GPO set to trigger in response to an event?

Question

I want to trigger an action/task when an event is raised in any computer of the domain.

It this possible via GPO, do or I need to deploy script to all machines on the domain?

Answer 1

Well, you can't have GPOs that are triggered by an event. GPOs are basically just registry keys, so they're either one value or another. So you need a script (of some sort) that can be triggered when you event pops up.

There are a few ways I can think of to do this that don't involve a lot of horrible manual copying.

1. The first way is to deploy a script via GPO, your best option probably being a startup script (so it runs as SYSTEM and doesn't need a logged on user to run) that monitors the event log and then does whatever you need done when this event occurs.

2. The second way, similar to the first, is to deploy a scheduled task by GPP, your task being the script in question. You can set the scheduled task to simply always be running, or run at an interval (say, every 5 minutes) and scan the event log when it starts.

3. The third way, which I would probably prefer, provided I could get the hardware to do it, would be to set up a central server to collect forwarded Event Logs, and configure the domain computers to forward the event you're concerned with to the this logging server.

   • This way, you can run your script on only one computer, and only have to worry about that one computer, instead of having to make sure it's running on multiple computers.

   • Doing it this way also opens up the option to attach a task to an event through the event log, which is a much more powerful option than having to have your script scan the event log. Technet even has a blog post on how to trigger a PowerShell script in response to an event, which is all kinds of nifty.

     • There may be a way to deploy these "attach to event" things through GPO, but I can't find a way easily, and am not all that interested in it, given my preference for log centralization.

Answer 2

You are talking about event based tasks in task scheduler.

Yes, it is possible to deploy them through a GPO. They require Vista or later. You will need to use GPP (Group Policy Preferences).

In the Group Policy Management Console (gpmc.msc), edit or create a GPO, navigate to Computer Settings > Preferences > Control Panel Settings > Scheduled Tasks Create a new Scheduled Task (Windows Vista and later)

Here you can create an event based scheduled task just like you would in the normal task scheduler. The crucial part is to choose the right trigger type on the Triggers tab. You should create a trigger and set it to Begin the task: On an event and select which events to trigger on.

You will also need to make sure the machines have access to the script. Either by sharing it somewhere on the network or by copying it to the local disk on the clients, perhaps using the GPP Files function in the same GPO.

Edit: I just realized the question is really old and probably not relevant anymore. It had only been updated by HopelessN00b