Problem: VBScript Deprecation Warning (Event ID 4096) During Windows Logon

Knowledge Base Community
, , , , ,
1

Problem:

Administrators observe recurring warnings in the Windows Event Log during user logon on client systems integrated with Univention environments.

The following event is logged:

  • Event ID: 4096
  • Source: VBScriptDeprecationAlert

Example message:

Die Beschreibung für die Ereignis-ID “4096” aus der Quelle “VBScriptDeprecationAlert” wurde nicht gefunden. Entweder ist die Komponente, die dieses Ereignis auslöst, nicht auf dem lokalen Computer installiert, oder die Installation ist beschädigt. Sie können die Komponente auf dem lokalen Computer installieren oder reparieren.
Falls das Ereignis auf einem anderen Computer aufgetreten ist, mussten die Anzeigeinformationen mit dem Ereignis gespeichert werden.
Die folgenden Informationen wurden mit dem Ereignis gespeichert:
VBScript is scheduled for deprecation. Our telemetry indicates that your system is currently utilizing VBScript.
We strongly recommend identifying and migrating away from any VBScript dependencies at the earliest.
The following process has been detected as using VBScript. The associated process tree and call stack are provided below to assist in identifying the scenario in which VBScript was invoked.
ProcessName = “wscript.exe”
ProcessTree = “wscript.exe;userinit.exe;winlogon.exe”
CallStack = “vbscript.dll+0x68C16;vbscript.dll+0x55531;vbscript.dll+0x40348;WScript.exe+0xB4F0;WScript.exe+0xAE47;WScript.exe+0xC678;WScript.exe+0xA7B2;WScript.exe+0x8950;KERNEL32.DLL+0x2E8D7;ntdll.dll+0x8C48C”
ProcessTreeEnhanced = “wscript.exe(”\WScript.exe" \ucs-school-logon.vbs"“);userinit.exe(”\userinit.exe");winlogon.exe"
Die Nachrichtenressource ist vorhanden, die Nachricht wurde in der Nachrichtentabelle jedoch nicht gefunden

Additional event details indicate that wscript.exe is executing a VBScript during the logon process:

  • Process Name: wscript.exe
  • Process Tree: wscript.exe → userinit.exe → winlogon.exe
  • Referenced Script: ucs-school-logon.vbs

Furthermore, the event log may display the message:

The description for Event ID “4096” from source “VBScriptDeprecationAlert” could not be found.

Root Cause

This behavior is caused by the ongoing deprecation of VBScript in Microsoft Windows.

Univention environments particularly those using UCS@school may still rely on legacy logon scripts such as:

  • ucs-school-logon.vbs

These scripts are executed via Windows Script Host (wscript.exe) during user logon, which triggers the VBScript deprecation warning.

For additional background, refer to the related Univention bug report:

Investigation

Why is VBScript being deprecated?

VBScript is considered a legacy scripting language and is being phased out by Microsoft in favor of modern alternatives such as:

  • PowerShell
  • JavaScript

These newer technologies provide improved security, maintainability, and extended functionality.

VBScript Deprecation Timeline

Microsoft has introduced a phased deprecation plan:

  • October 2023: Announcement of VBScript deprecation
  • Future Windows releases: VBScript becomes an optional Feature on Demand (FoD)
  • Long-term goal: Complete removal of VBScript from the Windows operating system

This means that systems relying on VBScript-based logon scripts will increasingly encounter warnings or functional limitations.

For more details, see:

Workaround

To suppress or avoid the warning temporarily, the following approaches may be considered:

  • Ensure that VBScript is enabled as a Feature on Demand (FoD) on affected Windows systems

Here’s the DISM command that enables the VBScript FOD.

DISM /Online /Add-Capability /CapabilityName:VBSCRIPT~~~~