[Webinar] Streamline your web hosting managementRegister Today


Cannot edit VBS, CMD or BAT files located under SYSVOL for GPOs

Posted on 2008-02-06
Medium Priority
Last Modified: 2010-10-14
I recently discovered the domain administrators profile was corrupted, so I temporarily promoted an account to domain admin level, rebooted DC1 (FSMO) and when it came back, logged on with temp account and nuked the profile of the domain administrator via the My Computer-->Properties-->Advanced-->User Profiles-->Delete

After that, I logged on as the domain admin, and demoted the temp account.

Since then, when I try to edit ANY file with the extension of CMD, VBS or BAT in my GPO folders  e.g. \\dc1\SYSVOL\domain.name\Policies\{SOMESID}\User\Scripts\Logon I get this error:


I CAN create bat, vbs and cmd files on the desktop etc and edit them just fine. If I rename the cmd file to txt I can then edit it....

It's WEIRD?!

I've tried using Nirsoft's shmnview.exe and shexview.exe as well as ContextEdit.exe by ZiffDavisMedia and NONE have helped me so far.. I'm desperate and need this working ASAP.

Can anyone help?
Question by:vtois
  • 5
  • 2
LVL 86

Expert Comment

ID: 20836047
That's the Internet Security Settings for you ...
Make sure that the server is recognized as belonging to the Local Intranet zone (add it there, if necessary), and make sure that "Miscellaneous > Launching Application and unsafe files" in the security setting for the Intranet zone is enabled.

Author Comment

ID: 20836088
I have:


In the list and the permission was set to Medium, I dragged it down to Low, also verified that the setting you mentioned is enabled...

Result: NO!

Still same error


Author Comment

ID: 20836095
I added <computername>, http://<computername> in there and no difference
Never miss a deadline with monday.com

The revolutionary project management tool is here!   Plan visually with a single glance and make sure your projects get done.

LVL 86

Accepted Solution

oBdA earned 2000 total points
ID: 20836182
When you're entering the UNC path in Windows Explorer, does the status bar (enable it, if necessary) show the "Local Intranet" zone in the lower right corner?
If not, you need to add just the computer name (no protocol) to the Local Intranet zone, and check the "Launching Application and unsafe files" for this zone.
If this is all established, check your virus scanner. Some, like McAfee, have an overeager "feature" of disabling network access to dangerous files like batch files as well.

Author Comment

ID: 20836205
Hmm it's still showing as Internet although I put in:



Author Closing Comment

ID: 31428657

Author Comment

ID: 20836224
nvm... I got it.. I was trying the IP and it was still showing as Internet... I tried the name of the DC after that and it worked!


Friggin undocumented IE crap!


Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Let's recap what we learned from yesterday's Skyport Systems webinar.
The article explains the process to deploy a Self-Service password reset portal I developed a few years ago. Hopefully, it will prove useful to someone.  Any comments, bug reports etc. are welcome...
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This video shows how to use Hyena, from SystemTools Software, to update 100 user accounts from an external text file. View in 1080p for best video quality.

590 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question