I am trying to provide a one time message at the logon screen. I have automated a software install process, which is triggered remotely (by Powershell Remote Job) only when no user is logged in to the machine. After the install completes the machine is restarted. But I need to provide some clue to the user that the machine is now ready, as I don't want them logging in before the install completes and the restart is triggered. I found this reference to adding a message via LocalPolicies, but it is really more suited to a persistent message. I want a user logon script to be able to reset the message so it can be a one time thing. But of course Local Policy is not normally editable to a non Local Admin user. My first thought is to have my Install script, which is running as Local Admin, change the permissions on the two Message properties to allow Authenticated Users to edit these two properties. This seems slightly iffy. Alternatively I could perhaps use saved credentials of the Local Admin account, but that seems even more iffy. The solution needs to work in Win7, Win8 and all builds of Win10.

Is there a better option than these two, or is one of these two considered acceptable security policy? Or is this just something that can't be done in Windows without violating best practices?


LocalPolicies is perfectly editable to a scheduled task, which will run under the System account.

I would suggest doing the following:

  • Creating the LocalPolicies message and a scheduled task whose trigger will never be satisfied (so will never run automatically)

  • When the installation finishes, it will trigger the task using the schtasks command. This task will then do the cleaning after the installation, including the LocalPolicies message.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.