Hi folks

I've been working on this for a week now, and I'm almost on the verge of giving up, I hope I can get some help here.

What I want to achieve: A simple shutdown script with a local group policy (machine policy).

My setup:

ZCM-Server: Version
ZCM-Agent-Version on Clients:
Client Computers: Windows 7 Professional 64bit

Well, what my problem is:

The shutdown script often (and yes, I mean often, I don't mean never) just doesn't start, and, this is really funny, sometimes it even starts invisibly in the background (which I can tell as after the reboot you clearly see the script has been doing some work), even though the group policy to be applied for those machines has the "run shutdown scripts visibly" setting applied.

If it's important, some users also have a user policy applied (which has no scripts however).

What I've checked on (after some extensive googling):

- The gpt.ini seems to be fine. Only extensions really used in the respective user or machine GPO are listed.
- The script is correctly written in the machines registry (I saw that by comparison with a test machine on which there is no ZEN adaptive agent and on which I have created the same GPOs locally; shutdown script works fine there).
- The scripts.ini also correctly references to the script.
- RSOP.msc doesn't show me any errors, the script is correctly shown there (as is the setting that scripts should be run visibly).
- Script shows up fine when I look in gpedit.msc, as does the "run visibly setting".
- ZENWorks adaptive agent does not give me any errors, says "policy applied successfully" for both user and machine policy.
- gpupdate /force doesn't give me any error messages.
- The adaptive agent's logfile does not show any errors with regard to group policy processing.

Maybe also of importance, the script fails to run when there has been an admin logged on before the shutdown (admins have no user policy assigned, so I can rule out that it is somehow an error when combining user and device policies) and also when it was a "normal" user (who have a user policy assigned, but again, not a user policy which would make use of the scripts extension). The only time when it is "more likely" (and yes, I mean it, not 100%, just "more likely") that the script gets run is when no user has been logged on before the shutdown happens (and the computer is shutdown directly from the login prompt).

There are almost no errors shown anywere, the only thing I can find is in the Windows event log, as follows:

- Provider
[ Name] Microsoft-Windows-GroupPolicy
[ Guid] {AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}

EventID 1085

Version 0

Level 3

Task 0

Opcode 1

Keywords 0x8000000000000000

- TimeCreated
[ SystemTime] 2015-12-18T12:49:39.460085900Z

EventRecordID 10216

- Correlation
[ ActivityID] {284CDB33-2BA5-492D-8FA7-ECD480BB5E6D}

- Execution
[ ProcessID] 664
[ ThreadID] 1288

Channel System

Computer W7-64-TEST

- Security
[ UserID] S-1-5-18

- EventData
SupportInfo1 1
SupportInfo2 3961
ProcessingMode 0
ProcessingTimeInMilliseconds 31
ErrorCode 2
ErrorDescription Das System kann die angegebene Datei nicht finden.
ExtensionName Scripts
ExtensionId {42B5FAAE-6536-11d2-AE5A-0000F87571E3}

For those of you who don't speak German, the "ErrorDescription" field says "Cannot find the file specified".

I tried to rule that one out too, the SYSTEM account (which runs shutdown scripts) has even full access to the %WINDIR%\System32\GroupPolicy folder (and all subfolders, like .\Machine\Scripts\Shutdown, and also files like the Shutdown.bat in that folder).

But really, that's the only error I could find in all the logs, like I said, not even RSOP.msc throws any errors, everything looks fine.

Just for testing purposes, I tried to put the script in a different location (%WINDIR%; and, of course, set that location accordingly in th GPO in ZCM), what's funny is that the Update.bat gets deleted from that directory upon policy refresh by the ZENWorks adaptive agent, but when I set the attributes to "read only" so it cannot be deleted, I get the same results I get when the Update.bat is in the designated folder (%WINDIR%\System32\GroupPolicy\Machine\Scripts\Shu tdown).

Of course, I've also tested on freshly imaged machines, on machines with all Windows updates installed etc, no success.

I'm really at a loss here, and I hope some of you might have some ideas what I could do or if there is a log apart from the Windows event log and the adaptive agent's log where I could look.

Especially since the script sometimes gets run and sometimes it doesn't (with no changes to the system between tries), I believe it's not really a permission issue. A vague theory I have is that it is a timing issue of some sort (system looks for the Update.bat file and after a couple of seconds gives up). I have seen to it that all services I know are involved in running the scripts are set to automatic so they don't need to be started to run the script (gpsvc, and the two on which it depends, RPC and Mup), doesn't help either.

Has anyone had the same problem with shutdown scripts, and has anyone been able to find a workaround?

I'm pretty new to ZENWorks (after years of experience with Microsoft Active Directory), so I don't really know what the ZENWorks adaptive agent does (for instance, does it do some sort of policy refresh when the system is shut down?).

Any help would be greatly appreciated.

Thanks a lot folks!