PowerShell script settings are ineffective after you delete VBScript logon or logoff settings from the Script tab

Applies to: Windows Server 2012 R2 DatacenterWindows Server 2012 R2 EssentialsWindows Server 2012 R2 Foundation More

Symptoms


Assume that you have VBScript scripts and Windows PowerShell scripts configured in a Group Policy logon or logoff script. You edit this Group Policy Object (GPO) by opening the properties dialog box for the logon or logoff script, deleting all VBScript settings from the Script tab, and then clicking OK or Apply followed by OK. After that, you notice that the PowerShell scripts are ineffective, even if you did not delete any settings from the PowerShell Scripts tab.

Cause


Deleting all VBScript settings from the Script tab removes the value of the gPCUserExtensionNames property of the GPO. (To determine this value, see the "More information" section.) This causes all logon and logoff scripts to be ineffective. 

This operation does not delete the PowerShell script files or the PowerShell script settings in the Psscripts.ini file. Therefore, you can still see the settings in Group Policy Management Editor. 

Resolution


To resolve this issue, install September 19, 2017 update, KB4038774 for Windows Server 2012 R2.

Workaround


To work around this issue, open the logon or logoff script properties dialog box, select the PowerShell Scripts tab, and then click OK. This restores the correct value of the gPCUserExtensionNames property.

More Information


Microsoft recognized this behavior as a product bug and will consider fixing this problem in future operating system versions.

To determine the value of the gPCUserExtensionNames property of the GPO, follow these steps:
  1. Open Adsiedit.msc. 
  2. Expand the domain NC->DC=domain, DC=ext -> CN=System -> CN=Policies
  3. Right-click the GUID of the GPO, and then click Properties on the shortcut menu. You can see the gPCUserExtensionNames value on the Attributes tab.