Logon scripts not running

Maybe the script is not getting run because of a group policy?  The web interface should use whatever is in the user's profile but it does strange things sometimes.

You can do an Result set of policy (right click the user in AD go to All tasks/Resultant Set of Policy-logging) and see what is getting run when they log into the terminal server.  If the logon script is being run it should show up in the User Configuration/Windows Settings/Logon Scripts.

Maybe try to make an OU of your citrix users and put the logon script there.  If all of the citrix users have the same logon script and you only have one or two terminal servers you can also put the logon script on the group policy of the terminal servers themselves.  Go to the run, type gpedit.msc, then like above go to User Configuration/Windows Settings/logon scripts and right click and set up a .bat file.

The logon script is not running as part of a GPO. It's set in the user object (logon script path). Your thought is good though - I'll try putting it in a GPO

Wierd that it wouldn't work in the user object though.  I used to have some logon scripts in the user object and I know they worked before I moved them to a GPO.  We use the web interface also but I don't have a CAG.  Maybe if the profiles aren't stored on the citrix server and instead are on a share somewhere that could perhaps cause the problem.  Or if the script is somehow dependant on a full desktop and you are running an application that may cause a conflict also.

i actually think it is a networking issue if I'm honest - but I'm very confused by it

since you are getting the error it shows it is trying to run the script but is unable to. The way the error is it seems it cannot find the logon script.  Are you using roaming profiles?  If not do you have a fileshare for the TS/Citrix user profiles or are the files saved on the citrix server (they will go there by default if you don't set them up elsewhere).

The logon scripts are all stored in a subdirectory of the netlogon share of the DC's.

ie
\scripts\script.bat

The unc of this is

\\Domaincontroller\netlogon\scripts\scripts.bat

or

\\domain\SysVol\domain\scripts\scripts\mike.bat

(yes scripts is there twice)

As far as I'm aware I wouldn't need to have the logon script on the citrix server as well. I accept that it seems to be having problems finding it.

Folder redirection is in use

One other thing to consider would be if it is on a windows 2003 server to make sure the restrictions are loosened up.  The Internet Explorer Enhanced Security Configuration can be a pain just to get a drive mapped until you disable it.

Running the script through a GPO linked logon script has the same problem.

Croberds your last comment is interesting - can you elaborate please.

As this is a vpn solution the script should run on the client side - (windows 2000 pro SP4) rather than on a server.

If a script tries to run while logging into citrix it is going to use the terminal/citrix servers local policies also.  If you write a script that runs a program on a network share but the terminal server is not allowed to view that share (even if the local client that is logging into the share has permissions) then the script cannot run.

If your citrix server is Win 2000 server then the defaults would have been fine unless you tightened up some local policies in the past.  Win 2003 server already has a lot of restrictions in place including the obvious IE enhanced security and software restiction policies.  http://support.microsoft.com/kb/324036 talks about making some changes to those.  If you are using a vpn that should give the user access to the domain, but when they logon onto the citrix server they still have to abide by the citrix users local policies.

I have never used Citrix Access Gateway so your knowledge of how it sets up your vpn will probably be better than mine.  I did attend a Brian Madden class where we discussed it briefly, but my knowledge is more with citrix itself as that is what I deal with every day.

I knew I had seen something on this before, I searched madden's site after I typed all of the above--http://www.brianmadden.com/Forum/Topic/87805

hope that helps

I think that's where a lot of the complexity comes here.
From my understanding the citrix gateway secure client is acting as a tunnel to the internal network and therefore the login script is running on the client (no involvement of Citrix presentation or WI servers).

Unfortunately as it is vpn then i can't do much with the network captures!!

Mike, I apoligize as I think I may have misinterpreted your question at the beginning.  From what you are saying you are not actually running a terminal session, you are just using the CAG to tunnel into the VPN?

If that is the case then the problem is different than I thought.  I am assuming you enabled logon scripts from the CAG?  I would also assume that by tunneling in that only basic command logon scripts would work, like drive mapping.  As I mentioned previously I am not an expert on CAG and we may need to hope someone else who is steps in.

The error of "user info lookup failed" seems to imply that the DC and the CAG either cannot communicate or have the user in a different security group.

yes that's exactly it - I'm sorry it seems I led you on a bit of a dance.

All the scripts are doing are mapping drives - but they aren't running at all.

Many thanks for your input, I'll leave the question open hoping it attracts others.

Mike

I found this on madden's site:  http://www.brianmadden.com/Forum/Topic/39566

maybe your answer is in there.

looks like the scripts will only run if the client is already a member of the domain.  That's a deficiency if that doesn't work but that's what I gather from the thread over there.

I'm still looking at investigating these new bits

Here's another new bit,

One user - manually added to power users group (as per articles and confirmed domain logon) sees this when it tries to run his script

[Wed Jan 23 09:54:04] Using user logon script \\??????????????!?!???????????????????????\NETLOGON\scripts\scriptname.cmd