Create or select an Organizational Unit that will hold your logon-restricted users.
Move users into the group (if necessary).
Create a group policy object and apply to the OU
Edit the group policy object. Navigate to:
User Configuration > Policies > Administrative Templates > System
and set the policy named "Custom User Interface" to &...
I'd recommend creating a Scheduled Task on each machine with a Logon Trigger so that it executes your script when any user logs on. The task itself can run under SYSTEM or Local Service or whatever.
You can configure your script so that it removes the Scheduled Task when it's done, although if it's supposed to run with every user that logs on (since you were ...
From the messages in your question, I assume the app is properly signed with a trusted certificate. If you want to avoid the regular Java security prompt, consider using Deployment Rule Set. You can define rules based on the location of the app or its signing certificate.
When ruleset.xml is ready, package it into DeploymentRuleSet.jar and sign. Then deploy ...
GPOs don't reboot a system, so you need something else e.g. based on shutdown -r.
Future machines don't need that as they pull GPOs as soon as they've joined the domain (and were possibly moved to the appropriate OU). Usually, that's part of plattform installation where a machine is restarted a few times anyway.
This is an old question but there is shockingly not an abundance of information regarding Windows FW rule management via GPO:
This has to do with group policy applied FW rules only updating the registry path at hklm\software\policies\microsoft\windowsfirewall\firewallrules. For example, when you try to enumerate the FW rules throgh netsh advfirewall ...
Not to necro this thread, but in case others run into this issue:
The issue (I believe) is that your script is located in a directory that lacks the required permissions. When you go to add your logon.bat to the logon settings in your GPO make sure to move the logon.bat to the folder that the "add" then "browse" button defaults to and not ...
Kudos in taking caution in your approach.
Download the ADMX templates from Microsoft and copy them into your Central Store. It's not any more difficult than that.
Just copy the admx/adml files to the location. Group Policy templates are backwards compatible with previous versions. You should not copy these from a Windows 10 installation, but use the official download from Microsoft.