Logon Scripts

  • For help on assigning logon scripts, see How to.
  • To understand more about logon scripts, see Concepts.


How to...

  • Assign a user logon script to an individual user
  • Assign user logon scripts


Assign a user logon script to an individual user

To assign a user logon script to an individual user

  1. Open Computer Management.
  2. In the console tree, click Users.

    Where?

    • System Tools
    • Local Users and Groups
    • Users
  3. Double-click the user to which you want to assign a logon script.
  4. Click the Profile tab.
  5. In the Logon script field, enter the path and name of the logon script you want to assign to that user, and then click OK.

Notes

  • To open Computer Management, click Start, click Programs, click Administrative Tools, and then click Computer Management.
  • The path to the logon script is relative to the local logon script path on the server.


Concepts

This section covers:
  • Logon Scripts overview
  • Using Logon Scripts


Logon Scripts overview

A system administrator can use logon scripts to assign tasks that will be performed whenever a user or member of a group logs on to a particular computer system. These scripts can use system environment variables, and can also call other scripts or executable programs. Logon scripts are frequently used to map network drives, start background processes, and initialize user environment variables.


Using Logon Scripts

This section covers:

  • Using logon scripts to configure user work environments
  • Assigning logon scripts to user or group accounts
  • Setting up replication of logon scripts
  • Using environment variables to manage workstations


Using logon scripts to configure user work environments

A logon script runs automatically whenever a user logs on to a computer running Window 2000. The script can contain operating system commands, such as those that make network connections or start programs. Logon scripts can also set environment variables to specify information such as the computer's search path and its directory for temporary files. Although a logon script is typically a batch file (.bat extension), any executable program (.exe extension) can also be used.

Logon scripts are optional. You can use them to configure user working environments by creating network connections and starting programs. Logon scripts are useful when you want to affect the user work environment without managing all aspects of it.

Windows 2000 supports the following script types: Windows Script Host (including Visual Basic Scripting Edition [VBScript] and JScript), and MS-DOS command scripts.

User profiles can restore network connections at logon that were established prior to logging off. User Profiles cannot be used to create new network connections at logon.

Creating logon scripts

You can use a text editor to create logon scripts and then use the User Properties page to assign different logon scripts to different users, or assign the same logon script to multiple users, sites, domains, and organizational units (OUs).

There are several special parameters you can use when creating logon scripts.

Parameter | Description
%HOMEDRIVE% | The user's local workstation drive letter connected to the user's home directory
%HOMEPATH% | The full path of the user's home directory
%OS% | The operating system of the user's workstation
%PROCESSOR_ARCHITECTURE% | The processor type (such as 80386) of the user's workstation
%PROCESSOR_LEVEL% | The processor level of the user's workstation
%USERDOMAIN% | The domain containing the user's account
%USERNAME% | The user name

You can also create logon scripts in VBscript and JScript.


Assigning logon scripts to user or group accounts

In Windows 2000, you can assign a logon script in a user account by entering a path to the logon script file. When a user logs on and a path to a logon script is present in the user account, the file is located and run at logon.

You can also assign logon and logoff scripts, and computer startup and shutdown scripts by using the Group Policy snap-in. These scripts apply to the entire scope of users and computers for which a particular Group Policy object applies.

In Computer Management, you can use the User Property dialog box to assign logon scripts to user accounts by typing the file name (for example, Clerks.bat) in the Logon script text box. At logon, the server authenticating the logon locates an assigned logon script. It looks for the specified file following the local logon script path on the server (usually C:\Winnt\System32\Repl\Import\Scripts). If a relative path is provided before the file name (for example, Admins\CristalW.bat), the server looks for the logon script in that subdirectory of the logon script path.

The entry in the Logon Script text box specifies only the file name (and, optionally, the relative path) and does not create the actual logon script. You create a logon script of the specified name and place it in the appropriate directory on the appropriate replication export server.

You can place a logon script in a local directory of a user's computer. You would typically use this location, however, when you are administering user accounts that exist on a single computer rather than in a domain. You must place the logon script following the computer's logon script path or in a subdirectory of that logon script path. The logon script path for a Windows 2000 computer is systemroot\System32\Repl\Import\Scripts.

For information on the specific procedures to follow to assign logon scripts to individual users and groups, see How to.


Setting up replication of logon scripts

A logon script is always downloaded from the server that validates a user's logon request. For users with accounts on Windows 2000 Server domains that have one or more backup domain controllers, any one of the domain controllers can authorize a user's logon attempt. In order for logon scripts to always work for users, logon scripts for all user accounts in a domain must exist on every primary and backup domain controller in that domain.

The Directory Replicator Service is the best way to ensure that logon scripts are always available. This service maintains identical copies of a directory tree on multiple computers. When you make a change to a file in the master copy of the tree (located on the export server), the Directory Replicator Service automatically copies the change to the other computers (the import computers).

When you use the Directory Replicator Service with logon scripts, you set up one domain controller as the export server and all the other domain controllers in the domain as import servers.

You can configure the logon script path for each server of a domain by using Server Manager (administering servers either locally or remotely), or by using the Server option in Control Panel of each server. Use the Directory Replication dialog box to set up replication export and replication import and to specify a local path to user logon scripts.

A master collection of logon scripts is usually maintained by an administrator in an export directory (typically C:\Winnt\System32\Repl\Export\Scripts and its subdirectories) of one replication export server in the domain. This master collection is replicated to all the servers in the domain so that each server has its own local copy of all logon scripts.


Using environment variables to manage workstations

When managing multiple user and group accounts, you may need to make the same change to many accounts. You can use environment variables to replace static names or labels with a dynamic variable. The dynamic variable is replaced by the appropriate environment data when called.

Changing the system environment variables

Windows 2000 requires certain information to find programs, to allocate memory space for some programs to run, and to control various programs. This information, called the system and user environment variables, can be viewed using the System option in Control Panel on the Environment Variables tab. These environment variables are similar to those that can be set in the MS-DOS operating system, such as PATH and TEMP.

The system environment variables are defined by Windows 2000 and are the same no matter who is logged on at the computer. If you are logged on as a member of the Administrators group, you can add new variables or change the values.

The user environment variables can be different for each user of a particular computer. They include any environment variables you want to define, or variables defined by your applications, such as the path where application files are located.

After you change any environment variables, Windows 2000 saves the new values in the registry, making them automatically available the next time you start your computer.

If any conflict exists between environment variables, Windows 2000 resolves the conflict in this way:

  • System environment variables are set first.
  • Variables defined in Autoexec.bat (except for Path variables) are set next, and override system variables.
  • User environment variables defined in the System dialog box are set next, and override both the system and Autoexec.bat variables.
  • Path variables defined in Autoexec.bat are set last.
Path settings, unlike other environmental variables, are cumulative. The full path (what you see when you type path at the command prompt) is created by appending the path contained in Autoexec.bat to the paths defined in the System option in Control Panel.

Using system environment variables in user profile paths, home directory paths, and logon scripts

Any system environment variable on a client computer running Windows 2000 can be used in a user account's user profile path, logon script path, home directory path, and within a logon script itself.

This feature helps to ensure that logon scripts and user profiles run most efficiently on domains that span wide area network (WAN) links, especially if users work at more than one site.

For example, suppose you have two physical sites, one located in Paris, and the other located in London. On every computer running Windows 2000 at the London site, you can set the servername system environment variable to the computer name of a backup domain controller in London. On the computers in Paris, you can set servername in a similar way, using the computer name of the backup domain controller in Paris. In every user account in the domain, you can use %SERVERNAME% in the logon script paths. In this instance, you can set the login script path to \\%SERVERNAME%\scripts. When a user logs on, the logon script is always loaded from a server at the local site.