Hello All,

I have written a logon script that includes the following statement to log users out of Windows 2000 systems and to log the event to the share:

 Code:
IF @PRODUCTTYPE = "Windows 2000 Professional" OR @PRODUCTTYPE = "Windows 2000 Workstation"
   
    Open (1, "\\##########################", 4)

    Writeline (1, @CRLF + @USERID + " " + @WKSTA + " " + @LDOMAIN + " " + @DATE + " " + @TIME + " " + @PRODUCTTYPE + @CRLF)

    Close (1)

    MessageBox("Windows 2000 workstation use is no longer supported on GE
                Water domains. You will be logged off after a 20 second   wait, or upon 
                pressing OK. If you require an exception, please obtain manager approval 
                and contact Helpdesk.", "LOGOFF WARNING", 0, 20)

    $RC = LOGOFF( 1 ) 

Endif

It looks like on workstations with particularly heavy User Profile lock issues (Userenv 1517 and 1524), the script may fail to detect the productype, returning <unknown:PRODUCTTYPE<unknown:. This is an intermittent event, usually cleared by reboot. When it happens, the above If statement executes for any operating system.

I have a workaround in mind, that places an exit statement prior to the logoff statement, targeting systems other than Windows 2000, for which the script should not be executing:

If @PRODUCTTYPE = "Windows Server 2003 Domain Controller" OR @PRODUCTTYPE = "Windows 7 Professional Edition" OR @PRODUCTTYPE = "Windows 7 Ultimate Edition"

Exit

EndIf

My thinking is that on a sysytem with the @PRODUCTYPE error condition, the If statement should exit the script prior to the logoff action. Could you please tell me if this is an accurate assumption? Also, is it possible to predicate an If statement on an Unknown producttype?

I have been trying to simulate the issue in lab. But when I deny access to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion for the logon account, the script does not execute. When I remove the ProductName value, the change does not take hold until relog, and the relog fails with an LSASS error. When I deny access to the HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions Registry key, @PRODUCTTYPE still returns the correct value. If you could inform me of a way to simulate the issue, it would also help greatly.

Thank you,

Sergey

Edited by Sergey_G (2011-04-14 10:25 PM)