Windows OS Hub
  • Windows
    • Windows 11
    • Windows Server 2022
    • Windows 10
    • Windows Server 2019
    • Windows Server 2016
  • Microsoft
    • Active Directory (AD DS)
    • Group Policies (GPOs)
    • Exchange Server
    • Azure and Microsoft 365
    • Microsoft Office
  • Virtualization
    • VMware
    • Hyper-V
  • PowerShell
  • Linux
  • Home
  • About

Windows OS Hub

  • Windows
    • Windows 11
    • Windows Server 2022
    • Windows 10
    • Windows Server 2019
    • Windows Server 2016
  • Microsoft
    • Active Directory (AD DS)
    • Group Policies (GPOs)
    • Exchange Server
    • Azure and Microsoft 365
    • Microsoft Office
  • Virtualization
    • VMware
    • Hyper-V
  • PowerShell
  • Linux

 Windows OS Hub / Group Policies / How to Run GPO Logon Script Only Once

March 17, 2024

How to Run GPO Logon Script Only Once

GPO logon scripts allow you to run a BAT or PowerShell script at computer startup or user logon/logoff. In some cases, an administrator wants a particular script (command/program) to be run for each user or computer only once and not run at the next logons.

To solve this task, you can use a standard logon script that checks for a certain flag on the computer. This can be a registry parameter, a text file on the disk, etc.

For example, you want a certain code block to be executed only once at the first user log on to a computer.

  1. Create the following BAT file (corp_user_init.bat) and save it to %SystemRoot%\SYSVOL\sysvol\<domain name>\scripts on your domain controller:@echo off
    IF EXIST C:\Users\%UserName%\AppData\app_init.txt GOTO END
    date /t >> C:\Users\%UserName%\AppData\app_init.txt
    time /t >> C:\Users\%UserName%\AppData\app_init.txt
    REM Put your code here, which will be executed once
    :END

    The script creates a small text file in a user’s profile when it is run for the first time. When the script is run for the next time through the GPO, it checks if the file exists on a disk. If it does, the script has already been executed and the code doesn’t need to be run again.
  2. Open the domain Group Policy Management console (gpmc.msc);
  3. Create a new policy and link it to an OU with users (or computers, but then you have to enable the Loopback Processing mode);
  4. Go to User Configuration -> Windows Settings -> Scripts (Logon / Logoff);
  5. Select Logon;
  6. Click Add and specify the path to your BAT file in SYSVOL (\\woshub.com\SysVol\woshub.com\scripts);
    GPO: Run a logon script once a new user logs on
  7. After updating Group Policy settings on a client computer, your script will be executed at user logon. Make sure that it has successfully created the app_init.txt file in a user’s profile.
    If the GPO with the script has not been applied, use the gpresult tool and troubleshooting methods described in the article Why GPO Is not Applied.
  8. At the next user logs on to a computer, the main script code will not be executed. So, the script is actually applied to the user only once.

Another way to run a script only once using GPO is to create a one-time task in the Task Scheduler.

  1. Save your script file (it may be either a BAT file or a PowerShell script) to the Sysvol folder on the domain controller (\\<your_domain_name>\SysVol\<your_domain_name>\scripts);
  2. Create a new GPO, link it to the user’s OU, and open its settings;
  3. Go to Preferences -> Control Panel Settings -> Scheduled Task -> New -> Immediate Task (At least Windows 7);
  4. Specify the task name;
    GPO create new Scheduled Task
  5. Open the Actions tab, click New, and specify the full UNC path to your script file in SYSVOL;
    run a script using Windows scheduled task
  6. Then go to the Common tab and check the Apply once and do not reapply option;
    Group Policy Preferences - sheduled task Apply once and do not reapply
  7. This task will run on a computer only once at the first user logon.
If you want to run PowerShell scripts through a GPO, you need to configure the PowerShell script execution policy or use the -ExecutionPolicy Bypass option when running your script (see an example here).
0 comment
2
Facebook Twitter Google + Pinterest
Active DirectoryGroup PoliciesWindows 10Windows Server 2019
previous post
How to Configure NIC Teaming on Windows Server 2019/2016 and Windows 10
next post
Disable Automatic Restart on System Failure in Windows 10/11

Related Reading

How to Find the Source of Account Lockouts...

March 12, 2024

How to Delete Old User Profiles in Windows

March 15, 2024

Configuring Windows Firewall Rules Using Group Policy

March 15, 2024

Updating List of Trusted Root Certificates in Windows

March 11, 2024

How to Hide or Show User Accounts from...

July 24, 2024

Copy Files and Folders to User Computers via...

March 15, 2024

How to Disable NTLM Authentication in Windows Domain

March 16, 2024

Updating Group Policy Administrative Templates (ADMX)

January 24, 2025

Leave a Comment Cancel Reply

join us telegram channel https://t.me/woshub
Join WindowsHub Telegram channel to get the latest updates!

Recent Posts

  • Map a Network Drive over SSH (SSHFS) in Windows

    May 13, 2025
  • Configure NTP Time Source for Active Directory Domain

    May 6, 2025
  • Cannot Install Network Adapter Drivers on Windows Server

    April 29, 2025
  • Change BIOS from Legacy to UEFI without Reinstalling Windows

    April 21, 2025
  • How to Prefer IPv4 over IPv6 in Windows Networks

    April 9, 2025
  • Load Drivers from WinPE or Recovery CMD

    March 26, 2025
  • How to Block Common (Weak) Passwords in Active Directory

    March 25, 2025
  • Fix: The referenced assembly could not be found error (0x80073701) on Windows

    March 17, 2025
  • Exclude a Specific User or Computer from Group Policy

    March 12, 2025
  • AD Domain Join: Computer Account Re-use Blocked

    March 11, 2025

Follow us

  • Facebook
  • Twitter
  • Telegram
Popular Posts
  • Configure Google Chrome Settings with Group Policy
  • Get-ADUser: Find Active Directory User Info with PowerShell
  • Allow Non-admin Users RDP Access to Windows Server
  • How to Find the Source of Account Lockouts in Active Directory
  • How to Disable or Enable USB Drives in Windows using Group Policy
  • Get-ADComputer: Find Computer Properties in Active Directory with PowerShell
  • Configuring Proxy Settings on Windows Using Group Policy Preferences
Footer Logo

@2014 - 2024 - Windows OS Hub. All about operating systems for sysadmins


Back To Top