Active Directory

Run a Script or Batch File with Administrative Privileges as Windows Starts

Logon scripts have long been used to configure users’ desktop environments, adding network drive mappings and desktop shortcuts etc. But there are some tasks that require administrative privileges and can’t be executed as part of a logon script if users don’t have administrative access to their PCs. In this Ask the Admin, I’ll show you how to configure a Group Policy Object (GPO) to run a startup script with administrative privileges.

Computer Startup Scripts vs. Logon Scripts

Startup scripts run just before the boot process gets to the logon screen, and in the context of the local computer account, which has local administrative privileges. Startup scripts can be stored in the GPO itself, removing the need to configure a network share.

Configure a Computer Startup Script

Log on to a Windows Server 2012 R2 domain controller (DC) with a domain administrator account and follow the instructions below.

Create a new Group Policy Object in Active Directory:

Sponsored Content

Passwords Haven’t Disappeared Yet

123456. Qwerty. Iloveyou. No, these are not exercises for people who are brand new to typing. Shockingly, they are among the most common passwords that end users choose in 2021. Research has found that the average business user must manually type out, or copy/paste, the credentials to 154 websites per month. We repeatedly got one question that surprised us: “Why would I ever trust a third party with control of my network?

  • Open Server Manager using the icon on the desktop taskbar or from the Start screen.
  • In the Tools menu, select Group Policy Management.
  • In the Group Policy Management Console (GPMC), expand your Active Directory (AD) forest, domain and click the Group Policy Objects container.
  • Right-click the Group Policy Objects container and select New from the menu.
  • In the New GPO dialog box, give the new Group Policy Object (GPO) a name and press OK.
  • Now right-click the new GPO in the right pane and select Edit from the menu.

Add the startup script settings to the GPO:

  • In the left pane of the Group Policy Management Editor window, expand Computer Configuration, Policies and click Scripts.
  • In the right pane, double-click Startup.
  • On the Scripts tab of the Startup Properties dialog, click Show Files. Copy the file(s) you want to run to this location.
  • Once the script you want to run has been added to the GPO, click Add on the Scripts tab.
  • Click Browse in the Add a Script dialog and select the file using the file browser.  Additionally in the Add a Script dialog, you can optionally specify parameters to configure how the script runs. Click OK to continue.

Configure a computer startup script in Group Policy

You can additional scripts and set the order in which they run by using the Up and Down buttons. Additionally, PowerShell scripts can be added on a separate tab and set to run before or after scripts specified on the first tab.

  • Complete the configuration by clicking OK in the Startup Properties window.
  • Close the Group Policy Management Editor window.

Finally, link the GPO to an OU, domain, forest or site:

  • Back in GPMC, decide where you want to link the new GPO. Right click the desired OU, domain, site or forest in the left pane and select Link an Existing GPO from the menu.
  • In the Select GPO dialog, select the GPO you just created and click OK.

The startup script will now run on computers that have the GPO applied. For more information on using the Group Policy Management Console and linking GPOs, see Working with Group Policy on Petri.

Related Topics:


Don't have a login but want to join the conversation? Sign up for a Petri Account

Comments (2)

2 responses to “Run a Script or Batch File with Administrative Privileges as Windows Starts”

  1. I use this to mount and share a TrueCrypt partition as a member of Users.
    It works fine in Windows XP. It shows the window of TrueCrypt where the user places the password.
    But in Windows 7 it doesn’t work. The window of TrueCrypt is not appear. I believe that login screen of Windows 7 hides login window of TrueCrypt.
    Any suggestions?

Leave a Reply

IT consultant, Contributing Editor @PetriFeed, and trainer @Pluralsight. All about Microsoft, Office 365, Azure, and Windows Server.