0
votes
0answers
9 views

Error on RSOP for Audit policy on DC

Domain Controller - Windows Server 2008 R2 Standard Please see the print-screen, I am unable to understood why such error is showing on my Domain Controller. I have also checked on Winlogon.log, ...
1
vote
1answer
70 views

Backup Active Directory users' files, deploy via GPO? [on hold]

Am looking for a solution which can be configured to be deployed via group policies. I've looked into Windows Backup, but it doesn't fulfill our requirements. We need something like this: Runs ...
1
vote
0answers
14 views

Group Policy Mapping Printer

There seems to be lots of different ways to map printers, all appear not to work (for me). Im running a Windows 2008 Environment with windows 7 clients, simple, hey? No.. I have a printer connected ...
1
vote
1answer
42 views

Group Policy “Maximum password age” fails to apply

In my Windows network with all AD servers (still) running Windows 2003, I encounter the following problem: The "Maximum password age" policy apparently does not apply. Even though some of the users ...
3
votes
1answer
50 views

How to do exceptions in Group Policy?

We're implementing Group Policy for the first time at our organization and have some questions about best practices and capabilities. We've already done some work and want to see if there is a better ...
-1
votes
1answer
24 views

GPO installed network printers wont show up under user account but only admin login

I use GPO to push out a network printer per machine from server 2008. but it only shows up under admin account. I restarted the PC , login logoff , gpupdate /force.... then it still only shows up on ...
0
votes
2answers
26 views

Deny AD-User Group to login on a certain AD-Computer Group

I have (simplified) two AD Groups for Users: bgs.ac.at\Students bgs.ac.at\Teachers I have (simplified) two AD Groups for Computers (like in two rooms) bgs.ac.at\Room1 bgs.ac.at\Room2 I want ...
1
vote
1answer
70 views

Fake Recycle Bin via Group Policy

Is it possible to create a fake recycle bin where the files aren't actually deleted using MS AD/ Group Policy? The goal is to be able to recover 'deleted' files after, let's say, a dirty resignation. ...
1
vote
1answer
55 views

Querying GPO Details

I need some help on querying GPO. I want to know how many total GPOs applied for each OU. GPO with out no parameters and no link GPO's With less than 2 parameters and less than 2 links Can any ...
0
votes
1answer
26 views

Group Policy: How to comment on each setting?

I am looking for a way to comment on each and every setting that can be made within a GPO. Unfortunately things like user logon scripts and security settings and some more can not be commented. Is ...
-2
votes
1answer
26 views

Remove delete permission for active directory group in Microsoft 2008 Server R2

I've created a group in Active Directory and I would like to prevent all users in this group from being able to delete any files on the server. How would I go about doing this?
0
votes
1answer
30 views

Group policy access with active directory

Under Active Directory (Win2008-R2), I want all "authenticated users" be able to access the "Add/Remove windows components" menu But where do I have to go in group policy to set this grant ? In ...
1
vote
1answer
56 views

Complex Group Policy Inheritance

I'm currently trying to design the OU and Group design for a new AD deployment. Firstly, taxonomy is hard. As a first guess attempt, we're trying to keep all User objects together in OU=Users, and ...
0
votes
3answers
58 views

GPO - Software restriction policy

I was trying to set up GPO - Software restriction policy, so i created the object on our Domain Controller. Fast forward the next day, everybody who turned off their systems at night could not login ...
10
votes
3answers
240 views

Deploying Printers via GPO/GPP - is there a programmatic option?

For reasons beyond my control, I've been tasked with setting up GPO/GPPs to deploy our 100+ printers to our 1000+ clients. The good news is that we have over a dozen sites, and for the most part, I'm ...
2
votes
0answers
31 views

Is it possible to add computers in a particular IP range to a particular Active Directory group?

I'm using AWS and have a VPC which is connected to the local network via a VPN. I can launch EC2 instances, put them in various subnets in various AZ's and connect to them via internal IP. I can also ...
3
votes
1answer
38 views

“Deny Logon Locally” effects

I'm planning to harden my AD-based infrastructure. One privilege that I'm planning to limit is the "local logon" privilege. Now, if I push "Deny Logon Locally" through GPO, besides preventing ...
0
votes
1answer
29 views

Set Country / Region field Access via Active Directory Delegation

After creating a security group for special permissions (edit User Objects fields like Street, ZIP etc.) I have a problem of not being able to delegate permission for the field "Country/Region" on a ...
0
votes
0answers
75 views

SBS 2011 Group policy won't update/apply properly

i'm running SBS 2011 on a dell poweredge t110 II, and recently i've found that i am unable to apply/update group policies. I get the following error: The processing of Group Policy failed. Windows ...
0
votes
1answer
30 views

Windows Startup and Logon scripts proper permissions

I'd like to know what the appropriate permissions should be for Startup and Logon scripts that run for everyone. Should Startup scripts have System read and execute permissions and Logon scripts read ...
5
votes
2answers
134 views

Will GPO Software Installation re-install already installed applications from a different policy?

I'm looking to install our latest AV suite through a GPO Software Installation policy. (As in the below screenclip.) Unfortunately my request to use DFS has been denied and I'll need to create a ...
0
votes
0answers
229 views

Why gpupdate fails?

So I have a Windows Active Directory Domain with two domain controllers, DC1 and DC2, both running Windows Server 2008 R2. DC1 is the primary DC holding all FSMO roles. It was functioning all right as ...
1
vote
1answer
45 views

Blocking USB through GPO in 2008 R2 & excluding certain users

I am looking for blocking USB devices in our Win 2008R2 SP1 server. I am already aware about GPO policy "\User Configuration\Policies\Administrative Templates\System\Removable Storage Access" & ...
1
vote
3answers
101 views

GPO Replication SysVol Inaccessible on Windows Server 2003

In our current AD setup, we have the following Domain Controllers: DC1: Server 2012 R2, Operations Master (All roles) DC2: Server 2012 R2 Mailserver1: Server 2003, Also hosts Exchange 2007 The ...
2
votes
2answers
150 views

Minimum Number of Port need to Open between Windows Client & Domain Controller Only

I just want to know, which port need to be open if i place firewall between Windows Client ( XP or 7 ) and Domain Controller ( Window Server 2008 R2 ) Please note it is between Client and DC and not ...
0
votes
2answers
410 views

Domain User Account Locks: Correct password used

I have a domain (DC is running Windows Server 2008 R2) and have the Account Lockout Policy enabled. When a user attempts to log into their PC (with the correct password) they receive the following ...
0
votes
0answers
54 views

GPO to have Chrome profile follow user on AD network, includes laptops

I'm currently working on a Windows network with domain, about 50 +/- workstations. I'm going to be doing a new PC roll out within the next few months and I'd like to have Chrome, or Firefox for that ...
1
vote
0answers
46 views

How to prevent Domain Users group from being added to local Users group

I do not want the Domain Users group to be automatically added to the local "Users" group when a computer joins the domain, but am struggling with finding how to prevent this. In the default domain ...
1
vote
0answers
84 views

Group Policy error 1006 with and error code 52

I have a hyper-v cluster operating on win2k8 R2 in a 2003 forest. These servers are at our NOC with a DC that connects to our PDC at HQ via a persistent VPN. The cluster boxes are reporting a error ...
0
votes
3answers
99 views

Bizarre - Domain Admin has no rights to modify domain scripts directory

Here is a quickie that has had me scratching my head. Not a showstopper, so an answer isn’t urgent, but still. I am trying to modify the logon scripts directory to include a login script. I have gone ...
0
votes
1answer
50 views

Should I run rsop as administrator or as domain user?

I have to diagnostic some AD policy on a windows7 client. So I want run rsop but I dont know if I have to run it as administrator (local) or as domain limited user.
2
votes
0answers
26 views

Need SSO, RMM w/ Mac client GP management (printers etc) from one web portal [closed]

I have a client that is looking for an all-in-one solution to manage users and computers. Preferable in the cloud or SaaS. They would like to be able to create/delete users from AD, integrate SSO ...
0
votes
0answers
29 views

IIS / MSSQL / Mysql server issues, after joining them to active directory

I have three different server. IIS server hosting .net solutions MSSQL server 2012, Db for server nr.1 MySql server, db for some of our php applications. All the servers above is using local ...
3
votes
2answers
97 views

Active Directory - How to find what machine applied a GPO

I've got a GPO that is configured to change the local builtin Administrator's password on certain machines. I need to find what machines have applied this GPO to themselves. I've written a script that ...
0
votes
1answer
31 views

Access Control questions

I have a couple of questions on access control and Group Policy We use a term server for employee's to get certain documents, access databases, etc. I'm trying to build a new access control plan ...
0
votes
0answers
97 views

AD: GPO mapped drive and/or setting home in user profile

I discovered something interesting today that I have no idea the consequences of. Having inherited a large, complex and patchwork system with very little design, I discovered what I would consider an ...
0
votes
0answers
22 views

Remove specific site/application/domain from IE cache

Apparently one of our web applications changed a path when we went to a new version. Now we're faced with many users who have the application in their IE cache getting errors because the browser has ...
0
votes
3answers
191 views

Certificate address mismatch warning GPO cannot be Disabled

I found the "Turn on certificate address mismatch warning" and I need to set it to Disabled. Seems like the Console is not accepting that option (I Can set it to enabled and it will work) and I'd like ...
1
vote
2answers
61 views

Windows GPO Restricted groups append

I need to add an user to local administrators of all machines in domain. I read about Restricted Groups, however I don't want to replace all members, but just append a new one. Is it possibile?
3
votes
1answer
178 views

Windows 7 starts a classic desktop theme unless admin logs in first

I'm running a bunch of computers which are pretty locked down with Group Policy (users can do virtually nothing other than browse the net and use Office), and local profiles are deleted from machines ...
-2
votes
1answer
69 views

How Unattended Install is different from GPO Install? [closed]

I want to deploy Microsoft Office, Adobe Reader and FileZilla on the workstations but there are two way doing this, install via GPO or Unattended Install (deployment server). How Unattended Install ...
0
votes
0answers
103 views

Windows Server 2008 Standard R2 GroupPolicy error

Windows Server 2008 Standard R2 GroupPolicy error I am receiving an error in System log Event ID with the description "Windows failed to apply the Group Policy Local Users and Groups settings. Group ...
1
vote
2answers
133 views

WinXP GPO folder direction update ignored? Errors re: old path

I have a W2K3 server that's an AD DC. It has a GPO in place that directs users' Desktop and My Documents folders to \\oldserver\Users$\<username>. I wanted to migrate their folders to another ...
0
votes
0answers
40 views

Access to network share folder works in VDI, but not on desktops

I have two separate environments running in our lab computing spaces. We are phasing over to VDI. There are some weird differences going on in each environment, and I believe that the problem is ...
-4
votes
1answer
58 views

Configuring the GPO: Computer and User Configuration [closed]

What is the difference between the two configuration? When to use or configure these configuration in a AD Domain? Does the individual affect each other? What is the best practice when configuring ...
7
votes
2answers
885 views

Is there a performance impact of direct AD universal groups assignment?

I'm implementing a tool which secures certain shared resources within AD forest (mostly file shares). By some criteria a list of users from different domains is generated, those users are added to a ...
4
votes
2answers
424 views

How do I disable SID security check for folder redirection with Group Policy?

How do I disable the SID security check for folder redirections with Group Policy? This isn't about weakening security, but rather about having Active Directory and Samba play nicely together. I have ...
1
vote
1answer
138 views

Pass unlock credentials to powershell script

I have a powershell script that is run as a scheduled task and is triggered to run "On workstation unlock". The script is programmed to reconnect an SSTP VPN connection if the connection becomes ...
0
votes
1answer
43 views

allowing only access to TFS to external

Recently I've found the need for allowing access to external people to my TFS server, but I have to be sure that they can't access others servers. This is what I've tried so far: Created a security ...
1
vote
2answers
206 views

Can I move these items around in active directory

I am just reorganising my companies active directory structure, as it hasn't kept up with changes in the company structure. There are a few items I am not sure if I can move or not. Can anyone tell ...