Group Policy is a built-in feature of the Microsoft Windows operating systems. Group Policy allows administrators to automatically configure myriad options within the OS. These policies can be configured, and applied, either locally to the computer via Local Group Policy or remotely within an ...

learn more… | top users | synonyms (1)

0
votes
2answers
25 views

Preventing windows from reconfiguring graphics on boot

Got a bunch of Windows boxes, each with two nvidia video cards, and each with either three or four monitors, that will every once in a while decide to rearrange the displays when the box is turned on. ...
5
votes
2answers
2k views

How to circumvent or alter screen timeout group policy when not on the domain?

I've been asked to look into a solution for our remote laptop users who are trying to give presentations in Powerpoint and Excel when at customer sites. We are running a Server 2008 /Win 7 ...
0
votes
2answers
405 views

Disable USB mass storage access on client machines

This might not be a new question for this forum but for me it is very critical. I am having a network of 10 PCs, one is having Windows Server 2012 and Others having Windows 7/Windows 8.1. The server ...
1
vote
1answer
69 views

Complex Group Policy Inheritance

I'm currently trying to design the OU and Group design for a new AD deployment. Firstly, taxonomy is hard. As a first guess attempt, we're trying to keep all User objects together in OU=Users, and ...
0
votes
1answer
192 views

Deploy Advanced Firewall Rules via GPO - How to avoid merging?

I am trying to deploy a set of advanced windows firewall ACLs to several 2008 R2 servers. I would like to (i have to) ensure that no local or old rules are getting applied. So I set "Apply local ...
0
votes
3answers
115 views

GPO - Software restriction policy

I was trying to set up GPO - Software restriction policy, so i created the object on our Domain Controller. Fast forward the next day, everybody who turned off their systems at night could not login ...
4
votes
2answers
105 views

OK to modify HKLM\Software\Policies and HKCU\SOFTWARE\Policies on a domain?

Background: I have a domain (2003 Functional Level) with a mix of Windows XP and Windows 7 clients. We have been using Group Policy to manage our workstations. Now, I am in a situation I need to ...
10
votes
3answers
612 views

Deploying Printers via GPO/GPP - is there a programmatic option?

For reasons beyond my control, I've been tasked with setting up GPO/GPPs to deploy our 100+ printers to our 1000+ clients. The good news is that we have over a dozen sites, and for the most part, I'm ...
3
votes
1answer
58 views

Is it possible to add computers in a particular IP range to a particular Active Directory group?

I'm using AWS and have a VPC which is connected to the local network via a VPN. I can launch EC2 instances, put them in various subnets in various AZ's and connect to them via internal IP. I can also ...
0
votes
1answer
43 views

Cannot unblock IE9 installation after GPO blocker kit

I need to unblock the installation of Internet Explorer 9, after using the Internet Explorer 9 Blocker Toolkit in a GPO. In a way the unblocking does work, after disabling it in the GPO, but the ...
3
votes
1answer
79 views

“Deny Logon Locally” effects

I'm planning to harden my AD-based infrastructure. One privilege that I'm planning to limit is the "local logon" privilege. Now, if I push "Deny Logon Locally" through GPO, besides preventing ...
0
votes
1answer
63 views

Set Country / Region field Access via Active Directory Delegation

After creating a security group for special permissions (edit User Objects fields like Street, ZIP etc.) I have a problem of not being able to delegate permission for the field "Country/Region" on a ...
0
votes
0answers
23 views

Advanced Windows Firewall - Strange logging behavior

I have created a GPO that set's several firewall rules to Windows Server 2008 R2 machines within a specific OU. The default behavior is set to block on inbound and outbound on all profiles. Also I did ...
1
vote
1answer
308 views

Lock down a Windows 7 computer via GPO

I have a client who needs 3 systems locked down to only allow a user to log in and have access to 3 shortcuts on their desktop. These shortcuts are to batch files that run in separate folders (DOS ...
0
votes
0answers
205 views

SBS 2011 Group policy won't update/apply properly

i'm running SBS 2011 on a dell poweredge t110 II, and recently i've found that i am unable to apply/update group policies. I get the following error: The processing of Group Policy failed. Windows ...
4
votes
2answers
485 views

GPO - Set Desktop Background But allow users to change

We have a policy setup to use an image for our desktop background, this works, however we have decided that by default this should be the setting but if the user wants to change it then they can, ...
1
vote
1answer
78 views

How can I either through vbscript or GPO push a Windows 7 Logon Screen to all my users

I know how to change the login screen, it's easy. But I would like to figure out a way to do it through GPO or login script. I have tried running the script as the computer start-up script as well as ...
0
votes
0answers
1k views

GPO Run these programs at user logon not taking effect

When on our W2k8-R2 DC I create a new GPO and configure "Computer Configuration/Policies/Windows Settings/Administrative Templates/System/Logon/run these programs at user logon" to ...
0
votes
1answer
50 views

Why does GPO for firewall inbound connections still allows change from “Block (Default)” to “Block all connections”

I found an interesting issue where I set a GPO to control the firewall policy to "Block (default)" the inbound connections, however that setting is not completely enforced. It still allows an ...
0
votes
2answers
59 views

Server 2008 Terminal Server + Outlook 2007. I need to change the default font used in Outlook

Server 2008 used as terminal server with Office 2007 installed. I've been asked to deploy a GPO to make the default font used Veranda 11 for all Office Suite applications. I've been doing some ...
-3
votes
1answer
60 views

Windows Server 2012: use GPO in multiple OU's but only for specific servers

sample: OU: A User1 User2 GPO1 OU: B User 3 User 4 GPO1 OU: C Server1 Server2 Server3 Now i want to restrict GPO1 to Server1 and Server2 -> how can i do this in a easy/smart way? thx
3
votes
1answer
33 views

Limit access to local data and applications while accessing the desktop remotely

We need to access client systems (desktops) remotely to do routine troubleshooting activities, however this isn't a very secure method to do as it exposes the local data to support personnel. Also, ...
0
votes
2answers
108 views

RSOP resolves wrong computer name

I have imaged a computer using Acronis Snap Deploy. The source computer from where the image have been taken is SOURCEW7, and the computer created with this image is W7TEST When I do a RSOP ...
3
votes
1answer
459 views

Windows - Software restriction policy to block exe files in all subdirectories

How can I block all executables in %APPDATA%? I've read for CryptoLocker this is a good policy: C:\Users\User\AppData\Roaming\*\*.exe But that apparently won't protect more than one layer ...
1
vote
1answer
188 views

When is a user considered “Everyone” in the “Access this computer from the network” policy

I am a bit puzzled by the existance of the "Everyone" group in this policy. Per http://technet.microsoft.com/en-us/magazine/dd637754.aspx: The Everyone identity All interactive, network, dial-up, ...
0
votes
1answer
43 views

Windows Startup and Logon scripts proper permissions

I'd like to know what the appropriate permissions should be for Startup and Logon scripts that run for everyone. Should Startup scripts have System read and execute permissions and Logon scripts read ...
1
vote
1answer
37 views

GPOs do not apply when logging into Windows 7 via RDP

I am developing a set of GPOs which that I've applied to an OU containing some Windows 7 x64 computers. loopback processing is enabled of course. This computers are located in a different room so i ...
2
votes
2answers
448 views

GPP drive map to nested share maps to root share on Windows 8.1

Good day everyone, I'm in the midst of testing out Windows 8.1 as an enterprise OS to avoid a crisis when Win7 is no longer supported. One of the problems I've run into is with drive mappings. Most of ...
1
vote
1answer
34 views

GPO with Auto Updates Disabled Updates only from WSUS

I currently have an environment with Windows 7 and a GPO in place where automatic updates are completely disabled and can't be installed. I would like to have it set where the updates are only ...
15
votes
4answers
793 views

What can be done to properly re-enable the Windows Firewall on a domain?

BACKGROUND/RESEARCH I honestly believe that questions like this one: Using GPO in Active Directory domain to force workstations Windows Firewall to disabled - how? existed because Windows Admins in ...
1
vote
0answers
72 views

Server 2003R2 DC Windows 7 and disable auto updates

I run an environment with Server 2003 R2 DC's and mostly WIndows 7 clients with just a few XP clients. The problem I am having is that the Windows 7 PC's are installing updates on their own. We have ...
1
vote
0answers
85 views

GPP Delete policy not working on Windows Server 2008 R2 RDS when deleting shared printee

I have one AD Security group for each shared printer, I have one GPP that map the printer if the user is in the security group that belong to the printer. And one GPP to delete the printer if the user ...
1
vote
2answers
39 views

gpo set to disabled but still applied

I set the 'prohibit access to properties of a LAN connection' to 'disabled.' After forcing, I confirmed they were not applied by running a gpresult. Now I realize that there are instances where ...
0
votes
0answers
89 views

Best way to enforce Bluetooth encryption/security on Windows 7 workstations?

My organization doesn't currently allow Bluetooth devices of any kind, even going so far as to totally remove the Bluetooth stack from many of our OS images. This stance is being re-evaluated, but ...
5
votes
2answers
481 views

Will GPO Software Installation re-install already installed applications from a different policy?

I'm looking to install our latest AV suite through a GPO Software Installation policy. (As in the below screenclip.) Unfortunately my request to use DFS has been denied and I'll need to create a ...
3
votes
1answer
112 views

RDP Certificate subject name though a gateway

I have Server 2012 R2 setup with the Hyper-V and Server Essentials role enabled. I am running multiple machines that I would like to RDP to through a RDP Gateway. The gateway is correctly configured ...
2
votes
1answer
193 views

Practical Limits of Configuring WLAN SSIDs via Group Policy on Windows 7

Is there a practical limit to the number of SSIDs that can be configured on a single WLAN profile via Group Policy on Windows 7? I am thinking about hundreds of SSIDs in a single WLAN profile. ...
1
vote
2answers
239 views

Distributing Favorites to all Internet Explorer installations in local network

I am managing a company with 150 Windows machines. I would like to manage a central list of Favorites (hyperlinks with a text description) which is automatically synced with each Internet Explorer ...
0
votes
3answers
508 views

Bypassing GPO for “set time limit for disconnected sessions”

In order to conserve server resources, I would like to enable a GPO which terminates disconnected RDP sessions after a certain time period. However, there are times when we might want to bypass this ...
1
vote
2answers
238 views

Controlling updates for Google Chrome enterprise deployment

We have been using Chrome's MSI and chrome's group policy templates to deploy it to all our users. Lately we have been bitten by a few bugs that made it into release updates. The latest being scroll ...
0
votes
1answer
712 views

How to remove programs from the start menu windows 7 client using a GPO managed on window server 2008 r2

I have a windows server 2008 r2 with a domain where windows 7 desktop pcs connect to. There are only 3 programs I'd like to display on the start menu for users. All client computers have the same ...
0
votes
0answers
72 views

Setting permissions for RDP security settings via Group Policy

Is there any way to set settings from the Security tab for a connection in Remote Desktop Session Host Configuration via group policy? I have discovered how to do it via the WMI class ...
0
votes
2answers
861 views

Citrix XenDesktop 7.1 hide local drives

I have currently testing Citrix Xen Desktop 7.1. I am delivering applications from Server 2008 R2. When users login to a app via the Storefront they are able to access the local drives on the server. ...
2
votes
1answer
73 views

GPO not applying to user

I'm testing setting user printers via group policy and I'm running into a strange issue. I created a new OU and then another sub OU. I then created a new blank GPO called IT as you can see in the ...
0
votes
0answers
966 views

Why gpupdate fails?

So I have a Windows Active Directory Domain with two domain controllers, DC1 and DC2, both running Windows Server 2008 R2. DC1 is the primary DC holding all FSMO roles. It was functioning all right as ...
3
votes
2answers
90 views

Scheduled Software Restriction GPO

We've got a Software restriction GPO setup and I was wondering if it was possible to make this only active during certain times. For example, only make certain game executables available to use at ...
1
vote
1answer
487 views

GPO to set firefox proxy

CONTEXT I have recently assigned to restructure a corporate network that contains about 100 client computers. There is an active directory domain (2003 functional level) for the whole network. The ...
3
votes
1answer
84 views

Can I apply a Group Policy only to systems that have specific software installed?

If I wanted to setup a group policy that installed Java, this would be no problem. But is it possible for the group policy to only apply to systems that have Mozilla Firefox installed? I don't know ...
1
vote
1answer
67 views

Blocking USB through GPO in 2008 R2 & excluding certain users

I am looking for blocking USB devices in our Win 2008R2 SP1 server. I am already aware about GPO policy "\User Configuration\Policies\Administrative Templates\System\Removable Storage Access" & ...
4
votes
1answer
176 views

Removing GPO - comprehensive list of 'tattooed and non tattooed' registry settings

Is there a comprehensive collection or perhaps even a 'quick guide' to which GPO settings (or registry keys) are protected from GPO 'tattooing'? I have a few clients who have horrendous GPO policies ...