Creating a Special TSE Logon Script

On our Windows NT network, we have two Windows NT 4.0, Terminal Server Edition servers with MetaFrame that we have set up as member servers. We want to use Application Security (APPSEC) to limit the applications that users can run. When we run APPSEC, the TSE servers don't appear to run the NT logon scripts. Is there any way to make the logon script run with APPSEC activated?

Because your servers are member servers, they look for your logon script on the authenticating server (the PDC or the BDC). APPSEC prevents all applications that don't appear on the permitted list from running. Because APPSEC's permitted list can't run applications on a network share, there's no way to permit the logon scripts. You need to create a special script on each TSE server that runs just for TSE users. The script can then appear on the permitted list.

To make a special logon script that runs only when you log on to a TSE server, create your logon script (e.g., tslo.cmd) in the %systemroot%system32 folder. (The script must reside in the System32 directory.) Next, open a Registry editor and go to HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogon. Expand Appsetup, and type ",TSLO.CMD" after the last entry (don't forget the comma—you must separate each entry with a comma). For example, if the value of Appsetup was

UsrLogon.Cmd, rmvlnks.exe,cmstart.exe,updatdrv.exe 

it should now be

UsrLogon.Cmd, rmvlnks.exe,cmstart.exe,updatdrv.exe,TSLO.CMD

Next, set up APPSEC.

Now, when a user logs on to the TSE server, tslo.cmd will run. If you want to get fancy, you can configure tslo.cmd to call commands or other .cmd files specific for each user or group, but don't forget to add each application to APPSEC.