Lab Objective:
Active Directory – Learn how to create a Logon Script at the Domain we just created.
Lab Purpose:
You will learn how to create a Logon Script for the user of the Domain “lab.local”.
Lab Tool:
Windows Server 2012 R2 + Windows 10
Lab Topology:
Use two machines, either on your home network or on the same virtual network in VMware.
Note:
You can use logon scripts to assign tasks that will be performed when a user logs on to a particular computer. These scripts can carry out operating system commands, set system environment variables, and call other scripts or executable programs. Some tasks commonly performed by logon scripts include:
Mapping network drives
Installing and setting a user’s default printer
Collecting computer system information
Updating virus signatures
Updating software
Basically, there are two ways to assign Logon scripts.
The first is done on the Profile tab of the user properties dialog in the Active Directory Users and Computers (ADUC).
The second is done via Group Policy Objects (GPO).
Note:
Using the first method via the Profile tab of the user properties will work for any Microsoft-based operating system, and is especially useful when you have older clients such as Windows 95/98 or Windows NT.
These types of operating systems do not use Group Policies. Therefore, it’s recommended you only use one method.
Lab Walkthrough:
Task 1:
We will add a new virtual disk at the machine. The below example is for VMware, but you can easily do the same in VirtualBox and there are several ‘how to’ videos available on the web.
Shutdown the DC (Domain Controller).
Edit the virtual machine settings ➜ Click on ➜ Add…
Select ➜ Hard Disk ➜ then click on ➜ Next >
Click on ➜ Next.
Click on ➜ Next.
Give 10 GB disk size ➜ Store virtual disk as a single file ➜ then click on ➜ Next.
Click on ➜ Finish.
Click ‘OK’ and start the machine.
In the Server Manager ➜ Select ➜ File and Storage Services.
Click on ➜ Disks.
Right-click on disk 1 ➜ select ➜ New Volume…
Click on ➜ Next.
Click on ➜ Next.
Click on ➜ OK.
Select Drive letter: Z ➜ then click on ➜ Next.
At the Volume label, type: Network_Share ➜ then click on ➜ Next.
Click on ➜ Create.
Click on ➜ File Explorer icon.
Double-click ➜ Network_Share disk.
Right-click and then select ➜ New ➜ Folder.
Rename the new folder as: Users_Shares.
Right-click on the folder ➜ then select ➜ Properties.
In the Sharing tab, click on ➜ Share…
Select ➜ Everyone ➜ then click on ➜ Add.
Select ➜ Read/Write ➜ then click on ➜ Share.
Click on ➜ Done.
Task 2:
Create the logon script to map a network drive
Click on ➜ Folder Icon to open the Windows Explorer at your DC.
The default location for logon scripts is the NETLOGON share, which, by default, is shared on all Domain Controllers in an Active Directory forest, and is located in the following folder:
%SystemRoot%\SYSVOL\sysvol\<domain DNS name>\scripts
Where %SystemRoot% is usually “C:\Windows” and <domain DNS name> is the DNS name of the domain, similar to “lab.local”.
This folder, which is a part of the SYSVOL special folder, is replicated to all the Domain Controllers in the domain.
Please type: %SystemRoot%\SYSVOL\sysvol\ and then press ➜ Enter Key.
Double-click on ➜ lab.local .
Double-click on ➜ scripts.
As you can see at the moment, we don’t have any logon script at our system.
The Administrator of the Domain has assigned a new Hard Disk at the system and they created a new network share for all the users of the Domain lab.local .
Now, the Administrator wants to make this Network Drive available for each user that logs in at the Domain with their client machines.
For this reason, the Administrator instead of going to each client present at the company and mapping the drive manually, they will create a script which will map this drive automatically.
In the scripts folder ➜ right-click on ➜ New ➜ select ➜ Text Document.
Type: login ➜ and then press Enter.
Select ➜ View ➜ then flag ➜ File name extensions ➜ and ➜ Hidden items.
Now you can see the file name followed by its extension which is .txt .
We need to rename this file extension to transform this simple text file into an executable batch file.
Right-click on the login.txt file ➜ then select ➜ Rename.
Please rename ONLY the extension name from txt to bat as shown.
Then press ➜ ENTER.
Confirm with ‘Yes’.
Right-click again at login.bat and then ➜ select➜ Edit
In this window, we will now insert our code to map the network drive.
@echo OFF
NET USE Z: “\\DC1\Users_Shares”
We need to give Domain Users permission to this file before we can run it. Save the file and close it.
Right-click on the file ➜ then select ➜ Properties.
Select the Security TAB ➜ then click on ➜ Edit…
Click on ➜ Add…
Type: Domain Users ➜ then click on ➜ Check Names.
Click on ➜ OK.
Check that the Domain Users have ➜ Read & execute + Read permissions as shown above ➜ then click on ➜ OK.
Confirm 2 times with ‘Yes’.
Then click on ➜ OK to close this window.
C:\Windows\SYSVOL\sysvol\lab.local\scripts\login.bat
Task 3:
Create a Group Policy Object to connect the logon script we just created to the user profile at Active Directory
In Server Manager Click on ➜ Tools ➜ then select ➜ Group Policy Management.
Select Domains ➜ lab.local ➜ then click on ➜ Create a GPO in this domain, and Link it here…
Give the name: Logon Script GPO ➜ then click on ➜ OK.
Right-click on Logon Script GPO ➜ then click on ➜ Edit…
Select ➜ User Configuration ➜ select ➜ Windows Settings ➜ select ➜ Scripts (Logon/Logoff) ➜ double-click on ➜ Logon.
Click on ➜ Show Files…
Copy the login.bat file from:
C:\Windows\SYSVOL\sysvol\lab.local\scripts
And paste it to:
\\lab.local\SysVol\lab.local\Policies\{AA28168A-1AB0-4E74-9A24-16B15BDC52D3}\User\Scripts\Logon
You can browse to check if it’s there if you wish.
Click on ➜ Add…
Click on ➜ Browse…
As you can see, the script is there. Close all the windows.
Task 4:
Test the logon script at a Windows Client Machine
Please log off if you are logged in at your Windows Machine and log back in.
Right-click on the Start icon ➜ Select ➜ Shut down or sign out ➜ click on ➜ Sign out.
Log back in.
Navigate to your Windows Explorer and now you can see the new Z Driver mapped!
You have learned how to create a logon script to map a drive for a user of the Active Directory through GPO.
