System Admin: Need help with Logon Scripts, Group Policy Etc...

[Vini]

I am a sysadm and am trying to setup a batch file (login script) that will change the background for Group Policy.

At the moment, I have the script copy the wallpaper from the server to the local machine. That is as far as i am.

Copy /Y "\\Server\Desktop Background.gif" "c:\windows"

I am open to suggestions as to other ways round this.

I have tried regedit /s wallpaper.reg in which the key is supposed to set the wallpaper to my specific image. However this fails to work.

[nichomach]

Assuming you have a GPO defined for all your domain users anyway, you should be able to set the wallpaper via User Configuration\Administrative Templates\Desktop\Active Desktop\ using the Active Desktop Wallpaper setting. Make sure you use the Enable Active Desktop setting as well, and under User Configuration\Administrative Templates\Control Panel\Display use the Prevent Changing Wallpaper setting.

[Moby-Dick]

last time I did a GPO deployed background I put it in the netlogon share of the DC ( for the Desktops )

its a little bit trickier for the laptops but you just need to deploy the file as part of the build

[nichomach]

That's a good way of handling it, but if it's a small file, you could make copying it part of the logon script as Vini's done above too, which'd handle your laptop users nicely, and could make updates to the wallpaper easier to deploy as well?

[Atomic]

Could make it easier on yourself by shortening the Backgrounds name too. Spaces in file names are no fun. Grippledesktop.gif?

[Moby-Dick]

you are right there but dont policies run before login scripts are excecuted ?

[Vini]

it doesnt have to be a policy, we dont want to clamp down on our users, our business runs on freedom and trust, so its more a case of standardising desktops what we're after, hence setting the background as our standard one, it is actually now just called GrippleBG.gif...

thanks for all the help btw, much appreciated.

when the wallpaper is copied to the local machine, i just need some way of it setting the background, surely it should be simple, would appear not tho.

[Moby-Dick]

using a group policy to set the wall paper is the best way - if you want , you can let them change it afterwards , but as for giving users freedom , thats your funeral - will you be saying the same thing about your umpteenth spyware removal or rebuild " because the machine is running slow" ?

[nichomach]

That's why you use a GPO. A GPO isn't an oppressive lack of trust thing, it's just the easiest way to get settings round a domain in short order.

Moby - yes, they do, but that'd only be an issue for the first login, after that the file'd be there.

[Vini]

so i got a GPO that does what i want, this gpo is going to be machine specific and not on the domain, so is there any way i can export the settings and import them on another machine?

[Moby-Dick]

group all the machines you want to apply this to into an OU within your AD

apply the policy to that OU

[Vini]

done and done, wicked

[Moby-Dick]

such is the beauty of Active Directory

[Vini]

so from what i gather, there is no way to block total access to IE or Media Player, so if i run a batch file

@echo off
C:
cd "\Program Files\Internet Explorer"
if not exist IEXPLORE.EXE goto End
if exist IEXPLORE.EX_ del IEXPLORE.EX_
if not exist IEXPLORE.DIR md IEXPLORE.DIR
if not exist IEXPLORE.DIR goto End
attrib -r -h -s IEXPLORE.EXE
ren IEXPLORE.EXE IEXPLORE.EX_
if exist IEXPLORE.EXE goto End
ren IEXPLORE.DIR IEXPLORE.EXE
echo IE disabled.
echo If prompted, click "Cancel" then "Yes" on File Protection restore.
echo Run enable-ie.bat to allow IE to run again.
:End

as a script in the policy would that work (i.e. does the "script" bit allow batch fileS?)

[Vini]

setting it as a logon script didnt seem to work, how could i incorporate this into our GPO?

the batch on its own works fine.

[Vini]

ideas?