Group Policy is a built-in feature of the Microsoft Windows operating systems. Group Policy allows administrators to automatically configure myriad options within the OS. These policies can be configured, and applied, either locally to the computer via Local Group Policy or remotely within an ...
7
votes
6answers
3k views
What are the popular (free?) options for application deployment?
I manage a small school network with about 150 machines. I am looking for an easy way to deploy software to all the machines without having to visit each one.
I've used Symantec Ghost to get the ...
6
votes
3answers
673 views
What group-policies have you applied?
I have set about 10 group-policies, and it works OK.
Although, it would be interesting to see what kind of things IT-administrators enforce.
If you have a ton of policies, just show some, that you ...
9
votes
7answers
44k views
Group Policy installation failed error 1274
I'm trying to deploy an MSI via the Group Policy in Active Directory. But these are the errors I'm getting in the System event log after logging in:
The assignment of application XStandard from ...
9
votes
6answers
45k views
How to lock down Windows XP for use as an internet kiosk?
One of our clients, whose website we built, is a manufacturer of ultra-high-end bicycles. They would like to distribute kiosks -- basically, locked-down Windows XP boxes from Dell -- at some of their ...
7
votes
3answers
1k views
How is software deployed via Active Directory?
What are the steps required for deploying a software package via Active Directory / GPO?
10
votes
3answers
16k views
What is the order group policy settings are applied?
So I have been reading the document "Group Policy processing and precedence". I get that policies are applied in the order of local, site, domain, organizational unit, child organizational unit. The ...
3
votes
1answer
1k views
Windows Server 2008 mapped drives not showing on workstations?
I am running Windows Server 2008 Standard Edition with a Windows XP Pro workstation setup as a test unit.
I have added an Organisational Unit called 'Misc Users' and have linked a GP called 'Basic ...
0
votes
2answers
804 views
Managing Users Logging into Multiple Workstations with Group Policy or AD Settings
Has anyone found a good way within Active Directory or Group Policy in order to prevent users from logging into multiple workstations simultaneously?
As a bit of background, I currently am a System ...
9
votes
2answers
6k views
How do I deploy an internal certificate authority?
IE7 aggressively warns about certificate failure; we have some internal sites that run over HTTPS and thus need a valid cert. We appear to have an certificate authority on the intranet that can sign ...
14
votes
9answers
2k views
'Windows Update' Best Practices
I'm finding that most users ignore the "There are updates ready to be installed, click here to install" message that WSUS pushes out. Until now we haven't forced the install but I'm thinking about ...
13
votes
7answers
60k views
Disable password complexity rule in Active Directory
Where do I go to disable the password complexity policy for the domain. I've logged onto the domain controller (Windows Server 2008) and found the option in local policies which is of course locked ...
8
votes
7answers
18k views
Disabling IE add-ons and toolbars with Group Policy?
I'd love to have the peace of mind of knowing that none of my desktops have toolbars, "browser helpers" or any other crap like that running.
Has anybody done this successfully with Group Policy?
I ...
4
votes
6answers
844 views
Locked myself out of Group Policy Editor
I set 'only allow certain applications' restrictions and accidentally applied them across the board to all accounts. Now I'm restricted to only running a browser and can't run the group policy editor!
...
5
votes
1answer
2k views
How do I deploy MS hotfix KB959628 exe/msp via a gpo easily?
I have been given a Microsoft hotfix that I need to deploy over the entire domain. I want to use GPO as the users do not have admin rights and Office was not deployed from an administrative point. It ...
2
votes
1answer
494 views
Unable to restore a backup GPO in Active Directory
I have only recently downloaded the Microsoft Security Compliance Manager and created several "profiles" and exported them as "GPO Backup (folder). No problems there.. Now I have copied the folders ...
1
vote
2answers
567 views
Is it possible to add a local user to the admins group through group policy?
I'd like to have a local user in the admins group for when the computer isn't connected to the domain. Currently I use a start up script to create the user and add it to the admins group. Is there a ...
0
votes
2answers
907 views
Add Group Policy by Script
I'm trying to make it easy to add a LogOff script to Group Policy and am having difficulty finding any information on adding Group Policy via script.
I already have the script I want to run at ...
0
votes
1answer
473 views
How to do folder redirection
I am using the instructions found here: http://www.informit.com/guides/content.aspx?g=windowsserver&seqNum=61 on a windows 2008 machine. My question is in regard to this step:
2.From the left ...
15
votes
4answers
36k views
How do I grant start/stop/restart permissions on a service to an arbitrary user or group on a non-domain-member server?
We have a suite of Windows Services running on our servers which perform a bunch of automated tasks independently of one another, with the exception of one service which looks after the other ...
16
votes
2answers
2k views
What is Group Policy and how does it work?
This is a Canonical Question about Active Directory Group Policy Basics
What is Group Policy? How does it work and why should I use it?
Note: This is meant to be a question & answer to ...
9
votes
1answer
8k views
How can I restrict the java plugin to run only on certain sites in Internet Explorer?
I want to secure our centrally managed computers better and it is very difficult to automatically deploy the java runtime, but how to do that is another question.
I find the security of Java ...
4
votes
1answer
1k views
Deploying Printers to Computers vs. Users via GPO
When I deploy a printer to a computer it only seems to deploy to our Windows XP machines. If I deploy to users it deploys to our Windows XP and 7 machines. When I look in the RSoP Snap-in it shows the ...
8
votes
3answers
1k views
I deployed Flash Player via a Software Installation policy. How to upgrade?
I have a Windows Server 2008 machine as my DC. Earlier this year I created a Software Installation GPO to deploy Adobe Flash Player plugin MSI. I assigned the policy to the computers, about half run ...
7
votes
3answers
280 views
Managing self-updating Windows software in GPO-deployed packages
Being very new to Windows software distribution for a small network (<50 clients) I was wondering how software packages like Adobe's Reader or Java are handled. I can deploy them as MSIs via group ...
6
votes
2answers
19k views
Mapping printers using Group Policy Preferences; works on Windows XP, not on Windows 7 x64
I'm trying to use Group Policy Preferences to manage user connections to shared printers.
The print server is Windows Server 2003 R2 Std edition. Several printers are installed, and I've added x64 ...
4
votes
5answers
778 views
Conficker: Should steps taken in group policy to secure against virus remain?
We got nailed two weeks ago by Conficker, I ran through the 26 step checklist from Mircrosoft on my own computer, as well as on our domain server. It says near the end to reverse all the changes, but ...
3
votes
2answers
6k views
Diagnosing why a Group Policy Object is inaccessible
I have a Windows Server 2003 domain. One of the Group Policy Objects appears as a linked item in an OU but all I can see if the Unique ID and that the Link Status is Enabled. There is a red minus icon ...
3
votes
3answers
21k views
How do I add a URL with a Windows Group Policy into a client's “Local Intranet Zone”?
I'm trying to add a specific web server URL into the local Intranet Zone on my client PCs using a Group Policy. Any ideas what policy to apply?
I can do it via the Internet Explorer Internet ...
2
votes
3answers
603 views
Are there any tools to do change management with Active Directory / Group Policy?
We seem to be having a lot of problems related to "forgetting some mundane detail" while managing our Group Policy settings in Active Directory, so I am curious as to whether there are any ...
5
votes
2answers
4k views
Group policy preferences that only target 32bit or 64bit os
I am currently deploying some files through GPP to a folder under program files. I now have to differ between a 64bits and 32bits os. What is the easy way to filter out what computer to target with ...
4
votes
2answers
6k views
Is it possible to use Group Policy to grant the permission to manage Windows services?
Is it possible to use Group Policy to grant the permission to manage Windows services?
I would really like to know if this is even possible, and if so, where do you recommend I look for more ...
4
votes
6answers
26k views
How can I export all group policies to a easily-parseable format?
I need to dump all the Group Policies within Active Directory to review offline at a later date. Is there a way I can easily export all the Group Policies to text or some other easily-parseable ...
3
votes
3answers
2k views
Is Active Directory Unreliable or is there Another Issue Here?
We have an organization of approximately 1200 Windows PC clients on an Active Directory network. We have noticed that there seems to be random systems that don't get policies set.
For example, we ...
6
votes
2answers
117 views
Correct way to update Google Chrome MSI through Group Policy
I am deploying Chrome through group policy. This is working fine.
Obviously Chrome has a pretty regular update cycle. I am not allowing Domain Users to install Chrome updates.
Having subscribed to ...
6
votes
1answer
2k views
Installing MSI via Group Policy in a Fully Unattended Way
I have some MSI files I would like to install via Group Policy. Does anyone know how to do this or know a document that explains how to do this that meets the following criteria:
When installed by ...
5
votes
1answer
12k views
How to disable autocomplete for passwords in IE8 via GPO?
In IE6 there was a registry key hidden away that would allow you to enable autocomplete but only for usernames, not passwords.
This key no longer has any effect in IE8. I can either enable or disable ...
4
votes
1answer
709 views
“Touching” software deployment group policy programmatically or via script
I have an internal application that uses the Windows Installer. Each update to this application is a "major upgrade" (different product code, same upgrade code) and it calls RemoveExistingProducts. ...
4
votes
1answer
6k views
Windows cannot access the file gpt.ini for GPO CN={31B2F340-016D-11D2-945F-00C04FB984F9}
I'm in the middle of a "swing" migration from Windows SBS 2003 to Server 2003 Standard.
It's going okay so far but we're getting event 1058 on client machines:
Windows cannot access the file gpt.ini ...
3
votes
3answers
8k views
Changing IE Home Page through GPO?
Seems this should be simple, but I'm unable to find the combination of GPO options to default the home page so that the user can't change it, but to let them add any of their own home pages to the ...
2
votes
1answer
361 views
Wireless Profile via Group Policy - Specific Trusted Root not Listed?
So I am trying to use Group Policy to configure the wireless settings on a bunch of laptops. We are using a third party cert that isn't showing up as an option in the list of Trusted Root ...
2
votes
6answers
2k views
Disable group policy from a workstation [closed]
How can I, as a Workstation Administrator, disable Group Policy on that workstation?
The Domain Administrator is feeding utter garbage via Group Policy and I want it stopped.
Last antic: turning on ...
1
vote
4answers
10k views
Run a .REG file in a logon script where regedit is disabled?
I need to run a .REG to add entries to the registry on logoff, but our GP environment disables regedit. I could probably accomplish this by turning regedit on, running the script, and then turning it ...
0
votes
1answer
84 views
Chrome Flash Updates in a Domain environment
One of the business critical applications for us is powered by Adobe Flash. Naturally, this comes with plenty of associated problems.
The company wide browser in use is Google Chrome. We run a ...
0
votes
1answer
792 views
Battling with Office 2007/2010 GPOs
I just set a GPO for the Shared Themes Path for the entire Office 2007 and 2010 suite using the Group Policy: User Policy --> Administrative Templates --> Microsoft Office 2007 System --> ...
4
votes
1answer
628 views
Syncing Domain Controller Clocks
It appears some computers in our computer lab have clocks running about 3-4 minutes fast.
As of right now, when we join a computer to the domain, it sets the clock based on our server's Domain ...
4
votes
5answers
14k views
Push new registry keys via group policy
Recently I have added registry keys in active directory and I need to push them via group policy instead of going to each PC to apply the new ones.
How can I push new registry keys (not modify ...
4
votes
3answers
1k views
Auto Log-Off Windows users - Windows 2003 domain
I am trying to make windows clients automatically log off after some time, I have been trying to use the winexit.scr which I have seen working else where in a similar environment.
After working ...
3
votes
3answers
9k views
Domain User can RDP into Domain Controller?
Vanilla Windows Server 2008 x64 Standard DC (AD, DNS). I was remoting into my DC to do a bit of work and, thru force of habit, logged into the server using a regular domain account, not a domain ...
2
votes
2answers
110 views
Setting up GPO to apply upon SSTP VPN login
I have successfully setup up a VPN connection to an EC2 instance of Windows Server 2008 using SSTP. How do I get GPOs to apply upon VPN login?
2
votes
1answer
450 views
Site-specific folder redirection through group policy
Suppose I have two sites - A and B - both with 5/5 Mbps WAN links that are connected via L2L VPN. Each Site is defined in AD Sites 'n Services with its own domain controllers, etc. The problem is that ...
