As far as I can tell, a logoff (and logon) script is added to this registry key: [HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System\Scripts\Logoff] "Script"="logoff.cmd" "Parameters"="" "ExecTime"=hex(b):00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 [HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System\Scripts\Logon] "Script"="logon.cmd" "Parameters"="" "ExecTime"=hex(b):00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 Scripts must be in $OEM$\$$\System32\GroupPolicy\User\Scripts\Logon and \Logoff