J House Consulting / Running Logoff Scripts in Novell Environments

Working on a big XenApp deployment in a Novell environment I’ve come across a limitation that I’ve always taken for granted in an Active Directory environment. You cannot deploy a Zen policy to run a logoff script. It’s not supported in a “Terminal Server” environment, and does not work. After experimenting with several ideas, I had to end up configuring the Local User policy to run the logoff script. How old school!!!

Anyway, I thought that modifying the Local Policy on all XenApp servers would be a pain, but it ended up being very simple indeed. Here is the script I used:

@Echo off

:: This script will create the Logon and Logoff scripts for the Local User Policy.
:: This was required due to a limitation of the integration with Novell Zen Policies, where logoff scripts are
:: not supported on Terminal Servers. Testing also confirms that they do not work.
:: Several different methods and options were trialed, but this is the only one that worked.
:: Even though this was specifically implemented for logoff scripts, I have also used it to run a specific logon
:: script using the same mechanism.

:: Written by Jeremy@jhouseconsulting.com on 6th August 2008.

SetLocal

:: Set the location of the logon and logoff scripts.
Set LogonScript=%SystemRoot%\LoadQAT.cmd
Set LogoffScript=%SystemRoot%\SaveQAT.cmd

:: Create the logcal policy folder structure.
IF NOT EXIST "%SystemRoot%\system32\GroupPolicy\User\Scripts" MD "%SystemRoot%\system32\GroupPolicy\User\Scripts"
IF NOT EXIST "%SystemRoot%\system32\GroupPolicy\User\Scripts\Logoff" MD "%SystemRoot%\system32\GroupPolicy\User\Scripts\Logoff"
IF NOT EXIST "%SystemRoot%\system32\GroupPolicy\User\Scripts\Logon" MD "%SystemRoot%\system32\GroupPolicy\User\Scripts\Logon"

:: Need to unhide the scripts.ini file to prevent any "access denied" errors.
IF EXIST "%SystemRoot%\system32\GroupPolicy\User\Scripts\scripts.ini" ATTRIB -H "%SystemRoot%\system32\GroupPolicy\User\Scripts\scripts.ini"

:: Create the scripts.ini file.
Echo.>"%SystemRoot%\system32\GroupPolicy\User\Scripts\scripts.ini"
Echo [Logon]>>"%SystemRoot%\system32\GroupPolicy\User\Scripts\scripts.ini"
Echo 0CmdLine=%LogonScript%>>"%SystemRoot%\system32\GroupPolicy\User\Scripts\scripts.ini"
Echo 0Parameters=>>"%SystemRoot%\system32\GroupPolicy\User\Scripts\scripts.ini"
Echo [Logoff]>>"%SystemRoot%\system32\GroupPolicy\User\Scripts\scripts.ini"
Echo 0CmdLine=%LogoffScript%>>"%SystemRoot%\system32\GroupPolicy\User\Scripts\scripts.ini"
Echo 0Parameters=>>"%SystemRoot%\system32\GroupPolicy\User\Scripts\scripts.ini"
Echo.>>"%SystemRoot%\system32\GroupPolicy\User\Scripts\scripts.ini"

:: Hide the scripts.ini file.
ATTRIB +H "%SystemRoot%\system32\GroupPolicy\User\Scripts\scripts.ini"

EndLocal

Exit /B