Home All Groups Group Topic Archive Search About

User authenticates, skips logon script

Author
26 Mar 2009 2:29 PM
MC Murphy
Server 2003 AD domain; GPO governs user logon; GPO includes a logon script. 
I have a user, not sure if it's the only user, who today does not execute the
logon script (drives aren't mapped, the log file the script writes to is not
modified by this logon).  GPO includes folder redirection, and that happens -
My Documents is set to her network My Documents.  Yesterday she logged on,
all was well.  This may be happening occasionally to others, my first advice
was "logout, login again" thinking that would fix as it usually does when I
get such a call.  It didn't.  How can I track this down?

Author
26 Mar 2009 4:01 PM
Ace Fekay [Microsoft Certified Trainer]
Show quote Hide quote
"MC Murphy" <MCMur***@discussions.microsoft.com> wrote in message
news:555BFC7B-FFB8-4FDF-88CF-23C6751C796D@microsoft.com...
> Server 2003 AD domain; GPO governs user logon; GPO includes a logon
> script.
> I have a user, not sure if it's the only user, who today does not execute
> the
> logon script (drives aren't mapped, the log file the script writes to is
> not
> modified by this logon).  GPO includes folder redirection, and that
> happens -
> My Documents is set to her network My Documents.  Yesterday she logged on,
> all was well.  This may be happening occasionally to others, my first
> advice
> was "logout, login again" thinking that would fix as it usually does when
> I
> get such a call.  It didn't.  How can I track this down?

By chance, was the workstation or laptop locked, and they simply logged back
in? Or were they offline at the time of logging back in, which would use
Cached Credentials?

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSA Messaging, MCT
Microsoft Certified Trainer
ace***@mvps.RemoveThisPart.org

For urgent issues, you may want to contact Microsoft PSS directly. Please
check http://support.microsoft.com for regional support phone numbers.
Author
26 Mar 2009 4:51 PM
MC Murphy
I restarted the computer after the first occurrence, then it happened again. 
I logged in a test acount on the machine, it executed the script (mappe
drives, etc).  Then she logged in again, still no login script.  Thanks.

Show quoteHide quote
"Ace Fekay [Microsoft Certified Trainer]" wrote:

>
> "MC Murphy" <MCMur***@discussions.microsoft.com> wrote in message
> news:555BFC7B-FFB8-4FDF-88CF-23C6751C796D@microsoft.com...
> > Server 2003 AD domain; GPO governs user logon; GPO includes a logon
> > script.
> > I have a user, not sure if it's the only user, who today does not execute
> > the
> > logon script (drives aren't mapped, the log file the script writes to is
> > not
> > modified by this logon).  GPO includes folder redirection, and that
> > happens -
> > My Documents is set to her network My Documents.  Yesterday she logged on,
> > all was well.  This may be happening occasionally to others, my first
> > advice
> > was "logout, login again" thinking that would fix as it usually does when
> > I
> > get such a call.  It didn't.  How can I track this down?
>
> By chance, was the workstation or laptop locked, and they simply logged back
> in? Or were they offline at the time of logging back in, which would use
> Cached Credentials?
>
> --
> Ace
>
> This posting is provided "AS-IS" with no warranties or guarantees and
> confers no rights.
>
> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSA Messaging, MCT
> Microsoft Certified Trainer
> ace***@mvps.RemoveThisPart.org
>
> For urgent issues, you may want to contact Microsoft PSS directly. Please
> check http://support.microsoft.com for regional support phone numbers.
>
>
Author
26 Mar 2009 5:03 PM
Ace Fekay [Microsoft Certified Trainer]
In news:E43A1F35-8C82-4733-BA83-71033E667533@microsoft.com,
MC Murphy <MCMur***@discussions.microsoft.com>, posted the following:
> I restarted the computer after the first occurrence, then it happened
> again. I logged in a test acount on the machine, it executed the
> script (mappe drives, etc).  Then she logged in again, still no login
> script.  Thanks.
>

I assume the workstation only has the internal DNS server in it's IP
proprties, otherwise various issues will occur.

Run an RSOP using the GPMC to confer that the machine is in the scope of the
GPO. Also run a gpresults on the machine when it does work, and when it does
not work and compare the results.

Also assuming replication is working, on the machine, run "echo
%logonserver% to see which DC authenticated the user. Check that DC for any
replication problems. When you specifiy a logon script in a GPO, it gets
stored in the Sysvol, which is supposed to replicate automatically to all
DCs' sysvol locations. If one is having repl problems, it may not get a copy
of the file, therefore there is nothing to run.

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSA Messaging, MCT
Microsoft Certified Trainer
ace***@mvps.RemoveThisPart.org

For urgent issues, you may want to contact Microsoft PSS directly. Please
check http://support.microsoft.com for regional support phone numbers.
Author
26 Mar 2009 8:25 PM
MC Murphy
gpresults showed for both the user and the machine:
Group Policy was applied from:      CDC-UTILWINB.CDCFCUNET.local
    Group Policy slow link threshold:   500 kbps

    Applied Group Policy Objects
    -----------------------------
        CDC OU Policy
Her logonserver was a different domain controller, but I checked SYSVOL on
all domain controllers, in the correct GPO folder, they all have a current
logon.vbs

Show quoteHide quote
"Ace Fekay [Microsoft Certified Trainer]" wrote:

> In news:E43A1F35-8C82-4733-BA83-71033E667533@microsoft.com,
> MC Murphy <MCMur***@discussions.microsoft.com>, posted the following:
> > I restarted the computer after the first occurrence, then it happened
> > again. I logged in a test acount on the machine, it executed the
> > script (mappe drives, etc).  Then she logged in again, still no login
> > script.  Thanks.
> >
>
> I assume the workstation only has the internal DNS server in it's IP
> proprties, otherwise various issues will occur.
>
> Run an RSOP using the GPMC to confer that the machine is in the scope of the
> GPO. Also run a gpresults on the machine when it does work, and when it does
> not work and compare the results.
>
> Also assuming replication is working, on the machine, run "echo
> %logonserver% to see which DC authenticated the user. Check that DC for any
> replication problems. When you specifiy a logon script in a GPO, it gets
> stored in the Sysvol, which is supposed to replicate automatically to all
> DCs' sysvol locations. If one is having repl problems, it may not get a copy
> of the file, therefore there is nothing to run.
>
> --
> Ace
>
> This posting is provided "AS-IS" with no warranties or guarantees and
> confers no rights.
>
> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSA Messaging, MCT
> Microsoft Certified Trainer
> ace***@mvps.RemoveThisPart.org
>
> For urgent issues, you may want to contact Microsoft PSS directly. Please
> check http://support.microsoft.com for regional support phone numbers.
>
>
Author
26 Mar 2009 8:32 PM
MC Murphy
And that DNS server issue.  This was an issue several weeks back, then I
found one of my dhcp servers handing out an ISP's dns server as its alternate
DNS server, instead of just my internal servers.  But I fixed that, and
verified this problem machine/user with IPCONFIG /all, it has just the
internal dns servers/domain controllers.

Show quoteHide quote
"MC Murphy" wrote:

> gpresults showed for both the user and the machine:
> Group Policy was applied from:      CDC-UTILWINB.CDCFCUNET.local
>     Group Policy slow link threshold:   500 kbps
>
>     Applied Group Policy Objects
>     -----------------------------
>         CDC OU Policy
> Her logonserver was a different domain controller, but I checked SYSVOL on
> all domain controllers, in the correct GPO folder, they all have a current
> logon.vbs
>
> "Ace Fekay [Microsoft Certified Trainer]" wrote:
>
> > In news:E43A1F35-8C82-4733-BA83-71033E667533@microsoft.com,
> > MC Murphy <MCMur***@discussions.microsoft.com>, posted the following:
> > > I restarted the computer after the first occurrence, then it happened
> > > again. I logged in a test acount on the machine, it executed the
> > > script (mappe drives, etc).  Then she logged in again, still no login
> > > script.  Thanks.
> > >
> >
> > I assume the workstation only has the internal DNS server in it's IP
> > proprties, otherwise various issues will occur.
> >
> > Run an RSOP using the GPMC to confer that the machine is in the scope of the
> > GPO. Also run a gpresults on the machine when it does work, and when it does
> > not work and compare the results.
> >
> > Also assuming replication is working, on the machine, run "echo
> > %logonserver% to see which DC authenticated the user. Check that DC for any
> > replication problems. When you specifiy a logon script in a GPO, it gets
> > stored in the Sysvol, which is supposed to replicate automatically to all
> > DCs' sysvol locations. If one is having repl problems, it may not get a copy
> > of the file, therefore there is nothing to run.
> >
> > --
> > Ace
> >
> > This posting is provided "AS-IS" with no warranties or guarantees and
> > confers no rights.
> >
> > Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSA Messaging, MCT
> > Microsoft Certified Trainer
> > ace***@mvps.RemoveThisPart.org
> >
> > For urgent issues, you may want to contact Microsoft PSS directly. Please
> > check http://support.microsoft.com for regional support phone numbers.
> >
> >
Author
27 Mar 2009 5:13 AM
Ace Fekay [Microsoft Certified Trainer]
In news:7228625F-D754-4EC6-87BA-D979E2FB88F0@microsoft.com,
MC Murphy <MCMur***@discussions.microsoft.com>, posted the following:
> And that DNS server issue.  This was an issue several weeks back,
> then I found one of my dhcp servers handing out an ISP's dns server
> as its alternate DNS server, instead of just my internal servers.
> But I fixed that, and verified this problem machine/user with
> IPCONFIG /all, it has just the internal dns servers/domain
> controllers.
>

Interesting about a prior DNS issue. I assume all the DCs are only using the
internal DNS servers. Therefore, if you feel the DNS infrastructure is
running clean, and all machines can resolve all internal DCs, no services
are disabled on any DCs (such as the DHCP Client service), etc, and there
are no errors in the DC event viewers, or the client machines that this is
occuring on, then I think you will need to dig a little deeper with GPO
logging.

Try creating a separate OU, link the GPO to it, then move that user into it.
Then enable logging and see what is happening. Please take a look at the
following links to help guide you.

Fixing Group Policy problems by using log files
http://technet.microsoft.com/en-us/library/cc775423.aspx

Enable Logging for Group Policy Object Editor Client Side Extensions
http://technet.microsoft.com/en-us/library/cc759167.aspx

Troubleshooting Group Policy application problems
http://support.microsoft.com/kb/250842

Enable Verbose Global Policy Logging
http://www.windowsnetworking.com/kbase/WindowsTips/Windows2000/RegistryTips/Miscellaneous/EnableVerboseGlobalPolicyLogging.html

JSI Tip 3100. How do enable Group Policy debug logging on a Windows 2000
Server?
http://windowsitpro.com/article/articleid/74419/jsi-tip-3100-how-do-enable-group-policy-debug-logging-on-a-windows-2000-server.html

Ace