Group Policy is a built-in feature of the Microsoft Windows operating systems. Group Policy allows administrators to automatically configure myriad options within the OS. These policies can be configured, and applied, either locally to the computer via Local Group Policy or remotely within an ...

learn more… | top users | synonyms (1)

1
vote
1answer
206 views

Preventing Login From Specific Computers with Group Policy

I have a very small network with a handful of users and machines. I would like to control which users can access which machines by using Group Policy. Here is a basic overview of my current setup. ...
1
vote
0answers
272 views

Windows Server 2012 R2 cannot rename Administrator account via GPO

On Windows Server 2012 R2 the Administrator account does not seem to be able to be renamed. Have created the normal Rename Administrator GPO: Comp config -> Policies -> Windows settings -> Security ...
0
votes
1answer
32 views

Group Policy: How to comment on each setting?

I am looking for a way to comment on each and every setting that can be made within a GPO. Unfortunately things like user logon scripts and security settings and some more can not be commented. Is ...
0
votes
1answer
1k views

GPO: User logon script not running

I have a GPO that is linked to an OU containing computers. Loopback processing is activated an set to merge. Within the user part of the GPO i have a powershell script defined that basically checks if ...
-2
votes
1answer
93 views

Remove delete permission for active directory group in Microsoft 2008 Server R2

I've created a group in Active Directory and I would like to prevent all users in this group from being able to delete any files on the server. How would I go about doing this?
6
votes
2answers
1k views

Windows 2008 R2 gpupdate locks my user account

I built a Windows 2008 R2 server last year, and ever since my elevated account locks 10-12 times a day. After much research and testing I found that the server is locking my account at each failed ...
1
vote
0answers
117 views

Group Policy Internet Explorer, Add-on list not working

We have group policy setup at our company something similar to the setup below Domain Policy OU Policy The domain policy is set to enabled for "Do not allow users to enable or disable add-ons" ...
2
votes
1answer
49 views

Pre-Configured installation of applications on domain computers

I have an application I would like to be installed for all computes that are joined to the domain. The thing about that is I would like to have the application pre-configured for all users. I have ...
1
vote
1answer
1k views

How do I whitelist Firefox installations from my Cryptolocker SRP GPO?

I've a GPO setup to try and prevent Cryptolocker from infecting systems in our environment. The below software restrictions are in place: %AppData%\*.exe %AppData%\*\*.exe ...
10
votes
2answers
326 views

Warn user if they try to logoff

I want a certain local user to not log off. ever. It's much like this silly question, however I don't necessarily care if the buttons are there, I want to pop up a messagebox that says "Please do not ...
2
votes
2answers
71 views

Can I use GPMC to edit a local policy?

I might be overlooking something obvious here, but can I use the Group Policy Management Console on Windows Server to edit a local policy? When I launch it I get a message saying that the machine ...
0
votes
0answers
72 views

GPO: Is there a way to apply NTFS permissions dynamically?

I would like to create a GPO that sets NTFS permissions on a set of folders and files. Computer Configuration => Policies => Windows Settings => Security Settings => File System and ...
1
vote
2answers
62 views

Installation of software on distributed laptops

We have company issued laptops distributed to our employees. Most employees keep these at home for working remotely. We want to install some remote management software on the machines, but the users ...
0
votes
1answer
31 views

Group policy access with active directory

Under Active Directory (Win2008-R2), I want all "authenticated users" be able to access the "Add/Remove windows components" menu But where do I have to go in group policy to set this grant ? In ...
0
votes
1answer
58 views

How can I disable Office 2007 online help function using GPOs?

As the title says: How can I disable the online help function in Office 2007 using a group policy? I just can't find a relevant setting within the administrative templates.
0
votes
2answers
26 views

Preventing windows from reconfiguring graphics on boot

Got a bunch of Windows boxes, each with two nvidia video cards, and each with either three or four monitors, that will every once in a while decide to rearrange the displays when the box is turned on. ...
5
votes
2answers
2k views

How to circumvent or alter screen timeout group policy when not on the domain?

I've been asked to look into a solution for our remote laptop users who are trying to give presentations in Powerpoint and Excel when at customer sites. We are running a Server 2008 /Win 7 ...
0
votes
2answers
893 views

Disable USB mass storage access on client machines

This might not be a new question for this forum but for me it is very critical. I am having a network of 10 PCs, one is having Windows Server 2012 and Others having Windows 7/Windows 8.1. The server ...
1
vote
1answer
83 views

Complex Group Policy Inheritance

I'm currently trying to design the OU and Group design for a new AD deployment. Firstly, taxonomy is hard. As a first guess attempt, we're trying to keep all User objects together in OU=Users, and ...
0
votes
1answer
346 views

Deploy Advanced Firewall Rules via GPO - How to avoid merging?

I am trying to deploy a set of advanced windows firewall ACLs to several 2008 R2 servers. I would like to (i have to) ensure that no local or old rules are getting applied. So I set "Apply local ...
0
votes
3answers
151 views

GPO - Software restriction policy

I was trying to set up GPO - Software restriction policy, so i created the object on our Domain Controller. Fast forward the next day, everybody who turned off their systems at night could not login ...
4
votes
2answers
142 views

OK to modify HKLM\Software\Policies and HKCU\SOFTWARE\Policies on a domain?

Background: I have a domain (2003 Functional Level) with a mix of Windows XP and Windows 7 clients. We have been using Group Policy to manage our workstations. Now, I am in a situation I need to ...
10
votes
3answers
889 views

Deploying Printers via GPO/GPP - is there a programmatic option?

For reasons beyond my control, I've been tasked with setting up GPO/GPPs to deploy our 100+ printers to our 1000+ clients. The good news is that we have over a dozen sites, and for the most part, I'm ...
3
votes
1answer
67 views

Is it possible to add computers in a particular IP range to a particular Active Directory group?

I'm using AWS and have a VPC which is connected to the local network via a VPN. I can launch EC2 instances, put them in various subnets in various AZ's and connect to them via internal IP. I can also ...
0
votes
1answer
44 views

Cannot unblock IE9 installation after GPO blocker kit

I need to unblock the installation of Internet Explorer 9, after using the Internet Explorer 9 Blocker Toolkit in a GPO. In a way the unblocking does work, after disabling it in the GPO, but the ...
3
votes
1answer
105 views

“Deny Logon Locally” effects

I'm planning to harden my AD-based infrastructure. One privilege that I'm planning to limit is the "local logon" privilege. Now, if I push "Deny Logon Locally" through GPO, besides preventing ...
0
votes
1answer
75 views

Set Country / Region field Access via Active Directory Delegation

After creating a security group for special permissions (edit User Objects fields like Street, ZIP etc.) I have a problem of not being able to delegate permission for the field "Country/Region" on a ...
0
votes
0answers
23 views

Advanced Windows Firewall - Strange logging behavior

I have created a GPO that set's several firewall rules to Windows Server 2008 R2 machines within a specific OU. The default behavior is set to block on inbound and outbound on all profiles. Also I did ...
1
vote
1answer
636 views

Lock down a Windows 7 computer via GPO

I have a client who needs 3 systems locked down to only allow a user to log in and have access to 3 shortcuts on their desktop. These shortcuts are to batch files that run in separate folders (DOS ...
0
votes
0answers
330 views

SBS 2011 Group policy won't update/apply properly

i'm running SBS 2011 on a dell poweredge t110 II, and recently i've found that i am unable to apply/update group policies. I get the following error: The processing of Group Policy failed. Windows ...
4
votes
2answers
948 views

GPO - Set Desktop Background But allow users to change

We have a policy setup to use an image for our desktop background, this works, however we have decided that by default this should be the setting but if the user wants to change it then they can, ...
1
vote
1answer
109 views

How can I either through vbscript or GPO push a Windows 7 Logon Screen to all my users

I know how to change the login screen, it's easy. But I would like to figure out a way to do it through GPO or login script. I have tried running the script as the computer start-up script as well as ...
0
votes
0answers
2k views

GPO Run these programs at user logon not taking effect

When on our W2k8-R2 DC I create a new GPO and configure "Computer Configuration/Policies/Windows Settings/Administrative Templates/System/Logon/run these programs at user logon" to ...
0
votes
1answer
68 views

Why does GPO for firewall inbound connections still allows change from “Block (Default)” to “Block all connections”

I found an interesting issue where I set a GPO to control the firewall policy to "Block (default)" the inbound connections, however that setting is not completely enforced. It still allows an ...
0
votes
2answers
72 views

Server 2008 Terminal Server + Outlook 2007. I need to change the default font used in Outlook

Server 2008 used as terminal server with Office 2007 installed. I've been asked to deploy a GPO to make the default font used Veranda 11 for all Office Suite applications. I've been doing some ...
-3
votes
1answer
70 views

Windows Server 2012: use GPO in multiple OU's but only for specific servers

sample: OU: A User1 User2 GPO1 OU: B User 3 User 4 GPO1 OU: C Server1 Server2 Server3 Now i want to restrict GPO1 to Server1 and Server2 -> how can i do this in a easy/smart way? thx
3
votes
1answer
33 views

Limit access to local data and applications while accessing the desktop remotely

We need to access client systems (desktops) remotely to do routine troubleshooting activities, however this isn't a very secure method to do as it exposes the local data to support personnel. Also, ...
0
votes
3answers
204 views

RSOP resolves wrong computer name

I have imaged a computer using Acronis Snap Deploy. The source computer from where the image have been taken is SOURCEW7, and the computer created with this image is W7TEST When I do a RSOP ...
3
votes
1answer
928 views

Windows - Software restriction policy to block exe files in all subdirectories

How can I block all executables in %APPDATA%? I've read for CryptoLocker this is a good policy: C:\Users\User\AppData\Roaming\*\*.exe But that apparently won't protect more than one layer ...
1
vote
1answer
230 views

When is a user considered “Everyone” in the “Access this computer from the network” policy

I am a bit puzzled by the existance of the "Everyone" group in this policy. Per http://technet.microsoft.com/en-us/magazine/dd637754.aspx: The Everyone identity All interactive, network, dial-up, ...
0
votes
1answer
52 views

Windows Startup and Logon scripts proper permissions

I'd like to know what the appropriate permissions should be for Startup and Logon scripts that run for everyone. Should Startup scripts have System read and execute permissions and Logon scripts read ...
1
vote
1answer
37 views

GPOs do not apply when logging into Windows 7 via RDP

I am developing a set of GPOs which that I've applied to an OU containing some Windows 7 x64 computers. loopback processing is enabled of course. This computers are located in a different room so i ...
2
votes
2answers
547 views

GPP drive map to nested share maps to root share on Windows 8.1

Good day everyone, I'm in the midst of testing out Windows 8.1 as an enterprise OS to avoid a crisis when Win7 is no longer supported. One of the problems I've run into is with drive mappings. Most of ...
1
vote
1answer
34 views

GPO with Auto Updates Disabled Updates only from WSUS

I currently have an environment with Windows 7 and a GPO in place where automatic updates are completely disabled and can't be installed. I would like to have it set where the updates are only ...
15
votes
4answers
1k views

What can be done to properly re-enable the Windows Firewall on a domain?

BACKGROUND/RESEARCH I honestly believe that questions like this one: Using GPO in Active Directory domain to force workstations Windows Firewall to disabled - how? existed because Windows Admins in ...
1
vote
0answers
85 views

Server 2003R2 DC Windows 7 and disable auto updates

I run an environment with Server 2003 R2 DC's and mostly WIndows 7 clients with just a few XP clients. The problem I am having is that the Windows 7 PC's are installing updates on their own. We have ...
1
vote
0answers
131 views

GPP Delete policy not working on Windows Server 2008 R2 RDS when deleting shared printee

I have one AD Security group for each shared printer, I have one GPP that map the printer if the user is in the security group that belong to the printer. And one GPP to delete the printer if the user ...
1
vote
2answers
50 views

gpo set to disabled but still applied

I set the 'prohibit access to properties of a LAN connection' to 'disabled.' After forcing, I confirmed they were not applied by running a gpresult. Now I realize that there are instances where ...
0
votes
0answers
110 views

Best way to enforce Bluetooth encryption/security on Windows 7 workstations?

My organization doesn't currently allow Bluetooth devices of any kind, even going so far as to totally remove the Bluetooth stack from many of our OS images. This stance is being re-evaluated, but ...
5
votes
2answers
815 views

Will GPO Software Installation re-install already installed applications from a different policy?

I'm looking to install our latest AV suite through a GPO Software Installation policy. (As in the below screenclip.) Unfortunately my request to use DFS has been denied and I'll need to create a ...