nerdexam
GIAC

GSEC · Question #301

Dilbert wants to have a script run on his Windows server every time Wally logs into it. Where should he place this script?

The correct answer is B. Default Domain Policy > User Configuration > Windows Settings > Scripts (Logon/Logoff). Logon scripts assigned per-user via Group Policy User Configuration run when the targeted user logs in, making it the correct location for scripts tied to a specific user account.

Windows and Malware

Question

Dilbert wants to have a script run on his Windows server every time Wally logs into it. Where should he place this script?

Options

  • AHKEY_LOCAL_MACHINF\SOFTWARE\Mlcrosofl\Wlndows\CurrentVerslon\RunOnce
  • BDefault Domain Policy > User Configuration > Windows Settings > Scripts (Logon/Logoff)
  • CHKEY.LOCAL MACHIN\SOFTWARE\Microsolt\Windows\CurrentVersion\Run
  • DDefault Domain Policy > Computer Configuration > Windows Settings > Scripts

How the community answered

(37 responses)
  • A
    16% (6)
  • B
    73% (27)
  • C
    3% (1)
  • D
    8% (3)

Why each option

Logon scripts assigned per-user via Group Policy User Configuration run when the targeted user logs in, making it the correct location for scripts tied to a specific user account.

AHKEY_LOCAL_MACHINF\SOFTWARE\Mlcrosofl\Wlndows\CurrentVerslon\RunOnce

HKLM\...\RunOnce executes a command once at the next system startup for all users and then removes the entry, so it is neither user-specific nor persistent.

BDefault Domain Policy > User Configuration > Windows Settings > Scripts (Logon/Logoff)Correct

User Configuration > Windows Settings > Scripts (Logon/Logoff) in Group Policy applies the script to the specific user object, so it executes each time that user logs on to any machine governed by the policy. This is the proper Group Policy path for user-specific logon automation, distinct from computer-level or one-time startup scripts.

CHKEY.LOCAL MACHIN\SOFTWARE\Microsolt\Windows\CurrentVersion\Run

HKLM\...\Run executes commands at every system startup for all users, not tied to a particular user's logon session.

DDefault Domain Policy > Computer Configuration > Windows Settings > Scripts

Computer Configuration > Windows Settings > Scripts applies startup and shutdown scripts at the machine level, not at user logon, so it cannot target a specific user.

Concept tested: Group Policy user logon script assignment

Source: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn789190(v=ws.11)

Topics

#Group Policy#logon scripts#user configuration#Windows Server

Community Discussion

No community discussion yet for this question.

Full GSEC Practice