GPO Issue, "Run these programs at user logon" - Weird issue.


Recommended Posts

Ok weird issue here, have a GPO applied to group of computers and "Authenticated Users". GPO is working fine for the most part, except the contents of the GPO.

Computer Config>Policies>Administrative Templates>System>Logon is there "Run these programs at user logon" resides. I have 1 program already there, it basically launches a 3rd party app with a disclaimer with an "I accept" and "I decline" button. That works fine, I can edit that line in the GPO at the server, do a GPUPDATE /FORCE on server and client and see the changes. It is entry: 1

Entry 2: is a second app. I can add it to GPO, do a GPUPDATE /FORCE on server and client. It never shows in the registry at HKLM>Software>Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run in the list with "1" above

It was previously in there, we took it out because of some issues, fixed the issues, added it back.

Now the weird part, if I add it twice to the GPO list, it will show up in the registry area above once I go the GPUPDATE /FORCE. But it is entry "3". It totally skips over entry "2". See this pic: https://dl.dropboxusercontent.com/u/111413/gpo-issue.jpg

Any ideas anyone?

  On 19/11/2015 at 15:44, Daedroth said:

Try running RSOP against the client machine/user to see what's going on with the policies that are being applied.

Yeah RSOP looks good. see: https://dl.dropboxusercontent.com/u/111413/gpo-issue-rsop.jpg

Interesting, so I change a filename to make the entry different then the previously used one

From: \\srv-dc01\netlogon\cc\runasspc.exe /cryptfile:\\srv-dc01\netlogon\cc\crypt.spc /quiet

To: \\srv-dc01\netlogon\cc\runasspc.exe /cryptfile:\\srv-dc01\netlogon\cc\crypt1.spc /quiet

And it took :/ that's really weird....

  On 19/11/2015 at 16:12, xendrome said:

Interesting, so I change a filename to make the entry different then the previously used one

From: \\srv-dc01\netlogon\cc\runasspc.exe /cryptfile:\\srv-dc01\netlogon\cc\crypt.spc /quiet

To: \\srv-dc01\netlogon\cc\runasspc.exe /cryptfile:\\srv-dc01\netlogon\cc\crypt1.spc /quiet

And it took :/ that's really weird....

I noticed that you are using the Computer Configuration side of the GPO for this. Is there a reason you're using that instead of the User Configuration? From my (limited/brief) experience with GP, Computer Configuration is applied when the computer starts up, using system credentials. If I want something to apply to a user account, or start something when the user logs on, I use the User Configuration side of the GPO.

Out of curiosity, what happens if you stick it in the User Configuration?

  On 20/11/2015 at 08:17, Daedroth said:

I noticed that you are using the Computer Configuration side of the GPO for this. Is there a reason you're using that instead of the User Configuration? From my (limited/brief) experience with GP, Computer Configuration is applied when the computer starts up, using system credentials. If I want something to apply to a user account, or start something when the user logs on, I use the User Configuration side of the GPO.

Out of curiosity, what happens if you stick it in the User Configuration?

Well according to Microsoft the different is, Computer Config applies to Computers and User Config appies to users, so HKLM (All users) vs (HKCU). The danger for a setting like this in using it under the User Config is, there will be an entry in every users registry hive, so if you remove something via GPO and it fails, you'll have to automate a script to clean up that reg entry for every user at logon or run on demand. By running it under Computer Config it puts it in HKLM and is 1 settings for all/any user.

This topic is now closed to further replies.
  • Posts

    • "all the way down" by 33 whole dollars. Amazing. You shouldn't have.
    • If they make a portable version, I might give it a try, but I will always prefer hotkeys to that approach
    • The Synology DS923+ is down to $610 just for today on Newegg by Steven Parker Right now on Newegg, and only for today (June 26) you can find the Synology DS923+ discounted all the way down to $609.99 when using a coupon during checkout, down from it's normal $642.99 price. Although we haven't reviewed the DS923+ on Neowin, we have seen Synology before and rated it quite highly. Besides, the DS1522 even has the same AMD R1600 CPU. Some people would consider Synology homelab NAS equipment the "gold standard", and as such, competitors strive to do as good, at least in regard to the Operating System, DSM, which ticks all the boxes for amateurs, professionals and small business users for its inclusion of mobile apps for core app services such as Surveillance Station, and more. Here are the most important specifications: Synology DS923+ CPU AMD Ryzen R1600 2-core 2.6 (base) / 3.1 (turbo) GHz Graphics No Memory 4 GB DDR4 SODIMM, maximum 32 GB (16 GB x 2) Disk Capacity 72 TB (18TB x 4) RAID Level RAID 0, 1, 5, 6, 10, and JBOD + SHR (Synology Hybrid RAID) Network 2 x RJ-45 1 GbE Internal storage 2 x M.2 2280 NVMe Slot USB Ports 1 x USB 3.2 (5 Gbps) HDMI 1 x Expansion 1 x eSATA 1 x Gen3 x2 network upgrade slot Size (H/W/D) 166 mm x 199 mm x 223 mm Weight 2.24 kg Power 35.51 W (Access) 11.52 W (HDD Hibernation) What's in the box? Main Unit X 1 Accessory Pack X 1 AC Power Adapter X 1 AC Power Cord X 1 RJ-45 LAN Cable X 2 Quick Installation Guide X 1 You may notice that the DS923+ does not have integrated graphics, which is a step down from earlier Intel-based models that did include an iGPU. However, even this year's model (the DS925+) does not include an iGPU with its slightly newer AMD Ryzen Embedded V1500B CPU, but also unhelpfully locks down what you can use in it. All 2025 models require hardware from Synology's own compatibility list, this currently does not affect the DS923+. In addition you are only getting dual 1 GB Ethernet with the DS923+, so you may need to factor in the cost of adding the 10 GbE PCIe network card, which sells for $110.99 on Newegg. Ultimately, deciding on a NAS device comes to down to your individual requirements. For example, more bays is not always better, especially once you factor in the price of hard drives. Those with more modest storage requirements may be better off with a 2-bay device. From my personal experience, DSM 7.2 is great, it's so great that I have installed it on my TerraMaster F4-424 Max. Finally, and perhaps more importantly many tinkerers would prefer building their own server which is definitely a cheaper option, but without the polish of a dedicated NAS. If you have no need to transcode video on the fly and want a four bay NAS device, then the DS923+ is a great solution for every other use case and I can highly recommend it. Synology DS923+ for $609.99 on Newegg (was $642.99) Enter coupon code SACET2369 for above price during checkout
    • I don't think it's childish, but I do think it would be ineffective. If I was addicted to social media I would just disable the extension when I wanted to visit the certain sites.
    • Did you copy SuperHands's post and just reword it 🤣
  • Recent Achievements

    • Conversation Starter
      Kavin25 earned a badge
      Conversation Starter
    • One Month Later
      Leonard grant earned a badge
      One Month Later
    • Week One Done
      pcdoctorsnet earned a badge
      Week One Done
    • Rising Star
      Phillip0web went up a rank
      Rising Star
    • One Month Later
      Epaminombas earned a badge
      One Month Later
  • Popular Contributors

    1. 1
      +primortal
      529
    2. 2
      ATLien_0
      207
    3. 3
      +FloatingFatMan
      168
    4. 4
      Michael Scrip
      150
    5. 5
      snowy owl
      126
  • Tell a friend

    Love Neowin? Tell a friend!