How Windows 2000 Processes Active Directory Logon Scripts

In Microsoft Windows 2000, logon script processing relies on Active Directory to deliver automated configuration tasks to users during the interactive logon sequence. Depending on whether scripts are assigned via legacy user account properties or Group Policy Objects (GPOs), the operating system queries domain controllers, downloads the script files from the SYSVOL share, and runs them based on defined policy rules and precedence.

Assignment Methods

Windows 2000 supports two distinct methods for assigning logon scripts in Active Directory:

  1. User Object Profile (Legacy Method): Configured directly on the user account object in Active Directory Users and Computers (under the Profile tab). The script name is entered into the "Logon script" field.
  2. Group Policy Objects (GPO Method): Configured within a GPO linked to a Site, Domain, or Organizational Unit (OU) under User Configuration > Windows Settings > Scripts (Logon/Logoff).

Processing Workflow

When a user logs on to a Windows 2000 domain-joined workstation, the operating system executes the following steps:

  1. Authentication: The client authenticates against a domain controller using Kerberos v5.
  2. GPO Discovery and Evaluation: The client contacts the domain controller to evaluate Group Policy inheritance. The system processes policies in standard order: Local, Site, Domain, and Organizational Unit (LSDOU).
  3. Locating Script Files:
    • Legacy Scripts: The system searches the Netlogon share (\\<domain>\sysvol\<domain>\scripts).
    • GPO Scripts: The system accesses the unique GPO directory within the SYSVOL share (\\<domain>\sysvol\<domain>\Policies\<GPO-GUID>\User\Scripts\Logon).
  4. Execution Environment: Windows 2000 determines the script interpreter based on file extension. Standard batch files (.bat, .cmd) execute via the command interpreter (cmd.exe), while VBScript (.vbs) and JScript (.js) run via the native Windows Script Host (cscript.exe or wscript.exe).

Execution Order and Concurrency

By default, Windows 2000 processes scripts with specific operational behaviors:

  • Legacy vs. GPO Precedence: Legacy scripts assigned to the user object run first. Once legacy scripts complete, the Group Policy logon scripts execute.
  • GPO Script Order: Scripts assigned within GPOs execute according to policy hierarchy. If multiple scripts are assigned within a single policy, they execute from top to bottom as listed in the GPO interface.
  • Asynchronous Execution: By default, Windows 2000 runs logon scripts asynchronously. The Windows Explorer shell and desktop load concurrently while the script runs in the background.
  • Hidden Windows: GPO-assigned scripts execute hidden from the user by default, whereas legacy user account scripts display a command prompt window unless suppressed.

Administrative Control via Policies

Administrators can alter default logon script behavior using Administrative Templates in Group Policy under User Configuration > Administrative Templates > System > Logon:

  • Run logon scripts synchronously: Forces the system to wait for logon scripts to complete before loading the Windows Explorer desktop interface.
  • Run logon scripts visible: Displays the command prompt or script host window to the user during execution, which is helpful for troubleshooting.
  • Maximum wait time for Group Policy scripts: Sets a timeout threshold (default is 600 seconds / 10 minutes) to prevent a hung script from permanently halting the logon process.