1

I'm managing Windows VMs in AWS ASGs that are not attached to a domain. I want to run a script at shutdown (not logoff) to remove these nodes from Chef, and I want to create/register the scripts using Chef. I have the removal script ready, it's getting them to run at shutdown that I cannot find an implementation for.

I can do it manually via gpedit.msc Local Computer Policy -> Computer Configuration -> Windows Settings -> Scripts (Start/Shutdown) -> Shutdown. This places the scripts in C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Shutdown. Unfortunately:

  • It looks like the scripts directories are only created when gpedit.msc is first run, and it's unclear if creating them manually is valid
  • Just placing scripts there does not on its own seem to register them - they don't show up in gpedit.msc
  • Placing the script and running gpupdate /force (as suggested here) also doesn't cause it to show up in gpedit, though gpupdate did suggest a reboot may be required to apply some changes - that's not an option as a reboot in an ASG may cause instance termination and replacement

I'm aware of a possible use of Task Scheduler to run a script at shutdown, but (from my research at least) it seems that the key difference is that a task scheduler shutdown script only has as much time to run as the system takes to shutdown, whereas a GPO shutdown script will postpone shutdown until it finishes.

So, the question is: is there a way, via Chef (i.e. via PowerShell, DSC, or batch script) to register a GPO shutdown script on a machine not attached to AD without rebooting?

1

Try using this LGPO utility. You should be able to use the GUI to config the shutdown script on a pilot machine, back it up with LGPO, and then use LGPO to import it onto newly built systems.

https://blogs.technet.microsoft.com/secguide/2016/01/21/lgpo-exe-local-group-policy-object-utility-v1-0/

  • Restoring the backup doesn't seem to be sufficient to enable the script, even after manually writing the script to the dir - any ideas why or how to make it happen? – Adrian Aug 9 '17 at 19:52
  • Sorry for the false lead. Despite what the doc says, the backups from LGPO seem to be more focused on Local Security and Audit settings. I could not get it to work on 2012 R2 for shutdown scripts. I also tried manual registry & file copies described here While they may work on XP (how the post is tagged) they did not work for me on 2012 R2. – Clayton Aug 10 '17 at 14:58
  • Reading through some other answers and the dump from LGPO got me there - I'll post an answer that worked for me on Win2016. – Adrian Aug 10 '17 at 15:00
1

Thanks to insight from @Clayton's answer and from this answer to another question, I was able to get it working on Win2016. I had to create C:\Windows\System32\GroupPolicy\Machine\Scripts\psscripts.ini:

[Startup]
0CmdLine=C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Shutdown\seppuku.ps1
0Parameters=

As well as set a slew of registry keys:

  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0
  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown\0\0
  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown\0
  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Scripts\Shutdown\0\0
  • HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown\0
  • HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown\0\0

Those ending in \Shutdown\0 get policy values:

"GPO-ID"="LocalGPO"
"SOM-ID"="Local"
"FileSysPath"="C:\\Windows\\System32\\GroupPolicy\\Machine"
"DisplayName"="Local Group Policy"
"GPOName"="Local Group Policy"
"PSScriptOrder"=dword:00000001

Those ending in \Shutdown\0\0 get script values:

"Script"="C:\\WINDOWS\\System32\\GroupPolicy\\Machine\\Scripts\\Shutdown\\seppuku.ps1"
"Parameters"=""
"IsPowershell"=dword:00000001
"ExecTime"=hex(b):00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00

This is for a PowerShell shutdown script located at C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Shutdown\seppuku.ps1. Setting all this is a pain but entirely possible using Chef, and after a converge, I see the script registered in gpedit.msc. I have yet to fully confirm the script actually executes at shutdown, that's my next step, but I believe it should.

  • What should psscripts.ini look like? I seem to only be able to edit this file in windows explorer... – jjxtra Feb 19 '18 at 2:30
  • It's in the linked answer, but I'll copy it to mine. – Adrian Feb 19 '18 at 13:20
  • Thanks! How did you create the psscripts.ini file, it seems that this is read-only? Even run as admin and saving does not seem to actually save anything, it stays blank. I'm hoping to do all of this in a script or C# program... – jjxtra Feb 19 '18 at 18:51
  • I've not had that problem, I was able to write the file from a Chef recipe (which runs as administrator) on Windows Server 2016. – Adrian Feb 19 '18 at 19:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.