Group Policy w/ User Agreements

[bbbngowc]

Hello,

Our Audit department has created an Email Usage agreement that they want users in the company to abide by. They want all the users to see this policy and agree to it before getting into the email. Anyone ever done anything like that?

[dwarfer]

Yes my school uses a system called 'Securus'. When you log on you read the User agreement, press accept and you can use the PC, press decline and be logged off!

Edited April 24, 2007 by dwarfer

[bbbngowc]

Hello,

Our Audit department has created an Email Usage agreement that they want users in the company to abide by. They want all the users to see this policy and agree to it before getting into the email. Anyone ever done anything like that?

I'm sorry, I should've mentioned that we're trying to do this using Windows Group Policy.

Anyone knows how to accomplish using WGP?

[jcarle]

What kind of e-mail systems are you using?

[bbbngowc]

Sorry I should've stated that too....

Exchange Server 2003 | Windows Server 2003

[nmX.Memnoch]

You can do this with a logon script and KiXtart. However, it happens at logon and not when they launch Outlook.

Using that method you would setup a policy so that user scripts run syncronously...that way explorer.exe won't load until the script finishes (i.e. until they click 'Yes').

[bbbngowc]

You can do this with a logon script and KiXtart. However, it happens at logon and not when they launch Outlook.

Using that method you would setup a policy so that user scripts run syncronously...that way explorer.exe won't load until the script finishes (i.e. until they click 'Yes').

This is interesting. I'll need to look into KiXtart. Never used it before.

[bbbngowc]

Is the KiXtart difficult to use?

[Idontwantspam]

Possibly you could use the Logon Message box. It has some disadvantages - you can only click OK to it, there is no "NO". And it is showed before logon. But it is doable from Group Policy. I don't remember exactly where, but it's there somewhere. If anyone knows how to make the logon message box require a yes or no, I'd be glad to hear about it though.

The box looks like this: (bad drawing, I know.)

====<YOUR TITLE>=========

Your message

=======================

==== OK ===============

=======================

[nmX.Memnoch]

The Logon Message box only displays a message...it doesn't give you the opportunity to require the use to agree or not agree to anything.

No, KiXtart is not difficult to learn. There are some really good editors that will help you. I recommend AdminScriptEditor (it does more than just KiX), but a good free one is Crimson Editor. Here's a basic MessageBox script using KiX:

$X = MessageBox("By agreeing to this statement you agree to abide by the usage terms blah blah blah", "Usage Consent", 4116)
If $X = 7
  ? "NO selected, logging out...."
  Logoff(1)
Endif

The 4116 number tells KiX to display Yes/No buttons, the Stop symbol and to wait until the user chooses an option. If Yes is selected a code of 6 is returned to the script. If No is selected a code of 7 is returned. In this case we are checking to see if 7 is returned (No selected), and if it is then we're logging off.

You get the numbers by adding up the selections from the below options:

Buttons to display

0 Display OK button only.

1 Display OK and Cancel buttons.

2 Display Abort, Retry, and Ignore buttons.

3 Display Yes, No, and Cancel buttons.

4 Display Yes and No buttons.

5 Display Retry and Cancel buttons.

Icon to display

16 Stop symbol

32 Question mark

48 Exclamation mark

64 Information symbol

Default button

0 First button is default.

256 Second button is default.

512 Third button is default.

Modality

0 Application-modal. The user must respond to the message box before continuing work in the application.

4096 System-modal. All applications are suspended until the user responds to the message box.

So to get 4116 I added the following:

4 (Yes/No buttons) + 16 (Stop symbol) + 0 (First (Yes) button is default) + 4096 (System-modal) = 4116

[Idontwantspam]

Well I know the logon box thing has no cancel or don't agree button... that's a problem I've been wanting to fix. Anyone know how? I started a thread on this a while ago over here. But I'll try out the methods being mentioned here, too.

[bbbngowc]

No, KiXtart is not difficult to learn. There are some really good editors that will help you. I recommend AdminScriptEditor (it does more than just KiX), but a good free one is Crimson Editor. Here's a basic MessageBox script using KiX:

Would KiX have to be installed on the machines to work? If so then this is not an answer. We're also trying to capture the users who have agreed and those who have not.

[nmX.Memnoch]

Would KiX have to be installed on the machines to work? If so then this is not an answer.

As long as all of your computers are running WinNT 4.0 or newer you can just have the executables on the NETLOGON share. Then create a batch file with the following line:

%0\..\KIX32.EXE %0\..\scriptname.kix

Then all you have to do is set the batch file as the users' logon script (this is done on the profile tab of the user account).

We're also trying to capture the users who have agreed and those who have not.

This can be done with KiX as well. You'll need a hidden/unadvertised share that all users need write access to though. Give me a little bit and I'll work up some simple code that will dump the information to a CSV. It's a PITA to get working correctly but you can have KiX dump straight to Excel or Access as well...for that matter, I'm pretty sure you can have it dump to a SQL database.

Edited April 25, 2007 by nmX.Memnoch

[nmX.Memnoch]

Here ya go. Tested and working. The only thing you should have to do is change the MessageBox text, create the share and point the RedirectOutput to your share.

You can also put in other code between the EndSelect and :end. For instance, if you wanted to map drives for your users, read registry keys, write registry values (i.e. screensaver settings), etc, etc. Putting that extra code between EndSelect and :end would only run it for users that agree to the Usage Consent.

; Keep users from closing script -- Closing the script with Break set to Off will automatically log the user off
Break Off


$X = MessageBox("By agreeing to this statement you agree to abide by the usage terms blah blah blah", "Usage Consent", 4116)
Select
   Case $X = 6
	  $Agreed = "Yes"
   Case $X = 7
	  $Agreed = "No"
	  ? "NO selected, logging out...."
	  Goto end
EndSelect



:end
; Convert @DATE into useable format for file/directory names
$DATE = Split(@DATE,"/")
$DATE = $DATE[0] + "-" + $DATE[1] + "-" + $DATE[2]

; Redirect output to agreement_YYYY-MM-DD.csv on hidden share
$OUTPUT = RedirectOutput("<SERVER>\<HIDDENSHARE$>\agreement" + $DATE + ".csv",0)

; Begin output for agreement_YYYY-MM-DD.csv
@WKSTA + ","
@USERID + ","
@DATE + ","
@TIME + ","
$Agreed + @CRLF

; Redirect output back to console
$OUTPUT = RedirectOutput("")

; Logout is user does not agree to terms
If $Agreed = "No
   Logoff(1)
EndIf

Exit

[bbbngowc]

Dude nmX.Memnoch!!!

You are da Man! Yeah that worked great. Only problem I'm having now is with the Group Policy to get it to run. It's not working.

The Batch file I need to put in the windows logon has "%0\..\KIX32.EXE %0\..\scriptname.kix" I was suppose to edit this right? The script runs locally but it does not run from the server.