PowerShell script settings are ineffective after you delete VBScript logon or logoff settings from the Script tab

Symptoms

Assume that you have VBScript scripts and Windows PowerShell scripts configured in a Group Policy logon or logoff script. You edit this Group Policy Object (GPO) by opening the properties dialog box for the logon or logoff script, deleting all VBScript settings from the Script tab, and then clicking OK. After that, you notice that the PowerShell scripts are ineffective, even if you did not delete any settings from the PowerShell Scripts tab. 

Note You can still see the PowerShell settings on the PowerShell Scripts tab. But those settings are neither distributed to clients nor displayed in the GPResult command-line tool (Gpresult.exe).

Cause

Deleting all VBScript settings from the Script tab removes the value of the gPCUserExtensionNames property of the GPO. (To determine this value, see the "More information" section.) This causes all logon and logoff scripts to be ineffective. 

This operation does not delete the PowerShell script files or the PowerShell script settings in the Psscripts.ini file. Therefore, you can still see the settings in Group Policy Management Editor. 

Workaround

To work around this issue, open the logon or logoff script properties dialog box, select the PowerShell Scripts tab, and then click OK. This restores the correct value of the gPCUserExtensionNames property.

More Information

Microsoft recognized this behavior as a product bug and will consider fixing this problem in future operating system versions.

To determine the value of the gPCUserExtensionNames property of the GPO, follow these steps:
  1. Open Adsiedit.msc. 
  2. Expand the domain NC->DC=domain, DC=ext -> CN=System -> CN=Policies
  3. Right-click the GUID of the GPO, and then click Properties on the shortcut menu. You can see the gPCUserExtensionNames value on the Attributes tab.
 
Properties

Article ID: 3071417 - Last Review: Jun 19, 2015 - Revision: 1

Feedback