Logon scripts run twice in Win2000

[jdaniels]

Hi,

I have set up a logonscript to run for users in a particular organisational unit. My OU structure is like this:

Domain
|-> Public
|->->Sales
|->->Marketing

(for example, ou=Sales, ou=Public, dc=.....)

I have users in Public, as well as users in Sales, Marketing etc. When a user in Public logs in to the domain from a workstation, the login script executes once. However when a user in Sales, for example, logs in in the same way, the script executes twice. The group policy for public is inherited to sales. All users are part of this group.

I have tried the following:
1) Block policy inheritance. Result: the public user gets the login script executing 1 time, the sales user does not get to run in at all.

Is there some way I can set the login script to execute just once per GPO application. I realise that I can set a logon script to each user, but I wonder if I can do it on a group policy level.

Thanks in advance,

Jonathan Daniels

 

[jdaniels]

I forgot ... the workstations are WinXP.

Thanks.

JD

 

[ReddLefty]

This may be a long shot, but check those policies again cause there are 2 places that you can start scripts:

Computer Configuration / Windows Settings / Scrips / Startup
and
User Configuration / Scrips / Logon

You can usually tell the two apart. The Logon script will run while the desktop is loading, the startup script usually takes a little longer to start. On fast computers, the desktop is loaded by then.

 

[jdaniels]

I don't have any startup scripts set, only the logon script which is part of a group policy applied to an OU and inherited down to OUs within it, and the users are located within both the first and second OUs. I suspect the problem may be partly due to the fact that the GPO is inherited and may be applied 2 times.

Thanks,

Jonathan Daniels

 

[ReddLefty]

Easy way to test that, create another OU at the Sales level without the modified policy and test it with a dummy users.. if the script runs, it's inherited.. if not.. well.. it's not.. hehe.

 

[jdaniels]

Bingo! I found that disabling the GPO in the second level OU had the desired effect of inheriting the features (security, logon scripts etc) of the GPO from the first level OU without applying it twice. I guess I thought that disabling it would override its application totally.

Thanks for your time,

JD