EliadTech's questions

I have a Microsoft domain (mostly 2008r2\7).
I looking for a way to run a script immediately after (the restart after) joining a domain (without requiring user login), and so far I've failed.

Also, I want it to run only once, so scheduling a repeated task is not an option.
It just seem to me a waste to let it run over and over again.

I've tried a GPO with startup script, but when the computer receives the GPO it's way after the startup.
I've also tried a GPO with a scheduled task (with different triggers), but they didn't work too:
"At startup" trigger fails same as the startup script.
"At Task creation" fails, I guess because it's not created the usual way.
"At schedule" is irrelevant, because I need it to run right after joining (and setting a date that had already passed didn't work).
Couldn't find any relevant registry keys, but I assume they would have the same problem as the GPO startup script.

The only idea that might do what I need is attaching a task to the relevant event on the DCs, and run the script remotely.

Any better suggestions?

--Edit--
By the answers (which are great, but doesn't quite cut it), I have a few points to add:
1. The question applies to both servers (2008r2\2012\2012r2), though I've tested only on 2012r2.
2. I'm looking for a more runonce-like solution, meaning I don't want it to run endlessly until some condition is fulfilled.
3. We use images to deploy servers and workstations, but I can't use a solution that involves editing them because a) That would require me to update them each time I need to change something in my script b) BYODs.
4. We don't use a joining script (we simply don't need one...), so starting to use one seem to me a waste. Also, there are a few problem with it (e.g. where should I put it? in the image? in a shared location? what with BYODs? that would defeat point 3).

Thanks.

Background:
We have Oracle 6i applications that used to run on Windows server 2003.
We've migrated to 2008r2, and we managed to get these applications running almost perfectly (took a while and a lot of ProcMon logs...).
I know it's not supported, etc. but I don't see management agreeing for an upgrade - they would rather stay with 2003...

What the application does:
The application collects data, and then creates emails (like mailto) with an address and an attached file (rtf).

Now we are stuck with the following problem:
The problem is that, quite randomly, the process RWRBE60.exe crashes before Outlook even starts.
I've disabled all Outlook security features, but it didn't help (for that particular problem anyway).
In the event viewer it shows the faulty module, but it looks random too (e.g. dhcpcsvc.dll, dhcpcsvc6.dll, olmapi32.dll...).
All tests were done on the same server, with the same user, the same application and the same configurations.

A few more weird things found in ProcMon:
1. It loads many (maybe even all of them) dlls from Windows and System32 (like dhcpcsvc.dll - I mean, WTH?!)
2. I saw once that it loaded a dll named OMSXP32.DLL, which didn't exist when I checked later.
3. When it works it seem to do less searching for the dlls it needs.

Any suggestion or a lead is welcome.

Does anyone know how I can crash the spooler service manually?
I have a problem with some drivers crashing it randomly, and I want to do it manually so I can do some tests.

How can I pass parameters to a com-object function by name rather than by position?

Specifically, I've a com-object function (Word document com-object SaveAs2) and for example I want to pass values to the 2 first parameters and to the last parameter (CompatibilityMode).

My Administrator user once in a while is getting locked-out by the workstations in our lab, due to failed logon attempts.
(While this is a problem that should be addressed, because this means there is something wrong with the techies process, it's a small and less important at the moment)

My main problem is that the Administrator can authenticate from anywhere in the network.
I've tried using GPO ("Deny log on through Remote Desktop Services"), ADUC ("Log On To" list).
While he can't actually logon, the authentication is performed first and only then the system checks if there's a GPO or an ADUC block, thus allowing the Administrator user to get locked-out.

Of course this problem can apply to any user.
My Domain\Forest level is 2008r2, and I don't have a firewall between my LAN and my DC.

So, in short, I want to allow authentication attempts of the Administrator only from a certain computers.
Any suggestions?

In my organization we have two guys dealing with different aspects of our printers.
One is the helpdesk team leader who's responsible (among other related things) for updating the list of printers and there details, and the other is the field technician who's responsible for physically handling them (fixing, replacing, etc.).
Unfortunately, they don't cooperate well and sometimes the technician replaces a printer without updating the helpdesk team leader (and thus the list is outdated).

Is there a way to block the relevant print queue on the print server (Windows 2008) when the physical printer has changed (even with a printer of the same series)?
Alternatively, is there a way to be alerted to such a change?