Logon Scripts

Logon scripts are groups of commands that run when a user logs on to a computer. Administrators design logon scripts to automate the process of configuring a user environment. Administrators use the tools described below to manage logon scripts for individual user accounts, especially those defined locally.

  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
Administrators use a different set of tools to manage scripts for groups of users and computers defined in Active Directory®. For more information about Group Policy startup, shutdown, logon, and logoff scripts, see Group Policy.


How to...

  • Assign a logon script to a user or group
  • Assign a logon script to a user in the Active Directory


Assign a logon script to a user or group

Microsoft Windows graphic

To assign a logon script to a user or group

  1. Open Computer Management.
  2. In the console tree, click Users.

    Where?

    • System Tools
    • Local Users and Groups
    • Users
  3. Double-click the user to which you want to assign a logon script.
  4. Click the Profile tab.
  5. In the Logon script field, enter the path and name of the logon script you want to assign to that user, and then click OK.

Notes

  • XOX
  • XOX
  • You can store local logon script files in any local or shared folder that the user can access during logon.
  • For most members of the Windows Server 2003 family, the default location for local logon scripts is the %systemroot%\System32\Repl\Imports\Scripts folder, which is shared using the share name netlogon. However, XOX, does not create this folder.

Related Topics


Assign a logon script to a user in the Active Directory

Microsoft Windows graphic

To assign a logon script to a user in the Active Directory

  1. Open Active Directory Users and Computers.
  2. In the console tree, click Users.
  3. Double-click the user to which you want to assign the logon script.
  4. Click the Profile tab.
  5. In the Logon script field, type the path and name of the logon script you want to assign to that user, and then click OK.

Notes

  • XOX
  • XOX

Related Topics


Concepts

This section provides general background information about logon scripts:

  • Logon scripts overview
  • Understanding logon scripts
  • Logon script assignment
  • Logon script replication
  • Environment variables


Logon scripts overview

A system administrator can use logon scripts to assign tasks that will be automatically performed whenever a user logs on to a particular computer system. These scripts can use system environment variables, and can also call other scripts or executable programs. Logon scripts are frequently used to map network drives, start background processes, and initialize user environment variables.


Understanding logon scripts

A logon script runs automatically whenever a user logs on to a computer running a member of the Windows Server 2003 family of operating systems. The script can contain operating system commands, such as those that make network connections or start programs. Logon scripts can also set environment variables to specify information such as the computer search path and the directory for temporary files. A logon script is usually a batch file (.bat or .cmd file name extension), but any executable program can be used.

Logon scripts are optional. You can use them to configure user working environments by creating network connections and starting programs. Logon scripts are useful when you want to affect the user work environment without managing all aspects of it.

Script files are text files that contain script commands. The Windows Server 2003 family of operating systems supports these types of scripts:

  • Batch file commands are stored in text files with the .bat or .cmd file name extension. Batch files automate simple series of tasks that would otherwise be run from a command line. Scripts written using batch file commands are run by the command shell. For more information about the command shell, see Command shell overview.
  • Visual Basic Scripting Edition (VBScript) commands are stored in text files with the .vbs file name extension, and JScript commands are stored in text files with the .js file name extension. VBScript and JScript allow the administrator to construct sophisticated scripts. The Windows Script Host can run these scripts from the desktop of the computer, or from a command line. For more information about the Windows Script Host, see Windows Script Host.

After you create a logon script, you can assign it to one or more local users, sites, domains, or organizational units (OUs).

For more information about specific tasks related to assigning scripts, see How To.


Logon script assignment

On computers running operating systems in the Windows Server 2003 family, you can assign a logon script to a user account. When a user logs on and a path to a logon script is present in the user account, the file is located and run.

You can also assign logon and logoff scripts, and computer startup and shutdown scripts by using the Group Policy snap-in. These scripts apply to the entire scope of users and computers for which a particular Group Policy object applies.

In Computer Management, you can use the User Property dialog box to assign logon scripts to user accounts by typing the file name (for example, Clerks.bat) in the Logon script text box. At logon, the server authenticating the logon locates an assigned logon script. It looks for the specified file following the local logon script path on the server (usually %systemroot%\SYSVOL\sysvol\domain_name\scripts). If a relative path is provided before the file name (for example, Admins\User1.bat), the server looks for the logon script in that subdirectory of the logon script path.

The entry in the Logon Script text box specifies only the file name (and, optionally, the relative path) and does not create the actual logon script. You create a logon script with the specified name and place it in the appropriate directory on the appropriate replication export server.

You can place a logon script in a local directory on a user's computer. You would typically use this location, however, when you are administering user accounts that exist on a single computer rather than in a domain. This logon script runs only when a user logs on locally to the computer and does not run when the user logs on to the domain. You must place the logon script using the computer's logon script path or in a subdirectory of that logon script path. The default location for local logon scripts is the %systemroot%\System32\Repl\Imports\Scripts folder. This folder is not created on an new installation of XOX. A folder must be created and shared with the name netlogon; for step-by-step instructions, see To share a folder or drive. The NTFS permissions of this folder should allow users and server operators only read and execute permissions, and should allow administrators full control. The folder is created and shared automatically on domain controllers, so you should not attempt to create a netlogon folder on a domain controller manually.

For more information, see: How to, Group Policy Overview, and Privileges.


Logon script replication

A logon script is always downloaded from the server that validates a user's logon request. For users with accounts on Windows Server 2003 family domains that have one or more domain controllers, any one of the domain controllers can authorize a user's logon attempt. In order for logon scripts to always work for users, logon scripts must exist for all user accounts in a domain, on every domain controller in that domain.

XOX, domain controllers and servers use File Replication Service (FRS) to replicate system policy and logon scripts to every domain controller in a domain. When you make a change to a logon script stored in the SYSVOL share of a domain controller, FRS replicates this change to the SYSVOL shares of all other domain controllers in the domain. If the administrator manages scripts for a domain using Active Directory Users and Computers, then the logon scripts are typically located in the %systemroot%\SYSVOL\sysvol\domain_name\Scripts folder. The system will look for scripts in the netlogon share of the domain controller that authenticates the user.

If the administrator uses Group Policy to manage logon scripts on a standalone system, then the user logon scripts are typically located in the %systemroot%\System32\GroupPolicy\User\Scripts\Logon directory.

For specific information on how to configure the logon script path for a user in a domain, see To assign a logon script to a user in the Active Directory.

For background information about replication, see Understanding sites and replication and Replication overview.

For instructions about configuring replication, see Configure replication between sites.


Environment variables

When managing multiple user and group accounts, you may need to make the same change to many accounts. You can use environment variables to replace static names or labels with a dynamic variable. The dynamic variable is replaced by the appropriate environment data when called.

Changing the system environment variables

Servers running Windows Server 2003 require certain information to find programs, to allocate memory space for some programs to run, and to control various programs. This information, called the system and user environment variables, can be viewed using the System Properties in Control Panel on the Advanced tab. These environment variables are similar to those that can be set in the MS-DOS operating system, such as PATH and TEMP.

The system environment variables are the same regardless who is logged on to the computer. If you are logged on as a member of the Administrators group, you can add new variables or change the values.

The user environment variables can be different for each user of a particular computer. They include any environment variables you want to define, or variables defined by your applications, such as the path where application files are located.

After you change any environment variables, the new values are saved in the registry, making them automatically available the next time you start your computer.

If any conflict exists between environment variables, variables are set in this way:

  • System environment variables are set first.
  • Variables defined in the Autoexec.bat file (except for Path variables) are set next, and override system variables.
  • User environment variables defined in System Properties are set next, and override both the system and Autoexec.bat variables.
  • Path variables defined in the Autoexec.bat file are set last.

Path settings, unlike other environment variables, are cumulative. The full path (what you see when you type path at the command prompt) is created by appending the path contained in Autoexec.bat to the paths defined in System Properties in Control Panel.

Using system environment variables in user profile paths, home directory paths, and logon scripts

Any system environment variable on a Windows-based client computer can be used in a user account profile path, logon script path, home directory path, and within a logon script itself. For a list of system environment variables, see Command shell overview

This feature helps to ensure that logon scripts and user profiles run most efficiently on domains that span wide area network (WAN) links, especially if users work at more than one site.

For example, suppose you have two physical sites, one located in Paris, and the other located in London. On every computer running an operating system in the Windows Server 2003 family at the London site, you can set the servername system environment variable to the computer name of a backup domain controller in London. On the computers in Paris, you can set servername in a similar way, using the computer name of the backup domain controller in Paris. In every user account in the domain, you can use %servername% in the logon script paths. In this instance, you can set the logon script path to \\%servername%\scripts. When a user logs on, the logon script is always loaded from a server at the local site.

For more information, see the Resource Kit.

For more information about constructing scripts, see System Administration Scripting Guide at the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/)