Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. SYSVOL
  4. domain
  5. scripts
FolderRisk: Caution
  • Windows Server

scripts C:\Windows\SYSVOL\domain\scripts

scripts: the real content of a domain controller's NETLOGON share, where legacy logon scripts (.bat, .cmd, .vbs) are placed.

Updated on By AltF4 Formation

What it’s for

A domain controller’s NETLOGON share points at this folder, reached through \\<domain>\NETLOGON. Legacy logon scripts are dropped here, and the scriptPath attribute of a user account is a path relative to it. Startup and logon scripts defined by GPO live instead in the Scripts folder of each {GUID} under Policies.

The Netlogon service publishes the SYSVOL and NETLOGON shares only once SYSVOL is ready, signalled by the SysvolReady=1 value under HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters.

What it contains

Scripts (.bat, .cmd, .vbs, .ps1) and their companion files. The folder is empty on a new domain. Like the rest of SYSVOL it is replicated between controllers, and any authenticated user can read it.

Risks and best practices

  • Keep passwords and secrets out of these scripts: every domain account can read them.
  • Restrict write access to an administration group. A script changed here runs for every user it targets.
  • If the NETLOGON share disappears, check SysvolReady, the Netlogon service events and DFSR replication before touching the folders.

Useful commands

Fenêtre de terminal
# Published shares and the folder they point to
Get-SmbShare -Name NETLOGON, SYSVOL | Select-Object Name, Path


# Netlogon and SYSVOL tests on the local domain controller
dcdiag /test:netlogons /test:sysvolcheck


# Is SYSVOL ready?
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters' | Select-Object SysvolReady

Report a mistake