How Scripts Extension Works

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

How Scripts Extension Works

The Scripts extension is one of the Group Policy extensions that automate configuration of the Group Policy infrastructure. The Scripts extension consists of two parts. The server-side extension, a Microsoft Management Console (MMC) snap-in, enables administrators to make enterprise-wide script Group Policy settings. The Scripts client side extension (CSE) implements those settings on the client computer. A separate process, Userinit, actually runs the scripts.

In this section

• Scripts Extension Architecture

• Scripts Extension Protocols

• Scripts Extension Physical Structure

• Scripts Extension Processes and Interactions

• Network Ports Used by Scripts Extension

Scripts Extension Architecture

The Group Policy Scripts client-side extension (CSE) is managed by the Group Policy core, which stores a list of Group Policy objects (GPOs) received from Active Directory. The GPO list is then passed into the Scripts CSE where the scripts.ini file of each GPO is read from the Sysvol folder. This information required for script processing is stored in the client registry. When Group Policy is finished processing, the WinLogon process retrieves the registry information, and then creates a Userinit process that actually runs the scripts. During logoff and shutdown, WinLogon again creates a Userinit process to run the relevant scripts. The Userinit process uses the ShellExecute command to run each script. The following figure shows the Scripts extension architecture and the client-server interaction of the two extension components.

Scripts Extension Architecture

Components important to the Scripts extension, seen in the preceding figure, are described in the table below. Components not seen in the figure, but important to the process are also described.

Scripts Logical Architecture Components

The CSE registration information is written at setup to the HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon\ GPExtensions registry key. This registry key structure exists on both the target and on the domain controller systems.

Scripts Extension Protocols

The various protocols used within the Scripts extension architecture are summarized in the following table.

Scripts Extension Protocols

Scripts Extension Physical Structure

Most Group Policy settings are stored in the Group Policy template, part of the domain controller’s file system. Group Policy templates are stored in the %systemroot%\SYSVOL\sysvol\domainname\policiessubfolder. The root of each Group Policy template contains a Gpt.ini file. Each Group Policy template contains a Machine and User subfolder, both of which contain a Scripts subfolder that contains the Scripts.ini file. The Machine Scripts subfolder contains a Shutdown and a Startup subfolder. The User Scripts subfolder contains a Logoff and a Logon subfolder. These four subfolders contain their respective Group Policy scripts to be implemented on the target by the Scripts CSE.

Components important to the Scripts CSE are described in the following table.

Scripts Physical Architecture Components

Scripts Extension Processes and Interactions

The Scripts CSE processes all applied GPOs. The Scripts CSE reads the command-line options for the scripts from the Scripts.ini file. If a full path is specified, the full path is stored in the registry. If only a name is specified, the CSE creates the full path to the file in the Sysvol folder, prior to storing it in the registry. On Windows XP and better, The Scripts CSE stores this information in the client’s registry, in the following keys:

• HKEY_LOCAL_MACHINE\Software\Policies\Windows\System\Scripts

• HKEY_CURRENT_USER\Software\Policies\Windows\System\Scripts

The script type is stored as one of the following registry values:

• Logon

• Logoff

• Startup

• Shutdown

The Scripts CSE sorts scripts by using the following rules:

• By GPO priority

• By priority order within each GPO

Scripts are usually stored in the Startup and Shutdown subfolders of the Machine\Scripts folder or in the Logon and Logoff subfolders of the User\Scripts folder. Scripts can be stored in a different location, or on a different server. However, for the script to run, the script file must be available and accessible (read access) for it to be run. Note that the user must have read access for logon and logoff scripts and the computer must have access for startup and shutdown scripts. Both are members of the Authenticated Users group, so by default both have access to run their respective scripts. The script is run from the file path location stored in Scripts.ini and the script is not cached on the client computer. If the network is unavailable when scripts are set to run, they will not run.

Network Ports Used by Scripts Extension

The following table summarizes the network protocols and port numbers used by the Scripts CSE. The Scripts extension impersonates the user and computer for network communication.

Port Assignments for Scripts CSE