Group Policy lets you run PowerShell scripts automatically when domain computers start. Per Microsoft Learn, the Scripts (Startup/Shutdown) extension under Computer Configuration includes a dedicated PowerShell Scripts tab.
Startup scripts run as Local System, giving them full machine privileges. This makes them ideal for machine-level tasks like configuring services or applying registry settings. Per Microsoft, you store the script in the Netlogon share so all domain controllers replicate it.
This tutorial covers creating the GPO, adding the PowerShell script, configuring the execution policy, and verifying with Event ID 5018.
Before you start
What you will learn
- You'll learn how to deploy a PowerShell script that runs at computer startup across domain-joined machines using Group Policy.
- PowerShell startup scripts automate machine configuration at boot: service startup, registry changes, software deployment. Per Microsoft Learn, Group Policy is the standard way to deploy these across a domain.
Requirements
- Domain controller with GPMC. Write access to the Netlogon or SYSVOL share.
- Domain Administrator
Good to know
- 15 minutes
Quick answer
In the Group Policy Management Console, edit a GPO and navigate to Computer Configuration > Policies > Windows Settings > Scripts (Startup/Shutdown). Open Startup, switch to the PowerShell Scripts tab, and add your script (stored in Netlogon). Link the GPO to the target OU. Scripts run as Local System at boot.
GPMC > Edit GPO > Computer Configuration > Windows Settings > Scripts (Startup/Shutdown) > Startup > PowerShell Scripts tabStep-by-step tutorial
6 stepsCopy the Script to the Netlogon Share
Store the PowerShell script where all domain controllers can access it.
Copy your PowerShell script (.ps1) to the Netlogon shared folder on a domain controller. This folder replicates automatically to all DCs.
Copy-Item .\ConfigureService.ps1 "\\contoso.com\NETLOGON\ConfigureService.ps1"Replace contoso.com with your domain.
Copy-Item .\ConfigureService.ps1 "\\contoso.com\NETLOGON\ConfigureService.ps1"Storing scripts in Netlogon ensures all DCs have a copy. Copy dependent files here too.
Create and Edit a GPO
Create or select a GPO to hold the startup script.
Server Manager > Tools > Group Policy ManagementOpen the Group Policy Management Console (GPMC). Right-click the target OU and select Create a GPO in this domain, and Link it here. Name it. Right-click the new GPO and select Edit.
You can also link an existing GPO. Target the OU containing the computers you want the script to run on.
Open the Startup Scripts Configuration
Navigate to the startup scripts configuration.
Computer Configuration > Policies > Windows Settings > Scripts (Startup/Shutdown)In the editor, navigate to Computer Configuration > Policies > Windows Settings > Scripts (Startup/Shutdown). Double-click Startup.
Use Computer Configuration for startup scripts. These run as Local System at boot.
Add the Script to the PowerShell Scripts Tab
Add the PowerShell script to the GPO.
In the Startup Properties dialog, click the PowerShell Scripts tab (NOT the regular Scripts tab). Click Add, then Browse, and select your script. Click OK.
The PowerShell Scripts tab is separate from the classic Scripts tab. Using the wrong tab means your .ps1 won't run correctly.
Configure PowerShell Execution Policy
Ensure the script isn't blocked by the default execution policy.
Computer Configuration > Administrative Templates > Windows Components > Windows PowerShellNavigate to Computer Configuration > Policies > Administrative Templates > Windows Components > Windows PowerShell. Double-click Turn on Script Execution. Set it to Enabled and choose an execution policy. Click OK.
Without this, the default Restricted policy may block your script.
Apply and Verify
Apply the policy and confirm the script runs.
On a target computer, run gpupdate /force and restart. After restart, open Event Viewer > Applications and Services Logs > Microsoft > Windows > GroupPolicy > Operational. Look for Event ID 5018.
gpupdate /forceStartup scripts only run at boot. gpupdate applies the policy but doesn't trigger the script until restart.
Verify the Startup Script Executed
After the GPO applies and the computer restarts, the PowerShell script runs as Local System. Per Microsoft Q&A, verify successful execution by checking Event ID 5018 in the Microsoft-Windows-GroupPolicy/Operational log.
To test without rebooting, run gpupdate /force, though startup scripts only fully apply at boot. For immediate testing, run the script manually as SYSTEM using PsExec.
If the script doesn't run, verify the execution policy is set via GPO, the script is in Netlogon, and there are no syntax errors.
- Event ID 5018 appears in the GroupPolicy/Operational log. The script's changes are applied.
- Event ID 5017 (failure) appears, or no event is logged. Check the execution policy, script path, and script errors.
- The startup PowerShell script completed successfully.
- Script failed. Check execution policy and script errors.
Troubleshooting
Script doesn't run at startup
Cause: The default Restricted execution policy blocks the script.
Verify the 'Turn on Script Execution' policy is Enabled in the GPO. Run gpupdate /force and restart.
Event ID 5017 (failure) appears
Cause: The script or dependencies aren't accessible from Local System, or the path is wrong.
Ensure the script is in Netlogon with correct permissions. Test manually as SYSTEM using PsExec (psexec -s -i powershell.exe).
GPO not applying to target computers
Cause: The GPO isn't linked to the OU with the target computers, or GP hasn't refreshed.
Verify the GPO link in GPMC. Run gpresult /r on a target machine. Check for conflicting GPOs with higher precedence.
Frequently asked questions
What account do startup scripts run under?
Per Microsoft Learn, startup scripts run under the Local System account with full machine privileges.
What is the difference between startup and logon scripts?
Startup scripts (Computer Configuration) run as Local System at boot. Logon scripts (User Configuration) run as the user at sign-in.
How do I verify the script ran?
Per Microsoft Q&A, check Event ID 5018 under Microsoft-Windows-GroupPolicy/Operational in Event Viewer.
How do I set PowerShell execution policy?
Configure it via GPO: Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell > Turn on Script Execution.
