uhm... my take is that you have UAC on, if your script gives you the expected results after logon, when ran manually.
during logon, the security 'token' is different.
if your users are local admins, they have admin token, that is separate from the UAC limited one.
this unlimited token is where logonscript gets executed.
to test it out, just disable UAC on the computer, reboot and login again.
_________________________
!download
KiXnet
