can't access logon script using UNC path

[Brandon McCombs]

I have a logon script defined in a group policy. It runs fine when I log
on to computers in the domain however, if I try to open the script or
run it from explorer by using GPO Mgmt snap-in to open the folder it is
in, I'm told that I either don't have the rights to access it or run it.
Why would it run just fine as my account during the logon sequence but
yet I can't even open the file (let alone run it) by opening the folder
it is in using Windows Explorer after I've logged in? No errors were
logged pertaining to trying to access the script file. This is insane.


thanks

[Meinolf Weber]

Hello Brandon,

Please post the path you are using.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

> I have a logon script defined in a group policy. It runs fine when I
> log on to computers in the domain however, if I try to open the script
> or run it from explorer by using GPO Mgmt snap-in to open the folder
> it is in, I'm told that I either don't have the rights to access it or
> run it. Why would it run just fine as my account during the logon
> sequence but yet I can't even open the file (let alone run it) by
> opening the folder it is in using Windows Explorer after I've logged
> in? No errors were logged pertaining to trying to access the script
> file. This is insane.
>
> thanks
>

[Brandon McCombs]

Meinolf Weber wrote:
> Hello Brandon,
>
> Please post the path you are using.

It is the path that the GPO Mgmt snap-in takes a person to when you open
the GPO, go to the Logon script section, click Show Files and it opens
the folder for you within the GPO folder hierarchy of where it stores
the script. I've been able to access it this way before with no problem
when I was first debugging the script. I don't have the full path right
now because I'm not at work but it would just be something like
\\domain.com\sysvol\<policy id>\admin templates\scripts\logon or
something like that.



>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>> I have a logon script defined in a group policy. It runs fine when I
>> log on to computers in the domain however, if I try to open the script
>> or run it from explorer by using GPO Mgmt snap-in to open the folder
>> it is in, I'm told that I either don't have the rights to access it or
>> run it. Why would it run just fine as my account during the logon
>> sequence but yet I can't even open the file (let alone run it) by
>> opening the folder it is in using Windows Explorer after I've logged
>> in? No errors were logged pertaining to trying to access the script
>> file. This is insane.
>>
>> thanks
>>
>
>

[Marcin]

Brandon,
have you verified that you connect to the same domain controller in both
cases (during logon and when opening the Logon subfolder of the relevant
Group Policy directory structure under SYSVOL)?

Marcin

"Brandon McCombs" <none@none.com> wrote in message
news:4895d865$0$5139$9a6e19ea@unlimited.newshosting.com...
> Meinolf Weber wrote:
>> Hello Brandon,
>>
>> Please post the path you are using.
>
> It is the path that the GPO Mgmt snap-in takes a person to when you open
> the GPO, go to the Logon script section, click Show Files and it opens the
> folder for you within the GPO folder hierarchy of where it stores the
> script. I've been able to access it this way before with no problem when I
> was first debugging the script. I don't have the full path right now
> because I'm not at work but it would just be something like
> \\domain.com\sysvol\<policy id>\admin templates\scripts\logon or something
> like that.
>
>
>
>>
>> Best regards
>>
>> Meinolf Weber
>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>> confers no rights.
>> ** Please do NOT email, only reply to Newsgroups
>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>
>>> I have a logon script defined in a group policy. It runs fine when I
>>> log on to computers in the domain however, if I try to open the script
>>> or run it from explorer by using GPO Mgmt snap-in to open the folder
>>> it is in, I'm told that I either don't have the rights to access it or
>>> run it. Why would it run just fine as my account during the logon
>>> sequence but yet I can't even open the file (let alone run it) by
>>> opening the folder it is in using Windows Explorer after I've logged
>>> in? No errors were logged pertaining to trying to access the script
>>> file. This is insane.
>>>
>>> thanks
>>>
>>

[Meinolf Weber]

Hello Brandon,

By default the permissions on the sysvol folder should be R&E for AUTHENTICATED
USERS. Check that this is the case on all DC's sysvol folder.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

> Meinolf Weber wrote:
>
>> Hello Brandon,
>>
>> Please post the path you are using.
>>
> It is the path that the GPO Mgmt snap-in takes a person to when you
> open the GPO, go to the Logon script section, click Show Files and it
> opens the folder for you within the GPO folder hierarchy of where it
> stores the script. I've been able to access it this way before with no
> problem when I was first debugging the script. I don't have the full
> path right now because I'm not at work but it would just be something
> like \\domain.com\sysvol\<policy id>\admin templates\scripts\logon or
> something like that.
>
>> Best regards
>>
>> Meinolf Weber
>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>> confers no rights.
>> ** Please do NOT email, only reply to Newsgroups
>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>> I have a logon script defined in a group policy. It runs fine when I
>>> log on to computers in the domain however, if I try to open the
>>> script or run it from explorer by using GPO Mgmt snap-in to open the
>>> folder it is in, I'm told that I either don't have the rights to
>>> access it or run it. Why would it run just fine as my account during
>>> the logon sequence but yet I can't even open the file (let alone run
>>> it) by opening the folder it is in using Windows Explorer after I've
>>> logged in? No errors were logged pertaining to trying to access the
>>> script file. This is insane.
>>>
>>> thanks
>>>

[Brandon McCombs]

Marcin wrote:
> Brandon,
> have you verified that you connect to the same domain controller in both
> cases (during logon and when opening the Logon subfolder of the relevant
> Group Policy directory structure under SYSVOL)?

I tried to access the file using the IP of each server in the UNC path
and neither path let me edit the script or run it. Permissions should be
fine though since it executes when I login. I tested the domain
administrator account and it can access the script just fine but my 2
accounts which are members of the domain admin group cannot access the
file post-logon.

I can edit/run the script just fine as long as I use a local path
("C:\windows\sysvol\....") to do so.

>
> Marcin
>
> "Brandon McCombs" <none@none.com> wrote in message
> news:4895d865$0$5139$9a6e19ea@unlimited.newshosting.com...
>> Meinolf Weber wrote:
>>> Hello Brandon,
>>>
>>> Please post the path you are using.
>> It is the path that the GPO Mgmt snap-in takes a person to when you open
>> the GPO, go to the Logon script section, click Show Files and it opens the
>> folder for you within the GPO folder hierarchy of where it stores the
>> script. I've been able to access it this way before with no problem when I
>> was first debugging the script. I don't have the full path right now
>> because I'm not at work but it would just be something like
>> \\domain.com\sysvol\<policy id>\admin templates\scripts\logon or something
>> like that.
>>
>>
>>
>>> Best regards
>>>
>>> Meinolf Weber
>>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>>> confers no rights.
>>> ** Please do NOT email, only reply to Newsgroups
>>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>>
>>>> I have a logon script defined in a group policy. It runs fine when I
>>>> log on to computers in the domain however, if I try to open the script
>>>> or run it from explorer by using GPO Mgmt snap-in to open the folder
>>>> it is in, I'm told that I either don't have the rights to access it or
>>>> run it. Why would it run just fine as my account during the logon
>>>> sequence but yet I can't even open the file (let alone run it) by
>>>> opening the folder it is in using Windows Explorer after I've logged
>>>> in? No errors were logged pertaining to trying to access the script
>>>> file. This is insane.
>>>>
>>>> thanks
>>>>
>

[RemyMaza]

On Aug 3, 4:12 pm, Brandon McCombs <n...@none.com> wrote:
> Marcin wrote:
> > Brandon,
> > have you verified that you connect to the same domain controller in both
> > cases (during logon and when opening the Logon subfolder of the relevant
> > Group Policy directory structure under SYSVOL)?
>
> I tried to access the file using the IP of each server in the UNC path
> and neither path let me edit the script or run it. Permissions should be
> fine though since it executes when I login. I tested the domain
> administrator account and it can access the script just fine but my 2
> accounts which are members of the domain admin group cannot access the
> file post-logon.
>
> I can edit/run the script just fine as long as I use a local path
> ("C:\windows\sysvol\....") to do so.
>
>
>
>
>
> > Marcin
>
> > "Brandon McCombs" <n...@none.com> wrote in message
> >news:4895d865$0$5139$9a6e19ea@unlimited.newshosting.com...
> >> Meinolf Weber wrote:
> >>> Hello Brandon,
>
> >>> Please post the path you are using.
> >> It is the path that the GPO Mgmt snap-in takes a person to when you open
> >> the GPO, go to the Logon script section, click Show Files and it opensthe
> >> folder for you within the GPO folder hierarchy of where it stores the
> >> script. I've been able to access it this way before with no problem when I
> >> was first debugging the script. I don't have the full path right now
> >> because I'm not at work but it would just be something like
> >> \\domain.com\sysvol\<policy id>\admin templates\scripts\logon or something
> >> like that.
>
> >>> Best regards
>
> >>> Meinolf Weber
> >>> Disclaimer: This posting is provided "AS IS" with no warranties, and
> >>> confers no rights.
> >>> ** Please do NOT email, only reply to Newsgroups
> >>> ** HELP us help YOU!!!http://www.blakjak.demon.co.uk/mul_crss.htm
>
> >>>> I have a logon script defined in a group policy. It runs fine when I
> >>>> log on to computers in the domain however, if I try to open the script
> >>>> or run it from explorer by using GPO Mgmt snap-in to open the folder
> >>>> it is in, I'm told that I either don't have the rights to access it or
> >>>> run it. Why would it run just fine as my account during the logon
> >>>> sequence but yet I can't even open the file (let alone run it) by
> >>>> opening the folder it is in using Windows Explorer after I've logged
> >>>> in? No errors were logged pertaining to trying to access the script
> >>>> file. This is insane.
>
> >>>> thanks- Hide quoted text -
>
> - Show quoted text -

I've seen this happen before. What I did to resolve it was add the
server name to the Trusted Sites Zone and set the security on that
zone to low. I put the server in like this:

\\servername

It changes to something similar: file://servername
Seems to work for me, give it a try.

Regards,
Matt

[Brandon McCombs]

RemyMaza wrote:
> On Aug 3, 4:12 pm, Brandon McCombs <n...@none.com> wrote:
>> Marcin wrote:
>>> Brandon,
>>> have you verified that you connect to the same domain controller in both
>>> cases (during logon and when opening the Logon subfolder of the relevant
>>> Group Policy directory structure under SYSVOL)?
>> I tried to access the file using the IP of each server in the UNC path
>> and neither path let me edit the script or run it. Permissions should be
>> fine though since it executes when I login. I tested the domain
>> administrator account and it can access the script just fine but my 2
>> accounts which are members of the domain admin group cannot access the
>> file post-logon.
>>
>> I can edit/run the script just fine as long as I use a local path
>> ("C:\windows\sysvol\....") to do so.
>>
>>
>>
>>
>>
>>> Marcin
>>> "Brandon McCombs" <n...@none.com> wrote in message
>>> news:4895d865$0$5139$9a6e19ea@unlimited.newshosting.com...
>>>> Meinolf Weber wrote:
>>>>> Hello Brandon,
>>>>> Please post the path you are using.
>>>> It is the path that the GPO Mgmt snap-in takes a person to when you open
>>>> the GPO, go to the Logon script section, click Show Files and it opens the
>>>> folder for you within the GPO folder hierarchy of where it stores the
>>>> script. I've been able to access it this way before with no problem when I
>>>> was first debugging the script. I don't have the full path right now
>>>> because I'm not at work but it would just be something like
>>>> \\domain.com\sysvol\<policy id>\admin templates\scripts\logon or something
>>>> like that.
>>>>> Best regards
>>>>> Meinolf Weber
>>>>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>>>>> confers no rights.
>>>>> ** Please do NOT email, only reply to Newsgroups
>>>>> ** HELP us help YOU!!!http://www.blakjak.demon.co.uk/mul_crss.htm
>>>>>> I have a logon script defined in a group policy. It runs fine when I
>>>>>> log on to computers in the domain however, if I try to open the script
>>>>>> or run it from explorer by using GPO Mgmt snap-in to open the folder
>>>>>> it is in, I'm told that I either don't have the rights to access it or
>>>>>> run it. Why would it run just fine as my account during the logon
>>>>>> sequence but yet I can't even open the file (let alone run it) by
>>>>>> opening the folder it is in using Windows Explorer after I've logged
>>>>>> in? No errors were logged pertaining to trying to access the script
>>>>>> file. This is insane.
>>>>>> thanks- Hide quoted text -
>> - Show quoted text -
>
> I've seen this happen before. What I did to resolve it was add the
> server name to the Trusted Sites Zone and set the security on that
> zone to low. I put the server in like this:
>
> \\servername
>
> It changes to something similar: file://servername
> Seems to work for me, give it a try.
>
> Regards,
> Matt

That doesn't work either, nor should I have to resort to that. If the
logon script runs fine during logon then I should have no problem
accessing the damn thing manually. I'm a domain admin. What else do I
have to do to edit a damn file?

[RemyMaza]

On Aug 9, 1:15 pm, Brandon McCombs <n...@none.com> wrote:
> RemyMaza wrote:
> > On Aug 3, 4:12 pm, Brandon McCombs <n...@none.com> wrote:
> >> Marcin wrote:
> >>> Brandon,
> >>> have you verified that you connect to the same domain controller in both
> >>> cases (during logon and when opening the Logon subfolder of the relevant
> >>> Group Policy directory structure under SYSVOL)?
> >> I tried to access the file using the IP of each server in the UNC path
> >> and neither path let me edit the script or run it. Permissions should be
> >> fine though since it executes when I login. I tested the domain
> >> administrator account and it can access the script just fine but my 2
> >> accounts which are members of the domain admin group cannot access the
> >> file post-logon.
>
> >> I can edit/run the script just fine as long as I use a local path
> >> ("C:\windows\sysvol\....") to do so.
>
> >>> Marcin
> >>> "Brandon McCombs" <n...@none.com> wrote in message
> >>>news:4895d865$0$5139$9a6e19ea@unlimited.newshosting.com...
> >>>> Meinolf Weber wrote:
> >>>>> Hello Brandon,
> >>>>> Please post the path you are using.
> >>>> It is the path that the GPO Mgmt snap-in takes a person to when you open
> >>>> the GPO, go to the Logon script section, click Show Files and it opens the
> >>>> folder for you within the GPO folder hierarchy of where it stores the
> >>>> script. I've been able to access it this way before with no problem when I
> >>>> was first debugging the script. I don't have the full path right now
> >>>> because I'm not at work but it would just be something like
> >>>> \\domain.com\sysvol\<policy id>\admin templates\scripts\logon or something
> >>>> like that.
> >>>>> Best regards
> >>>>> Meinolf Weber
> >>>>> Disclaimer: This posting is provided "AS IS" with no warranties, and
> >>>>> confers no rights.
> >>>>> ** Please do NOT email, only reply to Newsgroups
> >>>>> ** HELP us help YOU!!!http://www.blakjak.demon.co.uk/mul_crss.htm
> >>>>>> I have a logon script defined in a group policy. It runs fine whenI
> >>>>>> log on to computers in the domain however, if I try to open the script
> >>>>>> or run it from explorer by using GPO Mgmt snap-in to open the folder
> >>>>>> it is in, I'm told that I either don't have the rights to access it or
> >>>>>> run it. Why would it run just fine as my account during the logon
> >>>>>> sequence but yet I can't even open the file (let alone run it) by
> >>>>>> opening the folder it is in using Windows Explorer after I've logged
> >>>>>> in? No errors were logged pertaining to trying to access the script
> >>>>>> file. This is insane.
> >>>>>> thanks- Hide quoted text -
> >> - Show quoted text -
>
> > I've seen this happen before. What I did to resolve it was add the
> > server name to the Trusted Sites Zone and set the security on that
> > zone to low. I put the server in like this:
>
> > \\servername
>
> > It changes to something similar: file://servername
> > Seems to work for me, give it a try.
>
> > Regards,
> > Matt
>
> That doesn't work either, nor should I have to resort to that. If the
> logon script runs fine during logon then I should have no problem
> accessing the damn thing manually. I'm a domain admin. What else do I
> have to do to edit a damn file?- Hide quoted text -
>
> - Show quoted text -

Doesn't sound like you are a Domain Admin ;-) If you take a look at
this link, you'll understand my suggestion a whole lot more clearly:

http://support.microsoft.com/kb/815141

Here's an excerpt from the default page that appears when IE Enhanced
Mode is enabled:

This enhanced level of security can prevent Web sites from displaying
correctly in Internet Explorer and restrict access to network
resources, such as files on Universal Naming Convention (UNC) shares.
If you want to browse a Web site that requires Internet Explorer
functionality that has been disabled, you can add the Web site to the
inclusion lists in the Local intranet or Trusted sites zones. For more
information, see Managing Internet Explorer Enhanced Security
Configuration.

That clearly would explain the problem you are having. If in fact you
did add the server to the Trusted Sites Zone, double check to see if
you changed the security level for that zone. I recommend setting it
to low, just for now to rule out this being a possibility. If you are
still having problems you should really look at the permissions on the
Sharing and Security tabs on your NETLOGON folder. If you still can't
get in, try connecting using \\servername\C$ admin share.

Regards,
Matt