credential manager from logon script

Question

Hi,

I add logon script that retrives credentials from Azure Keyvault and save it to credential manager.

When I run this script on already opened session. it works correctly and it adds credential correctly.

However, when I logon to a session, the script runs ("I have a log file"). However , no credential is created.

What's the wrong with doing that from the logon script with GPO? Sometimes it works correctly and some times no credential is saved. It's truly a big issue for my application to work correctly. I need those credentiales to be saved.

Is it possible that it is slow? (When I run it from an already logged on session, every thing works fine)

Any idea?

bests,

Answer 1

Hi @mehar , thanks for the question. It's possible that the issue you're experiencing with the logon script is related to the timing of the script execution during the logon process. When the script runs during the logon process, some dependencies or services might not be fully initialized yet, causing the script to fail or behave unexpectedly.

Here are a few suggestions to troubleshoot and potentially resolve the issue:

Add a delay: Introduce a delay at the beginning of your script to ensure that all required services and dependencies are fully initialized before the script starts executing. You can use the Start-Sleep cmdlet in PowerShell or timeout command in a batch script to introduce a delay.

Check for errors: Make sure your script has proper error handling and logging mechanisms in place. This will help you identify any issues or errors that might occur during the logon process.

Review Group Policy settings: Double-check your Group Policy settings to ensure that the logon script is configured correctly and applied to the appropriate users or groups.

Test with a different script execution method: Instead of using a logon script, you could try using a scheduled task that runs at logon with a delay. This might help to ensure that all required services and dependencies are fully initialized before the script starts executing.

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark it as "Verified" so other users can reference it.

Thank you,

James

Answer 2

Add proper error handling to your script using the Try and Catch blocks

Try {
    New-StoredCredential -Target 'test1' -Type Generic -UserName 'test11' -Password 'test111' -Persist 'LocalMachine' -ErrorAction Stop
}
Catch {
    # Log the error message to your log file
    $errorMessage = "Error: " + $_.Exception.Message
    Add-Content -Path "Path\To\Your\Log\File.log" -Value $errorMessage
}

Introduce a delay before the New-StoredCredential command to ensure that all required services and dependencies are fully initialized before the command is executed.

Start-Sleep -Seconds 30