GPO Run these programs at user logon not taking effect when configured in Computer Configuration section

Question

[EDIT 20140207]:
I found that the default domain policy sets "run these programs at user logon" and (other than I expected) not BOTH GPO settings become active, but the setting from the default domain policy overrides the setting from my new GPO. So I think I have
found the answer myself.
When on our W2k8-R2 DC I create a new GPO and configure
"Computer Configuration/Policies/Windows Settings/Administrative Templates/System/Logon/run these programs at user logon" to "c:\windows\system32\notepad.exe" (just for testing) it won't take effect on Win 7 SP1, no matter what the Security
Filtering options are.
It seems other settings (in the very same GPO) become active but "run these programs at user login" from the computer policies section doesn't. I configure the very same setting in the section "user policies" instead and add "Authenticated
Users" to Security Filtering, the program will be started. But that's not what I need.
I can reproduce the issue, here are the exact steps:
create a new group "group-a" for later security filtering
create a new GPO
in the new GPO set "Computer Configuration/Policies/Windows Settings/Administrative Templates/System/Logon/run these programs at user logon" to "c:\windows\system32\notepad.exe"
for setting the scope remove "authenticated users" from Security Filtering and add "group-a" instead
link the GPO to the domain root
make "test computer" a member of "group-a"
on "test computer" run "gpupdate /force", reboot, log in
Issue: notepad is not being started.
What I'm aiming for is obvious: Depending on the membership of group-a I want to configure certain programs that should be started whenever a user logs in.
gpresult /R returns that it would be applying the GPO. (It actually is but the setting "run these programs at user login" is not being applied.)
For debugging I started MMC / RSoP on one of the machines on which the GPO should have been applied and found that "run these programs at user login" is not set (which seems to be the reason why the GPO won't work on the machines).
Searching the web I found similar reports
[1] [2] but no solution was found and the user used a workaround instead.
If I change the GPO so that I use the very same setting in "user configuration" instead of "computer configuration" it works as long as I add "authenticated users" to the Security Filtering. But then the GPO is applied to all users
and not only to the ones using computers which are members of group-a. According to this howto [3] I should not remove "authenticated users" but alter the security setting instead. However, the howto seems to be aimed ad w2k3 and using Win2k8 I cannot
find security settings "apply" for "authenticated users" so I cannot remove that setting, there's only "read" or "read and modify".
So two questions:
1. Why doesn't it work when using "computer settings"
2. What about that Security Filtering with removing "authenticated users" and using group-a instead?
T.
[1] http://social.technet.microsoft.com/Forums/windows/en-US/0e280490-fba6-4ced-aba5-ae49c60e44bd/computer-gpo-run-these-programs-at-user-logon-not-working-as-intended-on-win7-clients?forum=w7itproinstall
[2] http://social.technet.microsoft.com/Forums/windows/en-US/8cb78bf8-33ec-461e-8604-32d82d016685/run-these-programs-at-user-logon?forum=winserverGP
[3] http://www.grouppolicy.biz/2010/05/how-to-apply-a-group-policy-object-to-individual-users-or-computer/

Answer 1

Hi,
sounds like you find the answer already.
If you have any further question, please feel free to let me know.
Have a nice day!
If you have any feedback on our support, please click
here
Alex Zhao
TechNet Community Support