title: Trouble getting GPO logon script to run using Active Directory Domain Services
body: <p>I have just upgraded our company's domain controller from NT 4.0 to Windows 2008 Server. I used the in-place upgrade path, going first from NT 4.0 to Windows 2003 Server and then 2003 Server to 2008 Server. The orginal NT 4.0 domain was name <em>Company</em>. The new domain is <em>Company</em>.local. I have confirmed user and computer information was properly migrated, and the new domain has been in operation for a week with very few issues.</p>
  
  <p>The problem I am having right now is with setting up a GPO user login script for a set of users. I believe I have set up the GPO correctly, but the script does not get executed on the client after login.</p>
  
  <p>Upon investigation, I noticed I could execute the script (batch file) from the client manually after login if I navigated directly to the domain controller:
  \\<em>ServerName</em>\SysVol\<em>Company</em>.local\Policies\{GUID}\User\Scripts\Logon</p>
  
  <p>However, if my understanding is correct, this path is not used by the client when executing the login sript, but instead the domain (forest?) name is used as the source (domain and forest name are the same in this case):
  \\<em>Company</em>.local\SysVol\<em>Company</em>.local\Policies\{GUID}\User\Scripts\Logon</p>
  
  <p>When manually executing this batch file from the client I get a "Open File - Security Warning" dialog claiming the client cannot verify the publisher. The two paths above are essentially the same place, just accessed with different paths.</p>
  
  <p>Any idea why the clients do not trust content from their own domain controller when accessed via \\<em>Company</em>.local and not \\<em>ServerName</em>? Are there any other places I should be looking for the probable cause?</p>