The problem only occurse when the logon script is run with the /silent parameter it seems and what’s worse. It’s only very few machines that gets an error.

The error message is: “The procedure entry point GetProcessImageFileNameW could not be located in the dynamic link library PSAPI.DLL”

I’ve tried to google it and the problem exists in a number of applications. I have reason to believe it’s our new IE7 installation that gave us the problem since its one the applications that gives this problem. I just don’t understand why this only happens when I use the “/silent” parametre with your logon script and even why its only on a handfull of PCs?

It sounds very cool what you are doing.

I am still working on my new version, it is a total rewrite, based mainly on jscript. Basically I am trying my best to make the new version very modular, so you only include the parts you need. If you for example don’t need to map a network drive, you do not include the code to do that, nor the code to parse the map drive xml.

The added bonus is that it makes it very easy to add new actions, without touching the core logic of the script.

If you have the time, please post your version of the script on your blog, I will gladly link to it on this page, so people can get their hands on a more updates version than the one currently on this site.

Saw your comment re: working on an updated version via RSS feed for this thread and thought I would check in and ask how development is going and post a few updates re: our implementation of your script (based on the current version, 4.00k)

I’ve recently added code to check the domain membership of the workstation. We needed this because we have multiple domains and ran into situations where a workstation is in one domain and the user is in another.

Another is an update to the routine used to populate the dictionary object with user’s group membership information. It now checks to confirm the entry is not already in dictionary object prior to adding it. I’m pretty certain this is the same thing that Leao Bras described in this post: http://www.egil.dk/xml-driven-logon-script/comment-page-1/#comment-248.

In our situation, we saw the error on users that are members of a domain which is being replaced. As part of that project, user objects and groups from the original domain were copied to the new domain. Because the new domain is visible to the script, during the AD interrogation step performed by “GetGroupMembership”, the script would report “This key is already associated with an element of this collection.”

I believe we could have handled this by requiring user and group names to be fully qualified (i.e.: Instead of “myusername”, make it “mydomain\myusername” or “myusername@mydomain.com”). Another option was to include an “On Error Resume Next” just prior to the loop that populates the dictionary object but that’s really not my style .

Other updates we’ve made include:
- Forcing silent mode for all Citrix sessions
- Obtaining home drive info to support users logging in via VPN
- Addition of a “Warning” category for success/fail results. This allows special formatting of events posted to the IE status window but doesn’t prevent the IE window from closing.
- Ability to handle situations where an attempt to map a drive that is already assigned to a local system drive letter (these are flagged as a “Warning” instead of “Error”). This was done primarily to accommodate logging on to servers via Remote Desktop.

We’ve begun deploying to users across the enterprise as a replacement for the various logon scripts developed by separate IT groups at different locations — sort of a “one script to rule them all” idea. Things are going well overall.

Something I’m interested in now is identifying any unused bits, redundancies, and general optimization. Would you be interested in having a look at our latest efforts?

Thanks,
Ken

Thanks!

No, there is not a filter that will look at a computers security group.

A work around is to assign the script to the computers using group policy, and then use filters when applying group policies.

Very nice script,

Is there a way to see if a computer is part of a group not the user?

TIA
James

Thanks for the reply, found it, stupid me…

I am working on an updated version that will include the updates Ken, Marianok and you provided, hopefully I will be done with it over the weekend.

If you can wait a little bit, I will have something for you then.

Jacob:

There is a DTD included in the XML file right now (at the very top), are you trying to put the DTD in a separate file?

I am trying this out and it works great. I am trying to create dtd file for the xml file, but strugling a big load on this, is there an dtd file out there for this xml file?

Thanks all

Your script incl. my modifications works fine so far…

But I would be interested in the changes from:

- Ken Knicker (March 9th 200) : http://www.egil.dk/xml-driven-logon-script/#comment-275
- marianok (October 9th) : http://www.egil.dk/xml-driven-logon-script/#comment-218

Can you send them to me ?

Regards,
Oliver

Regards,
Oliver

I have implemented most of the stuff I mentioned above

%userhomedirectory%
%userhomedrive%
%userprofilepath%

New Actions:

Modified Filters:

They now can check against the OU where an object (user, group) is stored in.

“name” can now handle DNs as well. Example

It auto-detects if it is a real name or a DN and compares accordingly.

Added internal variables for

Computer Objects OU
Users OU

I had to slightly change the DTD of the XML file.

Can you send me your email so I can send you back the code ?
Especially the DTD definition of the “ou” attribute is special. As I am not a XML DOM crack
I would like to know what a real crack has to say about this implementation and if it could
be solved easier or cleaner.

Regards,
Oliver

Thank you for the input. I would be pushing the term “active development” if I said that it was. I have received some great input from a few others as well and would love to write an updated version of the script. With a bit of luck I might get to it during the summer, but no guarantees

If you decide to extend the script yourself with some of the functionality you talk about, please send me a copy of what you figure out.

Regards, Egil.

I must admit, your logonscript is one of the best I have seen so far. Is it still under active development ?
If so could you please add the following features ?

- %userprofilepath% = Users Profile Path
- %userhomedirpath% = Users Home-Directory Path
- %userhomedrive% = Users Home-Directory Drive (e.g. H:)

Actions:

RemoveNetworkPrinter = Would remove a specific network printer
RemoveAllNetworkPrinters = Would remove all network Printers

Maybe an additional option for AddPrinter would be nice as well (removebeforeadd = true¦false)

Would it be possible to extend teh TestFilter (for Computers) in a way you could test the OU name a computer object is stored in ? I need this for printer assignment. All PCs in the same OU (Room OU) get a specific Printer assigned.

Kind regards,
Oliver

Thanks for the feedback. I will drop you a mail later today, would love to see your code. I hope to get a chance to actually update the script with some of the feedback I have been getting from various people the last year.

Great work on this script! I had been considering splitting our logon script code from the functions and rules for a while.

I noticed a couple of minor issues in the ‘ReplaceWildCards’ function and thought you would like to know about it:
1. %Fonts% is being set twice
2. %PrintHood% is not set at all

Also, one other thing: In our environment we have a need to set IPC connections and also to map drives using alternate credentials. I have reworked your ‘MapDrive’ class a bit to accommodate these requirements. If you would like to see the updated code just let me know.

Best regards,
Ken

Alternatively, you can upgrade your distribution groups to security groups. To do that, I am pretty sure you have to have a domain that’s running in 2003 native mode on the forest level.

Hopo this helps, Egil.

How I can use the distribution group to make a filterset? There are exist registry filterset or action?

Thanks,

The line you are getting the error in, has nothing to do with the mapping of a drive.

The line of code adds each active directory security group to a dictionary for lookup later, it looks like you have two security groups with the exact same name, something I have never come across before.

Try testing with a new user, who is not a member of any security groups besides the default Domain Users.

Thanks,

That is very cool. I always like it when someone build upon then script. You should get a mail from me soon, would love to discuss the additions you have made.

If you think that the changes and you think that someone else might like them, let me know (you should have my email in this post) and i’ll send them to you.

There is no way to specify a user name and password. And you should never do that in a plain text file like the XML rules file, especially since that file is most likely placed in a rather public share like \\Domain\NETLOGON – which renders the point of having a user name and password irrelevant.

The script assumes the user logging onto computer is part of a domain, which means you can also assign access rights through NTFS ACLs on the shared folder directly, and thus do not need to specify a user name and password. That is by far the recommend way of doing things.

If the share is on a none Windows server, where you can not authenticate against the domain, and you need the data to be secure, I would look in to setting up a automated copy/move process of the data to a server that can be protected with NTFS security. That way only the copy/move process needs to know the security credentials to the original share.

Hope this helps, Egil.

Use S: “\\SERVER\SHARE” /user:SERVER\USERNAME /password:PASSWORD

I know I have to use something like this:

But cannot find a description about an option to put a username and password with mapDrive.

Thanks, please post any feedback you might have.