Jump to content

3 CMD Windows open on every new user' first logon


GIL

Recommended Posts

nLite does a great job making the windows installation more personalized

I used the 1.2.1 version this time, and I can take no having a RunOnceEx installation (I gather its not supported now?) but why are there 3 big old black CMD windows opening on every new user' first logon?

Found this on a RunOnce folder in the default user

cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N

Can those be removed?

Did nLite did it's thing the first time

thanks

GIL

Link to comment
Share on other sites


Just ran into this issue myself, strangely deleting [what i believe are] the offending keys from the registry dosnt resolve the

issue.

Unfortunately in my situation (large network with cmd.exe disable) this would results in three black dialogs telling users they're doing something they shouldnt at every logon, looking forward to a permenant solution.

On that note, I believe these keys are imported from NLITE.INF, i've removed the appropriate lines and am in the process of testing now... will udpate with results when i have them.

As for your RunOnceEx issue, im betting you install IE7 somewhere along the track... checkout the Application Installs thread for a solution.

EDIT: Removing the following lines from i386\NLITE.INF resolves the problem.

[LD]
HKU,".DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce","nltide1"
HKU,".DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce","nltide2"

....

HKU,".DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce","nltide3",0x00020000,"cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N

...

HKU,".DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce","nltide1",0x00020000,"cmd.exe /C move /Y ""%SystemRoot%\System32\syssetub.dll"" ""%SystemRoot%\System32\syssetup.dll"""
HKU,".DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce","nltide2",0x00020000,"cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N"

Not exactly sure what those DLL's are required for, but so far no adverse effects.

Regards, theunknown

Edited by theunknown
Link to comment
Share on other sites

My problem is, in a domain environment every time a new user logs in these three windows appear. That normally wouldnt worry me, but because of my GP's each of these windows present my users with "The command prompt has been disables, Please See your administrator" and requires a key press to continue. Im not sure how familiar you are with general user ignorance, but this would send them into a panic.

If these keys could be run ONLY on the first login, that'd be fine. But in their current position (every new user) they're a problem for me.

Regards, theunknown

Link to comment
Share on other sites

Sounds like ive been a little misunderstood. I didnt come here complaining, merely to explore what was causing the issue. On the off chance you missed it, ive also presented a solution that seems to have no side effects. Im here sharing it with someone else in my situation, how is it that people find that a problem? Since my posts no one has offered anything constructive... so why bother?

On a more related matter, a slight explanation of those key's would be appreciated. Because from what i've found, its not necessary to use the command prompt at all. The code below should achieve the same thing without the prompts that have brought us here.

[LD]
HKU,".DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce","nltide1"

....

HKU,".DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce","nltide1",0x00020000,"rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N

...

syssetup.dll and syssetub.dll are both present even without the move command, rundll32 can be executed by itself devoid of any reliance on cmd.exe, and i see no reason for the exact same line to be run twice.

i'll give it a test and report back with the results.

Regards, theunknown

Edited by theunknown
Link to comment
Share on other sites

Thanks for replying

I will check your solution to the RunOnceEx problem, theunknown.

I found the NLITE.INF in the installed windows, C:\WINDOWS\INF\NLITE.INF with the keys you mentioned for removal, but in the "nLited" ISO the NLITE.INF its called i389\NLITE.IN_ and it's unreadable, so, is it encoded somehow? if so how can I edited?

By the way, leave theunknown in peace! for you do not know him.

GIL

Link to comment
Share on other sites

  • 2 weeks later...

Only line which calls C, which are user tweaks is needed, others are just for first time admin. Left it there because it's left anyway, probably hard coded into the hive during install. So yes you can remove it but it may still appear.

If you find out from where it is called other than that runonce let me know and I'll clean it next time.

Link to comment
Share on other sites

  • 2 weeks later...

I found the same issue and narrowed it down to the following hotfix WindowsXP-KB922760-x86-ENU.exe nlite.in_ had the following lines

[LD]

HKU,".DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce","nltide2"

HKU,".DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce","nltide2",0x00020000,"cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N"

Once I removed the hotfix, problem went away.

Cheers

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...