PowerShell, Active Setup and running a SCCM package “before log on”

I have been struggling with the following idea for a while: How to run a package before before a person logs on using SCCM. There is a setting in SCCM that runs when no one is logged on, but if a person reboots and logs on before SCCM fires, the package will never run. Basically I wanted the ability to make SCCM work like Software Deployment in AD (AD prevents you from logging on until software is completely installed).

The missing piece, for me, was “Active Setup”. Active Setup is pretty well documented here. Combining Active Setup with PowerShell and SCCM, I believe I can run packages before people log on (or at least before they launch any programs).

Here are my steps

  • Step 1 : I need to create an Active Setup registry entry on everyone’s machine that will run a PowerShell script
    • I created this PowerShell script to create the Active Setup registry entries. This will put a StubPath that launches the PowerShell script.
  • Step 2 : Pop up an info message telling the user we are doing some work before the finish logging in.
  • Step 3 : Launch the SCCM Advertised program that you want. Since Active Setup is running as the user, you have to use SCCM to run anything that needs “administrative privileges”. The following code is used inside a PowerShell script to launch an advertisement on the local machine (you need to know the ProgramID and the PackageID):
Function JBMURPHY-SCCM-UIExecuteProgram {
 Param([parameter(Mandatory = $true)]$ProgramID,
       [parameter(Mandatory = $true)]$PackageID)
 $UIResource = New-Object -ComObject UIResource.UIResourceMgr
 $UIResource.ExecuteProgram($ProgramID, $PackageID,$true)

Kinda complicated, but I think it will work. Have you used these methods?


11 Responses to PowerShell, Active Setup and running a SCCM package “before log on”

  1. Robon August 8, 2012 at 9:05 am #

    We’re just migrating from our old software deployment application to Microsoft SCCM2012. We’ve got the same problem and are looking for a good workaround to install software packages before the desktop is provided to the end user. Do you have any progress in this issue? I would appreciate any response!

  2. jbmurphy August 9, 2012 at 12:42 pm #

    I have not had a chance to spend any more time on this. But there is no reason it should not work? It is not really using SCCM, just Active Setup and using that to launch the SCCM package I want. Shoudl work.

  3. Paul Jones August 31, 2012 at 2:07 pm #

    How about a scheduled task configured to run at computer startup which calls your script? This would fire the install before the user has the chance to logon.

  4. jbmurphy September 4, 2012 at 10:42 am #

    That would run every time the user logs on. My goal was for the first time the user logs on to that machine.

  5. Paul Jones September 4, 2012 at 2:07 pm #

    I tested it and it doesn’t work anyway. To get it to run only once, I wrote as part of my install to delete the Scheduled Task. Unfortunately, the way MS designed the UIResourceMgr it will only run if a user is logged on. The scheduled task would fire the script and it could find the advertised program but it wouldn’t run. I found in execmgr.log that the task won’t run because the user isn’t logged on. I tried various user accounts (domain accounts, local accounts, the SYSTEM account) but none of them worked.

  6. jbmurphy September 4, 2012 at 2:28 pm #

    That is why I used “Active Setup”, the script will be running as that user, and UIResourceMgr should be able to run a SCCM package.

  7. Paul Jones September 4, 2012 at 4:49 pm #

    Yes, I got that, and I agree that this works perfectly to install something when a user logs on (I too use this quite often). My goal was to start the installation before the user logged on, just like we used to be able to do when we deployed software using group policy.

  8. jbmurphy September 4, 2012 at 4:52 pm #

    Thank’s for taking the time to reply! I wish there was a way to make SCCM work like group policy software deployment.

  9. Bo December 5, 2013 at 8:25 am #

    a tad late to the party, but I just use registry to set windows logon message (before they log on) to wait 5 minutes before logging on. That way the SCCM package should run fine.

    SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    LegalNoticeCaption REG_SZ Dialog Caption
    LegalNoticeText REG_SZ Dialog Message

    See kb101063 for reference.

  10. Anil February 25, 2014 at 10:36 am #

    So what happens when a new user logs on? If the install has already run successfully is the call into UIResourceMgr ignored, or does it attempt to reinitiate the install? Or do you need to script in a removal of the HKLM Active Setup key into the package being installed?


  1. How To Fix Active Setup Stubpath Errors - Windows Vista, Windows 7 & 8 - November 24, 2014

    […] PowerShell, Active Setup and running a SCCM package … – 10 Responses to PowerShell, Active Setup and running a SCCM package “before log on”… […]