2

I have a PowerShell .PS1 script that I am trying to get to apply via a logon script with Group Policy. Here is the .PS1 script (very simple, just adds the user to RD Users group):

net localgroup "Remote Desktop Users" "$env:USERDOMAIN\$env:USERNAME" /add

According to RSoP.msc and GPresult, the GPO is getting applied without issue. I can run the PS1 manually and it works (albeit as Admin and with Set-ExecutionPolicy Unrestricted). However, the script is not working, because the user logging in never gets added to the "Remote Desktop Users" group.

In RSoP.msc under "last executed" time it is blank for the script. I'd like to look in Event Viewer to get a better idea of why the script isn't working, but am not sure what to look for exactly.

EDIT: Apparently the logon script must run as the logged on user, so it inherits whatever permissions said user has (or rather, does not have). I am going to try and run the script computer-side to see if it will work without the end-user having local admin rights since it will be using a system account.

  • What's the script execution policy? – Davidw Jul 18 '17 at 17:14
  • 1
    Try using &"net localgroup "Remote Desktop Users" "$env:USERDOMAIN\$env:USERNAME" /add" in the script. That will invoke it as cmd.exe, rather than Powershell. – Davidw Jul 18 '17 at 21:16
  • 1
    make it a start up script won't work either unless you know which user to add (i.e. hardcoding user name). – strongline Jul 21 '17 at 17:21
  • 1
    I'm trying a slightly different tack, running it from a scheduled task using group policy. – Davidw Jul 24 '17 at 16:56
  • 1
    It appears that it's not working as a scheduled task either. Computer Config > Policies > Admin Templates > System > Logon: Run these programs at user logon (the PS1 script) is for setting which script runs first. – Davidw Jul 25 '17 at 19:30
1

I was able to run it as a scheduled task deployed via Group Policy, using System as the account to run the scheduled task.

Create a new scheduled task under Computer Configuration > Preferences > Control Panel Settings > Scheduled Tasks, choosing the Scheduled Task (Windows Vista and Later) task type:

Task type

Task location

Set the account to NT AUTHORITY/System, and set to run with highest privileges: Task privilage

Set it to trigger at log on of any user: ![Task trigger

Select Start a program under action, set Powershell.exe as the program/script, and the path to the script as the argument: Task action

Leave all other tabs unchanged.

When the user logs in, they should see a powershell window show up, and by checking lusrmgr.msc, you should see the user in the specified group: User added to the group

  • Excellent info, David! I will try this out ASAP... – KidACrimson Aug 6 '17 at 23:37
  • I tried, but could not get this to work. Thank you anyhow though. – KidACrimson Oct 19 '17 at 13:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.