Something in GSS is blocking logoff scripts

[meargh]

I have a CMD script I run at each logoff. This is done by going into Group Policy and double clicking the Logoff entry under User Configuration | Windows Settings | Scripts (Logon/Logoff).

The actual script I run is C:\WINDOWS\system32\GroupPolicy\User\Scripts\Logoff\logoff.cmd.

This setup has worked fine for me for months. However, since installing GSS the other day, I see the following error in Event Viewer whenever I reboot:

-{ Quote: "Event Type: Error
Event Source: UserInit
Event Category: None
Event ID: 1000
Date: 12/3/2005
Time: 6:24:41 AM
User: N/A
Computer: <computer name>
Description:
Could not execute the following script logoff.cmd. Access is denied.
.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp." }-

I assume that something in GSS, probably AppDefend, is blocking whatever process kicks off the CMD script. The problem is that, without a log being saved to disk, I have no idea what's really going on.

Before I spend hours figuring out exactly what, can someone point me in the right direction?

[meargh]

Ignore this for now... I'm going to try figuring it out.

Would be nice if the Wilders admins would re-enable my real account so that I could edit posts and so on.

[meargh]

I think I've got it solved. I added C:\WINDOWS\system32\userinit.exe and gave it permission to Start Applications. I've rebooted once, and no error appeared in Event Viewer.

I wish this had been a default setting.

[meargh]

Yes, sometimes I post first, and think afterward. Sorry. And it only took a minute to figure out. Well at least there's a reference here for anyone else who needs it...

But I still wish they'd re-enable my forum account.

[meargh]

BTW, Jason, if you would like a reference (to justify giving userinit.exe permission to launch applications by default), here is where I got my info:

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/TechRef/0c714f15-0405-42d8-ae24-7280211635eb.mspx

-{ Quote: "During logoff and shutdown, WinLogon again creates a Userinit process to run the relevant scripts. The Userinit process uses the ShellExecute command to run each script." }-
Which of course means that userinit.exe needs to be able to launch cmd.exe.

[Jason_R0]

Thanks meargh,

I will update the default ruleset to reflect this. :)

[meargh]

Thanks. This topic helped me notice that RegDefend does not monitor related registry keys/values by default.

http://www.wilderssecurity.com/showthread.php?p=626932