Logon Script - VBScript

  • Thread starter Thread starter King
  • Start date Start date
K

King

Hi,

I have a Vista Business just installed for testing, all most is working
fine, except for the Logon Script which I created in VBScript to map network
share in servers.

The Vista can logon to the domain and I see it run the logon script, but the
Vista won't map any network share, the script just run, finished and no
error occurs, no drive mapped. If I manual run the same logon script, it map
the network drive successfully.

Does anyone have similar problem (network won't map when logon), and have
solutions on this?

Thanks for help.

King
 
King said:
Hi,

I have a Vista Business just installed for testing, all most is working
fine, except for the Logon Script which I created in VBScript to map
network
share in servers.

The Vista can logon to the domain and I see it run the logon script, but
the
Vista won't map any network share, the script just run, finished and no
error occurs, no drive mapped. If I manual run the same logon script, it
map
the network drive successfully.

Does anyone have similar problem (network won't map when logon), and have
solutions on this?

Thanks for help.

King
Click to expand...

King,

Does the script work on an XP or even '9x machine? It might be a good idea
to post the code here so we can take a look at it and see what's going on
(or, what's *not* going on).
 
From: http://technet2.microsoft.com/Windo...878e-48db-a3c1-4be6ac7cf7631033.mspx?mfr=true

<quote>

UAC may prevent Group Policy logon scripts from appearing to work properly. For example, a domain environment contains a Group Policy object that includes a logon script to map network drives. A nonadministrative user logs on to the domain from a Windows Vista computer. After Windows Vista loads the desktop, the nonadministrative user starts Windows Explorer. The user sees their mapped drives. Under the same environment, an administrative user logs on to the domain from a Windows Vista computer. After Windows Vista loads the desktop, the administrative user starts Windows Explorer. The user does not see their mapped drives.
When the administrative user logs on, Windows processes the logon scripts using the elevated token. The script actually works and maps the drive. However, Windows blocks the view of the mapped network drives because the desktop uses the limited token while the drives were mapped using the elevated token.
To get around this issue, administrative users should map network drives under the limited user token. This mapping is accomplished by using the launchapp.wsf script shown in Appendix A, which works by scheduling the commands using the task scheduler. The task scheduler launches the script under the administrative full token, thereby allowing Windows Explorer, other limited token processes, and the elevated token process to view the mapped network drives.

</quote>

© 2007 Microsoft Corporation. All rights reserved.

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows Shell/User]
Windows® Troubleshooting http://www.winhelponline.com


Hi,

I have a Vista Business just installed for testing, all most is working
fine, except for the Logon Script which I created in VBScript to map network
share in servers.

The Vista can logon to the domain and I see it run the logon script, but the
Vista won't map any network share, the script just run, finished and no
error occurs, no drive mapped. If I manual run the same logon script, it map
the network drive successfully.

Does anyone have similar problem (network won't map when logon), and have
solutions on this?

Thanks for help.

King
 
Hi Ramesh,

Thanks very much for your information, your quote you provided is exactly
what the problem I have, as my account is under Local Administrators group
of Windows Vista, after I try logon with other domain account without Local
Admin rights, the logon script run and drive mapped successfully.

Thanks!

King

From:
http://technet2.microsoft.com/Windo...878e-48db-a3c1-4be6ac7cf7631033.mspx?mfr=true

<quote>

UAC may prevent Group Policy logon scripts from appearing to work properly.
For example, a domain environment contains a Group Policy object that
includes a logon script to map network drives. A nonadministrative user logs
on to the domain from a Windows Vista computer. After Windows Vista loads
the desktop, the nonadministrative user starts Windows Explorer. The user
sees their mapped drives. Under the same environment, an administrative user
logs on to the domain from a Windows Vista computer. After Windows Vista
loads the desktop, the administrative user starts Windows Explorer. The user
does not see their mapped drives.
When the administrative user logs on, Windows processes the logon scripts
using the elevated token. The script actually works and maps the drive.
However, Windows blocks the view of the mapped network drives because the
desktop uses the limited token while the drives were mapped using the
elevated token.
To get around this issue, administrative users should map network drives
under the limited user token. This mapping is accomplished by using the
launchapp.wsf script shown in Appendix A, which works by scheduling the
commands using the task scheduler. The task scheduler launches the script
under the administrative full token, thereby allowing Windows Explorer,
other limited token processes, and the elevated token process to view the
mapped network drives.

</quote>

© 2007 Microsoft Corporation. All rights reserved.

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows Shell/User]
Windows® Troubleshooting http://www.winhelponline.com


Hi,

I have a Vista Business just installed for testing, all most is working
fine, except for the Logon Script which I created in VBScript to map network
share in servers.

The Vista can logon to the domain and I see it run the logon script, but the
Vista won't map any network share, the script just run, finished and no
error occurs, no drive mapped. If I manual run the same logon script, it map
the network drive successfully.

Does anyone have similar problem (network won't map when logon), and have
solutions on this?

Thanks for help.

King
 
Excellent! Thanks for the update, King.

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows Shell/User]
Windows® Troubleshooting http://www.winhelponline.com


Hi Ramesh,

Thanks very much for your information, your quote you provided is exactly
what the problem I have, as my account is under Local Administrators group
of Windows Vista, after I try logon with other domain account without Local
Admin rights, the logon script run and drive mapped successfully.

Thanks!

King

From:
http://technet2.microsoft.com/Windo...878e-48db-a3c1-4be6ac7cf7631033.mspx?mfr=true

<quote>

UAC may prevent Group Policy logon scripts from appearing to work properly.
For example, a domain environment contains a Group Policy object that
includes a logon script to map network drives. A nonadministrative user logs
on to the domain from a Windows Vista computer. After Windows Vista loads
the desktop, the nonadministrative user starts Windows Explorer. The user
sees their mapped drives. Under the same environment, an administrative user
logs on to the domain from a Windows Vista computer. After Windows Vista
loads the desktop, the administrative user starts Windows Explorer. The user
does not see their mapped drives.
When the administrative user logs on, Windows processes the logon scripts
using the elevated token. The script actually works and maps the drive.
However, Windows blocks the view of the mapped network drives because the
desktop uses the limited token while the drives were mapped using the
elevated token.
To get around this issue, administrative users should map network drives
under the limited user token. This mapping is accomplished by using the
launchapp.wsf script shown in Appendix A, which works by scheduling the
commands using the task scheduler. The task scheduler launches the script
under the administrative full token, thereby allowing Windows Explorer,
other limited token processes, and the elevated token process to view the
mapped network drives.

</quote>

© 2007 Microsoft Corporation. All rights reserved.
 
I don't suppose Microsoft is going to address that particular problem?
After all, login scripts should work equally well for members of the
administrators group as they do for those who aren't administrators.

Using a scheduled task to work around the problem is hardly a good long term
solution.

Many thanks,
Joe

Excellent! Thanks for the update, King.

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows Shell/User]
Windows® Troubleshooting http://www.winhelponline.com


Hi Ramesh,

Thanks very much for your information, your quote you provided is exactly
what the problem I have, as my account is under Local Administrators group
of Windows Vista, after I try logon with other domain account without Local
Admin rights, the logon script run and drive mapped successfully.

Thanks!

King

From:
http://technet2.microsoft.com/Windo...878e-48db-a3c1-4be6ac7cf7631033.mspx?mfr=true

<quote>

UAC may prevent Group Policy logon scripts from appearing to work properly.
For example, a domain environment contains a Group Policy object that
includes a logon script to map network drives. A nonadministrative user logs
on to the domain from a Windows Vista computer. After Windows Vista loads
the desktop, the nonadministrative user starts Windows Explorer. The user
sees their mapped drives. Under the same environment, an administrative user
logs on to the domain from a Windows Vista computer. After Windows Vista
loads the desktop, the administrative user starts Windows Explorer. The user
does not see their mapped drives.
When the administrative user logs on, Windows processes the logon scripts
using the elevated token. The script actually works and maps the drive.
However, Windows blocks the view of the mapped network drives because the
desktop uses the limited token while the drives were mapped using the
elevated token.
To get around this issue, administrative users should map network drives
under the limited user token. This mapping is accomplished by using the
launchapp.wsf script shown in Appendix A, which works by scheduling the
commands using the task scheduler. The task scheduler launches the script
under the administrative full token, thereby allowing Windows Explorer,
other limited token processes, and the elevated token process to view the
mapped network drives.

</quote>

© 2007 Microsoft Corporation. All rights reserved.
 
This KB is a direct resolution to this issue. However it't an "unsupported" fix:

After you turn on User Account Control in Windows Vista, programs may be unable to access some network locations
http://support.microsoft.com/kb/937624



Joe Guidera wrote:

I don't suppose Microsoft is going to address that particular problem?
14-Apr-07

I don't suppose Microsoft is going to address that particular problem?
After all, login scripts should work equally well for members of the
administrators group as they do for those who aren't administrators.

Using a scheduled task to work around the problem is hardly a good long term
solution.

Many thanks,
Joe

Excellent! Thanks for the update, King.

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows Shell/User]
Windows? Troubleshooting http://www.winhelponline.com


Hi Ramesh,

Thanks very much for your information, your quote you provided is exactly
what the problem I have, as my account is under Local Administrators group
of Windows Vista, after I try logon with other domain account without Local
Admin rights, the logon script run and drive mapped successfully.

Thanks!

King

From:
http://technet2.microsoft.com/Windo...878e-48db-a3c1-4be6ac7cf7631033.mspx?mfr=true

<quote>

UAC may prevent Group Policy logon scripts from appearing to work properly.
For example, a domain environment contains a Group Policy object that
includes a logon script to map network drives. A nonadministrative user logs
on to the domain from a Windows Vista computer. After Windows Vista loads
the desktop, the nonadministrative user starts Windows Explorer. The user
sees their mapped drives. Under the same environment, an administrative user
logs on to the domain from a Windows Vista computer. After Windows Vista
loads the desktop, the administrative user starts Windows Explorer. The user
does not see their mapped drives.
When the administrative user logs on, Windows processes the logon scripts
using the elevated token. The script actually works and maps the drive.
However, Windows blocks the view of the mapped network drives because the
desktop uses the limited token while the drives were mapped using the
elevated token.
To get around this issue, administrative users should map network drives
under the limited user token. This mapping is accomplished by using the
launchapp.wsf script shown in Appendix A, which works by scheduling the
commands using the task scheduler. The task scheduler launches the script
under the administrative full token, thereby allowing Windows Explorer,
other limited token processes, and the elevated token process to view the
mapped network drives.

</quote>

? 2007 Microsoft Corporation. All rights reserved.

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows Shell/User]
Windows? Troubleshooting http://www.winhelponline.com

Previous Posts In This Thread:

I don't suppose Microsoft is going to address that particular problem?
I don't suppose Microsoft is going to address that particular problem?
After all, login scripts should work equally well for members of the
administrators group as they do for those who aren't administrators.

Using a scheduled task to work around the problem is hardly a good long term
solution.

Many thanks,
Joe

Excellent! Thanks for the update, King.

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows Shell/User]
Windows? Troubleshooting http://www.winhelponline.com


Hi Ramesh,

Thanks very much for your information, your quote you provided is exactly
what the problem I have, as my account is under Local Administrators group
of Windows Vista, after I try logon with other domain account without Local
Admin rights, the logon script run and drive mapped successfully.

Thanks!

King

From:
http://technet2.microsoft.com/Windo...878e-48db-a3c1-4be6ac7cf7631033.mspx?mfr=true

<quote>

UAC may prevent Group Policy logon scripts from appearing to work properly.
For example, a domain environment contains a Group Policy object that
includes a logon script to map network drives. A nonadministrative user logs
on to the domain from a Windows Vista computer. After Windows Vista loads
the desktop, the nonadministrative user starts Windows Explorer. The user
sees their mapped drives. Under the same environment, an administrative user
logs on to the domain from a Windows Vista computer. After Windows Vista
loads the desktop, the administrative user starts Windows Explorer. The user
does not see their mapped drives.
When the administrative user logs on, Windows processes the logon scripts
using the elevated token. The script actually works and maps the drive.
However, Windows blocks the view of the mapped network drives because the
desktop uses the limited token while the drives were mapped using the
elevated token.
To get around this issue, administrative users should map network drives
under the limited user token. This mapping is accomplished by using the
launchapp.wsf script shown in Appendix A, which works by scheduling the
commands using the task scheduler. The task scheduler launches the script
under the administrative full token, thereby allowing Windows Explorer,
other limited token processes, and the elevated token process to view the
mapped network drives.

</quote>

? 2007 Microsoft Corporation. All rights reserved.

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows Shell/User]
Windows? Troubleshooting http://www.winhelponline.com

EggHeadCafe - Software Developer Portal of Choice
Notify Client Applications Using WCF Callbacks
http://www.eggheadcafe.com/tutorial...8-457b3a4f137c/notify-client-application.aspx
 
Back
Top