http://www.rlmueller.net/LogonScriptFAQ.htm

The old Windows NT style of managing logon scripts still works, and is probably sufficient for small organizations. However the new Group Policy methods are more powerful and more flexible.

You would assign a Logon script on the “Profile” tab of the user properties if you have client computers with Windows 95, Windows 98, Windows ME, or Windows NT. Group Policy is not applied on computers with these operating systems. If all of your clients have at least Windows 2000, you could use Group Policy to assign Logon scripts.

Login scripts are generally found here:

%SystemRoot%\sysvol\sysvol\<domain DNS name>\scripts

Scripts are assigned to users with the Active Directory Users and Computers (ADUC) tool. Edit a user object and enter the script name on the Profile tab.

1. Start → Run → gpmc.msc
2. Create or edit an existing Group Policy Object (GPO)
3. Right-click the GPO → Edit

User Configuration → Policies → Windows Settings → Scripts → Logon → Properties → Show Files

http://support.microsoft.com/kb/243330

http://networkadminkb.com/KB/a41/differences-between-authenticated-users-domain-users.aspx

http://ss64.com/nt/syntax-security_groups.html

Robb Dunn wrote this modular VBS logon script.

Script: http://community.spiceworks.com/scripts/show/299

Howto: http://community.spiceworks.com/how_to/show/1189

1. Download and copy the logon.vbs file to the the appropriate folder on the domain controller where the script will be run.
   1. Windows NT method
   2. Group Policy method
2. Create two additional folders in the same directory called 'configs' and 'includes'.
3. Create a configuration file in the 'configs' folder named 'global.conf'.
4. Using either the Windows NT method or the Group Policy method, call the login script specifying the config file as an argument: logon.vbs config:global.conf
5. Use the detailed log files generated to troubleshoot and verify script execution.

<order>
meta=1
drives=3
printers=2
processes=4
include=5
</order>

<meta>
description=For all users
created=02/12/12
author=Gene Cooper
</meta>

<drives>
m:\\WIN2008R2-PDC\company
p:\\WIN2008R2-PDC\users$\sUser 
t:\\WIN2008R2-PDC\test|group:testgroup
rem z:\\server\share
</drives>

<printers>
\\WIN2008R2-PDC\pdfcreator;default
rem \\server\hpprinter|group:Print Users
rem \\server\colorprinter|-group:domain users|group:Colorprint Users
rem \\server\faxprinter|ip:192.168.0.23
</printers>

<processes>
rem c:\windows\write.exe
</processes>

<include>
rem File1.inc
rem File2.inc|computerOU:OU=test,OU=domain computers
rem File3.inc|group:marketing
</include>

Start → Run → %temp%

• Look for logon_<your-conf-file>.log for login details.
• If you don’t see the logfile here, then you know that the script did NOT run.

ON ERROR RESUME NEXT

Dim WSHShell, WSHNetwork, objDomain, DomainString, UserString, UserObj, Path


Set WSHShell = CreateObject("WScript.Shell")
Set WSHNetwork = CreateObject("WScript.Network")
Set objDomain = getObject("LDAP://rootDse")
DomainString = objDomain.Get("intra.lourdesinc.com")

UserString = WSHNetwork.UserName
'Bind to the user object to get user name and check for group memberships later
Set UserObj = GetObject("WinNT://" & DomainString & "/" & UserString)

'Synchronizes the time with Server our NTP Server
'WSHShell.Run "NET TIME \\lisvrwin /set /y"


'Disconnect ALL mapped drives
Set clDrives = WshNetwork.EnumNetworkDrives
For i = 0 to clDrives.Count -1 Step 2
    WSHNetwork.RemoveNetworkDrive clDrives.Item(i)
Next

'Give the PC time to do the disconnect, wait 300 milliseconds
wscript.sleep 300

Set WSHPrinters = WSHNetwork.EnumPrinterConnections
For LOOP_COUNTER = 0 To WSHPrinters.Count - 1 Step 2    
    If Left(WSHPrinters.Item(LOOP_COUNTER +1),2) = "\\" Then
      WSHNetwork.RemovePrinterConnection WSHPrinters.Item(LOOP_COUNTER +1),True,True
    End If
Next

'Map drives needed by all
WSHNetwork.MapNetworkDrive "H:", "\\lisvrwin\users\" + UserString,True
WSHNetwork.MapNetworkDrive "F:", "\\lisvrwin\company",True
WSHNetwork.MapNetworkDrive "N:", "\\lisvrwin\nydocs",True
WSHNetwork.MapNetworkDrive "P:", "\\lisvrwin\contracts",True
WSHNetwork.MapNetworkDrive "Q:", "\\lisvrwin\quality",True
WSHNetwork.MapNetworkDrive "T:", "\\lisvrwin\test",True
WSHNetwork.MapNetworkDrive "S:", "\\lisvrwin\autosketch",True

'WSHShell.Run "REG ADD ""HKEY_CURRENT_USER\software\Microsoft\windows\CurrentVersion\Explorer\User Shell Folders"" /v AppData /t REG_EXPAND_SZ /d ""g:\Application Data"" /f"

WSHNetwork.AddWindowsPrinterConnection "\\lisvrwin\hl5280test", "Test Dept. Mono Laser"
WSHNetwork.AddWindowsPrinterConnection "\\lisvrwin\mx2600n", "Reception Color Copier"
WSHNetwork.AddWindowsPrinterConnection "\\lisvrwin\mxm283n", "Quality Dept. Mono Copier"

'WshNetwork.SetDefaultPrinter "\\filer-1\HP5200-1"


' This section of script will prevent the baloon window that appears when printing
' to a network shared printer after XP Service Pack 2 is installed.
'=====================================

Path = "HKCU\Printers\Settings\EnableBalloonNotificationsRemote"
WshShell.RegWrite Path, 0 ,"REG_DWORD"

'Clean Up Memory We Used
set UserObj = Nothing
set GroupObj = Nothing
set WSHNetwork = Nothing
set DomainString = Nothing
set WSHSHell = Nothing
Set WSHPrinters = Nothing

'Quit the Script
wscript.quit

REM To set the time when clients logon to the domain:
net time %LOGONSERVER% /set /yes

REM Un-map all drive letters
net use * /d /y

REM To map a home directory to drive h:
net use h: /home

net use f: %LOGONSERVER%\company persistent:no
net use n: %LOGONSERVER%\nydocs persistent:no
net use p: %LOGONSERVER%\contracts persistent:no
net use q: %LOGONSERVER%\quality persistent:no
net use t: %LOGONSERVER%\test persistent:no
net use s: %LOGONSERVER%\autosketch persistent:no

REM net use z: /d /y

REM pause

REM Exit befor installing Remote Support Tool
exit

rem Install SC Remote Support Tool on all workstations

if exist "C:\Program Files\TightVNC\tvnserver.exe" goto end
if %username%==admin call %logonserver%\netlogon\SCRemoteSupportInstaller.exe
if %username%==Admin call %logonserver%\netlogon\SCRemoteSupportInstaller.exe
if %username%==ADMIN call %logonserver%\netlogon\SCRemoteSupportInstaller.exe
if %username%==administrator call %logonserver%\netlogon\SCRemoteSupportInstaller.exe
if %username%==Administrator call %logonserver%\netlogon\SCRemoteSupportInstaller.exe
if %username%==ADMINISTRATOR call %logonserver%\netlogon\SCRemoteSupportInstaller.exe
if %username%==ADMINISTRATOR pause 
:end

Const ENGINEERING_GROUP     = "cn=engineering"
Const FINANCE_GROUP         = "cn=finance"
Const HUMAN_RESOURCES_GROUP = "cn=human resources"

Set wshNetwork = CreateObject("WScript.Network")
wshNetwork.MapNetworkDrive "h:",
"\\FileServer\Users\" & wshNetwork.UserName

Set ADSysInfo = CreateObject("ADSystemInfo")
Set CurrentUser = GetObject("LDAP://" &
ADSysInfo.UserName)
strGroups = LCase(Join(CurrentUser.MemberOf))

If InStr(strGroups, ENGINEERING_GROUP) Then

    wshNetwork.MapNetworkDrive "g:",
    "\\FileServer\Engineering\"
    wshNetwork.AddWindowsPrinterConnection
    "\\PrintServer\EngLaser"
    wshNetwork.AddWindowsPrinterConnection
    "\\PrintServer\Plotter"
    wshNetWork.SetDefaultPrinter
    "\\PrintServer\EngLaser"

ElseIf InStr(strGroups, FINANCE_GROUP) Then

    wshNetwork.MapNetworkDrive "g:",
    "\\FileServer\Finance\"
    wshNetwork.AddWindowsPrinterConnection
    "\\PrintServer\FinLaser"
    wshNetWork.SetDefaultPrinter
    "\\PrintServer\FinLaser"

ElseIf InStr(strGroups, HUMAN_RESOURCES_GROUP) Then

    wshNetwork.MapNetworkDrive "g:",
    "\\FileServer\Human Resources\"
    wshNetwork.AddWindowsPrinterConnection
    "\\PrintServer\HrLaser"
    wshNetWork.SetDefaultPrinter
    "\\PrintServer\HrLaser"

End If

This may help you out, I found that my users did not have permission to add networked printers. So I made the following change to allow them to add printers from my print server. Good luck

There is a setting under Computer Configuration/Administrative Templates/Printers called “Point and Print Restrictions” 1. Set it to “Enabled” 2. Put a check box in “Users can only point and print to these servers:” 3. Enter your print server name in the box “servername.domainname.com” 4. Security Prompts – set both to “Do not show” Now your users should be able to add printers from your print server