Disable login script from running on terminal servers 2

[dreamcurse]

Hi,

Is it possible to disable a user's login script from running when they are logging into a terminal server?

I have a terminal server in my environment which services other domains/users outside of my jurasdiction.
I want to disable their proprietary login script from executing when they log into my terminal server.

Any ideas is greatly appreciated.
Thanks

 

[markdmac]

Yes this is possible. You need to enable LOCAL LOOPBACK in a GPO.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.

 

[Roadki11]

Or you could add to their login script:

If WshNetwork.ComputerName = YourTS then
  wscript.quit
End IF

Or something like that.



RoadKi11

"This apparent fear reaction is typical, rather than try to solve technical problems technically, policy solutions are often chosen." - Fred Cohen

 

[dreamcurse]

i'll look into a local loopback in GPO.
Would this be the GPO of the Terminal Server?

The issue with modifying login script is I only have control over my domain and the TS server. Some of its users belong to another domain which I don't have any authority over.

 

[markdmac]

Yes, the loopback would be enabled on a GPO applied to the Terminal Server.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.

 

[dreamcurse]

Would the loopback work if the user's login script is embedded in the user account properties in the profile tab?

The users aren't currently running the login script from their GPO they are under.

I'm not sure if enabling loopback processing mode on the GPO of the terminal server would override the above?

I enabled it but still see the script running when I login the Terminal server

 

[markdmac]

Make sure you checked to ENFORCE the GPO for the Terminal Server.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.

 

[dreamcurse]

IS there any other items that need to be done?

- "User Group Policy Lookback policy mode" is enabled and set to "replace"

- Enforced is on

With these changes, the login script defined in my User ID profile properties still executes.

 

[markdmac]

Sorry it has just hit me that what you are saying here is that you are using the legacy setting and have enabled your login script via the user profile instead of the preferred method of using a GPO.

Move your login script out of the user properties and into a GPO.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.

 

[dreamcurse]

Ok that makes sense.

This might be an issue though as I have users from other domains hitting this Terminal server which I have
no control over their OU or their ID properties. And those IDs are using the legacy method for assigning login script.

 

[dreamcurse]

I think I may have found the solution.

This is to disable user login scrip execution.
The change is done on the Terminal Server itself.

http://support.microsoft.com/kb/924034