Recently a Webroot Bug : https://community.spiceworks.com/topic/2114911-netlogon-5820-endpoint-duplicate-windows-10 and https://community.webroot.com/t5/Known-Issues-KB/Netlogon-is-not-starting-after-Reboot/ta-p/316119 Had caused Netlogon service to not start on some machines which stops group policy running. We needed to deploy the following which ran a script when it detected netlogon stopped :
SCHTASKS /Create /TN “System_NETLOGON_5820” /TR c:\Scripts\netstartnetlogon.cmd /SC ONEVENT /RL Highest /RU SYSTEM /EC SYSTEM /MO “*[System[Provider[@Name=’NETLOGON’] and EventID=5820]]” /F
With netstartnetlogon.cmd stored on the local machine in C:\Scripts\containing “net start netlogon”
You can deploy a schedule task remotelty using :
SCHTASKS /Create /s %machinename% /TN “System_NETLOGON_5820” /TR c:\Scripts\netstartnetlogon.cmd /SC ONEVENT /RL Highest /RU SYSTEM /EC SYSTEM /MO “*[System[Provider[@Name=’NETLOGON’] and EventID=5820]]” /F
Then Run it remotely using
SCHTASKS /run /s %machinename% /TN “System_NETLOGON_5820”
However it seemed a long method to go through all the machines with this. I used BatchPatch to deploy the netstartnetlogon.cmd files into the Folder on each machine , then used the Deploy Software/Patch/Script/Regkey to deploy and run the file :
createscheduledtask.bat
Which containned :
SCHTASKS /Create /TN “System_NETLOGON_5820” /TR c:\Scripts\netstartnetlogon.cmd /SC ONEVENT /RL Highest /RU SYSTEM /EC SYSTEM /MO “*[System[Provider[@Name=’NETLOGON’] and EventID=5820]]” /F
SCHTASKS /Run /TN “System_NETLOGON_5820”