Windows Forum

Ask something
Discussion Locked

Only Domain Admins can run login scripts

0 helpful
18 replies

by geek2d 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Curently our network is a Novell Nt mix. Up til now all scripting was done through Novell. We want to go to an all NT Domain and then perhaps on to active dir. We are unable to make NT login scripts run in user accounts. As soon as we make the user account a domain admin, it runs fine. we have granted users full access to the script folder and still no luck. As a test we are running a simple pause comand in a batch file and it doesn't run unless they are domain admins. Local admins doesn't even work. Is there a sevice or a regisry setting that needs to be made to let NT login scripts run under user accounts?

18 replies

by iphicles

is the winnt/system32/repl folder shared?
can you run the script when manually running it through the network neighborhood under your user account?
i'm assuming you're correctly identifying the script in the user profile in user accounts and thatall users are members of the correct domain, etc...
where is the login script located? is replication set up between the PDC and BDC's?
try and create a brand new account in NT (since you used to have a mix of novell/NT) and try it then.

I had the same NT/Novell configuration as well as the script running as you, then I moved to NT. however, i manually recreated all my accounts (there weren't too many) rather than migrating. some of the user properties in Novell won't come over correctly when migrating to NT.

by geek2d

Yes, the folder is shared.
Yes, I can run the script manually.
Yes, the Script is properly identified, and accounts are in the proper Domain.
The login script is located winnt\system32\repl\import\scripts\script.bat on both the PDC and BDC.
No replication is not setup.
The account i am testing with is brand new.
You can see my confusion at why this isn't working. Everything as it is works as soon as I make the account a domain admin.

go figure...Thanks for the input.

by geek2d

Yes, the folder is shared
Yes, the script will run manually
Yes, the script is properly identifed and in the right folder and on the right domain. I have the script on both the PDC and the BDC, we are not doing replication.
the account i am testing with is brand new.
Aditional note: If I grant local (on the server not the client) Admin rights, it runs just fine. Previousely I thought only Domain Admin would work.
I think its pretty much narrowed down to rights on the server at some point I just dont know were.

by joseph moore

Check the NTFS Security on the NETLOGON share on the NT PDC. Make sure that Authenticated Users have Read/Write permissions.

by geek2d

Good Call, but I tried it and no change. I went so far as to grant Full Access at both the Shared permissions and the NTFS Sercurity permissions.

by joseph moore

How about you create a new shared folder on another Windows machine (or it could be on the PDC also), put the scripts in that folder, and point the user profiles to this new location. YOu can run logon scripts from any shared folder on any machine.So, set up the shared folder SCRIPTS on the PDC (set the Sharing rights to Everyone - FC, and the Security rights to Authenticated Users - FC just to be sure), then in User Manager for Domains for the user accounts change the Logon Script Path to be:

\\PDC\SCRIPTS\scriptfilename.bat

See if that works.

The only other things I can think of to try is:
Open User Manager for Domains -> Policies -> User Rights.
Make sure the Everyone group is listed for the following 2 rights:
Access Computer from Network
Bypass Traverse Checking

The 2nd right is an Advanced right, so you will have to check the checkbox to view advanced rights.

Good luck.

by gigelul

Your clients are NT machine?
Your problem can be your script!
For example: if you try to set the time of the workstation the same with the server time, by default a domain user don't have rights to change the system time of the workstation (but a local admin or domain admin can).

by shanghai sam

Clients are 2000 Pro
The scriprt is simply "pause" local rights shouldn't be an issue with this.

by huckleberryhound

Does the Everyone group have at least List NTFS permissions from the root of the drive to the scripts folder? The users need to be able to traverse the entire path from the root of the drive to the folder containing the logon scripts.

by green lantern

It sounds as if your batch file is doing something on a domain or local to the server adiministrator is authorized to do.

As a client on a distant machine, run the script from the netlogon share with pauses in the script to detect when the scriptdoes not run. I have seen this issue a number of times through the years.

ralph

by geek2d

Yes the issue is rights but not from the stand point that the batch file is causing it. The batch file says simply "pause" there should be no reason that runing a pause comand alone wouldn't run fine. the issue is getting the batch file to run at all. It will run if the user is a local admin on the server or a domain admin. Otherwise it just passes it by.

by geek2d

well I have figured it out, the problem is that the person that set the PDC up set it up with a 5 user license, after switching it to a per seat license (what it should have been all along)it runs like a champ. Thankyou to all that offered assistance.

This discussion is closed to new replies.