Active Directory Group Policy (GPO) Startup Script Configuration

Configuring a Startup Script via Group Policy

If you do not provide user account details, the script will run under the locally logged-in user account by default. However, this behavior differs depending on whether the script is configured as a logon script or a startup script.

The recommended approach is to configure the script as a startup script under the Computer Configuration section in the Group Policy Management Console (GPMC). This ensures the script runs under the local machine context.

How to Apply a Startup Script Using Group Policy

Required Permissions

To modify Group Policy in a domain environment, you must have Domain Administrator privileges. Without sufficient permissions, changes to domain-level policies cannot be applied.

Distributing the Script Across Domain Controllers

The script must be stored in a central location accessible by all domain controllers. The recommended location is the NETLOGON shared folder, which automatically replicates across the domain.

\\yourdomain\netlogon
%systemroot%\SYSVOL\domain\scripts

Applying the Script via Group Policy Management Console (GPMC)

Open the Group Policy Management Console using: gpmc.msc

Select the appropriate Organizational Unit (OU):

Apply to all domain controllers by selecting the Domain Controllers OU, or choose a specific OU to target selected computers only.

Right-click the selected OU and choose: Create a GPO in this domain and link it here. Assign a meaningful name such as Startup Script Policy.

Edit the GPO and navigate to: Computer Configuration > Policies > Windows Settings > Scripts (Startup/Shutdown) > Startup

Specify the script path: \\yourdomain\netlogon\gomyid.bat

Updating Group Policy

To apply the policy immediately, force a Group Policy update using:

gpupdate /force
For a single computer only:
gpupdate /target:computer /force