Group Policy Logon Scripts on VPN

Question

Group Policy Logon Scripts on VPN

Neil Shaw 1

Hi,
So with the increase in work from home we're starting to run into issues with managing user devices due to the use of logon and startup scripts.

I'm sure we're not alone in this. Our users sign into the corporate VPN after they've logged into their laptop, so there is no connection to the domain controllers at logon, and so the logon scripts cannot run.

Is there any workaround for this situation? About the only possibility I've come across is pushing the logon scripts to the local device using a GPO and then having the logon scripts point to this local script, assuming that GPOs are cached on the local device and so can still be triggered at logon; but not sure how feasible this is, or if it will even work.

Thanks,
Neil

Anonymous

2020-11-16T06:02:36.437+00:00

Hello Neil,

Thank you so much for posting here.

We are checking in to see if the provided information was helpful. If the reply is helpful, we would appreciate you to accept it as answer.

Please let us know if you would like further assistance. Thanks.

Best Regards,
Hannah Xiong

2 answers

Your answer

Anonymous

2020-11-16T06:02:36.437+00:00

Hello Neil,

Thank you so much for posting here.

We are checking in to see if the provided information was helpful. If the reply is helpful, we would appreciate you to accept it as answer.

Please let us know if you would like further assistance. Thanks.

Best Regards,
Hannah Xiong

Answer 1

hi neal,

you can solve it easily with a windows task. create a GPO which deploys a task that is triggered by event.
set the GPO action to update, in case you later do any changes it will aut. update them.
settings for the event are:

protocol : application
source : rasclient
event-ID : 20225

dealy : your choice (usually 30sec work fine).

then on action tell the task to run your usual loginscript.

this will then add a task to the user's machine, which is listening for a entry with ID 20225 in the application event protocol.
as soon as a entry is done (this happens when the tunnel is up and running), it will wait for 30 sec and then perform the action supplied.

the 30sec thin is because some times, even when the tunnel is up and running, the "full connection" to the office lan may still take a bit more time and then the
run of the loginscript will fail.

thru the targeting you can even set specific rules to what/who etc. this GPO shall apply

the nice thing about this is also, that if you change the task or any settings (on the DC)
it will update them by it self thru GPO updates :)) .

link the GPO to the desired user OU and your are done!

cheers
san

Answer 2

Leon Laude 86,026

Hi @Neil Shaw ,

What exactly is the logon script doing?
GPOs over VPN is indeed a challenge, because most GPOs initialize before the VPN tunnel is fully connected, basically when the computer is starting.

I can provide you with some information that quite a few of my customers have done, that is to create a shortcut on each user's desktop which the user can run whenever they run into issues, such as mapped network drives not being mapped.

The shortcut can simply run the script and the script could be whatever you desire, then you have clear guidance for each end-user to click on "this" shortcut if they run into problems.

----------

(If the reply was helpful please don't forget to upvote or accept as answer, thank you)

Best regards,
Leon

Neil Shaw 1 Reputation point

2020-11-16T10:51:21.29+00:00

Hi @Leon Laude

We have a variety of things that they include. Some are printer mappings (we still have active mail rooms where people need to print stuff to), drive mappings, registry key setting, software deployment (which can include updates). To be honest, it is that long since I've looked at some of the start-up stuff I forget most of what is in there - this is a request that has come from above!

Unfortunately, I doubt much of it can be done by asking users to click on a shortcut as there are so many different things that they may need to do. It's a bit of a by-product of a mature domain that has acquired other bits of a business, seen the scope of its work expand, etc.
Leon Laude 86,026 Reputation points

2020-11-16T13:39:55.85+00:00
Part 1:
The only way for domain computers to get updated group policy settings is if they have connectivity to a Domain Controller (DC) at a time when they are refreshing their group policy settings.

A GPO (Group Policy Object) is only refreshed upon the following scenarios:

At computer startup (foreground refresh of Computer settings)

At user logon (foreground refresh of User settings)

Periodically in the background (Background Refresh)

Manually by running the GPUpdate command.
Leon Laude 86,026 Reputation points

2020-11-16T13:40:43.703+00:00
Part 2:
Getting GPO settings to remote workstations is always tricky, however if you must updateGPOs on machines not normally connected to the domain network, consider these solutions:

Install a software-based VPN client on the roaming computers and configure it to connect to the domain network before user logon. This will ensure "User" GP is always applied and if the computer stays connected long enough, the background refresh will update the "Computer" GP as well.

Deploy VPN routers at off-site users' work locations (e.g. At their remote/home office) that maintain a persistent connection to the domain network. This will result in the remote computer having constant access to a domain controller and fully participate in Group Policy update.

Deploy a DirectAcess infrastructure which acts like an always-on VPN solution.

Share via

Group Policy Logon Scripts on VPN

2 answers

Your answer