0
votes
2answers
48 views

IE11: Allow display of local HTML files

How can I enable Internet Explorer 11 that has Enhanced Protected Mode turned on to display local HTML files? This is very annoying also I see the security need behind this feature. Can someone ...
1
vote
0answers
46 views

Prevent user interactive logon to domain computers

I currently have a user DOMAINJOINER (located in the WIN7Support OU) which I use to deploy Windows 7 machines. This user can Create and Delete Computer Objects in the WIN7Computers OU, that's about it ...
2
votes
1answer
125 views

Advanced Audit Policy not getting applied on 2012 R2

I have configured several avanced audit policy settings under: Computer Configuration => Policies => Windows Settings => Security Settings => Advanced Audit policy Configuration => ...
0
votes
0answers
29 views

domain admin account unable to modify IE settings, other DOMadmin group accounts can

When I log into one of the servers on our domain as DOMAIN\administrator, IE settings are locked, and indicate that I'll have to check with the system administrator. If I log into the same server ...
1
vote
0answers
67 views

Configuring Service Login Credentials with Group Policy following MS14-025

With Microsoft security bulletin MS14-025, GPMC and related tools are now patched to no longer allow the use of configuration items within Group Policy Prefs that would embed obfuscated passwords. The ...
2
votes
2answers
684 views

Removing address bar or Hiding its content from Windows Explorer - Windows Server 2008 R2

I'm currently trying to find a GPO or a registry edit that could either remove the address bar from Windows Explorer or prevent the bar from displaying the full UNC path. The current environment has ...
2
votes
1answer
1k views

Group policy to check/uncheck “require HTTPS” in Internet Explorer 11 trusted sites list?

When adding a list of trusted sites to Internet Explorer 11 in Windows 7 Professional SP1, there is a checkbox called "Require server verification (https:) for all sites in this zone". Is there a way ...
2
votes
0answers
65 views

In the Local Security Policy, how do you avoid putting “IIS APPPOOL\” before “DefaultAppPool”?

Doesn't seem to be a whole lot on the Internet about this. I was tweaking the Local Security Policy of one of our test servers (Windows Server 2008 R2 Standard Service Pack 1), when I got this error. ...
1
vote
1answer
223 views

When is a user considered “Everyone” in the “Access this computer from the network” policy

I am a bit puzzled by the existance of the "Everyone" group in this policy. Per http://technet.microsoft.com/en-us/magazine/dd637754.aspx: The Everyone identity All interactive, network, dial-up, ...
0
votes
0answers
75 views

Setting permissions for RDP security settings via Group Policy

Is there any way to set settings from the Security tab for a connection in Remote Desktop Session Host Configuration via group policy? I have discovered how to do it via the WMI class ...
1
vote
2answers
1k views

Windows GPO Software Restrictions Policy not working with %TEMP% variable

I'm trying to put in some meagre additional malware prevention measures, by restricting the execution of *.exe in a handful of locations -- in particular, the temporary folders that various ...
1
vote
0answers
346 views

How can I run a scheduled task on a Windows 2008 R2 Domain Controller as a non-admin user?

I'm trying to run an exe as a scheduled task on a Windows 2008 R2 Domain Controller. The exe runs fine when I try and run it manually using an account which is a Domain Administrator, but I don't ...
0
votes
1answer
90 views

allowing only access to TFS to external

Recently I've found the need for allowing access to external people to my TFS server, but I have to be sure that they can't access others servers. This is what I've tried so far: Created a security ...
0
votes
1answer
36 views

Security Policy Logs On Windows 7 - Determine Why A Certain Software Function Fails

Is there a log file or administrator screen (like Event Viewer) where one can see specific rules that are being enforced? You know how you can use Process Monitor to monitor a task and see registry ...
1
vote
1answer
197 views

Windows 7: Allow installation of software by non-admins?

I'm running a public library with PCs available for people to use. I'm setting up the next upgrade for the PCs, which will be running Windows 7. We use Deepfreeze to maintain the PC's state (a brief ...
1
vote
1answer
255 views

Windows 7: Update a file in the system32 folder via GPO

I'd need to update a Windows file in the system32-folder I've made a script to do this task. When I run it locally on a system (from a prompt with elevated privileges) it works fine. I've created a ...
4
votes
1answer
99 views

Microsoft Security Compliance Manager terms

Recently i have installed Microsoft Security Compliance Manager. But i am confused with some terms. As per the print-screen ( which is mark in Red-Colour Round ) 1st - the 'Default' here means the ...
3
votes
1answer
105 views

Create a Lockout policy for RDP

In my city there was a recent incident that some hackers login to a server by using brute force attack on RDP. I have got a server and I want to enable some security policy to lockout the account if ...
-1
votes
1answer
259 views

I need a script to lockdown the system time to users via gpedit.msc [closed]

I need to lockdown the system time on a number of PCs via gpedit.msc and then removing administrators from the group and then adding 'administrator' and 'polling'. Can I do this via a script? ...
0
votes
1answer
217 views

Applocker custom extension (Java, CPL, MSC etc.)

We have a Terminal server and want to prevent users from running inappropriate software. Previously we used Software Restriction Policies for this purpose. Now, Microsoft seems to recommend Applocker ...
4
votes
2answers
989 views

Applocker vs Software restriction policy

The goal is to prevent users from running unwanted programs on a terminal server. I have read many articles from Microsoft and others saying that the new Applocker feature is 100% better than the ...
3
votes
1answer
440 views

SIDs in Active Directory GPO

I am looking into some weird issues with active directory and group policy. This domain has been upgraded from windows NT and has had a few different administrators over the years. I am looking ...
2
votes
3answers
905 views

Local account lockout via Group Policy

Is it possible to set an Account Lockout Threshold via Group Policy but have it only apply to local accounts on member workstations and not to domain logins?
0
votes
2answers
89 views

Disable Server Login upon Updates Reboot

I have a co-located Dedicated Server running Windows 2008 R2. It is a Live server running my sites (wordpress, joomla, etc) I administer it via Remote Desktop. Everytime I do the Microsoft OS ...
1
vote
1answer
810 views

Cannot Apply Screensaver GPO to Windows 7 clients through a Security Group

Our environment consists of a 2003 Active Directory with about 50% split regarding XP and Windows 7 clients. Our security policy states that by default everyone's desktop should lock at 2 hours for ...
2
votes
2answers
314 views

Accurately assessing security policy on a system

I know there are several built-in tools (or tools available for download from Microsoft) that you can use to assess and modify the security policy applied to a system. A few I'm familiar with, to one ...
10
votes
1answer
13k views

How can I restrict the java plugin to run only on certain sites in Internet Explorer?

I want to secure our centrally managed computers better and it is very difficult to automatically deploy the java runtime, but how to do that is another question. I find the security of Java ...
1
vote
0answers
601 views

Why is my access being denied when I am an adminstrator on my Windows Server 2003 Installation?

I have recently been made an Administrator on our server (running Win Server 2003) and have been given all the same permissions and made part of the same groups as our other admin but when I try to ...
1
vote
1answer
289 views

Restrict access to All Users folder on XP and 7 via GP

I am attempting to restrict access to the All Users folder via GP. Currently I have the setting under: Computer/Policies/Windows Settings/Security Settings/File System configured for the ...
0
votes
1answer
683 views

Allow Non-issued Security Certificate for Localhost Via Group Policy

I have an application at https://localhost:4321 When using Internet Explorer 8 I'm greated with a "There is a problem with this website's security certificate" message with the big red X etc... Two ...
1
vote
2answers
785 views

Getting Windows 7 to run Scripts from Other Shares then NETLOGON

I have several Windows Server 2003 Environments I administer. These are separate disparate domains with their own structures and policies. I generalize as much as possible when I administer these ...
1
vote
1answer
3k views

Disable prompt “allow script/activex control to run”

We have a policy of disallowing scripts and ActiveX controls to run on in IE our network (instead opting to use Firefox) thereby skirting a number of security issues dating back to IE 6, but we ...
1
vote
0answers
32 views

Supress 'server properties' options in printers dialog

is there a way to supress the 'server properties' options (and the other one's) via GPO on Windows Server 2008? I don't want the user to see the print server settings etc. Niklas
1
vote
2answers
998 views

Users cannot delete Public icons

We are rolling out new laptops to my company and we are no longer setting the user as a Local Admin. Instead, the user will be a part of the "Users" group. While I am not a part of the team that ...
2
votes
1answer
11k views

Group Policy Internet Explorer default security settings?

Since re-installing our Domain Controller (Windows Server 2008R2) and re-creating all of our group policies I have stumbled across an strange issue. When a user logs in and goes no the internet, ...
0
votes
1answer
803 views

Remove local accounts but leave domain accounts in local administrators?

I'm trying to rename the local administrator account on all the PCs in a 2003 domain. The GP I have that uses GPP to rename the local administrator seems to work. However the problem I'm having is ...
4
votes
1answer
3k views

How can I remove my users from local admin rights with a GPO?

I have active directory 2003 and windows xp running on clients so I don't want any of my users to have any admin rights on their PCs and I have already gave them local admin rights So Without to go to ...
2
votes
1answer
1k views

Active Directory how to make Group Policy to allow users to change their network settings

I have Active Directory 2003 and my users are on Windows XP. How can I set a policy to active network configuration for the users? In other words some users are traveling a lot so I want to give them ...
0
votes
4answers
255 views

Why user logons to Windows always look like the first logon

I have Windows Server 2003 and all the users have windows XP with administrative privileges in local group setting, so I want to reduce them to normal users. i.e. Currently normal user in active ...
1
vote
2answers
19k views

How to set group policy in windows server 2008 domain?

I need to apply group policy to several computers in a Windows Server 2008 domain. After running gpmc.msc, we can see Default Domain Policy and Default Domain Controller Policy Can you tell me their ...
0
votes
1answer
38 views

Unable to make registry or security policy changes (that “stick”) in an offline Windows Server 2003 environment

I've inherited a network, in my new position, that I'm in the process of getting accredited and then online. For now it's completely offline and all my updates are done locally at the machine(s). ...
0
votes
2answers
300 views

Change local time on XP box - local admin but group policy restricts time change

I am a developer in need of doing some temporal unit testing on my local XP box. I am local admin but there is a group policy enforced centrally that prohibits changing local time (a severe case of ...
0
votes
2answers
6k views

Default Domain Policy Overriding Custom GPO even though Custom GPO is Enforced

I'm trying to apply a custom GPO to an OU with a specific account in it. Even though I enforce the GPO, the default domain policy is still overriding my custom GPO and settings are not being applied ...
0
votes
2answers
2k views

Unable to access NAS device

I have a 3 site network A, B, and C. Each site has its own DC, that replicates to the others. Each site also has a local NAS (Thecus) device. The NAS devices should be accessible from every other ...
0
votes
1answer
385 views

Is there a tool to check GPOs like MBSA?

I'd like to provide some background before I pose my question so please, bear with me. I have come across Microsoft's Security Compliance Manager. It's rather new to me and as I understand so far, ...
30
votes
4answers
64k views

How do I grant start/stop/restart permissions on a service to an arbitrary user or group on a non-domain-member server?

We have a suite of Windows Services running on our servers which perform a bunch of automated tasks independently of one another, with the exception of one service which looks after the other ...
0
votes
2answers
262 views

Windows XP Professional Group Policy question

If I use the group policy editor (gpedit.msc) in Windows XP Pro to disable the run option from the start menu and stop the user from having the ability to change the desktop wallpaper - is it possible ...
1
vote
1answer
430 views

Fixing Microsoft Application DLL Spoofing Vulnerability via GPO

With a metasploit module and POC code available, there's a growing concern about the DLL path-searching vulnerability in an increasing number of Microsoft and 3rd party applications. It appears that ...
1
vote
1answer
723 views

How can I monitor user access to a shared folder on Windows SBS 2008

I have multiple shared folders on Windows SBS 2008 server. I need to be able to tell if a domain user is accessing these shares and copying large quantities of files to their laptop. Is there a way of ...
0
votes
2answers
113 views

How do I configure privileges for a Standard user account?

How do I limit the features of a Standard user account, without affecting the Admin account?