Group Policy is a built-in feature of the Microsoft Windows operating systems. Group Policy allows administrators to automatically configure myriad options within the OS. These policies can be configured, and applied, either locally to the computer via Local Group Policy or remotely within an ...

learn more… | top users | synonyms (1)

4
votes
1answer
216 views

Merging group policies

So basically, we have a dozen or more group policies which make the process of applying/changing/adding new policies a PITA. What I want to do is merge all the policies together and basically end up ...
4
votes
2answers
14k views

How can I edit local security policy from a batch file?

I am trying to write a utility as a batch file that, among other things, adds a user to the "Deny logon locally" local security policy. This batch file will be used on hundreds of independent ...
4
votes
3answers
2k views

Auto Log-Off Windows users - Windows 2003 domain

I am trying to make windows clients automatically log off after some time, I have been trying to use the winexit.scr which I have seen working else where in a similar environment. After working ...
4
votes
1answer
453 views

How to define the built-in administrators group in a group-policy object?

How do I define the built-in administrators group in a group policy? For example Computer Configuration => Policies => Windows Settings => Security Options => Local Policies => User ...
4
votes
1answer
5k views

Installing Lync 2013 Standard silently

I am trying to find a good way to deploy Lync 2013 standard & basic clients silently on computers with Windows 7 / Office 2010 & ahve a few roadblocks. 1) I am successful installing the ...
4
votes
1answer
2k views

What is the relationship between User Rights Assignment Policies vs. Membership of Local Groups

I just spent the better part of this morning on a support call with a vendor where we eventually resolved our issue by manually adding the service account their application was using to the following ...
4
votes
1answer
13k views

Local Group Policy not updating. RSOP and GPResult show stale data

This issue exists on a Windows 7 Pro x64 machine (Dell Inspiron E6420). I am trying to adjust a setting using gpedit.msc, but the change never seems to take effect. By that, I mean that setting that ...
4
votes
2answers
2k views

Managing Windows 8 Start Screen Tiles

Using DISM (Deployment Image Servicing and Management) it is possible to customize the initial Windows 8 Start Screen, although not in any satisfactory way. Is there an effective way to manage the ...
4
votes
1answer
1k views

Printers intermittently not being set as default

We have a lab of computers with printers being deployed to and set as default with Group Policy Preferences, but we're getting a large number of users who don't pick up the default settings. There's ...
4
votes
2answers
942 views

Group Policy GPO not 'seen' at client

I have a new OU (natorg.local\NATO\Users) that I am trying to apply GP to. I have created a new user in this OU, and linked the 3 GPO's to this OU: DESKTOP - Folder Redirection (AppData) DESKTOP - ...
4
votes
1answer
1k views

What does “Use mandatory profiles on the RD Session Host server” do?

The description for "Use mandatory profiles on the RD Session Host server" is a little ambiguous: This policy setting allows you to specify whether Remote Desktop Services uses a mandatory ...
4
votes
1answer
3k views

Group Policy Client failed the logon - Access Denied?

Background We have a Server 2008 R2/Win7 domain. We have teachers and students using Windows 7 workstations, deployed via SCCM. Students all refer to a shared profile (\\dfsroot\\profiles\student, ...
4
votes
2answers
650 views

Does Group Policy detect installed version before downloading an MSI from network

I used group policy to deploy an Adobe Reader X .msi file, which successfully updated the machines it was targeted to. The computer group those machines belong to still has a link to the GPO which ...
4
votes
1answer
3k views

How do I package this vbscript as a msi for Group Policy

I had a developer that is no longer with us create an msi to do this for me, but the package is outdated now and we need to deploy new files. Basically I need to do the following: Take the code at ...
4
votes
1answer
2k views

How can I disable the “Do you want to allow this website to open a program on your computer?” warning for a specific program/moniker?

I've been playing with new URL monikers in Windows for a utility I'm working on. When I run the new URL from Start > Run, it just runs. If I send the URL to myself via Notes or enter it into the IE ...
4
votes
1answer
538 views

GPO startup script not being ran

I am unable to get a GPO to run a script on startup. The script creates a shared folder on each machine in a group of windows 8 machines. The script itself works great, but attaching it to a GPO is ...
4
votes
1answer
2k views

Consistently slow domain logins / folder redirection

I've been trying to diagnose slow logins to my domain. One of my first stops was Domain login very slow 10+ minutes. So far I've been able to tell it has to do with my policy that applies folder ...
4
votes
3answers
1k views

How can I create a windows shutdown script from powershell/command-line?

I've read the TechNet pages that describe using computer/user startup/shutdown scripts, and that's great, but I'd like to create those scripts via the command-line (and not have to click around in ...
3
votes
2answers
286 views

GPO option for “Show Desktop Icons”?

Is there a GPO setting (Server 2008 R2 domain) that we can use to set the following desktop property? View > Show Desktop Icons
3
votes
3answers
1k views

How do I make on Domain Controller be used more to logon than another Domain controller on the same network?

I am currently working in an environment where there are 2 DC's running and another DC that is a backup but is currently running as well so that if the other 2 fail, the backup has everything needed ...
3
votes
5answers
6k views

Implications of allowing Windows clients to use NTLMv1?

I have a web application that I'd like to authenticate to using pass-through NTLM for SSO. There is a problem, however, in that NTLMv2 apparently will not work in this scenario (without the ...
3
votes
2answers
8k views

Password policy vs password never expires question

I'm new to the Server administration game. I'm about to push out my first group policy concerning passwords. I'm going to do something simple. Use MS's built in complexity requirements and an max ...
3
votes
9answers
4k views

Windows domain password policy advice

I have windows domain that needs a password policy. Right now there isn't one. Anyone have feedback on a good balance between weak passwords and users having passwords so strong they just write them ...
3
votes
3answers
10k views

How do I add items to 'Favorites' via GPO?

How do I add items to all users 'Favorites', preferably via GPO? the screenshot is just an example from W7 but I'm actually working with 2008R2 Server and RDS
3
votes
3answers
16k views

How do you override a GPO with another GPO?

If there is a GPO which is applied to all Domain Computers which disables something, is there a way to re-enable the disabled thing for some hosts in the domain, without taking those hosts out of the ...
3
votes
4answers
880 views

Is it alright to turn off firewall in a LAN using Group Policy?

Is it a good idea or common practice to completely turn off windows firewall in an AD domain using Group Policy? At this time, even the servers' firewall are turned off. The only device not affected ...
3
votes
3answers
4k views

Automatically disable the “Manage Your Server” screen on Windows 2003?

Is there a line I can add to my login scripts or something with GPO to prevent the "Manage Your Server" screen from showing up when I log in to a Windows 2003 Server?
3
votes
5answers
549 views

Recommendations for learning to use Server 2003 (or possibly 2008)

I am currently an IT employee who works primarily with hardware/software desktop support, as well as various projects. I feel like I need to learn more about server/network administration and my ...
3
votes
2answers
718 views

Installing MSI Before User Logon

I have a requirement to install a MSI's to our workstations before logon, it's periodically updated and provides updates to our LOB applications. The problem we are encountering is when setting logon ...
3
votes
2answers
988 views

GPO Enforced Precedence

What is the precedence for Enforeced GPOs, I can't really find any MS articles which give a refined answer. My current understanding is as follows: Lets say we have 5 GPO's - GPO1 through GP05. I ...
3
votes
3answers
138 views

Precedence for GPO

I'm just trying to find what takes precedence in loading a GPO. Specifically, will drives map prior to scripts running? I have an .exe in a network share that I'm running every time a user logs in, ...
3
votes
4answers
325 views

GPO: Deploying software

I've set up a lab with 3 machines (2 Win7, 1 Win8) with the host being Win2008R2 acting as the DC (ADUC installed etc..). I've created a software package GPO and linked it to my domain: Here's the ...
3
votes
4answers
10k views

What Group Policy settings MUST be set within the Default Domain Policy?

Does anyone have an authoritative source of policies that, if set, MUST be set within the Default Domain Policy (if one chooses to set them)? Off the top of my head, I know that password policies and ...
3
votes
2answers
2k views

Distributing Files using a Group Policy on Windows Server 2003

A piece of software that we use at our office has recently moved to a new licensing system. This means that from now on a new set of license key files will need to be distributed to each of our 25 ...
3
votes
2answers
8k views

What URLs must be in IE's Trusted Sites list to allow Windows Update?

Particularly for servers in which IE Enhanced Security Configuration is enabled, you need to have all the Windows Update/Microsoft Update URLs in your "Trusted Sites" list in order to use the site. ...
3
votes
4answers
18k views

Diagnosing why a Group Policy Object is inaccessible

I have a Windows Server 2003 domain. One of the Group Policy Objects appears as a linked item in an OU but all I can see if the Unique ID and that the Link Status is Enabled. There is a red minus icon ...
3
votes
4answers
14k views

How to disable WSUS on our domain?

Our Network Admin, who toughed it out for 3 months here, setup a virtual WSUS server and added Group Policy to enforce a WSUS policy on about 1/3 of our workstations. The virtual WSUS server has since ...
3
votes
2answers
725 views

Setting up printers in active directory

I need some help setting up a printer in Active Directory. Specifically, deploying them via GPO. I want to have a computer associates with a specific shared computer so that anyone sitting there is ...
3
votes
2answers
3k views

Set Time Zone for all Windows Servers on a Domain (2008 R2)

Is there a way I can set the time zone for all machines on my domain (perhaps using a group policy?). All the Windows machines are Server 2008 R2.
3
votes
2answers
61 views

Is there a way to determine which client machines have installed software from a GPO?

If I assign software with a GPO, I assume that client machines will install this next time they reboot. However, I can't be certain without actually going to each of the clients and checking myself. ...
3
votes
2answers
6k views

WPA2 Personal - Deploying via GPO

I've got 300+ win7 clients I need to deploy WPA2 Personal PSK on. I can use a GPO to deploy the SSID information on the clients which is good but not the PSK. Is there a clean/easy way to script it ...
3
votes
3answers
10k views

Domain User can RDP into Domain Controller?

Vanilla Windows Server 2008 x64 Standard DC (AD, DNS). I was remoting into my DC to do a bit of work and, thru force of habit, logged into the server using a regular domain account, not a domain ...
3
votes
2answers
7k views

How to have downloads be automatically unblocked?

Downloaded exe files requires me to open the properties of the file and click on "Unblock" because "This file came from another computer and might be blocked to help protect this computer." ...
3
votes
4answers
2k views

Update group policy installed software without requiring a log off

Our IT Support Dept. releases an internal software product that I write via group policy. Is it possible to force an update of a particular group policy software install without asking the users to ...
3
votes
3answers
2k views

Managing applications like Acrobat Reader and Flash player via Windows GPO?

Without using additional software, how are people managing software like Acrobat Reader and Flash Player in a Windows domain? I can deploy these applications via GPO software installation. Am I ...
3
votes
1answer
424 views

SID in AD - SID from psgetsid?

Wondering if anyone can shed some light on some SID confusion. Currently having an issue with some policy applying to a few machines that were all based off the same image. One of our admins, ran ...
3
votes
3answers
747 views

Update a network driver through GPO/AD

Our organization has just deployed new computers with Windows 8.1. Roughly 50 of them. We've run into an issue with the driver on the new computers which is flooding the network with ipv6/multicast ...
3
votes
1answer
288 views

Permission to create GPOs

Is the sole reason of the Group Policy Creator Owner group just to dish out permissions to other users to create (and then modify only their own) GPOs in the domain? Is there another way to do this ...
3
votes
1answer
1k views

Will User GPO settings apply to a Computer OU

If I have a GPO that contains a handful of user settings - if i apply this to a OU container which contains computer objects - will those User Policies then apply to any user who logs onto that ...
3
votes
1answer
161 views

W2K8 - Why did GPOs break when I moved them to an OU?

I set up some GPOs and linked them to the top-level domain in the forest. They had security filtering enabled so that they would apply to a particular group, and everything worked great. My GPO tree ...