PowerShell script settings are ineffective after you delete VBScript logon or logoff settings from the Script tab

Support for Windows Server 2003 ended on July 14, 2015

Microsoft ended support for Windows Server 2003 on July 14, 2015. This change has affected your software updates and security options. Learn what this means for you and how to stay protected.

Symptoms
Assume that you have VBScript scripts and Windows PowerShell scripts configured in a Group Policy logon or logoff script. You edit this Group Policy Object (GPO) by opening the properties dialog box for the logon or logoff script, deleting all VBScript settings from the Script tab, and then clicking OK. After that, you notice that the PowerShell scripts are ineffective, even if you did not delete any settings from the PowerShell Scripts tab. 

Note You can still see the PowerShell settings on the PowerShell Scripts tab. But those settings are neither distributed to clients nor displayed in the GPResult command-line tool (Gpresult.exe).
Cause
Deleting all VBScript settings from the Script tab removes the value of the gPCUserExtensionNames property of the GPO. (To determine this value, see the "More information" section.) This causes all logon and logoff scripts to be ineffective. 

This operation does not delete the PowerShell script files or the PowerShell script settings in the Psscripts.ini file. Therefore, you can still see the settings in Group Policy Management Editor. 
Workaround
To work around this issue, open the logon or logoff script properties dialog box, select the PowerShell Scripts tab, and then click OK. This restores the correct value of the gPCUserExtensionNames property.
More information
Microsoft recognized this behavior as a product bug and will consider fixing this problem in future operating system versions.

To determine the value of the gPCUserExtensionNames property of the GPO, follow these steps:
  1. Open Adsiedit.msc. 
  2. Expand the domain NC->DC=domain, DC=ext -> CN=System -> CN=Policies
  3. Right-click the GUID of the GPO, and then click Properties on the shortcut menu. You can see the gPCUserExtensionNames value on the Attributes tab.
 
Properties

Article ID: 3071417 - Last Review: 06/19/2015 18:17:00 - Revision: 1.0

Windows Server 2012 R2 Datacenter, Windows Server 2012 R2 Essentials, Windows Server 2012 R2 Foundation, Windows Server 2012 R2 Standard, Windows Server 2012 Datacenter, Windows Server 2012 Essentials, Windows Server 2012 Foundation, Windows Server 2012 Standard, Windows Server 2008 R2 Datacenter, Windows Server 2008 R2 Enterprise, Windows Server 2008 R2 for Itanium-Based Systems, Windows Server 2008 R2 Foundation, Windows Server 2008 R2 Standard, Windows Web Server 2008 R2, Windows Server 2008 Datacenter, Windows Server 2008 Enterprise, Windows Server 2008 for Itanium-Based Systems, Windows Server 2008 Foundation, Windows Server 2008 Standard, Windows Web Server 2008, Microsoft Windows Server 2003 Service Pack 2

  • kbexpertiseadvanced kbsurveynew kbtshoot KB3071417
Feedback