Logon script error 0X000008A4 – quick fix that works

What is error 0X000008A4?

This error pops up when Windows (or a domain controller) tries to run a logon script and can't find it or can't run it. The error code 0X000008A4 translates to decimal 2212, which in Windows networking is NERR_LogonScriptError. I've seen this a dozen times – most recently with a small law firm where users couldn't access a shared drive because the script that mapped it (a .bat file) failed silently.

The fix is usually dead simple. Let's start with the fastest thing you can check.

30-second fix: Check the script path

Most of the time, the script path is wrong. Open Group Policy Management or local policy editor (gpedit.msc). Go to:

User Configuration > Windows Settings > Scripts (Logon/Logoff)

Look at the script name and path. If it says \\server\share\script.bat, make sure the server name is correct and the share exists. I had a client who renamed a file server and forgot to update the script path in Group Policy – took me 30 seconds to fix.

If you're on a standalone machine (not domain-joined), check local group policy: gpedit.msc or secpol.msc. The script path must be a full UNC or absolute local path like C:\Scripts\logon.bat. Relative paths like Scripts\logon.bat often fail because the working directory isn't what you think.

Quick test: From a command prompt, type \\server\share\script.bat (with your actual path). If it says "The network path was not found" or "Access is denied", you've found the problem.

5-minute fix: Permissions on the script

If the path is correct but the script still won't run, it's almost always a permissions issue. The user account running the script needs at least Read & Execute permission on the script file and Read permission on the folder.

On the file server or local machine:

1. Right-click the script file > Properties > Security tab.
2. Click Advanced > Add > Select a principal: type Authenticated Users or Domain Users.
3. Give Read & Execute permissions.
4. Click OK, then do the same for the folder (give Read permission).

I once spent 15 minutes chasing a script error only to find the script was on a drive with deny permissions for the Users group. The domain admin could run it fine, regular users couldn't. Easy fix once you know where to look.

Also check the script's content. If the script calls another file (like a batch file that runs a .vbs), that second file needs the same permissions.

15-minute advanced fix: Script execution policy or antivirus

If path and permissions are fine, the problem might be execution policy or security software.

PowerShell execution policy (if you use .ps1 scripts)

If your logon script is a PowerShell script (.ps1), Windows won't run it by default unless execution policy allows it. Run this as administrator:

Set-ExecutionPolicy RemoteSigned -Scope LocalMachine

Or set it via Group Policy: Computer Configuration > Policies > Administrative Templates > Windows Components > Windows PowerShell > Turn on Script Execution.

I've seen execution policy block scripts even for domain admins – drove me nuts until I checked the policy.

Antivirus or security software blocking

Some antivirus software (especially endpoint protection like SentinelOne or CrowdStrike) blocks scripts that run from network shares. Check the logs in your security console. Turn off real-time protection temporarily to test if that's the cause.

A client last month had Carbon Black blocking all .bat files from a particular share. Whitelisted the path, problem gone.

Corrupted Group Policy

Rare but possible. Run gpupdate /force and reboot. If that doesn't help, check the event logs under Applications and Services Logs > Microsoft > Windows > GroupPolicy > Operational. Look for error 1084 or related.

You can also reset the Group Policy cache:

rd /s /q %SystemRoot%\System32\GroupPolicyUsers
rd /s /q %SystemRoot%\System32\GroupPolicy
gpupdate /force

Reboot after that.

Still stuck? Check the script itself

If nothing above works, the script might have an error. Run it manually as the user who sees the error. Open command prompt as that user (use runas /user:domain\username cmd) then run the script file. Watch for error messages.

Common script errors:

• Path to a file inside the script doesn't exist.
• Script calls a program that's not installed (like a custom EXE).
• Script uses a drive letter that's already taken.

Try simplifying the script to just net use Z: \\server\share and see if that works. If it does, add lines back one by one until you find the broken part.

Error 0X000008A4 is annoying but rarely deep. 9 times out of 10 it's a path or permissions issue. Start with the path check, then permissions, then move to the advanced stuff. You'll save yourself an hour.