Understanding logon scriptsA logon script runs automatically whenever a user logs on to a computer running a member of the Windows .NET Server 2003 family of operating systems. The script can contain operating system commands, such as those that make network connections or start programs. Logon scripts can also set environment variables to specify information such as the computer search path and the directory for temporary files. A logon script is usually a batch file (.bat or .cmd file name extension), but any executable program can be used.
 
Logon scripts are optional. You can use them to configure user working environments by creating network connections and starting programs. Logon scripts are useful when you want to affect the user work environment without managing all aspects of it.
 
Script files are text files that contain script commands. The Windows .NET Server 2003 family of operating systems supports these types of scripts:  
 
Batch file commands are stored in text files with the .bat or .cmd file name extension. Batch files automate simple series of tasks that would otherwise be run from a command line. Scripts written using batch file commands are run by the command shell. For more information about the command shell, see Command shell overview.  
Visual Basic Scripting Edition (VBScript) commands are stored in text files with the .vbs file name extension, and JScript commands are stored in text files with the .js file name extension. VBScript and JScript allow the administrator to construct sophisticated scripts. The Windows Script Host can run these scripts from the desktop of the computer, or from a command line. For more information about the Windows Script Host, see Windows Script Host.  
After you create a logon script, you can assign it to one or more local users, sites, domains, or organizational units (OUs).  
 
For more information about specific tasks related to assigning scripts, see How To.

Creating logon scriptsYou can use logon scripts to assign tasks that will be performed when a user logs on to a particular computer. The scripts can carry out operating system commands, set system environment variables, and call other scripts or executable programs. The Windows .NET Server 2003 family supports two scripting environments: the command processor runs files containing batch language commands, and Windows Script Host (WSH) runs files containing Microsoft Visual Basic Scripting Edition (VBScript) or Jscript commands. You can use a text editor to create logon scripts. Some tasks commonly performed by logon scripts include:
 
Mapping network drives.  
Installing and setting a user's default printer.  
Collecting computer system information.  
Updating virus signatures.  
Updating software.  
The following example logon script contains VBScript commands that use Active Directory Service Interfaces (ADSI) to perform three common tasks based on a user's group membership:
 
It maps the H: drive to the home directory of the user by calling the WSH Network object's MapNetworkDrive method in combination with the WSH Network object's UserName property.  
It uses the ADSI IADsADSystemInfo object to obtain the current user's distinguished name, which in turn is used to connect to the corresponding user object in Active Directory. Once the connection is established, the list of groups the user is a member of is retrieved by using the user's memberOf attribute. The multivalued list of group names is joined into a single string by using VBScript's Join function to make it easier to search for target group names.  
If the current user is a member of one of the three groups defined at the top of the script, then the script maps the user's G: drive to the group shared drive, and sets the user's default printer to be the group printer.  
To create an example logon script
Open Notepad.  
Copy and paste, or type, the following:  
Const ENGINEERING_GROUP     = "cn=engineering"
Const FINANCE_GROUP         = "cn=finance"
Const HUMAN_RESOURCES_GROUP = "cn=human resources"
 
Set wshNetwork = CreateObject("WScript.Network" )
wshNetwork.MapNetworkDrive "h:", "\\FileServer\Users\" & wshNetwork.UserName
 
Set ADSysInfo = CreateObject("ADSystemInfo" )
Set CurrentUser = GetObject("LDAP://" & ADSysInfo.UserName)
strGroups = LCase(Join(CurrentUser.MemberOf))
 
If InStr(strGroups, ENGINEERING_GROUP) Then
 
    wshNetwork.MapNetworkDrive "g:", "\\FileServer\Engineering\"
    wshNetwork.AddWindowsPrinterConnection "\\PrintServer\EngLaser"
    wshNetwork.AddWindowsPrinterConnection "\\PrintServer\Plotter"
    wshNetWork.SetDefaultPrinter "\\PrintServer\EngLaser"
 
ElseIf InStr(strGroups, FINANCE_GROUP) Then
 
    wshNetwork.MapNetworkDrive "g:", "\\FileServer\Finance\"
    wshNetwork.AddWindowsPrinterConnection "\\PrintServer\FinLaser"
    wshNetWork.SetDefaultPrinter "\\PrintServer\FinLaser"
 
ElseIf InStr(strGroups, HUMAN_RESOURCES_GROUP) Then
 
    wshNetwork.MapNetworkDrive "g:", "\\FileServer\Human Resources\"
    wshNetwork.AddWindowsPrinterConnection "\\PrintServer\HrLaser"
    wshNetWork.SetDefaultPrinter "\\PrintServer\HrLaser"
 
End If
On the File menu, click Save As.  
In Save in, click the directory that corresponds to the domain controller's Netlogon shared folder (usually SystemRoot\SYSVOL\Sysvol\DomainName\Scripts where DomainName is the domain's fully qualified domain name).  
In Save as type, click All Files.  
In File name, type a file name, followed by .vbs, and then click Save. WSH uses the .vbs extension to identify files that contain VBScript commands.  
 Notes
 
To open Notepad, click Start, point to Programs, point to Accessories, and then click Notepad.  
To use the example logon script, you need to change the group names, network drive letters, and Universal Naming Convention (UNC) paths to match your system environment.  
To run a logon script, you need to assign the script to a user or a group. For more information, see To assign a logon script to a user or group.  
For more information about creating and using logon scripts, see Logon Scripts, Windows Script at the Microsoft Web site (http://www.microsoft.com/), and the Microsoft Windows Resource Kits Web site. (http://www.microsoft.com/).

Logon script assignmentOn computers running operating systems in the Windows .NET Server 2003 family, you can assign a logon script to a user account. When a user logs on and a path to a logon script is present in the user account, the file is located and run.
 
You can also assign logon and logoff scripts, and computer startup and shutdown scripts by using the Group Policy snap-in. These scripts apply to the entire scope of users and computers for which a particular Group Policy object applies.
 
In Computer Management, you can use the User Property dialog box to assign logon scripts to user accounts by typing the file name (for example, Clerks.bat) in the Logon script text box. At logon, the server authenticating the logon locates an assigned logon script. It looks for the specified file following the local logon script path on the server (usually %systemroot%\SYSVOL\sysvol\domain_name\scripts). If a relative path is provided before the file name (for example, Admins\User1.bat), the server looks for the logon script in that subdirectory of the logon script path.
 
The entry in the Logon Script text box specifies only the file name (and, optionally, the relative path) and does not create the actual logon script. You create a logon script with the specified name and place it in the appropriate directory on the appropriate replication export server.
 
You can place a logon script in a local directory on a user's computer. You would typically use this location, however, when you are administering user accounts that exist on a single computer rather than in a domain. This logon script runs only when a user logs on locally to the computer and does not run when the user logs on to the domain. You must place the logon script using the computer's logon script path or in a subdirectory of that logon script path. The default location for local logon scripts is the %systemroot%\System32\Repl\Imports\Scripts folder. This folder is not created on an new installation of Windows XP. A folder must be created and shared with the name netlogon; for step-by-step instructions, see To share a folder or drive. The NTFS permissions of this folder should allow users and server operators only read and execute permissions, and should allow administrators full control. The folder is created and shared automatically on domain controllers, so you should not attempt to create a netlogon folder on a domain controller manually.  
 
For more information, see: How to, Group Policy Overview, and Privileges.