Windows Domain Logon Script using VBS and XML

Windows Domain Logon Script

At one point or another every IT professional has battled with mapped drives and logon scripts. Logon scripts typically start out as a small batch file and grow into something totally different. If you’re creating a new login script or considering changing what you have now, the attached login script might fit the bill or at least give you a foundation to build upon.

Overview

The following Windows domain login script requires 3 files to be placed on your domain controller. If replication is working correctly, once the files are copied to your domain controller they will replicate to the other domain controllers in the forest.

Download Logon Script files here.

Login Script Files

Logon.bat is a simple batch file with the sole purpose of calling the vbs login script (logon.vbs). It may be possible to eliminate logon.bat all together but in my experience it’s easier to keep it in place.

  

Logon.vbs is basically the engine for the login script. It reads the values in the XML file and executes commands accordingly.

 Logon.xml holds the information about your environment. This is where you would list your user groups, departments, and global drive mappings.

    

Directions for modifying the login script for your environment.

Download the zip file containing the login script. Unpack the files into a folder on your computer. Right click and Edit the file called Logon.bat. Change the domain name value so it matches your internal domain name. Make sure to leave “\netlogon\Logon.vbs” intact.
     

      

Once you’re done with the edits, save the changes and exit out of Logon.bat. Open Logon.xml with your favorite editor. Logon.xml has multiple sections, each pertaining to a different group type. Please note, it works best to add the name of the Windows Security Group to the XML file in all CAPS.

    

Enterprise Section

The Enterprise section pertains to everyone in the company assigned to the logon script. Mapping a drive letter in the Enterprise section will give everyone assigned to logon.bat the same mapped drive.       

      

Branch Section

The Branch section is intended for different physical locations within your company. For example, offices in New York, Chicago and Miami might need different drive letters mapped to their own local file servers. This section utilizes Active Directory Security Groups and in order for the user to get the drive mappings, their security group must be listed in the logon.xml file. The user must also be a member of the security group in active directory. Please note, it works best to add the name of the Windows Security Group to the XML file in all CAPS.       

      

Machine Group

Machine Groups can be used for departments or other groupings. This section utilizes Active Directory Security Groups so in order for the user to get the drive mappings, their security group must be listed in the logon.xml file and the user must be a member of the security group.
      

Remove Drive Mapping

Sometimes end users may have another program or previous script that mapped a drive letter on their machine. If you would like to ensure the previous mapping are removed before remapping the drive to another location, use the following syntax in the xml document. The remove option will unmap any matching drives on the destination computer.       

<Drive letter="I:" action="remove" />

Adding a Drive Mapping

To add a new drive mapping, simply use the following syntax. You may want to first run the command above to remove any previous mappings for that particular drive letter. Removing previous mapping first will ensure your new mappings apply correctly.

<Drive letter="P:" action="add" unc="\\server\share1" />

Optional syntax: This syntax allows you to add a label to the mapped drive. The label will show up in Windows explorer with the name you enter.

<Drive letter="P:" action="add" unc="\\server\share1" title="Public Folder" />

Option variables: Some variables can be used when mapping drives. This is especially valuable when mapping drives based on a user name or computer name. If the folder exists and the permissions are correct, the script will map the drive.

<Drive letter="P:" action="add" unc="\\server\share1\%username%" title="Personal Folder" />

Deploying the logon scripts

Copy all 3 files (Logon.bat, Logon.vbs and Logon.xml) to your domain controller’s netlogon folder. Log into Active Directory and assign the logon script to a user using Active Directory User and Computer snap in.       

      

If all went well, you should be able to map some drives on your next reboot. Feel free to share this or post comments.  

Getting assistance

If you need help setting up your logon script, please contact us at https://jbtechconsulting.com