Logon script on AD working with domain admin but not working for standard users

Gyanesh23 1 Reputation point
2020-07-28T09:08:19.1+00:00

Hi All,

I am working on a cmd script which needs to the change local machine policies when a user who is connected to the domain logs on. I have been able to make it work with domain admins accounts. But it is not working when trying same with standard users. Here is my script:

net accounts /lockoutthreshold:3
net accounts /lockoutduration:30
net accounts /lockoutwindow:30

To make it work without prompt and as administrator, I created a shortcut then I went to Advanced settings tab on it and tick the Run as Administrator checkbox.

Kindly advise if there a way which i could make it work for standard users as well? Like a one command line so that despite a standard user is logging in, it would run the bat file. Or any other way around.

Thanks in advance for your help.

Regards,

Gyanesh

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,176 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,904 questions
0 comments

7 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Manu Philip 16,986 Reputation points MVP
    2020-07-28T09:17:58.05+00:00

    Hi Gyanesh,

    By Design, logon script runs as the logon user and not in elevated mode.

    Thanks,
    Manu

    0 comments
  2. Gyanesh23 1 Reputation point
    2020-07-28T10:42:32.287+00:00

    Hi Manu,

    I appreciate your help.

    So we cannot run a logon script with elevated privileges on a standard user account? :(

    Actually I am trying to achieve the below:

    When applying GPO, while user is connected to the domain, policies are working fine but local machine policies do not seem to be changing.

    Thus when the user is not connected to domain, GPO are not being applied hence no policies being applied locally.

    I want same policies to be applied to the user when he is connected to the domain and also when he is not connected to it(this i believe can be achieved when local policies will be changed to match same as GPO when connected to the domain.)

    Regards,
    Gyanesh

    0 comments
  3. Hannah Xiong 6,231 Reputation points
    2020-07-29T09:08:40.117+00:00

    Hi Gyanesh,

    Thank you so much for posting here.

    According to our description, we are working on a script to configure the Account Lockout Policy, which would change the local group policy. We would like to make it work for standard domain users.

    As we know, domain admins could configure the Account Lockout Policy, while standard users could not. As for the cmd commands, it should run as administrator, and then the command could complete successfully.

    As per my understanding and experience, we could configure the group policy of scheduled task as shown below.

    14206-task.png

    14160-configuration.png

    14246-configuration2.png

    In my test, the logon script is configured as:

    14264-net-accounts.png

    Then logon the client with the standard user account. After the scheduled task group policy applied and the scheduled task finished, the account lockout policy changed. And then logon the client with administrator account and check the local group policy, it is showing as below. (In my test, the Lockout duration would not change. I have no idea about this. But the other two settings could change. If possible, we could have a try and see whether it works. )

    14185-99.png

    14255-999.png

    Hope the information is helpful. For any question, please feel free to contact us.

    Best regards,
    Hannah Xiong

  4. Gyanesh23 1 Reputation point
    2020-08-06T11:31:52.117+00:00

    Hi Hannah,

    I really appreciate your response and help.

    The logon script is still working just for domain admins and not standard users.

    For now let's just disregard the part that it is not working for standard users as this not the main objective.

    Now the main concern is that despite the logon script changed the local policies for domain admin users, once the laptop is off network the policies are not applied(like in my scenario it is the Account Lock Out policy)

    Do you think there a way to mitigate this security issue? (Like to make the group policy work same as it is on network and off the network)

    Because the laptop is ''protected'' by group policies till it is connected to the active directory. Once the laptop is off network the group policies are not more being applied (in our particular situation which is the account lockout policy not being applied).

    Am still trying to figure out a way out.

    Thanks a lot for your help.

    Regards,
    Gyanesh

  5. Gyanesh23 1 Reputation point
    2020-08-07T12:29:26.843+00:00

    Hi Hannah,

    Yes, I have configured this logon script policy via Group Policy management on DC so that users can be differentiated when they are login in as normally there will be two types of users - Admin and Standard users.

    I tried changing the local policy via the logon script i.e. the local policy are changed by the script and kept even the laptop is disconnected from network, but the local policies are only applied to the local users accounts and not to domain users.

    I do not know if this is something that is feasible or not but it stands as a security loophole.

    Thanks enormously for your help.

    Regards,
    Gyanesh

    0 comments