Troubleshooting: Logon Script Does Not Run After Deploying a New VM from OVA on VMware

Version Affected: All
 
 

Overview

The logon script does not run fully or correctly after deploying a new virtual machine (VM) from the OVA on VMware, even when all the correct deployment steps are followed. The VM is left in an unusable state: the D drive may be labeled "New Volume", IIS may not have been moved to D:\inetpub, and permissions may not have been assigned as expected on items on the D drive, among other symptoms.

Cause

If a DVD is attached to the D drive on the new VM at initial startup, this prevents the logon script from running correctly, since the script does not have access to the D drive.

This can also happen even when both the C and D drives are the correct VMDK files, due to factors outside SecureAuth's usual deployment process — most commonly, how VMware handles VMDK files (hard disks) depending on how they are attached (for example, which SCSI controller is used). In some cases the drives are seen as "Removable Drives," which causes the OS to treat the D drive as read-only, so the logon script cannot run successfully.

To confirm this is the cause, try the following on the affected VM:

1. Try to copy a file or folder to the D drive. Expected result: "Access Denied" or similar.
2. Open the D drive and try to create a new folder. Expected result: the "New..." option is missing from the right-click menu.

Before suspecting the VMware environment, check the obvious basics first — confirm that the logged-on user (Administrator) has Full Control security permissions over the entire D drive.

Resolution

Deploy a new VM from the OVA, and before starting the VM for the first time, add the devices.hotplug parameter set to FALSE, following VMware's KB article on the topic, then start the VM. This allows changes to the drive and should let the logon script run successfully.

Special Considerations

The VMware KB article linked above may be slightly out of date for newer versions of VMware/vCenter. In newer versions, the equivalent configuration parameter setting is typically found under Settings > Options > Advanced > Edit Configuration (or a similarly named location).
 
 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.