How to Run a Script or Batch File with Administrative Privileges as Windows Starts with Group Policy Object (GPO)

Logon scripts have long been used to configure users’ desktop environments, adding network drive mappings and desktop shortcuts etc. But there are some tasks that require administrative privileges and can’t be executed as part of a logon script if users don’t have administrative access to their PCs. In this Ask the Admin, I’ll show you how to configure a Group Policy Object (GPO) to run a startup script with administrative privileges.

Computer Startup Scripts vs. Logon Scripts: What’s the Difference?

Startup scripts run just before the boot process gets to the logon screen, and in the context of the local computer account, which has local administrative privileges. Startup scripts can be stored in the GPO itself, removing the need to configure a network share.

Configure a Computer Startup Script

Log on to a Windows Server 2012 R2 domain controller (DC) with a domain administrator account and follow the instructions below.

Create a new Group Policy Object in Active Directory:

• Open Server Manager using the icon on the desktop taskbar or from the Start screen.
• In the Tools menu, select Group Policy Management.
• In the Group Policy Management Console (GPMC), expand your Active Directory (AD) forest, domain and click the Group Policy Objects container.
• Right-click the Group Policy Objects container and select New from the menu.
• In the New GPO dialog box, give the new Group Policy Object (GPO) a name and press OK.
• Now right-click the new GPO in the right pane and select Edit from the menu.

Add the startup script settings to the GPO:

• In the left pane of the Group Policy Management Editor window, expand Computer Configuration, Policies and click Scripts.
• In the right pane, double-click Startup.
• On the Scripts tab of the Startup Properties dialog, click Show Files. Copy the file(s) you want to run to this location.
• Once the script you want to run has been added to the GPO, click Add on the Scripts tab.
• Click Browse in the Add a Script dialog and select the file using the file browser.  Additionally in the Add a Script dialog, you can optionally specify parameters to configure how the script runs. Click OK to continue.

You can additional scripts and set the order in which they run by using the Up and Down buttons. Additionally, PowerShell scripts can be added on a separate tab and set to run before or after scripts specified on the first tab.

• Complete the configuration by clicking OK in the Startup Properties window.
• Close the Group Policy Management Editor window.

Finally, link the GPO to an OU, domain, forest or site:

• Back in GPMC, decide where you want to link the new GPO. Right click the desired OU, domain, site or forest in the left pane and select Link an Existing GPO from the menu.
• In the Select GPO dialog, select the GPO you just created and click OK.

The startup script will now run on computers that have the GPO applied. For more information on using the Group Policy Management Console and linking GPOs, see Working with Group Policy on Petri.

FAQ

How do I troubleshoot if my GPO startup script is not executing properly?

To troubleshoot a GPO startup script, check the Event Viewer for errors, verify the script permissions, ensure the script path is correct, and use GPResult or RSOP tools to confirm the GPO is being applied. You can also enable script logging through Group Policy to track execution details.

Can I use multiple GPO startup scripts in a specific sequence?

Yes, multiple GPO startup scripts can be configured to run in a specific order using link order and script execution priority settings. You can also use WMI filters and security filtering to control which machines execute specific GPO startup scripts.

What are the best practices for creating reliable GPO startup scripts?

When creating GPO startup scripts, always include error handling, use absolute paths, implement logging mechanisms, test in a non-production environment first, and ensure the script is compatible with the target operating systems. Additionally, keep scripts modular and document all dependencies.

Is it possible to run a GPO startup script with delayed execution?

Yes, you can implement delayed execution in GPO startup scripts using scheduled tasks, Windows Task Scheduler, or by incorporating sleep commands. This is particularly useful when certain network resources or services need to be available before the script runs.

How can I monitor and report on GPO startup script performance?

Monitor GPO startup script performance by enabling script execution logging, using PowerShell transcription logging, implementing custom performance counters, and utilizing Windows Performance Monitor. You can also create automated reports using Windows PowerShell to track script execution times and success rates.