Group Policy is a built-in feature of the Microsoft Windows operating systems. Group Policy allows administrators to automatically configure myriad options within the OS. These policies can be configured, and applied, either locally to the computer via Local Group Policy or remotely within an ...

learn more… | top users | synonyms (1)

0
votes
0answers
7 views

GPOs not applying even after gpupdate /force…but after a couple of days, do apply

For some odd reason, after I run gpupdate /force on both server and client, the GPOs do not apply. gpresult /r on the client does show that it recieves it and it is being applied but it does not do ...
2
votes
1answer
6k views

Deleting Local Profiles when using Roaming Profiles at Log off

I'm currently building an environment that will host about 5,000 users over 20 AppServer. I have finalized my GPOs but I'm experiencing an issue with the user's local profile when roaming profiles is ...
0
votes
0answers
17 views

Windows 2008 Group Policy Mapped Drives - Unmap

I seem to be missing something? I have a policy that seems to mapping drives, which I cannot find the policy, I've checked event viewer on local pc and cant see the policy. On AD "Group Policy ...
0
votes
1answer
25 views

I see my clients in AD but not in WSUS

I set up a WSUS but dont see any clients in the Unassigned Computers group. I can find my clients in the ADAC, when I select myWSUS (local) > computers. My group policy management got a domain ...
0
votes
0answers
14 views

How to give permissions to user (not admin) to access task manager WS 2012 R2?

I have a terminal server with ws 2012 R2. In it I have installed domain server and remote desktop services. I have administrator account, and other account without administrator rights called ...
0
votes
1answer
2k views

Why is my loopbacked GPO reporting as disabled

Let me start by saying that my experience with GPO is limited to tentatively poking at settings until they fall into place by trial and error. It is entirely possible this will be a very obvious ...
1
vote
0answers
19 views

Allow Execution, Deny Interactive login by GPO

Problem: Accounts to log into work stations are locked down tightly and unable to run nessesary applications on windows 7 stations. Saving an admin accounts credentials to elevate access is currently ...
1
vote
1answer
19 views

Windows Server 2012 Missing Internet Explorer Maintenance in Group Policy

I'm trying to set Internet Explorer as the default browser for all users on a clients terminal server. I was trying to do it following this guide however I couldn't get passed step 4 Right-click ...
8
votes
2answers
122 views

Need explanation of why a particular GPO is applied to all domain computers

I'm a little stumped on this one so I'm hoping someone can enlighten me, since I consider myself a pretty knowledgeable GPO person. I have a login banner GPO that changes the Interactive Logon: ...
4
votes
2answers
16k views

How can I edit local security policy from a batch file?

I am trying to write a utility as a batch file that, among other things, adds a user to the "Deny logon locally" local security policy. This batch file will be used on hundreds of independent ...
3
votes
0answers
32 views

Best practice for defining user “HOMEDRIVE” “HOMEPATH” “HOMESHARE”

Is it considered a best practice to map domain users' "HOME" environment variables to a network path? If so, why? By "HOME" variables, I am referring to: %HOMEDRIVE% %HOMEPATH% %HOMESHARE% This ...
3
votes
3answers
4k views

How do I whitelist Firefox installations from my Cryptolocker SRP GPO?

I've a GPO setup to try and prevent Cryptolocker from infecting systems in our environment. The below software restrictions are in place: %AppData%\*.exe %AppData%\*\*.exe ...
0
votes
1answer
2k views

Samba4 domain controller, group policy processing fails, gpupdate fails

I'm using a Samba4 domain controller, and on the machines joined to the domain I'm seeing this message: The processing of Group Policy failed. Windows attempted to read the file ...
8
votes
1answer
286 views

Is there any way to restrict user from changing file extensions in Windows XP, Vista, Windows 7?

For example, not allow users to rename abc.doc to abc.jpg? Is there any windows group policy for that? I am not asking file association restriction. If it really can't, is there any group policy to ...
14
votes
2answers
16k views

Registry key / GPO to disable and block Windows 10 upgrade?

One of our remote Windows 7 Professional users just reported that he received an Upgrade Reservation Offer for Windows 10. It appears the Get Windows 10 "App" running in his system tray is legit. So ...
6
votes
2answers
3k views

Applocker vs Software restriction policy

The goal is to prevent users from running unwanted programs on a terminal server. I have read many articles from Microsoft and others saying that the new Applocker feature is 100% better than the ...
2
votes
2answers
980 views

Default Domain Policy Corrupted

It appears that our domain's default domain policy is corrupted. The GPT.ini file is corrupted. When I go to open it, I get an access denied error. I tried to take ownership through explorer, takeown, ...
3
votes
1answer
22 views

Use “Client Site Name” in Group Policy Preferences

In Active Directory, you can map IP addresses to Client Sites. ...and then you can map Group Policy objects to sites. Which is great and all, but I have a client that is growing rapidly, and ...
0
votes
1answer
25 views

Unable to disable Thumbs.db on Windows Server 2012 R2

I have enabled the Group Policy setting "Turn off caching of thumbnails in hidden thumbs.db files", but the Thumbs.db is still getting generated. I have also enabling the Group Policy setting "Turn ...
0
votes
0answers
12 views

softwarerestrictions gpo and appdata locallow

In order to prevent accidental running of virus payloads I've added several paths to the SoftwareRestrictions Group Policy (Server 2008 R2) on our Windows Domain. The rules work fine for ...
0
votes
2answers
75 views

Disable Flash player in Chrome via group policy

How would I disable Flash player in Google Chrome browsers for my 50 AD computers via group policy or script 2008 R2? I have tried a couple of applications, PDQDeploy_6 among them, but this software ...
1
vote
1answer
43 views

How to exclude Outlook 2010 from Win7 roaming profiles

We have a user with sensitive emails that shouldn't be available when they login to a borrowed computer that is not their primary computer. We want to keep their Win7 roaming profile but exclude the ...
0
votes
1answer
29 views

Delete User profile older than X days globllay from all the COmputer within domian. Server 2008 R2

I need little help for deleting all the user profile form the Computer within my domain. if user is not logged in to particular computer for Than x Day in my case 60 Days. i have tried with default ...
1
vote
0answers
22 views

Group policy for Windows Update Server

I'm trying to setup a WSUS, having everything on the server installed, updates downloaded and accepted, etc... ready to go Problem is, when I go into group policy and try to change the 2 relevant ...
0
votes
1answer
24 views

Is there a way to manage machines which are off-domain centrally?

We have a number of three tier setups here which are mostly Windows Server 2008 boxes. They tend to consist of 1 web server, 1 application/web services server, 1 db server. As this is a three tier ...
2
votes
1answer
2k views

IE11 Enterprise Mode gpo not working

I've followed the following articles to configure the Enterprise Mode gpo for IE11: http://msdn.microsoft.com/en-us/library/dn640699.aspx http://msdn.microsoft.com/en-us/library/dn640696.aspx I ...
0
votes
0answers
8 views

Group policy to Delete unauthorised software per logon

I have a group of on-site engineers (domain users but have local administrators rights) who are using laptops. They are required to install software occasionally when they travel, therefore I need a ...
1
vote
1answer
11k views

How to change default region/culture settings in Windows 2012

I have researched this topic through the web but can't find a definitive answer. Our server team has recently upgraded our SQL Servers VMs from Win 2003 to Win 2012. Given our region we run all our ...
3
votes
2answers
3k views

Windows GPO Software Restrictions Policy not working with %TEMP% variable

I'm trying to put in some meagre additional malware prevention measures, by restricting the execution of *.exe in a handful of locations -- in particular, the temporary folders that various ...
1
vote
1answer
2k views

“Fast link detected” warning in GP management console

There is a message that is shown in every report i make in Group Policy Results section of Group Policy Management Console, saying that "A fast link is detected". I followed the link in the waring, ...
1
vote
3answers
4k views

Change/Force Left-handed Mouse settings via GPO, or other ways

Is it possible to control Left-handed Mouse settings via GPO? (or a script that can be pushed using GPO :) I have Windows 7 / Windows Server 2008. Many thanks for your advice. Toast
2
votes
2answers
38 views

Force a specific theme for entire network using GPO

I am attempting to force a specific theme to all machines in my network. I know that the GPO "Load a Specific Theme" in: User Configuration/Administrative Templates/Control Panel/Personalization Is ...
3
votes
1answer
3k views

How to abort applying group policy when it is stuck for too long?

I had a problem with a Win2k8 Domain Controller and had to restart it. It restarted with no issues and reached the "PRESS CTRL + DEL TO LOGON" screen. And so I did a usual logon with an ...
8
votes
1answer
3k views

Everything says Applocker is supposed to work: Why doesn't it?

I've setup a basic group policy consisting of the default Applocker rules. Per Microsoft's technet article on the subject, any files not explicitly allowed to run by the policy are supposed to be ...
5
votes
2answers
2k views

How can I disable the “Do you want to allow this website to open a program on your computer?” warning for a specific program/moniker?

I've been playing with new URL monikers in Windows for a utility I'm working on. When I run the new URL from Start > Run, it just runs. If I send the URL to myself via Notes or enter it into the IE ...
3
votes
1answer
2k views

Enabling SSL for Remote Desktop

Ok so I'm trying to remove a number of my systems from our Nessus scan from having this medium vulnerability. Microsoft Windows Remote Desktop Protocol Server Man-in-the-Middle Weakness I set the ...
7
votes
5answers
6k views

Why is this preventing me installing an MSI: The System Administrator has set policies to prevent this installation

I am trying to install an MSI on a Windows Server 2012 machine which is part of my lab domain. I am local and domain admin, but I seem to be prevented from installing this MSI. For clarification, ...
1
vote
1answer
93 views

Time Zone keeps changing after sync with PDC in different site

Background: I have a single domain, running in 2 sites that is connected using Site-to-Site VPN. Site A is running in time zone 2:00+ UTC Site B is running in time zone 4:00+ UTC DCs are correctly ...
0
votes
0answers
13 views

Give a right to domain user to manage his system's firewall

How can a we give a right to domain user to manage his system's firewall? We're having a Windows setup, and using Windows Server 2012 for managing domain group policies.
0
votes
2answers
35 views

Server 2008r2 File lost in Group Policy Redirection?

I keep an Access database in My Documents. We have a Group Policy redirecting documents to "\\server\userhomes\%username%\My Documents". I was experimenting with a Group Policy to redirect My ...
0
votes
2answers
6k views

processing of Group Policy failed only on 2008 Servers and Name Resolution failure on the current domain controller

Spent last 3 months doing a upgrade from 2003 domain to a 2008R2 domain. our last DC was rebuilt (5 total) and brought up on line. After it was put on line we have some 2008 and 2008R2 servers (10 ...
3
votes
1answer
30 views

Remove all sites from allowed list for plugin in IE via GP

I would like to remove all sites from the list of approved sites for a plugin in Internet Explorer as described here but I would like to do so via Group Policy. Is this possible? I know I can disable ...
1
vote
2answers
124 views

Windows Server 2008 Disabling Password Complexity Requirements

I'm using a Server 2008 R2 domain controller, trying to troubleshoot a bug where password complexity requirements seem to be enabled, even though they are disabled in group policy. Some notes: I am ...
1
vote
2answers
2k views

Restore legacy audit policies on Windows Server 2008 R2

Recently, I was trying to reduce spam of my security audits by disabling auditing of "Filtering Platform Packet Drop". In a week's time, I get enough of these audits the fill a 200Mb logfile. I tried ...
1
vote
1answer
937 views

Windows 2008 Group Policy Setting? - Migration Headache

I have a small domain of users that I just migrated from a linux domain running open-ldap. Our new servers are running Windows 2008 Standard. I've installed Active Directory and everything is ...
6
votes
1answer
1k views

How can I eliminate the “Several add-ons are ready for use” prompt in Internet Explorer?

The issue I describe here is the same as that in Group Policy Internet Explorer, Add-on list not working, but I provide more detail and troubleshooting steps, so I thought it was worth re-asking. I ...
2
votes
2answers
35 views

Multiple GPOs with Security Filtering or Single GPO with Item Level Targeting?

I have multiple GPOs for User Experience stuff (Eg: Shortcuts as GPP in User Configuration) which impacts a number of OUs and their users. It's currently one GPO per 'item' (Eg: shortcut, file) with a ...
3
votes
1answer
2k views

Deny access to removable storage media for Windows XP client machines via Group Policy

I am currently editing a GPO for user accounts of a particular OU and I want to disable removable drives access on a particular OU, problem is that all the client machines are Windows XP and the ...
0
votes
1answer
1k views

terminal server, hide desktop icons doesn't work as expected

In the User part of a GPO that i activate for users who log on a terminal server, i tried to set the Administrative Templates, Desktop, "Hide and disable all objects on the desktop" (may be that the ...
1
vote
2answers
5k views

Adding static route through group policy

We are trying to add a static route across all of our end user machines, we have setup a GPO object under Computer configuration > Policies > Windows Settings > Scripts (startup/shutdown) > Startup. ...