I use to know this from the metaframe days but cant remeber. What is the script and its location that runs every time a session it started on a rdsh\cvad server? You can see the black box real quick at the bottom

usrlogon.cmd?

hmm, that sounds like thats the one. But i dont see that in %systemroot%\system32 anymore.

I’m a mobile ATM, but can check my builds for the path in the AM.

Oh, yeah. Thanks