en-us Thu, 09 Sep 2010 09:01:38 -0500 donotreply@minasi.com 60 Mark Minasi's Reader Forum - Group Policies http://web2.minasi.com/forum/ Mark Minasi's Reader Forum http://web2.minasi.com/forum/http://www.minasi.com/ http://web2.minasi.com/forum/mrdlog.jpg Mark Minasi's Reader Forum Minasi Forums 144 47 Windows 7 slow processing Docs Folder Redirection chenchen21621 http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33850&REPLY_ID=173700 Group Policies Thu, 09 Sep 2010 01:15:20 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33850 Quote:
It might be worthwhile to turn on verbose FR tracing for this. Does it happen at every user logon or is it just the first time? It could be that FR is scanning files to determine if there have been any changes but it doesn't seem like that should take so long.


___________________________________________
http://www.monclerjacketde.com/
]]> Group Policy Preferences and Default Printers tom_myo http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=35475&REPLY_ID=173663 Group Policies Wed, 08 Sep 2010 09:26:58 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=35475 Quote:
quote:
I have a feeling that this is a Windows behavior you're seeing rather than a GP Preferences one


I thought that might be the case so I tested it on both Windows7 and XP. I set the default printers individually and waited for the policy to refresh and sure enough, the default printers changed on both devices.]]> Different profiles for different users. hickmanr http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=35469&REPLY_ID=173535 Group Policies Fri, 03 Sep 2010 21:25:18 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=35469 Quote:
wkasdo - As per your suggestion I decided to test my plan. Unfortunately it fell apart. As I had suspected the group policies did not get applied fully and no folder redirection occured.

I guess I'll focus on making the roaming profiles for students as light weight as possible.
]]> GPO options differ in RSAT and Remote Desktop dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=35378&REPLY_ID=173422 Group Policies Thu, 02 Sep 2010 13:57:58 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=35378 Quote:
The thing to keep in mind through all of this is that there is hard link between what you see in GP Editor and what is stored in the GPO. In other words, the reason you are able to set UAC settings within a 2003 domain is because the Vista GP editor contains the UI elements that tell the GP Editor how to store UAC settings within the GPO. The 2003 DC is just a file server at that point, storing the setting however the GP Editor tells it to. In the case of UAC settings (and any other settings under "Computer Config\Windows Settings\Security Settings) GP Editor is not using Admin. Template files but rather a combination of text files and hard-coded UI elements within the MMC snap-ins to present you options on what you can configure for that OS version. Its really all about the GP Editor in terms of what policy settings you can access and define. This is why we always say that when a new version of Windows comes out, its best to use that new version's GP Editor exclusively going forward to configure policy, because it will (generally) include all previous policy settings as well as the new ones.

Evgenij--as far as your question--see my previous paragraph. Security Settings, Folder Redirection, GP Preferences -- all of these are examples of CSEs that don't use Admin TEmplates to define what you see in GP Editor.


]]> Locking Down Desktop dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=35459&REPLY_ID=173415 Group Policies Thu, 02 Sep 2010 13:41:52 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=35459 Quote:
Really the only way to do this would be to use Folder Redirection to redirect the user's desktop to a read-only server share that contains the set of shortcuts that you want the users to see. Frankly, I haven't done this since NT 4 days so I can't say for sure that more modern versions of Windows won't choke on this but I think that would be your best bet.

Darren]]> Deploying multiple (many) apps via GPO aval http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=35423&REPLY_ID=173259 Group Policies Tue, 31 Aug 2010 09:54:44 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=35423 Quote:
Thanks guys.

But any preferences? Reasons to choose one way or the other?

Not having a multitude to manage, I'm leaning to separate GPOs for each app so I could enable/disable GPOs per app as needed.

I've used Software Deployment practically since it became available, but with only 1 or 2 (at most) apps.

Now I'm seeing advantages to deploy just about everything with them (rather than incoporate in a image).]]> Restricting PC access with GPO's daemonroot http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=35421&REPLY_ID=173247 Group Policies Tue, 31 Aug 2010 02:28:05 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=35421 Quote:
Thing is that userWorkstations and logonHours are user object's attributes... maybe you can script that and set it on the target users... I feel this is an unidirectional setting kinda odd since both objects are at the end security principals :(]]> Question on using zone mapping setting Dave Sweatt http://web2.minasi.com/forum/topic.asp?TOPIC_ID=35428 Group Policies Mon, 30 Aug 2010 16:51:39 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=35428 I've tried mk:@MSITStore:servername.domain.int and also tried mk:@MSITStore:\\servername.

The help file will open OK, but I get app log errors and 'data invalid' error in GP results.

I'm having a brain fart here and need to know what I'm doing wrong.]]> White List Issues JSCLMEDAVE http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=35321&REPLY_ID=172806 Group Policies Sat, 21 Aug 2010 21:29:11 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=35321 Quote:
Right you are Mark but here is the "State Agency" rub... The price for Enterprise will double the cost of every PC so it is not an option. The possibility of them going to Enterprise from Pro is slim to none.


So,,, I am going to do my best to help them with SRP using Certs if that is what it takes. They currently are using a 3rd party application that creates a White List but due to extremely frustrating issues with the SQL back-end and user complaints they would "really" like it to go away when the contract runs out this fall.

Having them all running Enterprise and being able to setup AppLocker would be VERY easy to setup for this small shop, but again due to them being a "State Agency" it just is not possible.

I am joining a team that wants to do the right things but thanks the policies set forth by the "State Agency" they have their brains tied behind their backs.

Remind me to tell you about their pay rate rules...

SRP is where I am headed. I have requested a WIN 7 Pro and XP SP3 box to be setup for testing which I will put into its own OU. Once I have a good foothold on what I think needs to be done we will pick a couple users to use as a live test. If all goes well we will push out from there.]]> Certificate Autoenrollment Policy OpsAdmin http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=35195&REPLY_ID=172247 Group Policies Wed, 11 Aug 2010 10:57:12 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=35195 Quote:
It would appear that I have answered my big money question. To set the value of a certificate template's autoenrollment permission from Not Allowed to Allowed you must select the properties of the template then click the Subject Name tab and use the option to 'build from this active directory information'. If you select 'supply in the request' autoenrollment is is not allowed.

I'm not sure which subject name options are appropriate for this template (there are several) but a minimum I have autoenrollment allowed.

J]]> GP not apply - The network path was not found karnbo http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=27263&REPLY_ID=171886 Group Policies Tue, 03 Aug 2010 00:49:50 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=27263 Quote:
Hi. Thanks.

Uninstalling and reinstalling the GPO feature did not do the trick surprisingly.

Well, think it is Windows Server 2008 R2 that is a bit... like a demo product, not really ready developed and tested yet.

Seen the same problem with allowing 'Remote Desktop', the two services that provide this feature is not switched on, even when I select that I want Remote Desktop enabled. (That would be two of the Terminal Services).
]]> Missing search values in GPMC dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=35074&REPLY_ID=171780 Group Policies Fri, 30 Jul 2010 13:01:33 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=35074 Quote:
Not sure what you mean by the "search" feature. GPMC does not provide setting level searching. You can search for policy areas within GPOs but not individual settings.]]> Solving event ID 1058 and 1030 userenv errors MRD001 http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=16129&REPLY_ID=171589 Group Policies Tue, 27 Jul 2010 19:15:12 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=16129 Quote:
It seems there are several potential solutions depending on the way the problem manifests itself. In my case, I was getting 1058 and 1030 errors on client PCs (XP Pro to a W2K8 Std Server). The event error noted the path that could not be found as \\domain_name.local\sysvol\... rather than \\server_name.domain_name.local\sysvol\... I entered a DNS entry mapping domain_name.local to the server IP and the problem went away.

I hope this helps.

Surge]]> Loopback Processing scope Playwell http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34860&REPLY_ID=170834 Group Policies Wed, 07 Jul 2010 14:45:35 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34860 Quote:
right.
The user gets all the GPO's for the OU the workstation/terminal server is in. And if loopback is in merge mode all the policies of where the user object resides as well. The workstation OU policies take precedence over the user object's OU.]]> Editing GPOs wkasdo http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34812&REPLY_ID=170584 Group Policies Thu, 01 Jul 2010 02:59:01 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34812 Quote:
Should NOT be disabled. If you do that and a client happens to refresh policy, it will do a rollback.]]> GPO to an OU wkasdo http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34773&REPLY_ID=170583 Group Policies Thu, 01 Jul 2010 02:56:38 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34773 Quote:
Filtering should work. Background reading for loopback:

http://technet.microsoft.com/en-us/library/cc785074(WS.10).aspx
http://support.microsoft.com/kb/231287]]> adm/admx confusion in mixed Win7/XP environment cj_berlin http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34756&REPLY_ID=170354 Group Policies Sun, 27 Jun 2010 05:22:39 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34756 Quote:
I believe Office settins are always bound to a specific version due to the paths in the registry which contain the internal version number. So with two different Office versions you would ALWAYS need two sets of policies which can of course be located in the same GPO.]]> IE Content Ratings Bbacoyiannis http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34674&REPLY_ID=170028 Group Policies Wed, 16 Jun 2010 10:57:07 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34674 Quote:
Thanks I will take a look]]> Outlook signatures oddity wkasdo http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34128&REPLY_ID=169959 Group Policies Tue, 15 Jun 2010 04:20:01 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34128 Quote:
You are on R2, right? Did you try applocker instead?]]> way to delete a couple shortcuts from start menu? Pesos http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34617&REPLY_ID=169835 Group Policies Sat, 12 Jun 2010 00:55:43 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34617 Quote:
Just a matter of getting used to Microsoft's inconsistent syntax... once I removed the .lnk it worked - woohoo! Thanks again!]]> WMI for OS Architecture JSCLMEDAVE http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34540&REPLY_ID=169746 Group Policies Thu, 10 Jun 2010 10:51:42 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34540 Quote:
James unfortunatly at the moment I have NO access to a DC or network for that matter... This links that were posted were dead on with what I think you are looking for. I would also search Darren's mail list site and Blog. I KNOW I have read this subject there on several occasions...

GPTalk Mailing List
http://www.gpoguy.com/


Blog
http://www.sdmsoftware.com/blog/]]> Enable Integrated Windows Authentication aval http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34616 Group Policies Wed, 09 Jun 2010 16:07:55 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34616
quote:
There is a user-dependant entry which you can find under "User Configuration/Administrative Templates/Windows Components/Internet Explorer".

Set "Enable Integrated Windows Authentication" to "Enabled" here.


Do any of you see this option?

I've sorted options alphabetically and it's not between the D's and the F's.

Windows 2003 SP2 with GPMC SP1


]]> Group Policy & sysvol Permission n3tw0rk http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34604&REPLY_ID=169719 Group Policies Wed, 09 Jun 2010 16:03:41 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34604 Quote:
hi wkasdo
your right

again thank you so much for your help

]]> Disable Shutdown, but keep Restart vaccarom http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34602 Group Policies Tue, 08 Jun 2010 16:18:58 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34602 Computer Config\Printers cj_berlin http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34543&REPLY_ID=169389 Group Policies Wed, 02 Jun 2010 12:10:13 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34543 Quote:
...because it is a per-user setting... loopback GPO processing maybe?]]> Folder Redirection Problem for win7/2008R2 kitkat http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34266&REPLY_ID=169363 Group Policies Wed, 02 Jun 2010 07:57:38 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34266 Quote:
quote:
Originally posted by kitkat

As I couldn't find a better solution, I solved the problem through deleting the order redirection GPO and creating it again. Now everything is working fine.
]]> Cannot edit Default domain GPO wkasdo http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34485&REPLY_ID=169136 Group Policies Thu, 27 May 2010 11:53:44 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34485 Quote:
possible next steps:
- run process monitor (sysinternals) with a filter on that file, see what happens.
- enable object auditing for one DC, set the correct SACL (everyone write failure), check eventlog.]]> Alternative way to configure Folder Redirection? Pesos http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34458&REPLY_ID=168946 Group Policies Mon, 24 May 2010 12:02:17 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34458 Quote:
Darren provides a workaround here, but it is unsupported.

http://www.minasi.com/forum/topic.asp?TOPIC_ID=23196&SearchTerms=x64,GPMC

The supported way to do it would be to use a 32bit XP workstation to install GPMC on, or use a 32 or 64bit Vista or Win7 workstation.]]> Folder Redirection does not show up! wlamore http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34267&REPLY_ID=168945 Group Policies Mon, 24 May 2010 11:33:16 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34267 Quote:
This is working fine on a 32bit version of windows 2003 enterprise edition. It does work on the 64bit since you cannot download GPMC]]> Windows XP Temporary User Profile avdevich http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34357&REPLY_ID=168710 Group Policies Wed, 19 May 2010 10:33:19 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34357 Quote:
I do not modify the default profile at all.

The profiles are roaming and I have the "User Profile Hive Cleaner" service on all client computers (Windows XP Pro).

If I delete any temp profiles from a client in question, the user can login successfully. Once another user logs in and off, the previous user gets a message stating the the profile cannot me found and issues a temp profile.]]> Screen Saver GPO??? Rastor728 http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34352&REPLY_ID=168471 Group Policies Thu, 13 May 2010 15:00:05 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34352 Quote:
I don't think you can force the screen to clear and still see the original user's screen.

I did create a domain "admin" account that can't do anything or go anywhere other than unlock the screen and log out the previous user. This stopped my users from calling me at 1 AM (Hospital Sysadmin) to clear a screen that someone walked away from while still logged in.]]> Custom ADM to Disable IP6 Dave Sweatt http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34232&REPLY_ID=168117 Group Policies Thu, 06 May 2010 14:32:31 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34232 Quote:
That's great Milissa!
Glad to be of help.]]> Some GPO's not applying totalstu http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34262&REPLY_ID=168094 Group Policies Thu, 06 May 2010 10:37:19 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34262 Quote:
Ok, I got it working. I had disabled that setting which still left the old homepage info. once I clicked not configured, applies and then enabled a field opened up where I could type in the new address.

Thanks for the lessons on GP.]]> Shortcut to All Users Desktop using GP Preferences ervi http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34278 Group Policies Wed, 05 May 2010 05:32:22 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34278 Solved: Uh oh i didnt have GP preferences Client side extensions installed [:o)]

I´m trying to make a shortcut to WindowsXP boxes desktop using gp preferences. I have followed instructions from this website http://itbloggen.se/cs/blogs/micke/archive/2010/01/19/mdt2010-publish-windows-7-upgrade-refresh-using-group-policy-s.aspx

[img]http://itbloggen.se/cs/cfs-filesystemfile.ashx/__key/CommunityServer.Blogs.Components.WeblogFiles/micke/image_5F00_172366AA.png[/img]


I have an .cmd file in shared folder in server and gp preference should make shortcut to this file in WindowsXP machine. I should but it wont :( If i point same gp preference to the server itself it works just fine and shortcut gets created. On XP machines shortcut doesnt get created. I have confirmed that shared folder is accessible on XP machines. Also i have checked that GP gets applied to XP machines using Group Policy Results Wizard]]> GPO not applying fantomen http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34229&REPLY_ID=167799 Group Policies Fri, 30 Apr 2010 11:19:20 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34229 Quote:
Sounds like when you edited the gpo it didn't update the version number.
After now when you have modified the policy to use another wav-file does it work with a new user?
Check gpt.ini to check that it really updated the version-number.]]> TS RDP-TCP Settings fantomen http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34147&REPLY_ID=167770 Group Policies Thu, 29 Apr 2010 16:41:52 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34147 Quote:
One way of doing it which came to my mind is to use Powershell (or vbscript) and script it.
Then you can execute the script in a group policy and at least that saves you from having to do any manual steps if you add more servers.
I have no clue if it's already in a TS-module for PS but you can access it using WMI and therefore you can use PS or VBs...

Hope it helps.]]> Denya access to Windows Explorer fantomen http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33845&REPLY_ID=167761 Group Policies Thu, 29 Apr 2010 15:29:56 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33845 Quote:
You can't hide it for specific users if it's not in a domain as it will affect all users to modify the local policy.
However as long as you don't restrict access to gpedit you can make the settings you need (like the above as wlazara suggested) and for some reason you need access you can change the policy again to unhide the drives.
You have options to hide drives (they can still access them) or you can prevent access (no access).]]> Windows 7 - Visible Powershell Startup scripts Xenophane http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34216&REPLY_ID=167721 Group Policies Thu, 29 Apr 2010 07:43:47 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34216 Quote:
Dave, I think your problem is that you are actually running your scripts asynchronously.

If I remember correct, Windows Vista/7 run all startup scripts asynchronously.

{EDIT disregard the above, I will have to learn to read at some point}]]> GPO issue with Windows Messenger fantomen http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34125&REPLY_ID=167564 Group Policies Mon, 26 Apr 2010 16:01:49 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34125 Quote:
You mean that you have tried SRP and it doesn't work?
http://gpfaq.se/2007/09/30/how-to-using-software-restriction-policies/]]> Hard Code Password in GP for Service Accnt? jadgate http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34174&REPLY_ID=167442 Group Policies Fri, 23 Apr 2010 17:58:15 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34174 Quote:
Tim-

See this thread:

http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33014

This is a topic that is all to familar to me. Let's just say I know more about it than I want to because it is a standard coding practice for service and process accounts in "home grown" applications where I work. They don't put the pwd in in GPOs, but they want to code accounts with non-expiring pwds, which is even worse.

From the perspective of the coder/developer of a mission critical gotta be up and running 24/7 app, they have to do this. However, there has to be a better way..

Jim
]]> Adding a user to the local pc Dave Sweatt http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34100&REPLY_ID=167434 Group Policies Fri, 23 Apr 2010 14:20:27 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34100 Quote:
Use 'Restricted Groups' in computer config\windows settings\security settings\restricted groups.
It's empty by default so you have to add the group 'administrators' then populate it.]]> secedit /refresh policy replacement dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34133&REPLY_ID=167239 Group Policies Tue, 20 Apr 2010 18:24:59 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34133 Quote:
no problem. "dmalaria"..that's funny. I have never been called a disease before :-)]]> serious bug with GPO win7/2008r2! Pesos http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34084&REPLY_ID=167153 Group Policies Mon, 19 Apr 2010 17:42:38 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34084 Quote:
hmm, the "app" is windows explorer... so I guess I could try it by applying the custom GP to an admin account on the server?

the default GP has nothing altered at all other than password policy...]]> gpotool.exe /verbose question. daemonroot http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34088&REPLY_ID=166950 Group Policies Thu, 15 Apr 2010 00:41:47 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34088 Quote:
Not sure that is exactly what you're looking for but you might want to play with "GetReportsForGPO.wsf" too.
You'll find that in the installation path of GPMC within the Scripts folder (i.e C:\Program Files\GPMC\Scripts|>)
There is also "GetReportsForAllGPOs.wsf" to get a report for all GPOs, as the name implies.]]> Turn off / Disable Pop Up Blocker in IE planzone http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34063&REPLY_ID=166806 Group Policies Mon, 12 Apr 2010 11:39:17 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34063 Quote:
RSOP appears to be fine.
the policy is applied to a OU

So let me ask are my assumptions correct in my initial post on how to go about disabling the pop up bocker (must do each zone?)]]> Disable Disk Defragmenter Mark Minasi http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34054&REPLY_ID=166724 Group Policies Fri, 09 Apr 2010 09:18:57 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34054 Quote:
There isn't a policy like that per se, but you could use Software Restriction Policies (it's in Windows Settings and has been since XP) to block the defragger. Or just change the NTFS permission on the file. In any case, it's

c:\windows\system32\dfrgui.exe]]> Folder Redirection Desktop Start Menu Win7 Vista Mark Minasi http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=34010&REPLY_ID=166625 Group Policies Thu, 08 Apr 2010 07:59:37 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=34010 Quote:
I'd look at Darren's responses here:

http://www.minasi.com/forum/topic.asp?TOPIC_ID=33850
]]> Group Policy Extensions dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33983&REPLY_ID=166351 Group Policies Wed, 31 Mar 2010 12:34:53 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33983 Quote:
yea, I agree, esp. since the GP engine knows ahead of time which CSEs have been implemented in the GPOs.]]> WARNING!! NEWBIE ALERT, lol Chris D http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33964&REPLY_ID=166262 Group Policies Mon, 29 Mar 2010 14:37:52 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33964 Quote:
Ha ha, I'm only new, not touched (or knowingly touched) Kerberos just yet. Will try reattaching it to the domain...

CD

]]> Stopping XP/2003 services with 2008 DC Rockyboa http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33966&REPLY_ID=166260 Group Policies Mon, 29 Mar 2010 14:17:29 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33966 Quote:
Interresting,

and that would be possible by installing GMPC v2 on Windows 2003?!

Thank you

Martin]]> Extensive use of "Deny Apply" dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33925&REPLY_ID=166140 Group Policies Thu, 25 Mar 2010 00:04:37 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33925 Quote:
The worst thing about Denies are that they are not exposed in any of the regular MS tooling. You have to dig to see a Deny, which I don't like in environments where multiple folks touch GP. Other than that, knock yourself out. Its not inherently bad, except for the reason stated above. Just more complex to manage (which can be inherently bad in poorly managed environments).
]]> manage W2k8 R2 firewall rules Rambler http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33843&REPLY_ID=166076 Group Policies Wed, 24 Mar 2010 05:11:13 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33843 Quote:
Thanks Willem, I'll do some tests anyway.
The confusing part is the FW GUI, which will show all these rules as enabled (even when they will be overriden by domain GPO settings).]]> Desktop Properties dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33921&REPLY_ID=166025 Group Policies Tue, 23 Mar 2010 08:28:06 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33921 Quote:
Have you run a GPMC GP Results report against one of the affected machines and users? That should show if there are any active policy settings in place.]]> Symantec Endpoint or GPO 2008R2 vaccarom http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33871&REPLY_ID=165963 Group Policies Mon, 22 Mar 2010 10:17:18 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33871 Quote:
There both free for me. They will be XP Pro clients and central reporting would be good...]]> Srv2008 DC Registry.Pol tmccabe http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33861&REPLY_ID=165926 Group Policies Fri, 19 Mar 2010 15:47:12 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33861 Quote:
Thanks Darren but I ended up creating a new DDP and "unlinked" and "un-enforced" the old DDP and now all seems to be well. I made sure I backed up that DDP as well just in case !]]> RSAT & Vista SP2 wkasdo http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33815&REPLY_ID=165629 Group Policies Fri, 12 Mar 2010 06:23:33 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33815 Quote:
Absolutely. I was thinking of existing XP/2003 policies, but in order to use or even edit the new features you need the higher platform.]]> GPO to prevent Duplicate computer Accounts ebrux http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33806&REPLY_ID=165623 Group Policies Thu, 11 Mar 2010 22:05:11 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33806 Quote:
quote:
Originally posted by wkasdo

A duplicate account (samAccountName)can only occur when they are created at the same time on different DC's, in different OU's.


Or...when you copy a VM that was already joined to the Domain, and then run both at the same time. Our developers liked to do this. [:)]

I do not know of a way to prevent it...]]> Patches failed - Cant change rights via secpol wkasdo http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33791&REPLY_ID=165581 Group Policies Thu, 11 Mar 2010 02:54:57 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33791 Quote:
Must be the group membership then. Perhaps some important accounts were renamed, and are not what they seem? Or somebody applied some clever DENY ace's?]]> GPO Software applied on VM but not on Desktop remko.de.koning http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33793&REPLY_ID=165516 Group Policies Wed, 10 Mar 2010 11:20:57 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33793 Quote:
Thanks for giving this some thought though [:)]

Also, just found out that the answer is often close by. (3 threads down [:D] )
http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33595

Groetjes....]]> gpo apply error wkasdo http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33776&REPLY_ID=165485 Group Policies Wed, 10 Mar 2010 03:18:06 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33776 Quote:
> Why did Utexas.edu list that method as a way to disable firewall

Disabling the FW in Admin templates sets the firewall in a mode where it blocks nothing. This depends on network location (domain mode or not). Turning the service off takes it one step further.

Not sure about the other error because I've never seen it.]]> group Polcies not being applied wkasdo http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33749&REPLY_ID=165323 Group Policies Fri, 05 Mar 2010 10:52:38 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33749 Quote:
We have a sticky for that: http://www.minasi.com/forum/topic.asp?TOPIC_ID=16129

Common problem, with many possible causes.]]> Homepage URL not applying to Vista aval http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33726 Group Policies Wed, 03 Mar 2010 12:35:41 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33726
Also, I configured the GPO in the GPMC.

http://www.vistax64.com/vista-networking-sharing/67170-group-policy-ie7-home-page-url.html

Anyone else see this?

User logs on to a XP sp2 machine: no problem.

User logs on to a Vista machine (SP1? - should have looked, not in front of me now) and the correct homepage does not display when opening IE.

gpresult /r shows that the policy is applying (other elements DO apply). GPMC shows the setting as part of the GPO.


Hmmm?]]> IE 8 install using msi file Bbacoyiannis http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33544&REPLY_ID=164993 Group Policies Fri, 26 Feb 2010 01:44:52 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33544 Quote:
The install interactive works fine several minutes....]]> Group Policy Settings not being removed DingoBait http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33664&REPLY_ID=164911 Group Policies Wed, 24 Feb 2010 13:44:07 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33664 Quote:
dmarelia and Evgenij, That makes complete sense now. I changed it and the tattooing was reversed.

Thanks for the help!]]> Lessons Learned dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33595&REPLY_ID=164901 Group Policies Wed, 24 Feb 2010 11:32:07 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33595 Quote:
Matt-
You could also try forcing GPSI to process during every refresh cycle, by enabling that policy under Computer Config\Admin Templates\System\Group Policy\Software Installation Policy Processing (process even if no GP changes have occurred)

This may get around timing issues related to GPSI requiring foreground processing to actually do the install, but that not happening due to unrelated reasons as it will force the machine to pick up instructions for GPSI packages during background refreshes, even if it missed it during a reboot/re-logon]]> Need a GPO to Set Adapters and Bindings order Vico311 http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33549&REPLY_ID=164293 Group Policies Fri, 12 Feb 2010 17:33:22 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33549 Quote:
Hey Thanks for asking. They are Random GUIDs. Not sure how I would do this VIA netsh?]]> Disable Pop-up Blocker dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33504&REPLY_ID=164096 Group Policies Tue, 09 Feb 2010 19:44:57 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33504 Quote:
glad to hear it! Forgot it was zone-specific]]> file/folder/registry rights deployment stuntman http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33445&REPLY_ID=163889 Group Policies Thu, 04 Feb 2010 08:51:55 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33445 Quote:
Thanks guys/gals for the great respose.


sm]]> GPO Startup script not working leadit http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=18057&REPLY_ID=163798 Group Policies Tue, 02 Feb 2010 16:35:39 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=18057 Quote:
I know that this is really old, but I thought I would reply for anyone that googled this any wants to know the solution (I know I did!).

The issue is in this line: strDomain = objWshNet.UserDomain

You cannot call objwshnet.userdomain during startup. I fixed it by putting in my domain instead of using the variable.

thought you would like to know :-)]]> How to block roaming profile loading ... Dave Sweatt http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33340&REPLY_ID=163774 Group Policies Tue, 02 Feb 2010 12:23:12 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33340 Quote:
All you need is computer settings\admin templates\system\user profiles. Enable 'only allow local user profiles' and 'prevent roaming profile changes from propagating to the server'. Used that on all my terminal servers for many years now.]]> Manage IE 6 and IE 8 settings with Group Policy dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33454&REPLY_ID=163760 Group Policies Tue, 02 Feb 2010 00:20:46 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33454 Quote:
The IE8 template should be a superset of the policies available for IE6. So if you replace the IE6 inetres.adm with the IE8 version, you should be able to manage both versions. Otherwise, you would need to create a GPO for IE 6 and one for IE8 with their respective ADMs, but again, you should not need to do this.]]> Local Admin Rights Pesos http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33422&REPLY_ID=163706 Group Policies Sat, 30 Jan 2010 13:54:55 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33422 Quote:
There are ways as Tim suggests. What we do is actually use remote
access tools to tie in and load hone printer setups manually so we can stay in control of what gets loaded]]> BMP Wallpaper does not display Mark Minasi http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33421&REPLY_ID=163662 Group Policies Fri, 29 Jan 2010 11:14:26 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33421 Quote:
Oh, yes, agreed! As far as I can see, that's the only way with group POLICIES.

But with PREFERENCES, you can just punch any image value into the Wallpaper entry in HKEY_CURRENT_USER\Control Panel\Desktop.

Does that make sense?]]> GPO Install IE8 to Windows XP SP2 PC's Bbacoyiannis http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33410 Group Policies Wed, 27 Jan 2010 10:56:43 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33410
When the computer reboots IE8 does not install. Is there some type of pre-req that we may be missing? Currently all stations are IE6.

Do we need to move to IE7 first?]]> Finding GroupPolicy GUID stuntman http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33298&REPLY_ID=162984 Group Policies Thu, 14 Jan 2010 20:07:09 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33298 Quote:
Thank you both so much Mark and wkasdo!

sm]]> Windows XP client and Windows 2008 GPO compatibili dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33194&REPLY_ID=162261 Group Policies Tue, 05 Jan 2010 13:32:38 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33194 Quote:
Yes, with the notable exception that some settings and policy areas that appear 2008 are simply not supported on XP. What policy(ies) specifically, are your XP clients not getting?
]]> how can user install any program timberk http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33137&REPLY_ID=161739 Group Policies Fri, 25 Dec 2009 15:26:30 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33137 Quote:
Is this an Active Directory environment?

~tb]]> Server 2008 forrest and gpresult /z Jazzy http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33127&REPLY_ID=161663 Group Policies Wed, 23 Dec 2009 06:32:28 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33127 Quote:
I've seen it happen before, have a look at this one: http://social.technet.microsoft.com/Forums/en-US/winserverDS/thread/f842852f-2257-4f9f-b574-4c08a65f6c04]]> deny power settings to certain computers shifty1981 http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33102&REPLY_ID=161558 Group Policies Mon, 21 Dec 2009 10:37:05 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33102 Quote:
quote:
Originally posted by Mark Minasi

You could also add just one 2008 DC and all of a sudden group policy preferences would open up to the 2003 and XP systems -- there's power config controls in there as well.


Thanks. Yeah a 2008 DC is not allowed in this environment. I had hoped they'd go for that. As for EZGPO I've followed their instrucitons to a T and it didn't work.]]> Attachment Manager setting question Dave Sweatt http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33079 Group Policies Wed, 16 Dec 2009 18:07:13 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33079 Quote:
]]> MY Doc's redirection leaves folders and files Uberwilhelm http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33010&REPLY_ID=161318 Group Policies Wed, 16 Dec 2009 14:32:39 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33010 Quote:
Make sure none of the users manually configured the use of offline files. This will make a local copy of the files. Set this in the policy. This will prevent the creation of a local copy.

Computer config/admin temp/network/offline files.

Policy Setting
Allow or Disallow use of the Offline Files feature Disabled
Prohibit user configuration of Offline Files Enabled

Policy Setting
Turn off reminder balloons Enabled





Hope this helps!
]]> Group Policy Services failed to execute dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32926&REPLY_ID=161129 Group Policies Mon, 14 Dec 2009 16:29:56 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32926 Quote:
Michelle-
It sounds like the GP Preferences setting for service configuation is corrupted or not available. If the problem is the former, probably the best think you can do is remove the setting from the existing GPO and create a new GPO to define it. If the latter, then you might want to run gpotool.exe from the Server 2003 Support Tools -- it will tell you if the SYSVOL part of your GPO (which is where these settings are stored) is inconsistent across your DCs. In that case, you may have an FRS replication problem.

Darren]]> Trusted Sites with Templates dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33015&REPLY_ID=161128 Group Policies Mon, 14 Dec 2009 16:27:31 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33015 Quote:
if you visit one of the sites, does it indeed show up as being in the trusted sites zone?]]> Explorer Menu Bar Removal dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=33038&REPLY_ID=161127 Group Policies Mon, 14 Dec 2009 16:25:37 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=33038 Quote:
Ultan- Have you tried running IE in kiosk mode? Not sure if that works for you but always comes to mind when I hear folks wanting to lock down the browser completely.]]> Removing IE proxy settings Pesos http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=23614&REPLY_ID=160902 Group Policies Tue, 08 Dec 2009 18:13:32 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=23614 Quote:
thanks!]]> Assigning drive letter to CD/DVD Pesos http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32772&REPLY_ID=160775 Group Policies Sat, 05 Dec 2009 20:23:24 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32772 Quote:
http://www.visualbasicscript.com/m2962.aspx

maybe this will help]]> folder redirection problem madman http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32918&REPLY_ID=160509 Group Policies Sun, 29 Nov 2009 21:13:04 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32918 Quote:
No VPN connections and no intentions to have data synchronized from off site. I just can't get people to remember to turn their wireless cards off before they go home. I wish that was the best answer but, knowing that after the computer goes to sleep and is woken up after 20 minutes everything works as designed, I'm not satisfied with the way things are running currently. There has to be a setting that I've overlooked or something that is conflicting. The majority of my clients are shutting their computers down, taking them home, and then connecting later in the evening to their home WLAN to work on various documents. I get alot of questions when they boot up with their wireless cards connected and they don't get their desktop/documents/app data (for firefox settings). If they do remember to turn off their wireless cards, all works great. I'm just trying to make this work with as few steps possible for my users.]]> Custom adm template for registry change AlLeX_ http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32888&REPLY_ID=160316 Group Policies Wed, 25 Nov 2009 04:37:47 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32888 Quote:
Now I have noticed that in the machine part of a GPO there are defined settings I am interested for Time service so there is no need for a custom adm template. :)

Here comes the moment to say - thank you Microsoft!]]> Fails to redirect My Documents dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32850&REPLY_ID=160143 Group Policies Fri, 20 Nov 2009 19:12:39 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32850 Quote:
Here's a guess. When you use the "redirect to users homedrive" its specifically looking at the *regular* home drive property on the user's AD account and doesn't know how to redirect to the TS home drive. Can you modify the folder redirection policy to point to an explicit path and use the TS home drive location?]]> Unable to connect the server 2003 through terminal mm_0_mm http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32855&REPLY_ID=160138 Group Policies Fri, 20 Nov 2009 15:53:12 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32855 Quote:
check all the various places an initial program can be configured

in mstsc click the options button then the programs tab.
in the environment tab of an AD user account
in the environment tab of the RDP-TCP properties in Terminal Services configuration

]]> Windows cannot access the file gpt.ini for GPO Mark Minasi http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=15363&REPLY_ID=159835 Group Policies Sun, 15 Nov 2009 05:07:08 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=15363 Quote:
May I suggest that we've already got a sticky on this:

http://www.minasi.com/forum/topic.asp?TOPIC_ID=16129]]> Registry settings change in GPO? Mark Minasi http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32673&REPLY_ID=159834 Group Policies Sun, 15 Nov 2009 05:05:57 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32673 Quote:
What Darren said.<g>

I wasn't singing PS's praises, just saying that it was the closest answer that I could think of.]]> GPO for restricting Internet access per computer Rambler http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32781&REPLY_ID=159825 Group Policies Sat, 14 Nov 2009 20:25:03 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32781 Quote:
Evgenij, if we're talking security filtering, then ofcourse you can filter on computer basis.]]> AutoConfigURL deleting after gpupdate madlinux http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32793&REPLY_ID=159804 Group Policies Thu, 12 Nov 2009 14:43:44 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32793 Quote:
After moving the computer object out of the testing OU issue resolved itself. In looking at what GPO's were applied in the OU the computer was in found one policy that was ENFORCED with loopback processing enabled Mode: Replace.

I have a feeling that this is the issue, but am not not very sure how it petains to this scenerio, can someone explain?

Regards,

Dan]]> GPO Troubleshoot tomo999 http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32779&REPLY_ID=159784 Group Policies Thu, 12 Nov 2009 09:34:06 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32779 Quote:
You could use the search functionality within GPMC; http://technet.microsoft.com/en-us/library/cc785166%28WS.10%29.aspx

Or there are a bunch of example scripts here; http://msdn.microsoft.com/en-us/library/aa814151%28VS.85%29.aspx]]> EDITTEXT string length dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32782&REPLY_ID=159761 Group Policies Wed, 11 Nov 2009 17:46:14 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32782 Quote:
I wonder if that 1023 limit is unicode or not--meaning that the real limit is half of 1023? Have you been able to find a length, shorter than the one you need, where it seems to work? The other alternative I would suggest is using the GP Preferences registry extension if you have that at your disposal.

]]> no RSOP data / only for one user on a specific PC neeeko http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32759&REPLY_ID=159712 Group Policies Tue, 10 Nov 2009 03:10:50 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32759 Quote:
Found the answer. Was obviously a Kerberos problem.
I deactivated "Store passwords using reversible encryption" in AD users and compputers for the specific account even though this option gave no pb for the XP machine.
Seems like Windows 7 cannot communicate well with Windows 2003 using this method...

Thanks to myself for my help.
Have myself a great day.]]> very weird Group Policy behaviour dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=16122&REPLY_ID=159670 Group Policies Mon, 09 Nov 2009 12:56:09 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=16122 Quote:
Well at least you solved it! I still don't recommend it but its good to know its not broken :)]]> Windows Firewall GPO Help Mamba http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32717&REPLY_ID=159543 Group Policies Thu, 05 Nov 2009 18:56:52 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32717 Quote:
>apply filtering to the GPO permissions to deny "apply policy" for this particular computer.

Hmmm...I don't want to move this system out of it's current OU, and filtering sounds complex as I only want to filter for this one rule and keep all the other current (and future) rules. But it's an idea...thanks.

>No. That's by design.

Figured..]]> Group Policy Results Wizard Error NikolasE http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32699&REPLY_ID=159375 Group Policies Tue, 03 Nov 2009 11:11:25 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32699 Quote:
Okay Found some Solutions.


Ping Problem : I created a New Inbound Rule to allow ICMPV4 for Echo Request in Win7 Firewall. Now i can ping the Client.


GPRW : I enabled the WMI in Windows Firewall but still GPRW didnt work since user options was greyed out

I have Enabled File and Print Sharing also in Windows Firewall and now GPRW works fine.

Question : Isnt a GPO that i can apply this Settings to all clients, Or i need to setup each client the same way?

And pls since am not expert in Firewall although it works is the settings i have applied correct?

Thanks]]> VB script Xenophane http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32663&REPLY_ID=159132 Group Policies Thu, 29 Oct 2009 07:22:52 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32663 Quote:
What are you using to edit the script file ? Do you choose edit in GPMC ?]]> Windows 7, ADMX, and Central Store Vic http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32418&REPLY_ID=158926 Group Policies Mon, 26 Oct 2009 14:02:32 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32418 Quote:
The GPMC will look for a Central Store first. If it exists, then the GPMC will use the templates from the Central Store. If no Central Store exists, then GPMC will use the templates that exist locally on the machine that is running GPMC.

If there is no Central Store, and the machine running GPMC is Windows 7, then you will be able to create GPOs that have all the controllable values that exist in any version of Windows, from 2000 all the way up to Win7 and Server 2008 R2.

If there is no Central Store, and the machine running GPMC is Vista (not Win7 as in the example above), then you will be able to create GPOs that have all the controllable values that exist in any version of Windows, from 2000 up to Vista, but the values specific to Win7/2008 R2 will not be available.

If there is a Central Store, as long as the GPMC is being run from a Vista machine or higher (2008, 2008 R2, Win7), and you have copied the ADMX/ADML files from a Win7 or 2008 R2 system, then you will be able to create policies that include settings for any version of Windows, from 2000 all the way up to Win7 and Server 2008 R2.

Unless you use the GPMC from Win7 or 2008 R2, though, you miss out on the cool filtering features of the new version of the GPMC. You can still create and manage the policies, but the GPMC interface improvements are specific to the GPMC that runs in Win7 or 2008 R2.]]> IE8 Compatibility View GPO not applying aggen http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32570&REPLY_ID=158915 Group Policies Mon, 26 Oct 2009 11:33:43 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32570 Quote:
Hi, they didn't handle this kind of issue at IE8 support. But I see that if you enter the top domain of the site that you request in the GPO it's applies and runs in compatible mode, but still you can't see it in the list.]]> Assigned Software GPO running every time dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32609&REPLY_ID=158805 Group Policies Fri, 23 Oct 2009 11:47:47 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32609 Quote:
Chris-
When I've seen this in the past, it was usually the result of a home-grown MSI that included a temporary file as a key file. In that case, if the temp file gets deleted, like as a normal function of using the app, then Windows Installer tries to repair it during each foreground processing cycle.
]]> IE Add-ons bpfoley http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32531 Group Policies Thu, 15 Oct 2009 14:08:32 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32531
I know that I can use the group policy to manage add-ons, but I do not want to explicitly say what add-ons I want, and what I do not. Is there any easy way to uninstall this BHO? Or do I have to go and dissect what add-ons I want to explicitly allow?

Thanks!]]> Computer Policy dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32509&REPLY_ID=158306 Group Policies Thu, 15 Oct 2009 12:11:53 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32509 Quote:
One thing to note is that removing a machine from a domain doesn't automatically remove policy from it. In fact, I always recommend that before removing a machine from a domain, that you move it to an OU that doesn't receive any policy, and let it go through the policy removal process so that any settings are removed prior to removing it from the domain. One thing you can try is to download a utility I wrote for this purpose called "Clean Registry Policy" (www.sdmsoftware.com/freeware). You can use this to remove all registry policies and preferences from a machine. Then, try re-joining it to the domain and see if the new policy applies.]]> GPP and Mapping Network Drives dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32510&REPLY_ID=158305 Group Policies Thu, 15 Oct 2009 11:51:34 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32510 Quote:
Not sure why replace wouldn't work as an action in this case?]]> GroupPolicyMinTransferRate Setting dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32508&REPLY_ID=158304 Group Policies Thu, 15 Oct 2009 11:49:24 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32508 Quote:
Actually, that value is already in Group Policy--under Computer (and User) Configuration\Admin Templates\System\Group Policy\Group Policy Slow Link Detection]]> Advanced Group Policy Management Mark Minasi http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=24526&REPLY_ID=158288 Group Policies Thu, 15 Oct 2009 06:38:30 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=24526 Quote:
Dunno; I've never used MDOP -- anyone here use it?

My guess is that the only difference in versions is that they keep adding stuff to it.]]> Scheduled Tasks off by 1 Hour sixdoubleo http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32499&REPLY_ID=158181 Group Policies Tue, 13 Oct 2009 14:27:21 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32499 Quote:
Given that we're in the new DST window I was wondering if this could be a DST bug of some sort. I've done some googling for "group policy preferences dst" and found this:

http://www.eggheadcafe.com/conversation.aspx?messageid=33448716&threadid=33414557

Appears it's a known bug with GPP. Anybody know if this has been addressed with a patch or something?
]]> IE Branding Failure on Windows 7 slaris http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32450&REPLY_ID=158033 Group Policies Fri, 09 Oct 2009 15:35:56 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32450 Quote:
What is interesting is that if I use the XP version of the IE7 branding dll on Windows 7, Iedkcs32.dll , the crashing stops.]]> Using GPO to force proxy or homepage netmarcos http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32393&REPLY_ID=157693 Group Policies Fri, 02 Oct 2009 12:33:17 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32393 Quote:
While you are playing with this, perhaps you should import the Firefox template into your GPO (http://sourceforge.net/projects/firefoxadm/)?]]> Dealing with String errors after SP2 cybersteve http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=10997&REPLY_ID=157691 Group Policies Fri, 02 Oct 2009 12:22:09 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=10997 Quote:
Got the errors, fixed the errors. Another day in paradise...

Merci!]]> One or multiple GPOs? joshuamorgan http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32274&REPLY_ID=157676 Group Policies Fri, 02 Oct 2009 05:59:25 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32274 Quote:
Which is odd given that printui.dll can do per-machine shared printer connections with the 'ga' switch.

Thankfully, GPP gave me a computer security group option so I was able to do it all from within one GPO. Flip side of that is I've set all to be 'default printer', so if the computer is a member of the group you get that printer and it's a default. This works well for PCs with one printer to attach, but those with multiple get a default printer based on its order within the GPO. I'm thinking of using a two group system: one to get the printer, and another to have it as a default. Therefore to get 'Finance Printer' as the default, you're a member of 'Finance-Printer-Default' group, and to get 'Reception' printer as not default, you're a member of 'Reception-Printer-Default' group. Whilst this means a printer is listed twice in the GPO, one for default and another for non-default, that's the only way I can think of solving this issue without relying on any other method of setting the default (such as having a script).]]> Group Policy Not Applying BenRad http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=29606&REPLY_ID=157653 Group Policies Thu, 01 Oct 2009 12:36:04 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=29606 Quote:
I'm having a similar issue. After moving our user's home directories to a new server, my GPOs that forced folder redirection and offline files stopped working. I was able to fix the folder redirection issue and remove the link to the old server for offline files. However, the GPO that sets up offline files is not being applied to the users it affects. I've run GPresult and it says that they're being applied, but when I check out the user's system, the folder is not synchronized. I've checked the permissions on the keys mentioned by Darren and the user has admin rights. Any other ideas?]]> GPO logon scripts not working without parameter dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32279&REPLY_ID=157294 Group Policies Thu, 24 Sep 2009 01:11:07 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32279 Quote:
While I haven't tested this in Win7, given that UAC hasn't changed, I suspect its still an issue. One option may be to see if you can move whatever it is you're doing in logon scripts to GP Preferences, which doesn't suffer from the same problem.]]> users installing USB device landry_bc http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32316&REPLY_ID=157265 Group Policies Wed, 23 Sep 2009 13:25:25 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32316 Quote:
Thanks for the words of wisedom.

As you suggest, the campus doesn't allow for "immediate" response on my part.

-Pauli]]> Visual Effects Group Policy itechsolutions http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32242&REPLY_ID=156926 Group Policies Wed, 16 Sep 2009 19:53:46 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32242 Quote:
In Group Policy you can go to User Configuration > Admin Templates > Control Pane > Display > Desktop Theme > and " Load a specific Visual Style file or force Windows classic. If you set the policy it will force Windows classic theme which turns off all the enhancements that best performance does.]]> Disable autoplay or autorun? jennie http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32151&REPLY_ID=156602 Group Policies Thu, 10 Sep 2009 22:01:31 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32151 Quote:
I faced the same challenge two weeks ago. I eventually gave up and used a small wizard called autoplay squelch. Since then I am no longer bothered by those programs automatically playing when I insert a USB key.

Jen]]> Delegate Group Policy dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=32196&REPLY_ID=156585 Group Policies Thu, 10 Sep 2009 14:13:08 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=32196 Quote:
Yes, once a GPO is created, if you highlight the GPO in the GPMC and select the Delegation tab on the right, you can choose which groups can View/Edit/Delete that GPO. If you need to do it against a lot of GPOs, then you'll have to use scripting. Let me know if you want to go that route and I can provide samples.]]> GPMC on x64 Mark Minasi http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=23196&REPLY_ID=155417 Group Policies Mon, 17 Aug 2009 15:58:24 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=23196 Quote:
Welcome, glad we could help! (That Darren guy is REALLY smart.)]]> Starting over with Group Policies wkasdo http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=31974&REPLY_ID=155367 Group Policies Sun, 16 Aug 2009 16:17:35 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=31974 Quote:
To restore default policies, investigate dcgpofix.

Are you aware of Group Policy Management Console(GPMC)? Use it to see what the current effective policies are. Create a new unlinked policy with all settings you like, test it, then activate it and unlink the old policies.]]> Deploying Wallpaper trough GPO AlLeX_ http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=31942&REPLY_ID=155249 Group Policies Thu, 13 Aug 2009 15:09:58 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=31942 Quote:
OK guys just for your knowledge I have revealed what was the issue finaly. I was doing the tests on test environment based on virtual machines and I used RDP to log on to these machines :). It seems RDP somehow hides the real desktop.
When I used Vmware console to log on the machines the wallpaper appears.

Good luck everyone seeking the answer to his/her IT problem!]]> GPO and Web Favorites dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=31944&REPLY_ID=155196 Group Policies Wed, 12 Aug 2009 23:38:26 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=31944 Quote:
My guess is that they would overwrite, but I haven't tested this specifically. I say overwrite because IE Maintenance Policy in general is not additive.

]]> Deploy same MSI GPO and SCCM Conflict? planzone http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=31877&REPLY_ID=155172 Group Policies Wed, 12 Aug 2009 14:16:11 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=31877 Quote:
Thank you kindly gentlemen for your replies]]> Locking Down Vista Wireless NMDANGE http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=31882&REPLY_ID=155066 Group Policies Tue, 11 Aug 2009 09:28:14 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=31882 Quote:
Most laptops have the ability to physically turn off the wireless receiver (usually through an Fn key). There's not much you can do when that happens...]]> GPO will not process userlogonscripts first time dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=31827&REPLY_ID=154649 Group Policies Wed, 05 Aug 2009 22:41:17 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=31827 Quote:
Another option is to force Scripts policy to process even over a slow link--Computer Config\Admin Templates\System\Group Policy\Scripts Policy Processing]]> Safe way to reset adm localization dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=31754&REPLY_ID=154482 Group Policies Mon, 03 Aug 2009 16:11:44 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=31754 Quote:
The other way to do this is, these ADMs automatically update when the date/timestamp of the files in your local c:\windows\inf folder on the machine where you edit a GPO are newer than what is up in SYSVOL. So you could "artificially" touch your local ADMs and that should push them up to the GPO. That's probably how you got the incorrect ones up there in the first place. Note that you can also disable this automatic updating process via policy (I think its under User Config\Admin Templates\System\Group Policy) for all your users.
]]> Implementing Password Complexity sbarrick http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=31787&REPLY_ID=154186 Group Policies Wed, 29 Jul 2009 10:58:58 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=31787 Quote:
Great. That's what I suspected, but I wanted to confirm before inciting the wrath of the users (who probably won't like the change to begin with). Thanks for the quick reply!]]> The following GPOs were not applied Mark Minasi http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=31786&REPLY_ID=154184 Group Policies Wed, 29 Jul 2009 10:56:22 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=31786 Quote:
The answer (assuming you're using XP or later) is to run a resultant set of policies analysis from Group Policy Management Console. It makes it all clear.]]> Client Side extension could not be removed dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=31638&REPLY_ID=153774 Group Policies Tue, 21 Jul 2009 19:37:50 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=31638 Quote:
no, if the GPO settings are gone, then you shouldn't be getting the errors. History wouldn't effect that. Not sure why you're still seeing them. Try running a GP Results report from GPMC and see if it lists the settings still.]]> GPO to Stop USB Modems dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=31685&REPLY_ID=153618 Group Policies Fri, 17 Jul 2009 14:06:16 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=31685 Quote:
THere are a couple of GP-based mechanisms for preventing users from installing or using removeable devices. The ADM mechanism is documented at MS' website and does work to prevent the drivers from being used. (there's also a mechanism for preventing devices from being installed in the first place by re-permissioning the underlying .inf files used to install the device. You can also use GP Preferences to prevent use of specific classes of devices, but Evgenij is correct that if your users are local administrators on their systems, then they will be able to ultimately circumvent these restrictions.]]> Search for GPO Settings - Keywords dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=31690&REPLY_ID=153617 Group Policies Fri, 17 Jul 2009 13:47:02 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=31690 Quote:
Also, the Technet blog article is correct that even in 2003 GPMC you can search at the domain level to see what GPOs implement a particular policy "area", but you cannot search for particular settings within each area, at the domain level. The exception to that is that I do show how in an article I wrote in the June issue of TechNet Magazine, how you can use Powershell and the GPMC APIs to search through settings within a GP settings report. Using that you could theoretically write a script that searches settings across multiple GPOs.
]]> Securing Local Admin group on every desktop shadowman http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=31618&REPLY_ID=153585 Group Policies Thu, 16 Jul 2009 18:14:36 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=31618 Quote:
quote:
Originally posted by shadowman

You can use a restricted groups policy to specify users who are allowed to be a member of the local admin group, other members than specified in this policy will be automatically removed when added to the local admin group.

An short howto:
To use restricted groups:

  • Open Active Directory Users and Computers.
    Browse to the OU that will contain the computer account objects

  • Open "Properties"

  • Select the Group Policy Tab

  • Create a new Group Policy Object

  • Edit the new object

  • In the Group Policy MMC, browse to:

  • * Computer Configuration/Windows Settings/Security Settings/Restricted Groups

  • Right-Click and choose "Add Group"

  • The group name you enter will be the group that is restricted (Administrators)

  • Select the group and choose the allowed members.




Or you can remove the permissions for users to add themselves to the local admin group, they should not have that permissions in any case.

The last one is to just disable the local administrator on every desktop, that can be scripted also.]]> 1202 x534 errors when using local accounts Xenophane http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=30363&REPLY_ID=153331 Group Policies Tue, 14 Jul 2009 03:20:44 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=30363 Quote:
I have run into the same problem here, there is a <server>\ASPNet account added to the default domain policy giving it permissions to "Act as part of the operating system". Which you can imagine gives quite a lot of errors in the event logs... 3.5 million of them to be exact in the last month.

Does anyone have an idea what could require this ?

I think I remember something about IIS 5 on Win2k that you had to give permissions to ASPNet, but I think that changed..

The local server account that is added in the default domain policy is running win2k though... (and since I am still here on my 3 months probation, I will not just remove it :)]]> Group Policy Filtering regnak http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=31603&REPLY_ID=153124 Group Policies Wed, 08 Jul 2009 15:15:14 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=31603 Quote:
Hi, no problem guys, really appreciate the swift responses!

I had a go in my home lab and found something that might help. I've removed authenticated users and added domain computers instead. Then I also add the Commercials group rights to apply the policy. When I log in as a commercial user it applies, when I log in as a user not in the commercial security group it doesn't. I did a gpresult straight away and found it is filtering the user portion of the policy even though the loopback settings are set! Sweet!

Thanks to all!! I just need a loan of a few more brain cells!

Mike
]]> Manage Windows Vista/7 GPO on a Windows 2000 domai dmarelia http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=31497&REPLY_ID=152984 Group Policies Sun, 05 Jul 2009 17:56:43 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=31497 Quote:
Its possible, but some functionality that relies on a newer AD schema version will not be available. Things that come to mind include Wired and Wireless policy, which rely on the Server 2008 AD schema to work. That being said, if you have a Vista or Win7 client in your Win2K domain that you use to manage policy, then most of the other policy areas will work just fine. Hope that helps.

]]> Setup Security.inf template reza http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=31515&REPLY_ID=152945 Group Policies Fri, 03 Jul 2009 13:20:26 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=31515 Quote:
Thanks]]> What does GPUPDATE do? TrainSignal http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=19540&REPLY_ID=152904 Group Policies Thu, 02 Jul 2009 15:09:09 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=19540 Quote:
You're welcome, and that's a great idea. We've started to have technical reviews on many of our newer courses and I'll make sure it becomes an more integral part of the process in the future.

I'd like to extend an offer to individuals in the forums: if anyone is interested in being a technical reviewer or beta tester for new Train Signal offering please contact me.]]> Outlook redirection runswithsizzors http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=30872&REPLY_ID=152753 Group Policies Tue, 30 Jun 2009 12:29:40 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=30872 Quote:
Sorry it has been a long time since I have been back to review this. What we ended up doing is keeping roaming profile and split up redirection of My Documents, Desktop and Application Data. That really helped with users logon times. Next year we are making policies to keep those profile size down, and we also limited the size a profile can be. That should make some end users angry. HA! They will get over it when the complaints of slow logon is less. Which will be great.

Thanks for all the information!]]> Iesacls.inf template reza http://web2.minasi.com/forum/topic.asp?TOPIC_ID=31514 Group Policies Fri, 26 Jun 2009 02:35:15 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=31514
Can anyone explain what the purpose of the Iesacls.inf template?

Thanks]]> group policy only updates with gpupdate /force jecker http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=30877&REPLY_ID=152518 Group Policies Wed, 24 Jun 2009 13:01:21 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=30877 Quote:
Sorry for the delay; I just had a chance to work on the troublesome computer. Changing the local policy to "always wait for network on startup" seemed to work. Thank you everyone for your help.]]> enforce gpo on all users only on some computers AdminGurl http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=13801&REPLY_ID=152261 Group Policies Sat, 20 Jun 2009 13:27:32 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=13801 Quote:
I have just been looking through old posts and found this one. I had the same problem and solved it using a third party product called Unlock Administrator http://www.e-motional.com/ULAdmin.htm This allows you to set up a GPO to lock the computer or logout on a per machine basis. It also allows you to set exactly who can unlock the machine so users don't wind up getting locked out of machines that are shared by many people.


quote:
Originally posted by jakeg

I'm stumped! I have a very simple 2k3 domain with a single server that handles everything for a handful (~20) XP Pro clients.

What I need to be able to do is enable a GPO for all users, but only on certain computers. I set up a GPO using settings in User Configuration -> Administrative Templates -> Control Panel / Display, so that the screen saver will kick (and lock the workstation) in after 15 minutes for all users on all computers on the domain, in order to combat the problem of users that forget to lock/logoff. Problem is, my boss doesn't like this for his computer, since access to his office is limited, and he is often away from the computer for 15+ minutes at a time, and felt like he was constantly having to unlock his computer.

So what I need to do is apply this GPO to meet the following requirements:

- any public computer gets locked after 15 minutes of inactivity regardless of who is logged in (including the boss)
- the boss' computer gets locked after 15 minutes of inactivity UNLESS the boss is logged into it. If the boss is logged into his own computer, the computer should lock after some longer period of inactivity.

Any tips on implementing this with GPOs? Applying a GPO to only particular users or groups of users seems easy, I'm just not sure about applying this type of GPO only to some or all users only on certain computers.

Hope that makes sense. Thanks in advance for any suggestions...

Jake G
]]> local logon script mm_0_mm http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=31373&REPLY_ID=152136 Group Policies Thu, 18 Jun 2009 08:59:08 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=31373 Quote:
is the subst'd drive missing from limited command propmt and elevated command prompt? also, I did see some references to the permissions getting changed from default on subst.exe?]]> Folder redirection cannot redirect application dat deepakbabbar http://web2.minasi.com/forum/topic.asp?TOPIC_ID=31403 Group Policies Wed, 17 Jun 2009 03:13:42 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=31403
Yes If I remove the policy then it works fine but if I apply the policy back then also everything works fine. Here is the sequence of steps:

Policy applied --> nothing works
Policy removed --> Works perfect.
Re-apply policy --> Everything keeps working.

So I don't think there is anything wrong in the policy application.

The office setup runs when the new user logs in for the first time. Like it is suppose to but after that the setup should not come up but it does.

The main issue I m facing is with the policy in place for application data the office setup runs everytime I try to run any of the office applications but if I remove the policy once and login everything works fine. After removing the policy and logging in if I re apply the policy then everything works fine.
Please suggest what should be done?

]]> Solving Event ID 1054 UserEnv mrichardh http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=26197&REPLY_ID=152068 Group Policies Tue, 16 Jun 2009 11:04:54 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=26197 Quote:
All, you should know that this event ID will persistently show up on Win2k3 and Win2k3R2 VMs (both 32bit and 64bit versions). All KB articles try and point you to a network adapter driver issue. This is not the case with a VM. The slow link detection IS the issue. While you wouldn't think the link is slow, it has to do with the way a VM 'sees' the CPU and how the host OS adjusts the CPU/clock on-the-fly (just like the AMD issue). We had a half-dozen Win2k3 VMs that were throwing this error constantly. Once we implemented the reg hacks, the error went way.

RayZ thanks for leading us in the right direction. Hope our additional information leaves everyone's hair in their head...where it belongs [:D]]]> marquee screensaver cj_berlin http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=31342&REPLY_ID=151690 Group Policies Wed, 10 Jun 2009 14:08:49 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=31342 Quote:
Russ,

please do not cross-post.

Have you seen this: http://www.petri.co.il/forums/showthread.php?t=29182 ?

'very quickly', however, calls for something like REG ADD "\\%COMPUTERNAMEFROMALOOP%\HKCU\Control Panel\Screen Saver.Marquee" /v Text /d "New motto here" run against a list of machines

EDIT: It is clear, though, that you can't change the motto on a screensaver already running. [:)]

Make sense?
]]> remove gpsi from share that does not exist jwilsonw http://web2.minasi.com/forum/topic.asp?TOPIC_ID=31233 Group Policies Mon, 01 Jun 2009 10:34:06 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=31233
I have put up a new computer with new shares, but it is failing on the removal of the group policy from the old computer share. I had to make the computer names different.

Thanks]]> No package... Error message on 2008 server novad http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=29310&REPLY_ID=150929 Group Policies Fri, 29 May 2009 18:07:10 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=29310 Quote:
Hi... For those who could be interested... I found an answer and hated it...

It was submitted by jwinder on http://www.questconsultantsllc.com/blog/gpo-software-distribution

The interesting part is the sidenote at the end (About a corrupt GPO). It can come from an aborted copy of an existing GPO or something like this. Here is a copy from what he said:

+---------------------------+

So the process of deploying software (MSI packages) to domain member machines is well documented, and won't be repeated here. What's not so well documented is what happens when you try to deploy software to domain controllers. If the installation binaries are stored on a plain vanilla fileshare, no problem. However if the binaries are stored on a DFS share (for example, the SYSVOL share...), there is an important rule to follow: make sure that the binaries are stored under the built-in "scripts" folder, and not under a folder directly under SYSVOL -- i.e., don't modify the default SYSVOL folder structure.

The scripts folder is a holdover from NT4 days -- it's the NETLOGON share, where logon scripts were stored, once upon a time. In Active Directory, this folder can be found at \\{domain}\sysvol\{domain}\scripts), or \\{domain}\scripts.

The issue is that DFS (and therefore the SYSVOL share, which is just a glorified DFS share) doesn't come online until AFTER the software installation (and startup script) portion of the GPO executes. And since DCs always point locally for SYSVOL data, if you try to be clever & create a top-level folder for software binaries directly under SYSVOL, the software installation will fail with a Software Installation error 103 (in the Application log) "No package in the software installation data in the Active Directory meets this criteria."

Because the scripts folder is available prior to DFS and SYSVOL, both startup scripts and software pushed from this location via GPO will install correctly.

As a sidebar note, it also turns out that the same error message ("No package in the software installation data in the Active Directory meets this criteria") also shows up if you try to add a software package to a corrupt GPO. The added package initially does not appear, but will eventually show up after an F5 refresh or after exiting/re-editing the GPO -- however the package will never install on client machines. The only cure here that I found is to recreate the GPO from scratch; even exporting and importing settings into a new GPO does not work. Continued kudos for Microsoft's informative and useful error messages!

+---------------------------+]]> Group Policies Backup and Restore wkasdo http://web2.minasi.com/forum/topic.asp?whichpage=-1&TOPIC_ID=31174&REPLY_ID=150923 Group Policies Fri, 29 May 2009 15:53:14 -0500 http://web2.minasi.com/forum/topic.asp?TOPIC_ID=31174 Quote:
Interesting. What was that corruption exactly?]]>