Group Policy is a built-in feature of the Microsoft Windows operating systems. Group Policy allows administrators to automatically configure myriad options within the OS. These policies can be configured, and applied, either locally to the computer via Local Group Policy or remotely within an ...

learn more… | top users | synonyms (1)

5
votes
3answers
5k views

Automatically make user local administrator on their computer through GPO?

In our AD 2003 domain each user gets local admin permissions on their computer. Everyone else can login with their domain account as normal user. Right now this means going to the desktop and ...
5
votes
2answers
125 views

How to use a tab character within a GPP registry item?

I am in the process of packaging an some software settings for deployment with a GPP. I need to include a few tab characters within string and eventually multi string values. When I paste tabs into ...
2
votes
1answer
8k views

Can I use group policy to set the permissions on registry keys?

I know that I can use group policy preferences to set registry key values on a Windows 7 computer. But is it possible to apply registry key permissions using group policy? Note: I've seen this post ...
1
vote
0answers
923 views

Windows 7 Screen Saver timeout problems using GPO

In our Windows 2003 domain, we are enforcing screensavers with timeouts through GPO. The settings currently in effect are. Screen Saver = Enabled Screen Saver executable name =Enabled and ...
3
votes
1answer
239 views

Can active directory GPO's apply to a group object?

I know I can set up an OU, move user objects in to it, and link a GPO to that OU and that GPO will apply to those users. Is it possible to set up an OU, move a group in to the OU, and have a linked ...
0
votes
2answers
94 views

Disable Server Login upon Updates Reboot

I have a co-located Dedicated Server running Windows 2008 R2. It is a Live server running my sites (wordpress, joomla, etc) I administer it via Remote Desktop. Everytime I do the Microsoft OS ...
1
vote
2answers
5k views

How can i force a user to save all his/her files to a specific folder on the machine?

How can i force a user to save all his/her files to a specific folder on the machine? Clients are using: XP, Vista, and 7 Thanks
0
votes
1answer
321 views

Correct Place to enable windows services in GPO?

Which is the correct place to enable windows services through GPO on Windows Server 2008? The domain has computers running XP, Vista, and 7. Computer Configuration > Policies > Windows Settings > ...
2
votes
1answer
555 views

XP software restrictions policy, disable message dialog every time software is restricted.

I have created some "Additional Rules", in "Software Restriction Policies". The rules work as expected, but I get a dialog message box every time they disallow the specified application. How can I ...
1
vote
1answer
130 views

Backing up my GPO's

If I wanted to backup everything related to all my GPO's - permissions, links for the domain (how they are linked to my OU's etc), and all the GPO's themselves, how would I go about doing that. I ...
1
vote
1answer
319 views

EAS remote wipe failure

I am getting the following error when trying to perform a remote wipe in Exchange 2010 via "Manage Mobile Device" within Recipient Configuration | Mailbox. I click the help link which leads me to a ...
5
votes
5answers
709 views

Restricting Internet Access in Windows 7

On a Windows 7 Professional laptop, not on a domain, what's the best way to restrict access to the internet (and preferably network) to Administrator users only? I don't want to simply set a bogus ...
0
votes
1answer
2k views

Where do I define a group policy that will set a users desktop background color to green the first time they log in?

Servers: W2k8 R2 x64 Desktops: Win7 Pro x64 Our current group policy uses a custom ADM file to define certain properties of the desktop (Background Image (centered), Background Color is green (00 74 ...
0
votes
2answers
1k views

Windows group policy controlling ability to create and execute Excel macros (but not enable/disable macro security settings)

I have a Windows 2003 Server box with Excel 2010 installed, upon which I am unable to create new or execute existing macros in spreadsheets. This machine is in a Windows Domain (and I am not getting ...
2
votes
1answer
870 views

How to lock down a RDP session so one user can only access one folder

I need to allow a user to RDP to a Win 2003 server (not currently a TS) and lock that user down to just have access to one folder and to run the app in that one folder. I feel like there is a few ...
1
vote
1answer
1k views

Cannot Apply Screensaver GPO to Windows 7 clients through a Security Group

Our environment consists of a 2003 Active Directory with about 50% split regarding XP and Windows 7 clients. Our security policy states that by default everyone's desktop should lock at 2 hours for ...
2
votes
3answers
497 views

Can I prevent logon scripts in one GPO from executing before those in the parent GPO finish?

According to this article, group policy is processed in descending order through the organization (ie start at forest, then domain, ou, etc). I have one GPO linked to the domain which runs a startup ...
0
votes
2answers
840 views

Windows 7 machine not setting homepage via GPO

A Windows 7 machine that is currently deployed has its homepage currently set as: http://hp-comm.us.msn.com/?pc=CMDTDF&OCID=HPDHP We have a GPO in place that sets all authenticated users IE ...
1
vote
1answer
652 views

Wireless settings saved for all users?

For both Windows 7 and Windows XP the wireless network settings are being saved for all users. I want to stop this behavior - force all users to enter their own credentials - plus kill any existing ...
2
votes
1answer
131 views

gpsvc consuming ldap ports?

I have an odd issue with my Group Policy service on one of my domain controllers. For some reason the gpsvc service within one of my svchosts is consuming a huge number of ports. The destination ...
1
vote
1answer
704 views

Group Policy and Outlook

I would like to be able to default sharing the user's calender to everyone using a group policy. Is this possible? A brief google hasn't come up with anything. (Outlook 2010 and the AD is Server ...
0
votes
1answer
278 views

Group Policy Object Path

I was wondering if there is a way to copy the group policy path. For example: Deafault Domain Policy> Computer Configuration> Windows Settings> Security Settings> Account Policies> Kerberos Policy> ...
8
votes
7answers
7k views

Locked myself out of Group Policy Editor

I set 'only allow certain applications' restrictions and accidentally applied them across the board to all accounts. Now I'm restricted to only running a browser and can't run the group policy editor! ...
2
votes
2answers
395 views

Accurately assessing security policy on a system

I know there are several built-in tools (or tools available for download from Microsoft) that you can use to assess and modify the security policy applied to a system. A few I'm familiar with, to one ...
2
votes
0answers
661 views

Windows XP not mapping drives after logging into a windows 7 PC

Bit of background. We map out network drives via GPO. This works fine for both XP and windows 7 clients. The GPO’s are served by a Win2008R2 DC. I have a user that has to works in 2 departments. The ...
2
votes
2answers
986 views

Deploy Office 2010 after uninstalling Office 2007 via Group Policy

I'm trying to automate the uninstall/install of Office. Removing 2007, installing 2010. I've downloaded the OCT and made changes as I needed. In there I can select, "Remove the following earlier ...
1
vote
2answers
247 views

Windows Server 2008 AD user rights

What is the difference between applying user rights through these two mechanisms: Policies -> Windows settings -> Security Settings -> Restricted Groups Preferences -> Control Panel -> Local Users ...
1
vote
1answer
790 views

GPO not setting security permissions on restart

I have a GPO that is assigning permissions to a folder on the user's C drive (computer configuration\Policies\Windows settings\security settings\File System). The folder that this applies to doesn't ...
0
votes
1answer
603 views

Group Policy Recovery Agent EFS not being used

I am trying to get EFS working on our workstations. First when I tried to set a directory to be encrypted I got a warning about the Recovery Agent certificate being invalid. It turned out that the ...
0
votes
2answers
167 views

Need a GUI app for group policy login script

I wrote a C# 4.0 application that works on a Windows computer but when using Group Policy to set it as a login script, it does not run. The application is being called from the same location and ...
1
vote
2answers
780 views

GPOs are on users gpresult but not updating settings

I have the GPOs setup correctly for WSUS and even just adding a favorite in IE but none of these are working. Is there another setting somewhere I'm missing to get these things to force? Windows ...
2
votes
3answers
2k views

Windows 7 blocks network access to network-installed apps

Windows 2008 R2 domain. Users, running Windows 7 Enterprise, are trying to run some software from a network share. Specifically, I've tested this with MATLAB and PuTTY. When starting, MATLAB has to ...
2
votes
1answer
3k views

GPO - Block 3rd party cookies for IE 8

I am trying to find some settings in GPOs that explicitly say, "Block 3rd Party cookies" in IE. I am looking under policies>admin template>windows components>IE> IE control panel>Security page. ...
3
votes
1answer
2k views

Enabling SSL for Remote Desktop

Ok so I'm trying to remove a number of my systems from our Nessus scan from having this medium vulnerability. Microsoft Windows Remote Desktop Protocol Server Man-in-the-Middle Weakness I set the ...
1
vote
1answer
4k views

Task Scheduler Cannot Apply My Changes - Adding a User with Permissions

When I login to the server using a domain account with administrator privileges and create a task in the Task Scheduler, I am unable to successfully save the Task once I select the following options: ...
3
votes
3answers
1k views

Group policy not applying to security group

Preface: I have enough privileges to create GPOs in my OU, and have made a few of them for some simple tasks (like deploying a printer to certain users). Not actually a sysadmin...I'm a developer who ...
1
vote
1answer
284 views

Active Directory Restricted Group confusion

I am trying to implement Restricted Group policy for my company's AD infrastructure, namely standardizing the local "Administrators" group. The documentation (and various webpages) said that the ...
0
votes
1answer
852 views

Auto log off windows machine after certain number of minutes

I have three machines on my network, two are windows xp and one is windows 7. i would like to have all three machines log a user off if they are on for more than 60 minutes. And I would like this to ...
3
votes
2answers
4k views

Group policy to disable notifications of particular errors?

How do i disable the notifications of particular errors? A little background to my issue. During the installation of the Kaspersky, it disables all the windows firewall for all except the domain. I ...
2
votes
0answers
742 views

Is GPP Item Level Targeting any faster or slower than WMI filtering?

I need to filter a GPO so that it only applies if an application is installed. From what I can see, I should be able to do this either with WMI or with GPP item level targeting. Is there a performance ...
3
votes
2answers
176 views

Do the GnuWin32 tools require the POSIX subsystem to run?

I would like to remove Posix from the Group Policy Object Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\System settings: Optional Subsystems. Do ...
1
vote
2answers
63 views

Deploy all MSIs from a folder-share to group of computers via domain group-policy?

Is it possible to deploy all MSI packages within a folder-share to a group of computers, with a single group-policy object? If so, how?
0
votes
1answer
306 views

Microsoft Office 2007 system missing from GPedit

I'm trying to change some security settings in Group Policy for Windows 7 x64 to comply with DISA STIG viewer; its flagging a lot of presets for the 2007 Microsoft Office Suite. When I attempt to ...
4
votes
3answers
18k views

How do you override a GPO with another GPO?

If there is a GPO which is applied to all Domain Computers which disables something, is there a way to re-enable the disabled thing for some hosts in the domain, without taking those hosts out of the ...
1
vote
1answer
838 views

Deny permissions to resouces outside of a users own OU

I am fairly new to Active Directory and this may be a simple thing to do but I am unsure of how to do it. I have a Organizational Unit in my AD named WI, in that OU I have 2 groups WI Users and WI ...
6
votes
4answers
1k views

GPO to Disable Screensaver only when connected via RDP

Is there a GPO option to disable the idle-time screensaver for RDP connections, but keep the idle-time screensaver options for interactive logins? Edit: All users are TS users as well a local so they ...
0
votes
2answers
916 views

WMI query to check setting “Reversible Encryption” in Windows XP

In Windows XP, there are two settings in Group Policy I'm looking at: Password must meet complexity requirements Store password using reversible encryption Both of these settings are under Local ...
0
votes
2answers
330 views

GPO Software Restriction Policy

Just a quick little question here, i am trying to block exe's and such from running from users home drives but running into problems. Sure I can add a hash rule for all the exe's but this is tedious ...
1
vote
2answers
11k views

How do I execute a powershell script via group policy?

How can I execute a powershell script by means of group policy on a number of machines? The script is signed and will run on the targeted machines when you right-click and select "run with ...
5
votes
3answers
7k views

Windows Server 2008 R2 Map User Specific Drive

On our old Windows 2003 SBS, the guy that set up the network created a login script that fired to map some drives and add a network printer. I would like to do away with that script and just use the ...