Questions tagged [group-policy]
Group Policy is a built-in feature of the Microsoft Windows operating systems. Group Policy allows administrators to automatically configure myriad options within the OS. These policies can be configured, and applied, either locally to the computer via Local Group Policy or remotely within an Active Directory environment.
3,226
questions
-2
votes
1
answer
23
views
Deploy Termius software with Active Directory Group Policy, which includes pre-login settings using a shared account
I want to deploy Termius software with Active Directory's Group Policy.
The software requires pre-login settings using a shared account.
How can we do that?
-1
votes
0
answers
34
views
Same GPOs inside OU
I have two GPO inside the same OU that are target of two different groups (auth users and another group of my choice). The issue is that they do the opposite:
One GPO is set to enabled while the other ...
0
votes
2
answers
75
views
Do Windows domain builtin groups grant the same permissions as the equivalent machine builtin groups? (eg, Performance Monitor Users)
I am developing a Windows service that uses PDH to query some performance counter data.
It is necessary for the service to by run by another user (ie, not the all-powerful SYSTEM).
I am aware that the ...
0
votes
0
answers
40
views
Windows failed to apply the Deployed Printer Connections settings
I have created a new policy in my domain using Group Policy Management. I have successfully deployed it from Print Server Management. However, when I run the command "gpupdate /force" on my ...
0
votes
0
answers
29
views
How to enable service installation event (event id 4697) in windows 7?
In windows 10, after I use the following command to enable Security System Extension:
auditpol /set /subcategory:"Security System Extension" /success:enable /failure:disable
Whenever a new ...
0
votes
0
answers
10
views
Windows workstation unable to change password change for other accounts
When I do a CTRL-ALT-DEL, then change password, on a workstation in one of my domains, it gives me the option to put in a username.
For another domain that I manage, it does not.
I assume this is a ...
-2
votes
1
answer
54
views
Group policy works on Server not on Workstations
I have a Windows Server running Server2022. I created a group policy to copy a file to the user's C: drive on login.
When I log on to the server this works like a charm, but it doesn't work when I ...
0
votes
0
answers
30
views
How to prevent ADMX template Group Policy from removing registry values when policy is removed or disabled?
I am using an ADMX Template to set a registry values. The key for the values already exists on the machines, and it may be changed but not removed or it will impact the service which depends on it.
...
0
votes
0
answers
50
views
NRPT via GPO while using Always On VPN NRPT
I have a working Always On VPN Profile deployed using the ProfileXML implementation of automatic NRPT to the local device configuration:
<DomainNameInformation>
<DomainName>.example....
0
votes
1
answer
24
views
GPO install application and then service pack
scenario:
I have a GPO for deploying SoftwareABC.msi and every computer that fits GPO will have SoftwareABC installed.
Now I have a Service Pack SoftwareABC_SP1.msi, deployed new GPO and it deployed ...
0
votes
0
answers
27
views
How to Reduce Delay in Displaying Incorrect Password message on Domain PC
I've been encountering an issue with domain PCs where it takes a longer time to notify entering of incorrect password. After conducting some research, we identified that the delay is caused due to ...
0
votes
0
answers
49
views
BitLocker Full Disk Encryption - WIN
I am encountering a recurring issue with BitLocker Full Disc Encryption (WIN) via Policy Management on Windows devices. The issue manifests as a failed encryption attempt due to the presence of ...
0
votes
0
answers
32
views
Issues with "Site to Zone Assignment List" working and then not working
I'm not a domain expert so I apologize if some of my lingo is off.
I'm trying to make it so that users on my domain don't need to enter a username/password when accessing a specific website. I've ...
-1
votes
1
answer
69
views
December Windows Update disable use of registry keys to set lockscreen image for Windows 11 Professional?
As the title says, to clarify, you can't normally set lockscreen image with GPO for Windows 11 Pro computers, as it only works for Enterprise and Education. However you could set three ...
0
votes
1
answer
122
views
SQL Server installation failing due to Software Restriction Policy - but no policy exists on server?
I am attempting to install SQL Server Express 2022 on Windows Server 2022.
When I setup the Windows server, I added a Software Restriction Policy for preventing the installation of executables and msi ...
0
votes
1
answer
149
views
Why would IT lock down SeIncreaseWorkingSetPrivilege?
Question:
Why would anyone lock down the SeIncreaseWorkingSetPrivilege == Increase a process working set == https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-...
0
votes
2
answers
146
views
Group Policy, applocker, Application Control Policies
Error Screenshot
As an admin how can I prevent .exe generated specifically from ASP.NET web applications from getting blocked by AppLocker.
Context:
We are currently utilizing the local Active ...
0
votes
0
answers
131
views
Running diskpart from system in windows sever 2022 - shows no disks
I've inherited a system of VMs (AWS ec2) running on an older version of windows server. Due to software upgrades we need to also upgrade to windows server 2022.
One hang up I have is that the existing ...
0
votes
1
answer
205
views
What does Windows use to determine how old a profile is when implementing the CleanupProfiles registry setting?
How does the Windows registry setting HKLM\Software\Policies\Microsoft\Windows\System!CleanupProfiles determine the age of a profile on Windows 10?
I have tried to understand the setting, which is ...
0
votes
0
answers
113
views
Printers deployed through GPO disappear on terminal server
Windows Server 2012 Print Server and Domain Controller.
Printers deployed with GPO, per user and per machine, to Windows Server 2019 Terminal Server.
Main issue:
Every time I logon to Terminal All/...
0
votes
1
answer
304
views
GPO Application Error - Cannot Access GptTmpl.inf
In my organization's Windows AD environment, I cam across an error on several machines:
"Security policy cannot be propagated. Cannot access the template. Error code = -536870656.
\.net\sysvol<...
0
votes
1
answer
495
views
GPO - Missing "Manage updates offered from Windows Server Update Service"
in our Windows Server 2019 DC we are missing the following Administrative Template:
Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Update > ...
0
votes
1
answer
1k
views
Windows group policy settings are not replicating to other DC (windows 2019)
I have a scenario where group policy settings are not replicating from primary DC01 to backup DC02.
Please see in the picture attached below showing the same exact GPO policy being viewed from both ...
1
vote
1
answer
187
views
Change of the keyboard language and operating system language on users' computers using GPO (Windows Server)
I am responsible for managing a fleet of computers in my organization, and I would like to know how to configure the change of keyboard language and operating system language on users' computers using ...
2
votes
1
answer
361
views
How can I add a Capability SID to GPO Registry permissions?
We attempted to configure the permissions of a Registry key (HKLM\Software) via GPO. (https://www.stigviewer.com/stig/windows_server_2019/2019-12-12/finding/V-93025)
However this resulted in a ...
0
votes
0
answers
284
views
1 Domain Controller(s) with replication in progress
I have 3 DCs (DC01, DC02 and DC03).
If I create a group policy on any DC I find it replicated to the others.
But I see an error in Group policy management, in domain status if I click “Detect Now” it ...
2
votes
1
answer
196
views
Windows Group Policy Management - Session host limit group policy doesn't work as expected
I have created a group policy to end the sessions which are disconnected automatically & the settings of RDP session timeouts are located in the following GPO section Computer Configuration -> ...
0
votes
2
answers
2k
views
Change primary and secondary DNS on domain servers using GPO
Windows Server 2016.
All Servers in domain obtain IP address automatically and DNS addresses are set manually:
Primary DNS 172.16.0.1
Secondary DNS 172.16.0.2
I created a 3rd DC (172.16.0.3), and ...
0
votes
0
answers
305
views
Cannot access network resources after connecting to Always On VPN
Background: recently moved offices to a new network that did not have any domain controllers. The network here has a basic WiFi router that has both DNS and DHCP. We moved our DC here that has our ...
0
votes
0
answers
72
views
Configuring Windows Workstations to use their TPM in Bit Locker for all drives?
I have a bunch of AD-integrated workstations that will need to use BitLocker. They all have TPM 2.0 installed, and my overall goal is to get BitLocker set up and using the TPM for both the OS drive ...
0
votes
0
answers
253
views
Prevent Users from installing Windows Updates on Terminal Server
I'm trying to manage a RDS environment running Windows Server 2016. It's been noticed that Users logged into the terminal server receive prompts for and are able to install Windows Updates. The ...
0
votes
0
answers
82
views
How to update an application deployed with gpo
I deployed VLC 3.0.18 using the software installation GPO, later i updated the package to 3.0.19 over the existing one without issues.
I now have to deploy 3.0.20, what's the correct procedure?
gpo ...
7
votes
2
answers
1k
views
How does group policy know when the network subsystem is ready?
I'm trying to troubleshoot some group policy startup processing issues on domain joined, remote computers that establish a Zscaler/VPN connection at startup and before logon. This causes a short delay ...
0
votes
0
answers
38
views
Windows 10 symbolic links: Finer grained than developer mode?
We have a number of external developers who are not administrators on their Windows 10 machines. In a new project, we have a git repository with lots of symbolic links which we would like to actually ...
1
vote
0
answers
70
views
AGPM and Production Delegation
Advanced Group Policy Management (AGPM) and Production Delegation. The Production Delegation should set the delegation permissions on a GPO, i.e. Read, Edit, or Edit, Delete and Modify Security. In ...
0
votes
1
answer
262
views
How to create a GPO to audit start/stop of a service not running on the DC?
I'm trying to enable auditing of service start/stop events for a few specific services on a group of domain computers, and to make this change using Group Policy.
I've seen this answer, however when I ...
1
vote
0
answers
34
views
Domain administrator unable to connect via remote desktop after group policy deployment
The network I administer has two virtualized Windows Server DC and a handful of Windows clients. I wanted to enable remote desktop on all computers (some had it, some hadn't) via group policy and so I ...
1
vote
2
answers
52
views
Stuck with a GPO, no class or attribute on AD Object?
I may have blundered a GPO towards the end of my shift.
A fairly important (at least to me and future weeks) had its links go red and unreachable after I altered Delegation settings on a specific ...
0
votes
1
answer
316
views
Logon Message Powershell Script Runs But Does Not Launch Prompt
I'm trying to setup a login prompt according to https://aws.amazon.com/blogs/desktop-and-application-streaming/generate-logon-messages-for-security-and-compliance-in-amazon-windows-workspaces/ because ...
1
vote
0
answers
340
views
PowerShell - Failure to load built-in modules due to software restrictions
Yesterday, I was working with PowerShellEditorServices to develop a tool. Internally, it uses named pipes to communicate between the client and server. They are both running locally.
At some point, ...
0
votes
1
answer
474
views
Group Policy Management Access Denied on Delegation Tab
I'm running a Windows Active Directory Domain using two 2016 DCs. Everything about the domain and my GPO policies are functioning correctly. However, when I open up Group Policy Management and then ...
0
votes
1
answer
127
views
How to create and manage a new DCOM object via batch or powershell
Win+R. dcomcnfg > I need to register a new dll using this tool as a COM. I can do this manually. But I have a lot of WS.
regsvr32 is not enough. The COM App need to exist in dcomcnfg
So, can it be ...
0
votes
0
answers
37
views
Why Windows Default Domain Policy overrides custom group policy? [duplicate]
I did notice that there's similar answer about this situation, such as this one.
But I'm still confused so need some opinions.
I'm currently creating some custom group policies in a windows server ...
0
votes
1
answer
594
views
Why isn't the GPO showing up in gpresult?
I have a GPO made for a specific OU that I have a test device in. Other test GPOs work fine and show up on the device in gpresult. The GPO I'm having issues with is set to run a PowerShell script on ...
2
votes
2
answers
2k
views
How To Ask Remote Desktop Password After Connection
I would like in a windows server 2022 to edit the login behaviour of remote desktop.
I've been told that it is possible to ask for password AFTER the connection has been established.
In order to ...
0
votes
0
answers
58
views
After setting the windows 10 gpo "DenyUnspecified" and "DenyRemovableDevice", and configure AllowDeviceIDs device is visible but cannot be removed
I need to allow only specific usb media on my windows 10 Host (21h1).
The gpo configuration:
GPO_LocalMachineRegistryKeySet "Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions&...
1
vote
0
answers
158
views
Find Group Policy object to allow ms-appinstaller protocol
We're running a proof of concept of an application, the preferred deployment method is web install:
The user goes to the locally hosted app server
If the user is in the AD Group for the application a ...
0
votes
0
answers
105
views
dcgpofix "Could not open the Active Directory Object"
I am trying to run dcgpofix because my AD environment is a disaster. This organization had only one person in IT and he hired me to help, and shortly thereafter left. He left behind a corrupted domain ...
0
votes
0
answers
172
views
Turn off Focus assist via GPO not working as expected
Is there a standardized way to turn off focus assist centrally since i am trying to display balloon tips and toast notifications for applications and windows updates being deployed from sccm software ...
0
votes
0
answers
169
views
GPO "Administratively assigned offline files" is applied but files are not available offline
I've configured a GPO that uses the "Administratively assigned offline files" to make a path \\server\share\%username% available offline. It works perfectly fine on my old Windows XP laptop, ...