a scheduled task either. Computer Config > Policies > Admin Templates > System > Logon: Run these programs at user logon (the PS1 script) is for setting which script runs first.
    – Davidw
    Jul 25, 2017 at 19:30

1 Answer 1


I was able to run it as a scheduled task deployed via Group Policy, using System as the account to run the scheduled task.

Create a new scheduled task under Computer Configuration > Preferences > Control Panel Settings > Scheduled Tasks, choosing the Scheduled Task (Windows Vista and Later) task type:

Task type

Task location

Set the account to NT AUTHORITY/System, and set to run with highest privileges: Task privilage

Set it to trigger at log on of any user: ![Task trigger

Select Start a program under action, set Powershell.exe as the program/script, and the path to the script as the argument: Task action

Leave all other tabs unchanged.

When the user logs in, they should see a powershell window show up, and by checking lusrmgr.msc, you should see the user in the specified group: User added to the group

  • Excellent info, David! I will try this out ASAP... Aug 6, 2017 at 23:37
  • I tried, but could not get this to work. Thank you anyhow though. Oct 19, 2017 at 13:09
  • same here , No luck :(
    – Mak
    Sep 30, 2019 at 10:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .