GPO Issue, "Run these programs at user logon" - Weird issue.


Recommended Posts

Ok weird issue here, have a GPO applied to group of computers and "Authenticated Users". GPO is working fine for the most part, except the contents of the GPO.

Computer Config>Policies>Administrative Templates>System>Logon is there "Run these programs at user logon" resides. I have 1 program already there, it basically launches a 3rd party app with a disclaimer with an "I accept" and "I decline" button. That works fine, I can edit that line in the GPO at the server, do a GPUPDATE /FORCE on server and client and see the changes. It is entry: 1

Entry 2: is a second app. I can add it to GPO, do a GPUPDATE /FORCE on server and client. It never shows in the registry at HKLM>Software>Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run in the list with "1" above

It was previously in there, we took it out because of some issues, fixed the issues, added it back.

Now the weird part, if I add it twice to the GPO list, it will show up in the registry area above once I go the GPUPDATE /FORCE. But it is entry "3". It totally skips over entry "2". See this pic: https://dl.dropboxusercontent.com/u/111413/gpo-issue.jpg

Any ideas anyone?

  On 19/11/2015 at 15:44, Daedroth said:

Try running RSOP against the client machine/user to see what's going on with the policies that are being applied.

Yeah RSOP looks good. see: https://dl.dropboxusercontent.com/u/111413/gpo-issue-rsop.jpg

Interesting, so I change a filename to make the entry different then the previously used one

From: \\srv-dc01\netlogon\cc\runasspc.exe /cryptfile:\\srv-dc01\netlogon\cc\crypt.spc /quiet

To: \\srv-dc01\netlogon\cc\runasspc.exe /cryptfile:\\srv-dc01\netlogon\cc\crypt1.spc /quiet

And it took :/ that's really weird....

  On 19/11/2015 at 16:12, xendrome said:

Interesting, so I change a filename to make the entry different then the previously used one

From: \\srv-dc01\netlogon\cc\runasspc.exe /cryptfile:\\srv-dc01\netlogon\cc\crypt.spc /quiet

To: \\srv-dc01\netlogon\cc\runasspc.exe /cryptfile:\\srv-dc01\netlogon\cc\crypt1.spc /quiet

And it took :/ that's really weird....

I noticed that you are using the Computer Configuration side of the GPO for this. Is there a reason you're using that instead of the User Configuration? From my (limited/brief) experience with GP, Computer Configuration is applied when the computer starts up, using system credentials. If I want something to apply to a user account, or start something when the user logs on, I use the User Configuration side of the GPO.

Out of curiosity, what happens if you stick it in the User Configuration?

  On 20/11/2015 at 08:17, Daedroth said:

I noticed that you are using the Computer Configuration side of the GPO for this. Is there a reason you're using that instead of the User Configuration? From my (limited/brief) experience with GP, Computer Configuration is applied when the computer starts up, using system credentials. If I want something to apply to a user account, or start something when the user logs on, I use the User Configuration side of the GPO.

Out of curiosity, what happens if you stick it in the User Configuration?

Well according to Microsoft the different is, Computer Config applies to Computers and User Config appies to users, so HKLM (All users) vs (HKCU). The danger for a setting like this in using it under the User Config is, there will be an entry in every users registry hive, so if you remove something via GPO and it fails, you'll have to automate a script to clean up that reg entry for every user at logon or run on demand. By running it under Computer Config it puts it in HKLM and is 1 settings for all/any user.

This topic is now closed to further replies.
  • Posts

    • The government should force Microsoft support w10 longer, the amount of ewaste that Microsoft is causing with w11 will be massive
    • Firefox 140 released bringing custom search engine, new ESR, and more by David Uzondu Firefox 140 is out now for the stable channel. After a period in testing, several features from the beta released in May made their way to the stable channel, bringing some much-needed quality-of-life improvements. The main highlights are a new Tab Unload feature and the ability to add a custom search engine. To use the tab unload feature, you simply right-click on a single tab or a selection of tabs and hit "Unload Tab". This kicks the tab out of your computer's memory, freeing up system resources without you having to close it for good. If you are someone who keeps a lot of tabs open, this could definitely help if your machine starts to chug. The other big thing is support for a custom search engine. If you want to use something other than the pre-packaged options, you can now add it by right-clicking a search field on a site or by manually adding it in the settings. If you are a fan of vertical tabs, you can now drag a divider to resize the pinned tabs section. On the flip side, some things are getting the boot. The Pocket integration, including its toolbar icon and New Tab presence, has been removed completely. This follows the service's shutdown announcement and cleans up the interface a bit, for better or worse, depending on how much you used it. As you may know, 140 is also the new base for the next Extended Support Release (ESR). This version brings a massive number of updates that non-ESR users have had for a while. ESR is for organizations that prefer stability over new features. The new ESR brings in a massive number of features that standard users have had for a while, like vertical tabs, tab grouping, a redesigned sidebar, and better privacy protections like bounce tracking protection. Other notable improvements in the main Firefox 140 release include: The full-page translation tool now works smarter, prioritizing the text in your current view to speed things up. Address autofill support has been rolled out to users in Italy, Poland, and Austria. Firefox builds in Arabic now come with a built-in dictionary for the spellchecker. For web developers, there is new platform support for a variety of APIs, including the CookieStore API and Service Workers in Private Browsing Mode. You can now remove the dedicated extensions button from the main toolbar. If you're interested in this release, you can grab a build for your operating system from our Software Stories page. Release notes for Firefox 140 and the ESR version are also available.
    • well that's just the basics. on every new windows (or android) install, turn off all UI animations, and all system sounds. then the rest.
    • Yet another Chromium-based AI-using browser?
  • Recent Achievements

    • First Post
      956400 earned a badge
      First Post
    • Week One Done
      davidfegan earned a badge
      Week One Done
    • First Post
      Ainajohn earned a badge
      First Post
    • Conversation Starter
      sophiaisabella32 earned a badge
      Conversation Starter
    • First Post
      Brett76 earned a badge
      First Post
  • Popular Contributors

    1. 1
      +primortal
      602
    2. 2
      ATLien_0
      223
    3. 3
      Michael Scrip
      179
    4. 4
      +FloatingFatMan
      142
    5. 5
      Xenon
      135
  • Tell a friend

    Love Neowin? Tell a friend!