#148057 - 2005-09-19 10:53 PM
Kix from batch and group policy
|
cyri
Getting the hang of it
Registered: 2005-06-27
Posts: 95
|
I'm hoping one of you group policy guru's will be able to help me answer this one.
I've noticed something peculiar about the way kix processes a script inside a group policy object or GPO. Let me give an example.
To start this example lets assume that the netlogon share contains "kix32.exe", "login.bat", and a script called "login.kix". The login.bat file just runs the "%0\..\kix32 login.kix"
Then I try to run a script inside a GPO, also called "login.kix". I'm running this script the same way. "Kix32.exe", "login.bat", and "login.kix" are all stored in the GPO. The only difference is that I'm not using the "%0\..\" Just running "kix32.exe login.kix" in the batch file
For some strange reason it always runs the "kix32.exe" in the netlogon share instead of running the one inside the GPO. Then of course it runs the "login.kix" from the netlogon share instead of the one in my GPO.
Can anyone explain why it behaves like this?
|
|
Top
|
|
|
|
|
#148060 - 2005-09-20 08:06 AM
Re: Kix from batch and group policy
|
cyri
Getting the hang of it
Registered: 2005-06-27
Posts: 95
|
I'm not sure if I'm explaining this properly because your both off the mark slightly. Jooel you are sort of correct in your statement. The current directory inside my GPO is located in the sysvol which then becomes my working directory, but it's not my netlogon share. I think you meant working directory instead of netlogon there.
There is one of two things happening here. Either kix32.exe is executing from the netlogon share (instead of inside the GPO) which then makes my working directory the netlogon share. Thus why the login.kix script runs from there.
Or kix32.exe is executing from inside the GPO, but the script is executing from the netlogon share. I can't explain why it's doing this, I just know it is doing one of those two things.
And Les that is not the case, the current directory for the GPO is on the sysvol not in the netlogon. GPO's as well as any scripts inside a GPO are all stored in the sysvol. There is no legacy script being called. I'm using test accounts for all my testing. They don't run any login scripts at all unless I specifically move the user account into the OU that houses the GPO i'm using to test.
Simply put, if I set a GPO to run a kix script from within a batch file, it should in no way be looking to execute anything from the netlogon share unless I specifically state that in my script. That's why I'm also still leaving the possibility open that this is a strange kix/batch issue when used with group policy objects.
I'm going to do a little more testing to see if this is isolated to kix or if it affects all batch scripts in a GPO.
|
|
Top
|
|
|
|
|
#148063 - 2005-09-20 05:21 PM
Re: Kix from batch and group policy
|
cyri
Getting the hang of it
Registered: 2005-06-27
Posts: 95
|
Jooel I did not see the need to use your code as I already know the outcome.
Thanks Les, I've read that area before, but unfortunately with group polices the UNC path would look something like this.
\\testrdc\sysvol\microsoft.com\Policies\{083BF3F8-E2AA-4EE8-821F-877B91B0C7D3}\User\Scripts\Logon
Plus I'd have to modify the batch file every single time I use it in a new GPO because the UNC path would change.
The fact that it looks at the netlogon first before looking anywhere else seems like a downfall more than a positive thing. It should be looking at the netlogon last if anything. Your current directory should always be the first place it looks. That's a given in almost all command line processing. Imagine if the command prompt looked at your path statements for the file you specify before it looked in the current directory. Not very intuitive.
|
|
Top
|
|
|
|
|
#148064 - 2005-09-20 05:38 PM
Re: Kix from batch and group policy
|
Richard H.
Administrator
Registered: 2000-01-24
Posts: 4946
Loc: Leatherhead, Surrey, UK
|
Quote:
Imagine if the command prompt looked at your path statements for the file you specify before it looked in the current directory. Not very intuitive.
That's not a very good comparison as that's the normal action in most mature operating systems. Looking in your current directory first is an extremely dangerous and unwelcome action which has been deplored since it was first implemented in DOS - Trojan Horse anyone 
Not that looking in the Netlogon share as a default is much better 
Can you use a relative path?
|
|
Top
|
|
|
|
|
#148065 - 2005-09-20 06:05 PM
Re: Kix from batch and group policy
|
cyri
Getting the hang of it
Registered: 2005-06-27
Posts: 95
|
Hi Richard,
Relative path is what's causing all the problems in the first place. Kix looks at the netlogon instead of inside the GPO first when you use a relative path.
|
|
Top
|
|
|
|
|
#148068 - 2005-09-20 09:37 PM
Re: Kix from batch and group policy
|
cyri
Getting the hang of it
Registered: 2005-06-27
Posts: 95
|
Yup that should work Les. Unfortunately, I'm the one who scripts and have no control over where they are placed. In this case, the powers that be place them inside the GPO. So I don't really have a choice.
And Jooel, I don't understand Quote:
proper script file names would remove your problem totally.
They are proper script file names...since when is login.kix not acceptable? And since when can I not have a script with the same name as one in the netlogon share? It's a variation in the way kix looks for the script. It's not a user error in this case.
I'm going to put this one to bed. Sorry if a seemed a bit snippy through this post, but it was implied that this was something I was doing wrong. Les offered a work around and I'm accepting that.
|
|
Top
|
|
|
|
|
#148070 - 2005-09-20 10:40 PM
Re: Kix from batch and group policy
|
cyri
Getting the hang of it
Registered: 2005-06-27
Posts: 95
|
Yes your option is a valid workaround as well...though no one seems to care that this is a limitation with kix and GPO's. But i guess that's my fault.
I chose not to entertain your code because your code would have given me the long unc path in the sysvol as the current directory. I already knew that. The idea of knowing something is to not have to repeat the process you took to know it in the first place. Hence the reason I didn't try your code.
Edited by cyri (2005-09-20 10:44 PM)
|
|
Top
|
|
|
|
|
#148072 - 2005-09-21 01:14 AM
Re: Kix from batch and group policy
|
cyri
Getting the hang of it
Registered: 2005-06-27
Posts: 95
|
Thanks for the vote of confidence.
By the way, the reason I stumbled upon this issue is because I'm testing a new login script. That's why the script names are exactly the same as they are in the netlogon share. Since that is where our current login script executes from. In case anyone wondered why I would do something like this.
|
|
Top
|
|
|
|
Moderator: Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart
|
0 registered
and 1471 anonymous users online.
|
|
|
