1
vote
1answer
72 views

When is a user considered “Everyone” in the “Access this computer from the network” policy

I am a bit puzzled by the existance of the "Everyone" group in this policy. Per http://technet.microsoft.com/en-us/magazine/dd637754.aspx: The Everyone identity All interactive, network, dial-up, ...
0
votes
0answers
18 views

Setting permissions for RDP security settings via Group Policy

Is there any way to set settings from the Security tab for a connection in Remote Desktop Session Host Configuration via group policy? I have discovered how to do it via the WMI class ...
1
vote
0answers
286 views

Windows GPO Software Restrictions Policy not working with %TEMP% variable

I'm trying to put in some meagre additional malware prevention measures, by restricting the execution of *.exe in a handful of locations -- in particular, the temporary folders that various ...
1
vote
0answers
131 views

How can I run a scheduled task on a Windows 2008 R2 Domain Controller as a non-admin user?

I'm trying to run an exe as a scheduled task on a Windows 2008 R2 Domain Controller. The exe runs fine when I try and run it manually using an account which is a Domain Administrator, but I don't ...
0
votes
1answer
43 views

allowing only access to TFS to external

Recently I've found the need for allowing access to external people to my TFS server, but I have to be sure that they can't access others servers. This is what I've tried so far: Created a security ...
0
votes
1answer
19 views

Security Policy Logs On Windows 7 - Determine Why A Certain Software Function Fails

Is there a log file or administrator screen (like Event Viewer) where one can see specific rules that are being enforced? You know how you can use Process Monitor to monitor a task and see registry ...
1
vote
1answer
134 views

Windows 7: Allow installation of software by non-admins?

I'm running a public library with PCs available for people to use. I'm setting up the next upgrade for the PCs, which will be running Windows 7. We use Deepfreeze to maintain the PC's state (a brief ...
1
vote
1answer
135 views

Windows 7: Update a file in the system32 folder via GPO

I'd need to update a Windows file in the system32-folder I've made a script to do this task. When I run it locally on a system (from a prompt with elevated privileges) it works fine. I've created a ...
4
votes
1answer
82 views

Microsoft Security Compliance Manager terms

Recently i have installed Microsoft Security Compliance Manager. But i am confused with some terms. As per the print-screen ( which is mark in Red-Colour Round ) 1st - the 'Default' here means the ...
3
votes
1answer
96 views

Create a Lockout policy for RDP

In my city there was a recent incident that some hackers login to a server by using brute force attack on RDP. I have got a server and I want to enable some security policy to lockout the account if ...
-1
votes
1answer
205 views

I need a script to lockdown the system time to users via gpedit.msc [closed]

I need to lockdown the system time on a number of PCs via gpedit.msc and then removing administrators from the group and then adding 'administrator' and 'polling'. Can I do this via a script? ...
0
votes
1answer
151 views

Applocker custom extension (Java, CPL, MSC etc.)

We have a Terminal server and want to prevent users from running inappropriate software. Previously we used Software Restriction Policies for this purpose. Now, Microsoft seems to recommend Applocker ...
3
votes
2answers
558 views

Applocker vs Software restriction policy

The goal is to prevent users from running unwanted programs on a terminal server. I have read many articles from Microsoft and others saying that the new Applocker feature is 100% better than the ...
3
votes
1answer
324 views

SIDs in Active Directory GPO

I am looking into some weird issues with active directory and group policy. This domain has been upgraded from windows NT and has had a few different administrators over the years. I am looking ...
2
votes
3answers
577 views

Local account lockout via Group Policy

Is it possible to set an Account Lockout Threshold via Group Policy but have it only apply to local accounts on member workstations and not to domain logins?
0
votes
2answers
86 views

Disable Server Login upon Updates Reboot

I have a co-located Dedicated Server running Windows 2008 R2. It is a Live server running my sites (wordpress, joomla, etc) I administer it via Remote Desktop. Everytime I do the Microsoft OS ...
1
vote
1answer
611 views

Cannot Apply Screensaver GPO to Windows 7 clients through a Security Group

Our environment consists of a 2003 Active Directory with about 50% split regarding XP and Windows 7 clients. Our security policy states that by default everyone's desktop should lock at 2 hours for ...
2
votes
2answers
244 views

Accurately assessing security policy on a system

I know there are several built-in tools (or tools available for download from Microsoft) that you can use to assess and modify the security policy applied to a system. A few I'm familiar with, to one ...
9
votes
1answer
12k views

How can I restrict the java plugin to run only on certain sites in Internet Explorer?

I want to secure our centrally managed computers better and it is very difficult to automatically deploy the java runtime, but how to do that is another question. I find the security of Java ...
1
vote
0answers
461 views

Why is my access being denied when I am an adminstrator on my Windows Server 2003 Installation?

I have recently been made an Administrator on our server (running Win Server 2003) and have been given all the same permissions and made part of the same groups as our other admin but when I try to ...
1
vote
1answer
255 views

Restrict access to All Users folder on XP and 7 via GP

I am attempting to restrict access to the All Users folder via GP. Currently I have the setting under: Computer/Policies/Windows Settings/Security Settings/File System configured for the ...
0
votes
1answer
587 views

Allow Non-issued Security Certificate for Localhost Via Group Policy

I have an application at https://localhost:4321 When using Internet Explorer 8 I'm greated with a "There is a problem with this website's security certificate" message with the big red X etc... Two ...
1
vote
1answer
579 views

Getting Windows 7 to run Scripts from Other Shares then NETLOGON

I have several Windows Server 2003 Environments I administer. These are separate disparate domains with their own structures and policies. I generalize as much as possible when I administer these ...
1
vote
1answer
2k views

Disable prompt “allow script/activex control to run”

We have a policy of disallowing scripts and ActiveX controls to run on in IE our network (instead opting to use Firefox) thereby skirting a number of security issues dating back to IE 6, but we ...
1
vote
0answers
30 views

Supress 'server properties' options in printers dialog

is there a way to supress the 'server properties' options (and the other one's) via GPO on Windows Server 2008? I don't want the user to see the print server settings etc. Niklas
1
vote
2answers
669 views

Users cannot delete Public icons

We are rolling out new laptops to my company and we are no longer setting the user as a Local Admin. Instead, the user will be a part of the "Users" group. While I am not a part of the team that ...
2
votes
1answer
9k views

Group Policy Internet Explorer default security settings?

Since re-installing our Domain Controller (Windows Server 2008R2) and re-creating all of our group policies I have stumbled across an strange issue. When a user logs in and goes no the internet, ...
0
votes
1answer
680 views

Remove local accounts but leave domain accounts in local administrators?

I'm trying to rename the local administrator account on all the PCs in a 2003 domain. The GP I have that uses GPP to rename the local administrator seems to work. However the problem I'm having is ...
4
votes
1answer
2k views

How can I remove my users from local admin rights with a GPO?

I have active directory 2003 and windows xp running on clients so I don't want any of my users to have any admin rights on their PCs and I have already gave them local admin rights So Without to go to ...
2
votes
1answer
1k views

Active Directory how to make Group Policy to allow users to change their network settings

I have Active Directory 2003 and my users are on Windows XP. How can I set a policy to active network configuration for the users? In other words some users are traveling a lot so I want to give them ...
0
votes
4answers
243 views

Why user logons to Windows always look like the first logon

I have Windows Server 2003 and all the users have windows XP with administrative privileges in local group setting, so I want to reduce them to normal users. i.e. Currently normal user in active ...
1
vote
2answers
16k views

How to set group policy in windows server 2008 domain?

I need to apply group policy to several computers in a Windows Server 2008 domain. After running gpmc.msc, we can see Default Domain Policy and Default Domain Controller Policy Can you tell me their ...
0
votes
1answer
38 views

Unable to make registry or security policy changes (that “stick”) in an offline Windows Server 2003 environment

I've inherited a network, in my new position, that I'm in the process of getting accredited and then online. For now it's completely offline and all my updates are done locally at the machine(s). ...
0
votes
2answers
298 views

Change local time on XP box - local admin but group policy restricts time change

I am a developer in need of doing some temporal unit testing on my local XP box. I am local admin but there is a group policy enforced centrally that prohibits changing local time (a severe case of ...
0
votes
2answers
5k views

Default Domain Policy Overriding Custom GPO even though Custom GPO is Enforced

I'm trying to apply a custom GPO to an OU with a specific account in it. Even though I enforce the GPO, the default domain policy is still overriding my custom GPO and settings are not being applied ...
0
votes
2answers
1k views

Unable to access NAS device

I have a 3 site network A, B, and C. Each site has its own DC, that replicates to the others. Each site also has a local NAS (Thecus) device. The NAS devices should be accessible from every other ...
0
votes
1answer
368 views

Is there a tool to check GPOs like MBSA?

I'd like to provide some background before I pose my question so please, bear with me. I have come across Microsoft's Security Compliance Manager. It's rather new to me and as I understand so far, ...
26
votes
4answers
54k views

How do I grant start/stop/restart permissions on a service to an arbitrary user or group on a non-domain-member server?

We have a suite of Windows Services running on our servers which perform a bunch of automated tasks independently of one another, with the exception of one service which looks after the other ...
0
votes
2answers
258 views

Windows XP Professional Group Policy question

If I use the group policy editor (gpedit.msc) in Windows XP Pro to disable the run option from the start menu and stop the user from having the ability to change the desktop wallpaper - is it possible ...
1
vote
1answer
350 views

Fixing Microsoft Application DLL Spoofing Vulnerability via GPO

With a metasploit module and POC code available, there's a growing concern about the DLL path-searching vulnerability in an increasing number of Microsoft and 3rd party applications. It appears that ...
1
vote
1answer
663 views

How can I monitor user access to a shared folder on Windows SBS 2008

I have multiple shared folders on Windows SBS 2008 server. I need to be able to tell if a domain user is accessing these shares and copying large quantities of files to their laptop. Is there a way of ...
0
votes
2answers
112 views

How do I configure privileges for a Standard user account?

How do I limit the features of a Standard user account, without affecting the Admin account?
1
vote
1answer
1k views

Disable password age policy for admin on Windows Server

By default on my SBS08, the Maximum password age is set to 1year. I'd like to disable this particular parameter for Domain Admin, not the entire policy (Default Domain Policy). Is that possible ? ...
0
votes
2answers
219 views

Give a domain group full control to the profile folders of all servers and workstations

I have a domain group (called GSG_TECH_USER) which need "full control" right to the folder "document & setting" of all servers and workstation. I made a test with this configuration: On a ...
1
vote
1answer
121 views

Security Restrictions Downloading From the Internet

For some reason since we rolled out IE7 to the estate users are unable to download from the Internet, they get an error message "the operation could not be completed due to restrictions on the ...
2
votes
2answers
9k views

How can I edit local security policy from a batch file?

I am trying to write a utility as a batch file that, among other things, adds a user to the "Deny logon locally" local security policy. This batch file will be used on hundreds of independent ...
3
votes
1answer
2k views

Removing Debug-Program privileges via GPO - should I leave Local System?

Per recommendations from SANS and others to mitigate against hash dumping and other attacks, I'm looking at defining the 'Debug Programs' user rights assignments using a group policy. When not ...
0
votes
1answer
68 views

Why can't I modify the contents of this folder when I'm part of the group with full permissions?

dsmith@ip-xx-xxx-xxx-xx:~$ groups dsmith dsmith sudo py dsmith@ip-xx-xxx-xxx-xx:~$ sudo chmod -R g+rwxt /usr/local/virtualenvs dsmith@ip-xx-xxx-xxx-xx:~$ ls -al /usr/local ... drwxrwxr-x 2 root py ...
2
votes
1answer
920 views

Applying different group policy Computer Settings depending on which OU a user is in

I might be asking the impossible here, as I understand it "Computer Settings" are only applied once when the computer first boots up. What I would like to do is have different policy restrictions ...
7
votes
7answers
763 views

Is there a way to audit AD for a particular password?

Is there a way I can audit AD to check for a particular password? We used to use a "standard" password for all new users (e.g. MyPa55word). I want to make sure this is no longer in use anywhere on ...