SetLGP() restore removes the Scripts CSE from gpt.ini, silently disabling all Local Group Policy startup/shutdown scripts

rufus.log

Checklist

• I looked at https://github.com/pbatard/rufus/wiki/FAQ to see if my question has already been answered.
• I performed a search in the issue tracker for similar issues using keywords relevant to my problem. Closest are #711 and #961, both about SetLGP() side effects, but neither identifies the specific entry that goes missing here.
• I have the full log from the run that caused this, and it's below. It's 82 KB / 1150 lines, which is over GitHub's issue body limit, so the body has the head and tail plus every SetLGP line; the complete file is attached.

Not a media-creation issue — the media was written fine. The problem is what got left behind on the host.

Issue description

After running Rufus, C:\Windows\System32\GroupPolicy\gpt.ini is missing the Scripts client-side extension entry. The effect is that every startup and shutdown script configured in Local Group Policy silently stops running. gpedit.msc still lists the scripts and psscripts.ini is untouched, so nothing looks wrong — the scripts just never execute again.

Took me a while to track down, because every place you'd normally look still shows the script correctly configured.

The line in question

gPCMachineExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{2D4156A2-897A-11DB-BA21-001185AD2B89}{3D271CFC-2BC6-4AC2-B633-3BDFF5BDAB2A}{D02B1F72-3407-48AE-BA88-E8213C6761F1}]

Missing from it:

[{42B5FAAE-6536-11D2-AE5A-0000F87571E3}{40B6664F-4972-11D1-A7CA-0000F87571E3}]

{42B5FAAE-…} is the Scripts CSE, {40B6664F-…} its snap-in. I don't have a byte-level before-image, but that pair must have been there, because the Scripts extension was still processing the local GPO that same evening (event log below).

Meanwhile {3D271CFC-2BC6-4AC2-B633-3BDFF5BDAB2A} is still present. That's snap_guid from SetLGPThread() in src/stdfn.c — the one with the // Can be anything really comment. So the arbitrary GUID Rufus passes in survived the restore, and the Scripts pair next to it didn't.

What the restore is supposed to do

hr = pLGPO->lpVtbl->Save(pLGPO, TRUE, (p->bRestore)?FALSE:TRUE, &ext_guid, &snap_guid);

On the restore pass bAdd is FALSE, which should remove REGISTRY_EXTENSION_GUID and snap_guid from the extension list. Both of those are still in the file. A pair that was never passed to Save() is the one that got removed.

The log is missing the restore line

Every exit path in SetLGPThread() logs through ubprintf, success and failure alike, and so does the 5-second stuck-thread timeout in SetLGP(). The log has exactly one SetLGP line in 1150:

SetLGP: Successfully set NoDriveTypeAutorun policy to 0x0000009E

Nothing for the restore. Not a success, not an error, not the stuck-thread kill.

The restore definitely ran, though: Windows logged a machine-targeted policy refresh attributed to rufus-4.15.exe at 23:46:06, and Machine\Registry.pol has an mtime of the same second.

I can't tell from outside whether the log simply gets flushed before the restore fires, or whether the restore genuinely didn't reach either logging branch. You'll know which. If it's the second one, that plus a Save() that removed the wrong bracket group would explain what I'm seeing.

Downstream effect

On the next policy application the Scripts CSE runs, finds no GPO claiming to supply scripts, and purges its cached state:

HKLM\...\Group Policy\State\Machine\Scripts\Startup        <- key deleted
HKLM\...\Group Policy\History\{42B5FAAE-...}               <- emptied

That cached state is what Winlogon reads at boot to decide which startup scripts to run, so from then on it runs none.

Timeline

From Microsoft-Windows-GroupPolicy/Operational:

8/29 23:35:44  GP Refresh Attribution: Target=Machine RpcClient="...\rufus-4.15.exe"
8/29 23:35:44  Starting Scripts Extension Processing ... (Changes were detected.) Local Group Policy
8/29 23:46:06  GP Refresh Attribution: Target=Machine RpcClient="...\rufus-4.15.exe"
8/29 23:46:06  Starting Scripts Extension Processing ... (Changes were detected.) Local Group Policy
9/1  23:49:59  Starting Scripts Extension Processing ... (Changes were detected.) None

The first two lines are the set and restore passes. By the next boot the extension list reads None. Nothing else triggered a machine-targeted policy refresh anywhere in the retained log (which goes back to 8/24), and there were no boots between the restore pass and the 9/1 one.

Environment

Rufus x64 v4.15.2396
Windows version: Windows 11 Enterprise x64 (Build 26200.9278)

Standalone workgroup machine, local GPO only, no domain. One startup script configured — a PowerShell script that holds sign-in until the iSCSI initiator has brought two volumes online.

Working around it

Remove the script in gpedit.msc (Computer Configuration → Windows Settings → Scripts → Startup), OK, then add it back — that makes gpedit rewrite gpt.ini with the Scripts pair restored. Then gpupdate /target:computer /force and check the State\Machine\Scripts\Startup key is back before rebooting.

Deleting Registry.pol, which was the advice on #961, doesn't help — the missing entry is in gpt.ini.

For anyone who needs Rufus to keep its hands off group policy entirely, DisableLGP works: HKCU\Software\Akeo Consulting\Rufus for the regular build, rufus.ini for the portable one.

Log

Full file attached. Head, tail, and every SetLGP line:

Rufus x64 v4.15.2396
Windows version: Windows 11 Enterprise x64 (Build 26200.9278)
Syslinux versions: 4.07/2013-07-25, 6.04/pre1
Grub versions: 0.4.6a, 2.14
System locale ID: 0x0409 (en-US)
Will use default UI locale 0x0409
SetLGP: Successfully set NoDriveTypeAutorun policy to 0x0000009E
Localization set to 'en-US'
Found USB 3.0 device 'Samsung Flash Drive FIT USB Device' (090C:1000)
No logical drive found (unpartitioned?)
1 device found
No volume information for drive 0x81
Disk type: Removable, Disk size: 29.9 GB, Sector size: 512 bytes
Cylinders: 3900, Tracks per cylinder: 255, Sectors per track: 63
Partition type: GPT, NB Partitions: 0
Disk GUID: {02810F75-849A-40FF-9775-841F8D107E61}
Max parts: 128, Start Offset: 17408, Usable = 32080165888 bytes
Found 5 additional UEFI revocation filters from remote SBAT
Found 4 active Secure Boot certificate entries from remote
Found 1 revoked Secure Boot certificate entries from remote
Scanning image...

[... 1100 lines of ISO extraction and NTFS fixup elided for the body — full log attached ...]

Found USB 3.0 device 'Samsung Flash Drive FIT USB Device' (090C:1000)
1 device found
Disk type: Removable, Disk size: 29.9 GB, Sector size: 512 bytes
Cylinders: 3900, Tracks per cylinder: 255, Sectors per track: 63
Partition type: GPT, NB Partitions: 2
Disk GUID: {08684F67-0D04-4615-AE16-F102AAC49E6E}
Max parts: 128, Start Offset: 17408, Usable = 32080165888 bytes
Partition 1:
  Type: Microsoft basic data
  Name: 'Main Data Partition'
  Detected File System: NTFS
  ID: {492375B9-04C6-40FA-A545-1C54904E14A0}
  Size: 29.9 GB (32078041088 bytes)
  Start Sector: 2048, Attributes: 0x0000000000000000
Partition 2 (UEFI:NTFS):
  Type: Microsoft basic data
  Name: 'UEFI:NTFS'
  Detected File System: FAT12
  ID: {6D0CD789-4907-4993-B06F-E2FF61AB2E73}
  Size: 1 MB (1064448 bytes)
  Start Sector: 62654508, Attributes: 0x8000000000000000