Group Policy is a built-in feature of the Microsoft Windows operating systems. Group Policy allows administrators to automatically configure myriad options within the OS. These policies can be configured, and applied, either locally to the computer via Local Group Policy or remotely within an ...

learn more… | top users | synonyms (1)

4
votes
1answer
2k views

How can I disable the “Do you want to allow this website to open a program on your computer?” warning for a specific program/moniker?

I've been playing with new URL monikers in Windows for a utility I'm working on. When I run the new URL from Start > Run, it just runs. If I send the URL to myself via Notes or enter it into the IE ...
4
votes
1answer
77 views

GPO startup script not being ran

I am unable to get a GPO to run a script on startup. The script creates a shared folder on each machine in a group of windows 8 machines. The script itself works great, but attaching it to a GPO is ...
4
votes
1answer
1k views

Consistently slow domain logins / folder redirection

I've been trying to diagnose slow logins to my domain. One of my first stops was Domain login very slow 10+ minutes. So far I've been able to tell it has to do with my policy that applies folder ...
4
votes
3answers
873 views

How can I create a windows shutdown script from powershell/command-line?

I've read the TechNet pages that describe using computer/user startup/shutdown scripts, and that's great, but I'd like to create those scripts via the command-line (and not have to click around in ...
4
votes
2answers
1k views

Applocker vs Software restriction policy

The goal is to prevent users from running unwanted programs on a terminal server. I have read many articles from Microsoft and others saying that the new Applocker feature is 100% better than the ...
3
votes
3answers
1k views

How do I make on Domain Controller be used more to logon than another Domain controller on the same network?

I am currently working in an environment where there are 2 DC's running and another DC that is a backup but is currently running as well so that if the other 2 fail, the backup has everything needed ...
3
votes
5answers
6k views

Implications of allowing Windows clients to use NTLMv1?

I have a web application that I'd like to authenticate to using pass-through NTLM for SSO. There is a problem, however, in that NTLMv2 apparently will not work in this scenario (without the ...
3
votes
2answers
7k views

Password policy vs password never expires question

I'm new to the Server administration game. I'm about to push out my first group policy concerning passwords. I'm going to do something simple. Use MS's built in complexity requirements and an max ...
3
votes
9answers
4k views

Windows domain password policy advice

I have windows domain that needs a password policy. Right now there isn't one. Anyone have feedback on a good balance between weak passwords and users having passwords so strong they just write them ...
3
votes
3answers
8k views

How do I add items to 'Favorites' via GPO?

How do I add items to all users 'Favorites', preferably via GPO? the screenshot is just an example from W7 but I'm actually working with 2008R2 Server and RDS
3
votes
4answers
786 views

Is it alright to turn off firewall in a LAN using Group Policy?

Is it a good idea or common practice to completely turn off windows firewall in an AD domain using Group Policy? At this time, even the servers' firewall are turned off. The only device not affected ...
3
votes
3answers
4k views

Automatically disable the “Manage Your Server” screen on Windows 2003?

Is there a line I can add to my login scripts or something with GPO to prevent the "Manage Your Server" screen from showing up when I log in to a Windows 2003 Server?
3
votes
5answers
47k views

Enforcing lock screen after idle time via GPO

I run a network of computers and I would like enforce a GPO which locks the screen after a predefined idle time. I can't find this setting, I can only find a screen saver idle time setting, how can I ...
3
votes
5answers
547 views

Recommendations for learning to use Server 2003 (or possibly 2008)

I am currently an IT employee who works primarily with hardware/software desktop support, as well as various projects. I feel like I need to learn more about server/network administration and my ...
3
votes
2answers
467 views

Installing MSI Before User Logon

I have a requirement to install a MSI's to our workstations before logon, it's periodically updated and provides updates to our LOB applications. The problem we are encountering is when setting logon ...
3
votes
2answers
687 views

GPO Enforced Precedence

What is the precedence for Enforeced GPOs, I can't really find any MS articles which give a refined answer. My current understanding is as follows: Lets say we have 5 GPO's - GPO1 through GP05. I ...
3
votes
3answers
132 views

Precedence for GPO

I'm just trying to find what takes precedence in loading a GPO. Specifically, will drives map prior to scripts running? I have an .exe in a network share that I'm running every time a user logs in, ...
3
votes
4answers
310 views

GPO: Deploying software

I've set up a lab with 3 machines (2 Win7, 1 Win8) with the host being Win2008R2 acting as the DC (ADUC installed etc..). I've created a software package GPO and linked it to my domain: Here's the ...
3
votes
2answers
2k views

Distributing Files using a Group Policy on Windows Server 2003

A piece of software that we use at our office has recently moved to a new licensing system. This means that from now on a new set of license key files will need to be distributed to each of our 25 ...
3
votes
2answers
7k views

What URLs must be in IE's Trusted Sites list to allow Windows Update?

Particularly for servers in which IE Enhanced Security Configuration is enabled, you need to have all the Windows Update/Microsoft Update URLs in your "Trusted Sites" list in order to use the site. ...
3
votes
4answers
14k views

How to disable WSUS on our domain?

Our Network Admin, who toughed it out for 3 months here, setup a virtual WSUS server and added Group Policy to enforce a WSUS policy on about 1/3 of our workstations. The virtual WSUS server has since ...
3
votes
2answers
654 views

Setting up printers in active directory

I need some help setting up a printer in Active Directory. Specifically, deploying them via GPO. I want to have a computer associates with a specific shared computer so that anyone sitting there is ...
3
votes
4answers
16k views

Diagnosing why a Group Policy Object is inaccessible

I have a Windows Server 2003 domain. One of the Group Policy Objects appears as a linked item in an OU but all I can see if the Unique ID and that the Link Status is Enabled. There is a red minus icon ...
3
votes
2answers
2k views

Set Time Zone for all Windows Servers on a Domain (2008 R2)

Is there a way I can set the time zone for all machines on my domain (perhaps using a group policy?). All the Windows machines are Server 2008 R2.
3
votes
2answers
56 views

Is there a way to determine which client machines have installed software from a GPO?

If I assign software with a GPO, I assume that client machines will install this next time they reboot. However, I can't be certain without actually going to each of the clients and checking myself. ...
3
votes
2answers
5k views

WPA2 Personal - Deploying via GPO

I've got 300+ win7 clients I need to deploy WPA2 Personal PSK on. I can use a GPO to deploy the SSID information on the clients which is good but not the PSK. Is there a clean/easy way to script it ...
3
votes
3answers
10k views

Domain User can RDP into Domain Controller?

Vanilla Windows Server 2008 x64 Standard DC (AD, DNS). I was remoting into my DC to do a bit of work and, thru force of habit, logged into the server using a regular domain account, not a domain ...
3
votes
4answers
2k views

Update group policy installed software without requiring a log off

Our IT Support Dept. releases an internal software product that I write via group policy. Is it possible to force an update of a particular group policy software install without asking the users to ...
3
votes
3answers
2k views

Managing applications like Acrobat Reader and Flash player via Windows GPO?

Without using additional software, how are people managing software like Acrobat Reader and Flash Player in a Windows domain? I can deploy these applications via GPO software installation. Am I ...
3
votes
1answer
176 views

SID in AD - SID from psgetsid?

Wondering if anyone can shed some light on some SID confusion. Currently having an issue with some policy applying to a few machines that were all based off the same image. One of our admins, ran ...
3
votes
3answers
436 views

Update a network driver through GPO/AD

Our organization has just deployed new computers with Windows 8.1. Roughly 50 of them. We've run into an issue with the driver on the new computers which is flooding the network with ipv6/multicast ...
3
votes
1answer
240 views

Permission to create GPOs

Is the sole reason of the Group Policy Creator Owner group just to dish out permissions to other users to create (and then modify only their own) GPOs in the domain? Is there another way to do this ...
3
votes
1answer
689 views

Will User GPO settings apply to a Computer OU

If I have a GPO that contains a handful of user settings - if i apply this to a OU container which contains computer objects - will those User Policies then apply to any user who logs onto that ...
3
votes
1answer
132 views

W2K8 - Why did GPOs break when I moved them to an OU?

I set up some GPOs and linked them to the top-level domain in the forest. They had security filtering enabled so that they would apply to a particular group, and everything worked great. My GPO tree ...
3
votes
5answers
3k views

How to disable Java across all browsers via registry?

With the known Java threat on the loose, I've pushed a GPO to disable Java within IE. However, I'd like to disable Java across all browsers. Java provides documentation on how to do this via their ...
3
votes
1answer
499 views

SIDs in Active Directory GPO

I am looking into some weird issues with active directory and group policy. This domain has been upgraded from windows NT and has had a few different administrators over the years. I am looking ...
3
votes
1answer
212 views

Can active directory GPO's apply to a group object?

I know I can set up an OU, move user objects in to it, and link a GPO to that OU and that GPO will apply to those users. Is it possible to set up an OU, move a group in to the OU, and have a linked ...
3
votes
4answers
5k views

Printers deployed using Group Policy?

I am trying to deploy three printers on our network. I have added the role of Print and Document Services to our Domain Controller and then added the printers. I have right clicked on the printers ...
3
votes
1answer
527 views

Group Policy Design

I am planning the layout of an Active Directory installation for our organization. I am looking into the use of Group Policy to enforce particular settings, enhance security on our desktops and ...
3
votes
3answers
12k views

Changing IE Home Page through GPO? [duplicate]

Seems this should be simple, but I'm unable to find the combination of GPO options to default the home page so that the user can't change it, but to let them add any of their own home pages to the ...
3
votes
1answer
153 views

Disable TCP/IP Filtering via GPO

Is it possible to disable/overwrite Windows TCP/IP filtering settings via a Group Policy object? I have a server running 2012 R2 which I was setting up RRAS on, and I inadvertently cut myself off ...
3
votes
1answer
36 views

How to easily remove a large number of GPOs from Group Policy Management

I was setting up a group policy when I noticed what appears to be a large number of GPOs created by Kasperky AV. Im positive they were from a failed installation of the management software 2 years ...
3
votes
3answers
20k views

Using a GPO to run a batch file once

Is it possible that I could setup a GPO list for newly installed computers with many batch files (mainly file moving) and these would run only once and never again? I am beginner on this and I ...
3
votes
1answer
387 views

Audit when users log on and off servers

We have contractors periodically remoting into our production servers and goodness know what changes that they could potentially make. So What can I use to log when users log on or off a server(s)? ...
3
votes
1answer
4k views

Where Do I Find The Update URL For Google Chrome Extensions?

I'm trying to setup group policy for Google Chrome (http://support.google.com/installer/bin/answer.py?hl=en&answer=146164) particularily I'm working on setting up the Configuring the list of ...
3
votes
1answer
3k views

Deploying .msi application through GPO doesn't work

I've been trying to deploy the forticlient SSL VPN application (.msi format) into my domain machines, using a GPO. Even though I made a silent previous installation by issuing the command: msiexec /qb ...
3
votes
2answers
2k views

What security context does the Group Policy engine run under on Windows?

More specifically… I would like to create a policy that runs a login script to copy a file from a share to a local folder. What account do I need to grant access to on the share in order for the ...
3
votes
1answer
847 views

Can I move the default domain Administrator account to a new OU without breaking something?

Question really asks it all. I want to apply a GP to the Domain Administrator account, but when I go to GPMC, you don't see the default OUs like Computers or Users listed. Can I move the account to ...
3
votes
4answers
3k views

Need to push a mass desktop background change

I need to find a quick way to change the background on all computers on my domain other than going to each one of them. I have already tried gpedit.msc user configuration/administrative ...
3
votes
1answer
2k views

Modifying Word's Normal template company-wide

We use Word 2003 on all computers; we also use Group Policy to set a shared "workgroup templates" folder, which is really useful as we can just copy .DOT files into there to make them accessible to ...