Home All Groups Group Topic Archive Search About

How to ensure login script runs on client?



Author
20 Apr 2007 1:14 AM
Richth
Need help understanding what security setting prevents my client login
scripts from running on WinXP SP2 workstations.  When I run it manually I get
a security window that warns it cannot determine if it should be run, and
prompts me whether to allow it to run or not. 

What setting do I clear to allow my login scripts to run?
TIA
rich

Author
20 Apr 2007 1:29 AM
Marty List
That's unusual, how did the file get copied to the domain controller?  Maybe
it was "downloaded" through IE and the security zone is stored in an
alternate data stream?

Try the freeware tool STREAMS.EXE:
http://www.microsoft.com/technet/sysinternals/FileAndDisk/Streams.mspx

To view the alternate data streams of a file:
C:\>streams.exe \\server\share\scriptname.ext

To delete the alternate data streams of a file:
C:\>streams.exe -d \\server\share\scriptname.ext



Show quote
"Richth" <Ric***@discussions.microsoft.com> wrote in message
news:7520858F-ABA3-407E-A384-2C081FE31276@microsoft.com...
> Need help understanding what security setting prevents my client login
> scripts from running on WinXP SP2 workstations.  When I run it manually I
> get
> a security window that warns it cannot determine if it should be run, and
> prompts me whether to allow it to run or not.
>
> What setting do I clear to allow my login scripts to run?
> TIA
> rich
Author
20 Apr 2007 1:40 AM
Richth
Not sure we're talking about the same thing, but thanks.  I'll look into this.

Show quote
"Marty List" wrote:

>
> That's unusual, how did the file get copied to the domain controller?  Maybe
> it was "downloaded" through IE and the security zone is stored in an
> alternate data stream?
>
> Try the freeware tool STREAMS.EXE:
> http://www.microsoft.com/technet/sysinternals/FileAndDisk/Streams.mspx
>
> To view the alternate data streams of a file:
> C:\>streams.exe \\server\share\scriptname.ext
>
> To delete the alternate data streams of a file:
> C:\>streams.exe -d \\server\share\scriptname.ext
>
>
>
> "Richth" <Ric***@discussions.microsoft.com> wrote in message
> news:7520858F-ABA3-407E-A384-2C081FE31276@microsoft.com...
> > Need help understanding what security setting prevents my client login
> > scripts from running on WinXP SP2 workstations.  When I run it manually I
> > get
> > a security window that warns it cannot determine if it should be run, and
> > prompts me whether to allow it to run or not.
> >
> > What setting do I clear to allow my login scripts to run?
> > TIA
> > rich
>
Author
20 Apr 2007 2:34 AM
Marty List
When the security warning is displayed, open Task Manager and highlight the
window in the Applications tab.  Right-click the app and choose "Go To
Process".  This might help you determine where the security warning is
coming from.


Show quote
"Richth" <Ric***@discussions.microsoft.com> wrote in message
news:D26324F7-7BF4-4A07-9676-75FA8B36AD6E@microsoft.com...
> Not sure we're talking about the same thing, but thanks.  I'll look into
> this.
>
> "Marty List" wrote:
>
>>
>> That's unusual, how did the file get copied to the domain controller?
>> Maybe
>> it was "downloaded" through IE and the security zone is stored in an
>> alternate data stream?
>>
>> Try the freeware tool STREAMS.EXE:
>> http://www.microsoft.com/technet/sysinternals/FileAndDisk/Streams.mspx
>>
>> To view the alternate data streams of a file:
>> C:\>streams.exe \\server\share\scriptname.ext
>>
>> To delete the alternate data streams of a file:
>> C:\>streams.exe -d \\server\share\scriptname.ext
>>
>>
>>
>> "Richth" <Ric***@discussions.microsoft.com> wrote in message
>> news:7520858F-ABA3-407E-A384-2C081FE31276@microsoft.com...
>> > Need help understanding what security setting prevents my client login
>> > scripts from running on WinXP SP2 workstations.  When I run it manually
>> > I
>> > get
>> > a security window that warns it cannot determine if it should be run,
>> > and
>> > prompts me whether to allow it to run or not.
>> >
>> > What setting do I clear to allow my login scripts to run?
>> > TIA
>> > rich
>>
Author
20 Apr 2007 2:10 AM
Richard Mueller [MVP]
rich wrote:

> Need help understanding what security setting prevents my client login
> scripts from running on WinXP SP2 workstations.  When I run it manually I
> get
> a security window that warns it cannot determine if it should be run, and
> prompts me whether to allow it to run or not.
>
> What setting do I clear to allow my login scripts to run?

Some virus software blocks scripts from running. Could the security message
come from your virus software?

When you say you manually run the script, I assume you run it at a command
prompt, perhaps with the cscript host, and you get the security warning, not
an error message (with a line number) from WSH. I know I had to modify a
setting in Norton AntiVirus to allow VBScript programs to run. I can't
remember the setting now.

--
Richard Mueller
Microsoft MVP Scripting and ADSI
Hilltop Lab - http://www.rlmueller.net
--
Author
20 Apr 2007 4:04 AM
Shenan Stanley
Richth wrote:
> Need help understanding what security setting prevents my client
> login scripts from running on WinXP SP2 workstations.  When I run
> it manually I get a security window that warns it cannot determine
> if it should be run, and prompts me whether to allow it to run or
> not.
>
> What setting do I clear to allow my login scripts to run?

Short version...
Add the server/domain to your Internet Options -> Security tab -> Local
Intranet -> sites.. -> advanced area..

"Internet Explorer" --> "Tools" --> "Internet Options" --> "Security"
tab --> "Local Intranet" --> "Sites" button --> "Advanced" --> add the
server's domain name *.my.domain.com and OK your way out.

This can also be done by group policy *if* everyone is on a domain.

--
Shenan Stanley
     MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html
Author
20 Apr 2007 11:52 AM
Richth
Thanks Shenan and Richard,
This is exactly along the lines of what I'm experiencing.  It is a Windows
Security dialog that displays with the prompt instead of my anti-virus
software.  I'm guessing this all changed when SP2 was installed as they
worked prior to that.  I'll try your suggestions and post results.

I will need to do this for 30 clients, so knowing how to do this via group
policy would be great.  I'll look through the knowledge base.  Thanks.

Rich

Show quote
"Shenan Stanley" wrote:

> Richth wrote:
> > Need help understanding what security setting prevents my client
> > login scripts from running on WinXP SP2 workstations.  When I run
> > it manually I get a security window that warns it cannot determine
> > if it should be run, and prompts me whether to allow it to run or
> > not.
> >
> > What setting do I clear to allow my login scripts to run?
>
> Short version...
> Add the server/domain to your Internet Options -> Security tab -> Local
> Intranet -> sites.. -> advanced area..
>
> "Internet Explorer" --> "Tools" --> "Internet Options" --> "Security"
> tab --> "Local Intranet" --> "Sites" button --> "Advanced" --> add the
> server's domain name *.my.domain.com and OK your way out.
>
> This can also be done by group policy *if* everyone is on a domain.
>
> --
> Shenan Stanley
>      MS-MVP
> --
> How To Ask Questions The Smart Way
> http://www.catb.org/~esr/faqs/smart-questions.html
>
>
>
Author
20 Apr 2007 1:48 PM
Richth
Shenan, thx, that solved the Security Warning dialog issue for when I run the
script manually from Run cmd line.

Now however, I still see that the login script is not getting executed when
the user logs in.  This is a separate issue, so I'll create a new thread for
it. Thx again!

Rich

Show quote
"Shenan Stanley" wrote:

> Richth wrote:
> > Need help understanding what security setting prevents my client
> > login scripts from running on WinXP SP2 workstations.  When I run
> > it manually I get a security window that warns it cannot determine
> > if it should be run, and prompts me whether to allow it to run or
> > not.
> >
> > What setting do I clear to allow my login scripts to run?
>
> Short version...
> Add the server/domain to your Internet Options -> Security tab -> Local
> Intranet -> sites.. -> advanced area..
>
> "Internet Explorer" --> "Tools" --> "Internet Options" --> "Security"
> tab --> "Local Intranet" --> "Sites" button --> "Advanced" --> add the
> server's domain name *.my.domain.com and OK your way out.
>
> This can also be done by group policy *if* everyone is on a domain.
>
> --
> Shenan Stanley
>      MS-MVP
> --
> How To Ask Questions The Smart Way
> http://www.catb.org/~esr/faqs/smart-questions.html
>
>
>

AddThis Social Bookmark Button