13

So I have been reading the document "Group Policy processing and precedence". I get that policies are applied in the order of local, site, domain, organizational unit, child organizational unit. The article isn't clear about the order that things are applied to the computer like software installation, script and the new group policy preferences.

I am trying to write a script to adjust some things on the computer that doesn't seem possible with preferences, but I need to be certain that a software install has completed, and some preferences have been applied first.

Update:

Here is some background information. I have a group policy that has a software installation for Widget A (Computer Configuration\Policies\Software Settings\Assigned Applications). Widget A places shortcuts all over the place that are annoying so I am trying to use the preferences feature (Computer Configuration\Preferences\Windows Settings\Shortcuts) to delete the unneeded shortcuts. The program has a slight bug in it and I have to fix it, but the publisher hasn't provided an updated msi, just an exe that will apply an update. So I have to a startup script to run the EXE that is supposed to patch the program.

It appears the 'Computer Configuration\Preferences' are applied before software installation happens, because my file deletes don't seem to take effect until after a couple reboots. It appears something about this software package needs a reboot because the startup script that is supposed to patch it errors out until I reboot.

In my searching of Google I haven't been able to find a document that specifically states what the order is. I am also curious what the ordering is between the various preferences available. For example, I can set environment variables via preferences. Will I be able to use those variables in a Files, Folders, or Shortcuts preferences?

I am hoping there is a document somewhere that described the process in detail.

Zoredache
  • 130,897
  • 41
  • 276
  • 420

3 Answers3

3

Software installation policy is processed before Startup Scripts are executed. Sometimes that's exactly what you want, and other times it's not. You can't change it.

When I want a startup script to run before software installation I end up using group membership to control the execution of the startup script and I end the startup script with a command to add the computer to a second group that controls software installation. The only problem with this is that, to date, I have yet to find any reliable way to restart a Windows XP or newer OS from a startup script. (Yes, yes-- I've tried a variety of methods, too. I can discuss them in detail if you'd like.) As such, this always makes this strategy require two boots to "take effect".

You mention "preferences", so I think you're looking at doing things to the user's environment via a logon script. Logon scripts are executed, obviously, after logon. If you're looking to check to see if a piece of software has been installed during the logon script query the Windows Installer "database" in the registry to see if the program is there and "bail out". You'll find the installed products in the "HKEY_CLASSES_ROOT\Installer\Products" key. Obviously, you'll have to figure out the GUID for the package you're dealing with.

Edit: Group Policy client-side extension (CSE) processing order is performed based on the value of the GUID for the client-side extension, from what I've been able to glean from documentation. It looks like the CSE's with numerically higher GUIDs execute later. I don't have the GUID for the "Preferences" CSE handy so I can't tell you how it should act re: running before / after other CSE's.

On Windows XP, at least, dig into HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\GPExtensions and look for the CSE for "Prefernces". REGEDIT will sort those GUIDs numerically, too, so you could be able to tell, visually, if that "Preferences" CSE is going to execute before/after other CSE's.

Evan Anderson
  • 141,881
  • 20
  • 196
  • 331
  • In the situation I am trying to debug everything is in a single GPO, and everything is a per-computer setting. It does sound like I am going to have to something tricky to make sure the system reboots and things happen in the order I need. – Zoredache Aug 10 '09 at 20:20
  • @Zoredache: Yep. That's about the size of it. You can filter scripts and software installation packages within a single GPO per group memberships, so you can get fairly "tricksy" with it. Really, if you just want to run a particular startup script after a package has installed just check for that package in the registry at the beginning of the script and bail if it's not installed. If you want to run exactly one time either make a mark that you check for later in the local registry or have the computer join itself to a group that's denied the rights to read the script (heh heh). – Evan Anderson Aug 10 '09 at 21:37
2

There are two kinds of scripts that are run. Startup scripts are run after computer preferences are set (things in the Computer Settings part of the GPO). Login scripts are run after the user logs in and the User Settings are applied. Scripts are run synchronously in the order that they are listed in the GPO (so one script has to finish before the next can start). Note that by default Windows XP will actually let you login before Network Settings have been processed, which means that you can logon before GPOs are processed. This behavior can be bypassed using the GPO setting found at Computer Configuration\Administrative Templates\System\Logon\Always wait for the network at computer startup and logon. So, startup scripts will run after computer preferences but before user preferences and login scripts will occur after all preferences have been set. Hope that helps.

Catherine MacInnes
  • 1,958
  • 11
  • 15
  • Thanks, but I was hoping for something more detailed then just startup scripts happen before login scripts. – Zoredache Aug 10 '09 at 19:55
  • Read the last sentence it tells you exactly what order things applied in. Computer Settings (things in the computer settings portion of the GPO), then startup scripts, then User Settings (things in the user settings portion of the CPO), then login scripts. That is the EXACT order that things are run in. – Catherine MacInnes Aug 10 '09 at 21:21
  • @Catherine: He's asking about where the CSE for preferences falls into that mix, too. – Evan Anderson Aug 10 '09 at 21:35
1

Order is set by the admin with the setting with teh lowest link order processed last (thus having the highest precedence). If you need to ensure that policies are applied at boot use the setting Computer Configuration\Administrative Templates\System\Logon\Always wait for the network at computer startup and logon. Also set Apply Group Policy for computers synchronously during startup. This forces the system to wait until it can retrieve and process computer policy before allowing the user to login. If you need to check if group policy ran sucessfully check the log files listed here

Jim B
  • 24,081
  • 4
  • 36
  • 60
  • 1
    That is all interesting, but doesn't really tell me much about the ordering of things. Do my per-computer preferences (shortcut creation, file deletion, etc) get processed before software installation, after scripts, or when? – Zoredache Aug 10 '09 at 19:49