Solved

Login.bat script will not run on Terminal Servers

Posted on 2006-11-03
11
437 Views
Last Modified: 2010-07-27
Hey everyone. We have an interesting situation that I am not figuring out here. We run 9 Windows 2003 servers on the domain. Servers 6, 7 and 8 are Terminal Servers (Runing Citrix). The Active Directory sets 2 things - mapping the Home Directory (H:) through the user profile and running the Login.bat script which creates a J: drive.

Up until the other day there have been no problems. Both drives map. Now, if I log into the server, the J: drive doesn't map. The H: drive maps fine.

There was some white papers where it talked about certain registry entries and services that needed to be installed and running. The servers look like they're correct. Yet if I log into 6, 7 or 8, it still does not map the J: drive.

The entry in the Login.bat file is:

Net use j: \\Domain location\files

We have altered the bat file to disconnect the drive and reconnect and even run with persistance, but the result does not change. J: will still not map.Since the tech info suggested a service not running, we decided to reboot the three machines. No change.

Any other thoughts on this? If I log onto any other machine (server or workstation) the drive maps. If I type in the unc, it will go to the location. If I manually map the drive, it will be there.
0
Comment
Question by:j_powers
  • 6
  • 5
11 Comments
 
LVL 5

Author Comment

by:j_powers
ID: 17867789
more information on this - We do have GPO set so the Citrix servers don't inherit the policies from the other machines. However, there is a policy to run %logonserver%\folder\login.bat.
0
 
LVL 9

Expert Comment

by:SamuraiCrow
ID: 17868601
Try this:

Create a new login script called logtest.bat and place it in the %logonserver%\folder\ location

Add the following syntax to logtest.bat:

%logonserver%\folder\login.bat >> %logonserver%\folder\%username%Login.txt 2>&1

Next assign this script to a test terminal server user (generally one of the IT guys)

This will redirect all output from the original login script into a text file (including errors!) for evaluation.  Please post the results here.
0
 
LVL 9

Expert Comment

by:SamuraiCrow
ID: 17868634
Also wondering what happens if you add:

Net use j: \\Domain location\files

to the first line of the usrlogon.cmd located in the c:\windows\system32 directory.  This script kicks off every time someone logs into the terminal server.  Let me know if this manages to map the drive.

Hope this helps
Crow
0
 
LVL 5

Author Comment

by:j_powers
ID: 17869367
The logtest.bat script does not come back with any errors.

I put the reference in the usrlogon.cmd file, and yes, it does kick off and map the J: drive, as well as any other drive in the script.

This is a perfect workaround, but not a long term issue. GPO should be controlling the file.
0
 
LVL 9

Expert Comment

by:SamuraiCrow
ID: 17869398
Can you do the following at the command line:
gpresult > c:\gpresult.txt

Please post the results here
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 5

Author Comment

by:j_powers
ID: 17870110
I am guessing you are looking for this part of the txt file:

    Applied Group Policy Objects
    -----------------------------
        CTX Prod Policy
        Local Group Policy

    The following GPOs were not applied because they were filtered out
    -------------------------------------------------------------------
        Local Group Policy
            Filtering:  Not Applied (Empty)

        CTX Prod Policy
            Filtering:  Denied (Security)

0
 
LVL 9

Expert Comment

by:SamuraiCrow
ID: 17870544
Which policy delivers the login script (It appears they are both being filtered)
0
 
LVL 5

Author Comment

by:j_powers
ID: 17872596
The CTX Prod Policy is in the folder in question. It works like this:

Domain
(Local Group Policy)
 Citrix
 (Blocking Domain Policies)
     DEV
     (No Policies)
     PROD
     (CTX Prod Policy)

The way it's set up is the way it's suggested to set up in several docs.

0
 
LVL 9

Accepted Solution

by:
SamuraiCrow earned 300 total points
ID: 17875293
According to the GPResult snippet you gave me the CTX Prod policy is being filtered because of security.  What groups have the 'apply group policy' permission on this GPO?
0
 
LVL 5

Author Comment

by:j_powers
ID: 17914424
OK. Sorry on the wait. Other issues had to come first. NEWay - here is the security of the profile CTX Prod Policy:

Authenticated Users - Read(From Security Filtering)
Domain Admins - Edit Settings, delete, modify security
Enterprise Admins - Edit Settings, delete, modify security
Enterprise Domain Controllers - Read
System - Edit Settings, delete, modify security

Authenticated Users are the only ones that have the 'apply group policy' permission in this GPO

Here is the hierarchy:
Forest
-Domains
--Local Domain (Default Policies in place)
---Computers
----Servers (Server Policy)
-----Citrix (Block Inheritance)
------Prod (CTX Prod Policy)

0
 
LVL 5

Author Comment

by:j_powers
ID: 17915944
I redid the permissions following a tech sheet I found. Once I did that, GPO started working without problem - well, at least not THAT problem. I cleaned up the errant policies for the container and it is now functioning correctly.

Thanks.
0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

Organizations create, modify, and maintain huge amounts of data to help their businesses earn money and generally function.  Typically every network user within an organization has a bit of disk space to store in process items and personal files.   …
Learn about cloud computing and its benefits for small business owners.
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now