Wednesday, January 26, 2011

AD logon script, how to...

I'm a student, I have this assignment where I need to know how to disable the user from changing the background to a client computer, thing is that I've been looking around to know what language does the logon script use, any site with handy information, tried googling but I really can't find anything useful, don't know if I'm googling the right terms

All I've found for now is a lot of tutorials about mapping network drives and so on

  • Login-scripts will use anything the client machine considers a valid script. .BAT and .CMD files are understood by everything, but are significantly limited in what they can do; they can do simple drive mappings and a few other operations but little else. Almost everything also can run .VBS scripts which allows a much more robust script. If you're lucky enough to have a pure Win7 environment, it is very possible to use PowerShell scripts. And finally, if you're really gung-ho about it, you can actually compile your own .EXE files that will do everything you need to do and have it be your login script. The thing to keep in mind is that the login script is, I believe, executed in the User's context so it can only do what the user is allowed to do.

    Think of a login script as a file that the Group Policy engine gives to the local machine to run after a start command.

    start login.vbs
    start login.bat
    start login.ps1
    start login.exe
    

    That's not exactly how it works, but it does frame the concept better.

    Also, the machine itself can have startup-scripts! These run before user login, and run in SYSTEM context. Can be handy for certain tasks.

  • A logon script is not the appropriate place for what you are trying to accomplish. Group Policy is what you want to do as previously noted. Alternatively you could set a mandatory profile for the user(s).

    From sinping
  • You don't want to use a logon script for this. You want to use group policy. You'll need to read up on Group Policy, there's plenty of resources to learn with (like GPOGuy.com), but here's the specifics on how to absolutely prevent the wallpaper from being changed.

    Microsoft KB Article: You can change the desktop wallpaper setting after administrator selects "Prevent Changing Wallpaper" option in Group Policy (327998)

  • Here are the exact instructions modified for a domain from @K. Brian Kelley's link

    Open up the group policy object editor and point it to your domain group policy

    Under the Domains Policy, expand User Configuration, expand Administrative Templates, expand Desktop, and then click Active Desktop.

    Double-click Active Desktop Wallpaper.

    On the Setting tab, click Enabled, type the path to the desktop wallpaper that you want to use, and then click OK.

    Hope that helps.

    K. Brian Kelley : Right, except you might not want it to be your default domain policy. That's why I gave the other link to GPOGuy.com. You may only want to customize this for particular users.
    From Campo

0 comments:

Post a Comment