3 CMD Windows open on every new user' first logon

[GIL]

nLite does a great job making the windows installation more personalized

I used the 1.2.1 version this time, and I can take no having a RunOnceEx installation (I gather its not supported now?) but why are there 3 big old black CMD windows opening on every new user' first logon?

Found this on a RunOnce folder in the default user

cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N

Can those be removed?

Did nLite did it's thing the first time

thanks

GIL

[theunknown]

Just ran into this issue myself, strangely deleting [what i believe are] the offending keys from the registry dosnt resolve the

issue.

Unfortunately in my situation (large network with cmd.exe disable) this would results in three black dialogs telling users they're doing something they shouldnt at every logon, looking forward to a permenant solution.

On that note, I believe these keys are imported from NLITE.INF, i've removed the appropriate lines and am in the process of testing now... will udpate with results when i have them.

As for your RunOnceEx issue, im betting you install IE7 somewhere along the track... checkout the Application Installs thread for a solution.

EDIT: Removing the following lines from i386\NLITE.INF resolves the problem.

[LD]
HKU,".DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce","nltide1"
HKU,".DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce","nltide2"

....

HKU,".DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce","nltide3",0x00020000,"cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N

...

HKU,".DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce","nltide1",0x00020000,"cmd.exe /C move /Y ""%SystemRoot%\System32\syssetub.dll"" ""%SystemRoot%\System32\syssetup.dll"""
HKU,".DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce","nltide2",0x00020000,"cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N"

Not exactly sure what those DLL's are required for, but so far no adverse effects.

Regards, theunknown

Edited November 6, 2006 by theunknown

[Madhits45]

What is the actual problem here? There usta be an inf error when those boxes popped up at first login. Now nuhi has fixed this and the error is gone for me. So what is the issue here?

[minigun]

its applying the tweaks

[theunknown]

My problem is, in a domain environment every time a new user logs in these three windows appear. That normally wouldnt worry me, but because of my GP's each of these windows present my users with "The command prompt has been disables, Please See your administrator" and requires a key press to continue. Im not sure how familiar you are with general user ignorance, but this would send them into a panic.

If these keys could be run ONLY on the first login, that'd be fine. But in their current position (every new user) they're a problem for me.

Regards, theunknown

[minigun]

well nlite isnt meant to be used in that sort of enviromnet so nuhi isnt going to help

[Madhits45]

Yeah nlite is not a corp app. So you might be SOL. The best you can do is either find where the keys are in the reg and kill them for new user's or post a note for all PC users in the lab to do this when those prompts pop up.

[theunknown]

Deleted, didnt realise this made it through

Edited November 7, 2006 by theunknown

[theunknown]

Sounds like ive been a little misunderstood. I didnt come here complaining, merely to explore what was causing the issue. On the off chance you missed it, ive also presented a solution that seems to have no side effects. Im here sharing it with someone else in my situation, how is it that people find that a problem? Since my posts no one has offered anything constructive... so why bother?

On a more related matter, a slight explanation of those key's would be appreciated. Because from what i've found, its not necessary to use the command prompt at all. The code below should achieve the same thing without the prompts that have brought us here.

[LD]
HKU,".DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce","nltide1"

....

HKU,".DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce","nltide1",0x00020000,"rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N

...

syssetup.dll and syssetub.dll are both present even without the move command, rundll32 can be executed by itself devoid of any reliance on cmd.exe, and i see no reason for the exact same line to be run twice.

i'll give it a test and report back with the results.

Regards, theunknown

Edited November 7, 2006 by theunknown

[GIL]

Thanks for replying

I will check your solution to the RunOnceEx problem, theunknown.

I found the NLITE.INF in the installed windows, C:\WINDOWS\INF\NLITE.INF with the keys you mentioned for removal, but in the "nLited" ISO the NLITE.INF its called i389\NLITE.IN_ and it's unreadable, so, is it encoded somehow? if so how can I edited?

By the way, leave theunknown in peace! for you do not know him.

GIL

[GIL]

oh! so that's what the extentions with "_" are all about, there CAB files.

behold the UNKNOWN!

Before I mess with it again let me check how to recompress them.

GIL

[nuhi]

Only line which calls C, which are user tweaks is needed, others are just for first time admin. Left it there because it's left anyway, probably hard coded into the hive during install. So yes you can remove it but it may still appear.

If you find out from where it is called other than that runonce let me know and I'll clean it next time.

[MatrixNZ]

I found the same issue and narrowed it down to the following hotfix WindowsXP-KB922760-x86-ENU.exe nlite.in_ had the following lines

[LD]

HKU,".DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce","nltide2"

HKU,".DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce","nltide2",0x00020000,"cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N"

Once I removed the hotfix, problem went away.

Cheers

[Madhits45]

sweet. sounds like a fix for the next nlite.