Startup Batch Script not applying through GPO

Question

Here is the configuration for my startup script. Basically The script includes 1 line to enable bitlocker which requires administrative privileges to run the batch script. How do i pass the parameter so my batch script runs at startup

My script parameters are powershell.exe -executionpolicy bypass -file "bitlocker.ps1"

The batch file content is

@Echo off

manage-bde -on C: -recoverypassword -skiphardwaretest

when i run the script as an administrator locally, the script runs fine, so i believe it has something to do with parameters i have passed on. Can someone help me out with this question ?

Answer 1

Hello @Chauhan, Aniket,

Thank you for posting in our Q&A forum.

I understand you deploy the startup script via domain GPO.

You can try the steps below.

1. Create a GPO and rename it (such as "startup script to enable bitlocker").
   2.Create an OU and rename it (such as PC) and put the machine which you run the script as an administrator locally to this OU to test the script.
   3.Link the GPO "startup script to enable bitlocker" to OU "PC".
   4.Put the script file to the path below (for example):

\a.com\SYSVOL\a.com\Policies{5EE96627-35BD-434C-9C6A-4AE328E7D13A}\Machine\Scripts\Startup

5.Edit the gpo as below:

Check if gpo applies.
1.Check if you can access the script file on domain machine above.
2.Start up the domain machine above and check if the script takes effect.
3.Logon the domain machine using domain administrator.
Open CMD and run gpresult /h C:\gpo.html and click Enter.
Open gpo.html and check if you can see gpo setting under "Computer Details".

Hope the information above is helpful. If you have any question or concern, please feel free to let us know.

Best Regards,

Daisy Zhou

===============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

Hi everyone,

As Daisy mentioned, i have the script setup in the same location, although it is a batch script. If i run my script locally as an administrator, it turns on the bitlocker just fine but the script does not run through GPO. I have also tried setting up the scheduled task but it does not run through GPO. what should be my script paramaters in the GPO for the batch script, is what i have setup correct ?