Privileges to run Logon Scripts?

[bbbngowc]

Hello,

I have a logon script that will do the following:

1. Check to see if Office 2007 is installed on the Computer

2. If installed, Exit

3. If not installed, Install

Why is it that, unless the user has Admin permissions on the local computer the Application will not install? I have "Always Use Elevated Privileges" Enabled for both Computer and User Configuration.

What else am I suppose to do to allow the application to install without giving the user admin rights?

[Tripredacus]

What Server is running your domain? What user is running the script? You may need to add that user into the proper group.

[bbbngowc]

Windows Server 2003.

How to configure the user?

I thought once you configure the "Use Elevated Privileges" the systems knows to use the local system account?

Edited October 7, 2008 by bbbngowc

[bbbngowc]

Unless perhaps I should put the logon script as a startup script under Compuer Configuration?

[Tripredacus]

Windows Server 2003.

How to configure the user?

I thought once you configure the "Use Elevated Privileges" the systems knows to use the local system account?

Not knowing how exactly your AD is set up, it could be overriden. Say, for example, there is some folder or accout or Group or OU permission that has a Special Permission with a Deny checked for something, this can override using the SYSTEM. Or perhaps a GPO is set to disallow something that the installer needs for that user.

Do you get a specific error?

Also make sure to use the following:

The default location for local logon scripts is the %systemroot%\System32\Repl\Imports\Scripts folder. This folder is not created on an new installation of Windows XP. A folder must be created and shared with the name netlogon; // The NTFS permissions of this folder should allow users and server operators only read and execute permissions, and should allow administrators full control.

http://technet.microsoft.com/en-us/library/cc758958.aspx

From Microsoft Windows Server 2003, Administrator's Pocket Consultant:

Also, you shouldn't use logon scripts to specify applications that should run at startup. You shoulld set startup applications by placing the appropriate shortcuts in the user's Startup folder.

Is your Logon Script a batch file? You could try recoding as AutoIT (or similar) and set Runas option to an account with administrative access.

[bbbngowc]

You were right. There was another policy that was overiding the new one. I configured the elevated privileges settings and it looks to be working now.