How to Execute PowerShell Scripts at Windows Startup Using Group Policy

First, create your PowerShell script and place it in a location accessible to all domain computers. The SYSVOL share is the standard location for Group Policy scripts.

Create a test script to verify the process works:

# Create test script content
$scriptContent = @'
# Startup Script Test
$timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
$computerName = $env:COMPUTERNAME
$logMessage = "$timestamp - Startup script executed on $computerName"

# Write to Event Log
Write-EventLog -LogName Application -Source "Application" -EventId 1001 -EntryType Information -Message $logMessage

# Create log file
$logPath = "C:\Windows\Temp\startup_script.log"
Add-Content -Path $logPath -Value $logMessage
'@

# Save script to local file
$scriptContent | Out-File -FilePath "C:\temp\startup-test.ps1" -Encoding UTF8

Copy the script to the SYSVOL location on your domain controller:

copy "C:\temp\startup-test.ps1" "C:\Windows\SYSVOL\sysvol\yourdomain.com\scripts\startup-test.ps1"

Set proper permissions for the script file:

icacls "C:\Windows\SYSVOL\sysvol\yourdomain.com\scripts\startup-test.ps1" /grant "Domain Computers:(RX)"

Launch the Group Policy Management Console to create a new Group Policy Object for your startup script.

Open GPMC as a domain administrator:

gpmc.msc

Navigate to your domain in the console tree and create a new GPO:

1. Expand your domain (e.g., yourdomain.com)
2. Right-click on Group Policy Objects
3. Select New
4. Enter a descriptive name: PowerShell Startup Scripts
5. Click OK

The new GPO will appear in the Group Policy Objects container. This GPO is created but not yet linked to any organizational unit, so it won't affect any computers yet.

Edit the newly created GPO to add your PowerShell startup script configuration.

Right-click your new GPO and select Edit. This opens the Group Policy Management Editor. Navigate to the startup scripts section:

1. Expand Computer Configuration
2. Expand Policies
3. Expand Windows Settings
4. Click on Scripts (Startup/Shutdown)
5. Double-click Startup

In the Startup Properties dialog, click the PowerShell Scripts tab (not the Scripts tab). This is specifically for PowerShell scripts and provides better execution control.

Add your script:

1. Click Add...
2. In the Script Name field, enter the UNC path: %LogonServer%\NETLOGON\startup-test.ps1
3. Leave Script Parameters blank unless your script requires specific parameters
4. Click OK

Your script now appears in the PowerShell Scripts list. You can use the Up and Down buttons to control execution order if you have multiple scripts.

Windows 11 has a default PowerShell execution policy of Restricted, which blocks script execution. Configure the execution policy through Group Policy to allow your startup scripts to run.

In the same Group Policy Management Editor, navigate to the PowerShell execution policy settings:

1. Go to Computer Configuration
2. Expand Policies
3. Expand Administrative Templates
4. Expand Windows Components
5. Click on Windows PowerShell
6. Double-click Turn on Script Execution

Configure the execution policy:

1. Select Enabled
2. In the Execution Policy dropdown, choose Allow local scripts and remote signed scripts (RemoteSigned)
3. Click OK

This policy allows locally stored scripts to run while requiring remote scripts to be digitally signed, providing a good balance of security and functionality.

Alternative method: If you prefer not to change the execution policy globally, you can modify your script configuration in Step 3 to use the Scripts tab instead of PowerShell Scripts tab, with these parameters:

Script Name: %windir%\System32\WindowsPowerShell\v1.0\powershell.exe
Script Parameters: -ExecutionPolicy Bypass -File "%LogonServer%\NETLOGON\startup-test.ps1"

Configure timing settings to ensure the network is ready before your PowerShell script executes. This prevents common failures due to network services not being available at startup.

In the Group Policy Management Editor, navigate to the startup timing policies:

1. Go to Computer Configuration
2. Expand Policies
3. Expand Administrative Templates
4. Expand System
5. Click on Group Policy

Configure the startup policy processing wait time:

1. Double-click Specify startup policy processing wait time
2. Select Enabled
3. Set the wait time to 60 seconds (or 120 for slower networks)
4. Click OK

Configure the logon script delay:

1. Double-click Configure Logon Script Delay
2. Select Enabled
3. Set the delay to 1 minute (60 seconds)
4. Click OK

These settings ensure that:

• The system waits for network connectivity before processing Group Policy
• Scripts have adequate time to execute before user logon begins
• Network resources are available when your script runs

Link your configured GPO to an organizational unit to apply it to specific computers. Start with a test OU before applying to production systems.

In the Group Policy Management Console, navigate to your target OU:

1. Expand your domain
2. Navigate to the OU containing your test computers (e.g., Test Computers)
3. Right-click the OU
4. Select Link an Existing GPO...
5. Select your PowerShell Startup Scripts GPO
6. Click OK

Verify the GPO link and precedence:

1. Click on the OU in the left pane
2. Check the Linked Group Policy Objects tab
3. Ensure your GPO appears in the list
4. Note the Link Order - lower numbers have higher precedence

If you need to adjust the link order (when multiple GPOs affect the same computers):

1. Select your GPO in the Linked Group Policy Objects list
2. Use the arrow buttons to move it up or down
3. Higher precedence GPOs (lower link order numbers) override conflicting settings

Apply the new Group Policy settings to a test computer and verify that your PowerShell startup script executes correctly.

On a test computer in the target OU, force a Group Policy update:

gpupdate /force

Check that the new policy is applied:

gpresult /r

Look for your GPO name in the output under "Applied Group Policy Objects". If it doesn't appear, check the GPO link and ensure the computer is in the correct OU.

Restart the test computer to trigger the startup script:

shutdown /r /t 0

After the computer restarts, verify script execution by checking the Event Log:

Get-EventLog -LogName Application -Source Application -Newest 10 | Where-Object {$_.EventID -eq 1001}

Also check for the log file created by the script:

type C:\Windows\Temp\startup_script.log

If the script didn't execute, check the Group Policy event logs for errors:

Get-WinEvent -LogName "Microsoft-Windows-GroupPolicy/Operational" -MaxEvents 20 | Where-Object {$_.LevelDisplayName -eq "Error"}

Implement monitoring and troubleshooting procedures to ensure your startup scripts continue working reliably across your environment.

Create a monitoring script to check startup script execution across multiple computers:

# Monitor startup script execution across domain computers
$computers = Get-ADComputer -Filter "OperatingSystem -like '*Windows 11*'" -Properties Name

foreach ($computer in $computers) {
    $computerName = $computer.Name
    try {
        $lastEvent = Get-WinEvent -ComputerName $computerName -LogName Application -MaxEvents 1 -FilterXPath "*[System[EventID=1001]]"
        if ($lastEvent) {
            Write-Host "$computerName - Last execution: $($lastEvent.TimeCreated)" -ForegroundColor Green
        } else {
            Write-Host "$computerName - No startup script execution found" -ForegroundColor Red
        }
    } catch {
        Write-Host "$computerName - Unable to connect or check logs" -ForegroundColor Yellow
    }
}

Common troubleshooting steps for script execution failures:

Check Group Policy application:

gpresult /scope computer /v

Verify script file permissions:

icacls "\\yourdomain.com\NETLOGON\startup-test.ps1"

Test script execution manually:

powershell.exe -ExecutionPolicy RemoteSigned -File "\\yourdomain.com\NETLOGON\startup-test.ps1"

Check for execution policy blocks:

Get-ExecutionPolicy -List

Common issues and solutions:

• Event ID 1055/1130: Network not ready - increase startup wait time to 120 seconds
• Access denied errors: Verify Domain Computers group has Read & Execute permissions on script file
• Script not found: Check SYSVOL replication status and UNC path syntax
• Execution policy errors: Verify the PowerShell execution policy GPO is applied correctly