Five Group Policy Preferences that replace Windows logon scripts

Are you still using Windows logon scripts? They’re no longer the Windows administrator’s necessary evil for desktop configuration control. These days, Group Policy Preferences can accomplish virtually anything a logon script can do.

Here are five Group Policy Preferences (GPPs) that’ll get you off the scripts and onto complete configuration control.

Drive Maps

Many IT shops still use logon scripts solely because of their ability to map drives to shares. Until GPPs came around, logon scripts were the easiest way to associate those drives with specific users and groups. Logon scripts execute as the user logs on, so adding a net use into that script makes it so H: drives map to home folders and S: drives to shared ones. Add in a little conditional script logic, and you can map drives based on each user’s identity.

Drive Maps are a GPP found under a Group Policy Object’s User Configuration half. Creating yours there enables the same mapping of drives to users, but without all the nasty scripting.

Environment variables

Not every user needs environment variables set, nor does every application. Therefore, many logon scripts required some fairly complex logic to confirm variables were set based on user, machine, and even application.

GPPs greatly simplify this process. Found in a GPO’s Computer Configuration half, environment variables can be configured on a per-machine basis. Even better, by tagging each GPP with the File Match item-level targeting, you can ensure an environment variable is only applied to computers containing the application that needs them.

Files

Ever have to work with an application whose settings are stored not in the registry, but in one or more files? There are still plenty of applications around that use files for storing their entire-machine and specific-user information. Files are great because they’re easy to work with, but they can be hard when multiple users need configurations on multiple machines.

The “preferences” in Group Policy Preferences highlights the fact that GPPs don't have to be enforced. It is entirely possible (and encouraged!) to use GPPs for defining a user’s or an application’s initial configuration. Once that initial configuration is set, users can then make whatever changes suit their needs.

Files are a GPP found in either half of a GPO. This GPP enables you to copy files from a source to destination location. They’re absolutely useful for copying files for those applications that need them. Just create your initial configuration, add that file to a GPP, and see it automatically distribute out to any relevant computer. Check the box for Apply once and do not reapply under the GPP’s Common tab if you want to give users the preference and not the policy.

Registry

While there remain some apps that store configurations in files, the vast majority of them today use the Windows registry. Back before GPPs, making registry changes was notoriously difficult, especially if they were to the HKEY_CURRENT_USER hive.

GPPs once again come to the rescue for locking down (or suggesting) application configurations, across both HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER. In a GPO you’ll find Registry GPP support in both the Computer and User Configuration halves. You can guess which hive each half corresponds to.

More on Group Policy Preferences

Five Group Policy Preferences you must implement right now
Five Group Policy improvements in Windows Server 2012
Configuring applications in Windows with Group Policy preferences

Often, however, the hardest part of controlling registry values is merely finding them. The software packager tool can help. Many software packagers do their work by analyzing two snapshots of a system, one before the application and another after it completes. By looking for what’s different between these two snapshots, the packager can identify what files and registry keys were changed by an installation.

You can use that same process to figure out which registry value an application setting corresponds to. The trick: Do the initial snapshot with the application already installed. Change the application setting, and then do the second snapshot. Whatever changed is what you’ll enter into the Registry GPP.

Printers

You think you’re smart because you’ve published your printers into your Active Directory, but even the most well-documented (and well-named) printer structure can still confuse users. Why not map whatever printer is closest to them, automatically?

You can with Printers in a GPP, linked with either the Computer or User half of a GPO. You’ll also need the aid of some setting on each computer that identifies where that computer lives. A common one is its subnet.

If your network engineers have laid out subnets by location, you can use that network in a GPP’s Item-Level Targeting. Just add it as an IP Address Range, and the next time users log in they’ll automatically attach to their closest printer.

GPPs aren’t even new technology. They’ve been around since the release of Windows Server 2008. They’re stable, they’re easy to use, and they’re a technology you already have on-hand. No extra software (or budget) needed.

If you haven’t spent much time with this incredibly useful administrative solution, give them another look. Coupled with their Item-Level Targeting, they’re a great way to finally eliminate those nasty logon scripts forever.

Source:-http://searchwindowsserver.techtarget.com/tip/Five-Group-Policy-Preferences-that-replace-Windows-logon-scripts?utm_medium=EM&asrc=EM_ERU_19400615&