windows 添加注销脚本

Adding a logoff script

提问by Loduwijk

I have some scripts that I would like to run every time a user logs off. I would like to create something that programatically sets up the logoff scripts. For example, an exe or a cmd file that can be executed to add the logoff script to the list of logoff scripts that Windows executes. Because of this, a Windows API function or a Windows shell command would be preferable, but I can find no such functions or commands to help with this.

我有一些脚本，每次用户注销时我都想运行这些脚本。我想创建一些以编程方式设置注销脚本的东西。例如，可执行的 exe 或 cmd 文件将注销脚本添加到 Windows 执行的注销脚本列表中。因此，最好使用 Windows API 函数或 Windows shell 命令，但我找不到此类函数或命令来帮助解决此问题。

I checked on the registry edits that the local group policy editor makes when you use it to add a logoff script to group policy, but it does a lot of things that I'm not sure I can mimic. For example, it makes a lot of registry edits, and it uses numeric codes in some of the registry keys and binary data in some of the values. I would not know what the values represent.

我检查了本地组策略编辑器在您使用它向组策略添加注销脚本时所做的注册表编辑，但它做了很多我不确定我可以模仿的事情。例如，它对注册表进行了大量编辑，在某些注册表项中使用数字代码，在某些值中使用二进制数据。我不知道这些值代表什么。

I have tried subsets of the changes that GPEdit does in the hopes that doing so would still work. For example, I exported the changes it made to HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logoff and imported them on another PC, but that did not work, and the GPEdit MMC was unaware that I had even made the change.

我已经尝试了 GPEdit 所做的更改的子集，希望这样做仍然有效。例如，我将它所做的更改导出到 HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logoff 并将它们导入到另一台 PC 上，但这不起作用，而且 GPEdit MMC 不知道我什至做了改变。

As I said, a set of Windows API functions or a Windows shell command would be preferable if anyone knows of some that could help, but if anyone knows of a way to decode the heap of information that GPEdit makes in a way that I could mock it then I'm not against making registry changes as long as they are stable.

正如我所说，如果有人知道可以提供帮助的一些 Windows API 函数或 Windows shell 命令将是可取的，但是如果有人知道解码 GPEdit 以我可以模拟的方式生成的信息堆的方法那么我不反对更改注册表，只要它们稳定即可。

Whatever the solution I find and use, it has to be able to be automatic and reliable, as it will be executed remotely against many computers with psexec, and it will also be included into automated setup processes for future PCs that are set up.

无论我找到并使用什么解决方案，它都必须是自动且可靠的，因为它将通过 psexec 对许多计算机远程执行，并且它还将包含在未来设置的 PC 的自动设置过程中。

Unfortunately, this seems to be a difficult topic to Google for, as many other things people are trying to do have many of the same key words that I query for but are not actually the same topic. For example, shutdown/logoff hooks for running apps, or remotely logging off users.

不幸的是，对于谷歌来说，这似乎是一个困难的话题，因为人们试图做的许多其他事情都有许多与我查询相同的关键词，但实际上并不是同一个话题。例如，用于运行应用程序的关闭/注销挂钩，或远程注销用户。

If anyone is a Windows registry or MMC wizard and thinks that seeing a dump of the registry changes that the GPEdit MMC makes when doing the same thing would be helpful then just say so, and I'll make that available since I've already captured it. I doubt that's the way to go, however I have started looking into how to create MMC snap-in tools; my thought is that perhaps the GPEdit snap-in itself can be reverse engineered so that I can see exactly what it's doing in a simple way. This is not going anywhere fast though, as none of the .adm files I see appear to have the settings for this, and the gpedit.msc file doesn't appear to have anything that would give it away in the plaintext part, though there is a section in it that appears as gibberish, so maybe there's some sort of magic going on in there.

如果有人是 Windows 注册表或 MMC 向导，并且认为在做同样的事情时看到 GPEdit MMC 所做的注册表更改的转储会有所帮助，那么就这么说吧，我会提供它，因为我已经捕获了它。我怀疑这是要走的路，但是我已经开始研究如何创建 MMC 管理单元工具；我的想法是，也许可以对 GPEdit 管理单元本身进行逆向工程，以便我可以以一种简单的方式准确地看到它在做什么。不过，这不会很快，因为我看到的 .adm 文件似乎都没有为此设置，并且 gpedit.msc 文件似乎没有任何可以在明文部分泄露它的内容，尽管有是其中一个看起来像胡言乱语的部分，所以也许那里有某种魔法。

采纳答案by Loduwijk

The task scheduler can do this as of Windows Vista. For Windows XP and previous, there does not seem to be a good answer. XP does not have the "On disconnect from a user session" trigger listed below.

从 Windows Vista 开始，任务计划程序可以执行此操作。对于 Windows XP 和以前的版本，似乎没有一个好的答案。XP 没有下面列出的“断开与用户会话的连接”触发器。

There are two main command line utilities for scheduling tasks in Windows: at.exe and schtasks.exe. By themselves, neither seem to provide all of the options that you can get from the GUI interface (though schtasks comes very close). However, the Task Scheduler has an XML format that describes scheduled tasks, and schtasks.exe has an option to import tasks from an XML file.

在 Windows 中有两个用于调度任务的主要命令行实用程序：at.exe 和 schtasks.exe。就其本身而言，它们似乎都没有提供您可以从 GUI 界面获得的所有选项（尽管 schtasks 非常接近）。但是，任务计划程序具有描述计划任务的 XML 格式，并且 schtasks.exe 具有从 XML 文件导入任务的选项。

To create a logoff script, create an XML file that describes the task you want to create. Make sure to use a trigger of "On disconnect from a user session" and select the log off from "any user" (which requires elevated privileges) and "connection from local computer." Set up all desired logoff actions (such as your logoff scripts) as task actions.

要创建注销脚本，请创建一个 XML 文件来描述您要创建的任务。确保使用“从用户会话断开连接”的触发器，并选择从“任何用户”（需要提升的权限）和“从本地计算机连接”的注销。将所有需要的注销操作（例如注销脚本）设置为任务操作。

Microsoft has a list of examples for developing tasks for the Task Scheduler, including XML examples. You can find this list here.

Microsoft 有一个用于为 Task Scheduler 开发任务的示例列表，包括 XML 示例。您可以在此处找到此列表。

Alternatively, you can set up your task once using the GUI tool, then you can right-click the task where it appears in the task list and select "Export." You will get a save dialog that will allow you to save the task in XML format.

或者，您可以使用 GUI 工具设置一次任务，然后右键单击任务列表中出现的任务并选择“导出”。您将获得一个保存对话框，允许您以 XML 格式保存任务。

I then script the setup of the task with the following command:

然后，我使用以下命令编写任务设置的脚本：

schtasks /create /tn "Task Name Here" /XML "path to xml file here" /ru domain\username /rp "password"

Note: partial credit should go to user606602 for the suggestion to use the task scheduler, though he was suggesting the use of the GUI application which, as per my question, would not work for this. I tried to edit his answer with the scripted version of his suggestion then accept, but a peer review declined the edit.

注意：user606602 建议使用任务调度程序的部分功劳应该归功于 user606602，尽管他建议使用 GUI 应用程序，根据我的问题，该应用程序不适用于此。我试图用他建议的脚本版本编辑他的答案，然后接受，但同行评审拒绝了编辑。

回答by Ciaran Gallagher

Couldn't you just use the windows task scheduler to launch the scripts?

你不能只使用 Windows 任务调度程序来启动脚本吗？

Newer versions of the task scheduler (e.g. Windows Server 2008, Windows Vista/7) should allow you the option to run scripts that are triggered when the user logs off.

较新版本的任务调度程序（例如 Windows Server 2008、Windows Vista/7）应该允许您选择运行在用户注销时触发的脚本。

See here

看这里

All you need to do is create a new task, then create a new trigger. From this window, select 'On disconnect from a user session' from the drop-down menu, then select the scripts you want to run from the 'Actions' tab on the task configuration window.

您需要做的就是创建一个新任务，然后创建一个新触发器。在此窗口中，从下拉菜单中选择“断开与用户会话的连接”，然后从任务配置窗口的“操作”选项卡中选择要运行的脚本。