Group Policy is a built-in feature of the Microsoft Windows operating systems. Group Policy allows administrators to automatically configure myriad options within the OS. These policies can be configured, and applied, either locally to the computer via Local Group Policy or remotely within an ...

learn more… | top users | synonyms (1)

43
votes
5answers
103k views

How do I grant start/stop/restart permissions on a service to an arbitrary user or group on a non-domain-member server?

We have a suite of Windows Services running on our servers which perform a bunch of automated tasks independently of one another, with the exception of one service which looks after the other ...
34
votes
7answers
160k views

Disable password complexity rule in Active Directory

Where do I go to disable the password complexity policy for the domain? I've logged onto the domain controller (Windows Server 2008) and found the option in local policies which is of course locked ...
32
votes
3answers
2k views

Why are many admins using 'Turn off Automatic Root Certificates Update' Policy?

My company distributes a Windows Installer for a Server based product. As per best practices it is signed using a certificate. In line with Microsoft's advice we use a GlobalSign code signing ...
28
votes
10answers
119k views

Group Policy installation failed error 1274

I'm trying to deploy an MSI via the Group Policy in Active Directory. But these are the errors I'm getting in the System event log after logging in: The assignment of application XStandard from ...
22
votes
3answers
16k views

What is Group Policy and how does it work?

This is a Canonical Question about Active Directory Group Policy Basics What is Group Policy? How does it work and why should I use it? Note: This is a Question & Answer to new ...
21
votes
3answers
130k views

Registry key / GPO to disable and block Windows 10 upgrade?

One of our remote Windows 7 Professional users just reported that he received an Upgrade Reservation Offer for Windows 10. It appears the Get Windows 10 "App" running in his system tray is legit. So ...
20
votes
1answer
1k views

How to time-bomb a GPO?

I am doing a lot of work in higher education where it is a rather common requirement to reconfigure a number of Windows domain members (e.g. PCs in a classroom) for the duration of a specific course ...
16
votes
3answers
17k views

How do you manage Java in your Windows/Active Directory environment?

Like I suppose a lot of people, we have a Windows/Active Directory environment and a lot of internal line of business apps that require Java. Our experience is that Java does not play nice in such a ...
15
votes
4answers
4k views

What can be done to properly re-enable the Windows Firewall on a domain?

BACKGROUND/RESEARCH I honestly believe that questions like this one: Using GPO in Active Directory domain to force workstations Windows Firewall to disabled - how? existed because Windows Admins in ...
14
votes
9answers
2k views

'Windows Update' Best Practices

I'm finding that most users ignore the "There are updates ready to be installed, click here to install" message that WSUS pushes out. Until now we haven't forced the install but I'm thinking about ...
14
votes
3answers
4k views

Windows 2008 R2 CA and auto-enrollment: how to get rid of >100,000 issued certificates?

The basic problem I'm having is that I have >100,000 useless machine certificates cluttering up my CA, and I'd like to delete them, without deleting all certs, or time jumping the server ahead, and ...
14
votes
1answer
358 views

Group Policy Result summary says DC is member of “BUILTIN\Administrators”

Whenever I run the Group Policy Result wizard and select a Domain Controller as the target computer, the summary shows BUILTIN\Administrators in the list of "Security Group Membership when Group ...
13
votes
5answers
23k views

Disable Windows Server Network Locations

I'm not sure what exactly this feature is called. But in Windows Server 2008, it has the Vista Public/Private/Domain locations. This makes sense for laptops, and none at all for servers. My problem ...
13
votes
4answers
5k views

How can I make WSUS less invasive for our users?

We have WSUS pushing updates out to our user's workstations, and things are going relatively well with one annoying caveat: there seems to be an issue with a pop-up being displayed in front of some ...
13
votes
3answers
21k views

What is the order group policy settings are applied?

So I have been reading the document "Group Policy processing and precedence". I get that policies are applied in the order of local, site, domain, organizational unit, child organizational unit. The ...
13
votes
2answers
383 views

What is the industry standard method for administering the change of the local administrator password for all machines on a domain?

Although there appears to be three available options, one of which is actually secure, there seems to be only two available choices that will be able to impact machines that are not powered on at the ...
13
votes
1answer
10k views

Prevent IE10 from creating WebCache through Group Policy

IE10 implemented the WebCache which appears to be the new way of doing Temporary Internet Files. The location of this is C:\Users\\AppData\Local\Microsoft\Windows\WebCache In my situation we have a ...
12
votes
7answers
18k views

Why is this preventing me installing an MSI: The System Administrator has set policies to prevent this installation

I am trying to install an MSI on a Windows Server 2012 machine which is part of my lab domain. I am local and domain admin, but I seem to be prevented from installing this MSI. For clarification, ...
11
votes
2answers
14k views

How can I manipulate Windows 7 Libraries via Group Policy?

I'm trying to add and remove Library locations from Windows 7's "Library" locations in for each of my users. While its easy to do this from the desktop, and its easy to disable libraries appearing ...
11
votes
6answers
51k views

How to lock down Windows XP for use as an internet kiosk?

One of our clients, whose website we built, is a manufacturer of ultra-high-end bicycles. They would like to distribute kiosks -- basically, locked-down Windows XP boxes from Dell -- at some of their ...
11
votes
8answers
33k views

Disabling IE add-ons and toolbars with Group Policy?

I'd love to have the peace of mind of knowing that none of my desktops have toolbars, "browser helpers" or any other crap like that running. Has anybody done this successfully with Group Policy? I ...
10
votes
6answers
13k views

Group Policy: Administrator Rights for Specific Users on Specific Computers

I'm a programmer stuck trying to administer an Active Directory setup for a small company. The Domain Controller is running Windows Small Business Server 2008. We have a staff of field workers using ...
10
votes
5answers
24k views

Applying a GPO to one user on one computer only

I have a GPO that I need to apply to the user DOMAIN\DumbGuy, but only when he logs on to DOMAIN\DumbGuysComputer$. When DOMAIN\NiceReceptionist logs on to DOMAIN\DumbGuysComputer$ it should not ...
10
votes
2answers
786 views

Warn user if they try to logoff

I want a certain local user to not log off. ever. It's much like this silly question, however I don't necessarily care if the buttons are there, I want to pop up a messagebox that says "Please do not ...
10
votes
3answers
4k views

Deploying Printers via GPO/GPP - is there a programmatic option?

For reasons beyond my control, I've been tasked with setting up GPO/GPPs to deploy our 100+ printers to our 1000+ clients. The good news is that we have over a dozen sites, and for the most part, I'm ...
10
votes
2answers
5k views

How can I stop .exe's being ran from removeable media, such as USB drives?

I have an issue with users running .exe's from removable storage such as Memory Sticks and SD cards. I am trying to set up blocking of exe's being ran from all removable storage to combat this, ...
10
votes
1answer
16k views

How can I restrict the java plugin to run only on certain sites in Internet Explorer?

I want to secure our centrally managed computers better and it is very difficult to automatically deploy the java runtime, but how to do that is another question. I find the security of Java ...
10
votes
2answers
6k views

Can I deny “Internet Explorer” via GPO and use Google Chrome as a default and the only Browser?

Can I deny "Internet Explorer" via GPO and use Google Chrome as a default and the only Browser? I wonder as Internet Explorer is a part of an Windows operating system, if it's possible to deny it. ...
10
votes
2answers
14k views

How do I deploy an internal certificate authority?

IE7 aggressively warns about certificate failure; we have some internal sites that run over HTTPS and thus need a valid cert. We appear to have an certificate authority on the intranet that can sign ...
10
votes
8answers
22k views

ActiveSync devices causing accounts to lockout

When a user changes his account password for whatever reason (read: expired), and the old password is stored in his mobile device connected through EAS. This will cause his account to lockout almost ...
10
votes
2answers
2k views

How to enable BitLocker with no prompts to the end user

I have configured BitLocker and TPM settings in Group Policy such that all the options are set and the recovery keys stored in Active Directory. All our machines are running Windows 7 with a standard ...
9
votes
6answers
8k views

What are the popular (free?) options for application deployment? [closed]

I manage a small school network with about 150 machines. I am looking for an easy way to deploy software to all the machines without having to visit each one. I've used Symantec Ghost to get the ...
9
votes
1answer
8k views

Two ways of deploying printers via group policy

I've noticed two options for deploying printers via group policy: Create and link Group Policy in GP Management, add printer(s) via User Configuration > Preferences > Control Panel Settings > ...
9
votes
2answers
170 views

Need explanation of why a particular GPO is applied to all domain computers

I'm a little stumped on this one so I'm hoping someone can enlighten me, since I consider myself a pretty knowledgeable GPO person. I have a login banner GPO that changes the Interactive Logon: ...
9
votes
3answers
6k views

Will GPO Software Installation re-install already installed applications from a different policy?

I'm looking to install our latest AV suite through a GPO Software Installation policy. (As in the below screenclip.) Unfortunately my request to use DFS has been denied and I'll need to create a ...
9
votes
3answers
6k views

Applocker vs Software restriction policy

The goal is to prevent users from running unwanted programs on a terminal server. I have read many articles from Microsoft and others saying that the new Applocker feature is 100% better than the ...
9
votes
2answers
4k views

Everything says Applocker is supposed to work: Why doesn't it?

I've setup a basic group policy consisting of the default Applocker rules. Per Microsoft's technet article on the subject, any files not explicitly allowed to run by the policy are supposed to be ...
9
votes
4answers
2k views

Windows 2003 GPO Software Restrictions

We're running a Terminal Server farm in a Windows 2003 Domain, and I found a problem with the Software Restrictions GPO settings that are being applied to our TS servers. Here are the details of our ...
9
votes
1answer
38k views

Internet Explorer 9 & 10 Group Policy Preferences missing

I have a single Domain Controller network (Windows Server 2008 R2, running on the 2003 Forest/domain level), with the clients currently migrating from WinXP Pro to Win7 Pro. I Need to control the ...
8
votes
4answers
7k views

I deployed Flash Player via a Software Installation policy. How to upgrade?

I have a Windows Server 2008 machine as my DC. Earlier this year I created a Software Installation GPO to deploy Adobe Flash Player plugin MSI. I assigned the policy to the computers, about half run ...
8
votes
3answers
3k views

How is software deployed via Active Directory?

What are the steps required for deploying a software package via Active Directory / GPO?
8
votes
4answers
16k views

How do I disable remote printers using group policy

When I configure a new remote desktop connection to connect to servers I often forget to uncheck the option inside of local devices and resources for remote printers. This creates exceptions in the ...
8
votes
4answers
4k views

Speeding up Group Policy, and how will implementing Group Policy Preferences impact logon time?

I'm looking for some advice on speeding up and upgrading our logon system to make it more robust and faster. I inherited an older logon system, which was migrated over from Novell Netware originally. ...
8
votes
7answers
26k views

What is the best (free) tool to wrap an .exe into a MSI?

I'm looking at deploying some software via GPSI and the current version of the software is distributed as a .exe so I need to convert it to an MSI file. furthermore, why does MS still distribute some ...
8
votes
3answers
145k views

How to set the Internet Explorer Home Page via GPO?

I need to set the default home page for the entire domain via GPO. Where is the IE Home Page Policy located?
8
votes
3answers
7k views

Local Admin user via GPO

I have a Windows 2008R2 DC (Just setup), we already had around 25 Windows 7 professional / ultimate clients, which we are now going to join to our new domain / dc. Users were already using the ...
8
votes
1answer
19k views

What takes precedence when multiple, conflicting GPOs apply to the same OU?

If two or more GPOs are applied to the same OU (and they have contradictory policies), which would be applied? For example, if there is a GPO with the computer policy "Enable autoplay on all drives" ...
8
votes
7answers
13k views

Locked myself out of Group Policy Editor

I set 'only allow certain applications' restrictions and accidentally applied them across the board to all accounts. Now I'm restricted to only running a browser and can't run the group policy editor! ...
8
votes
2answers
4k views

How do I block inheritance/application of a single GPO?

Due to the workload generated by recent ransomware outbreaks (Cryptolocker/Cryptowall/etc.), I was recently tasked with implementing Software Restriction policies to block program execution from ...
8
votes
7answers
965 views

Is there a way to audit AD for a particular password?

Is there a way I can audit AD to check for a particular password? We used to use a "standard" password for all new users (e.g. MyPa55word). I want to make sure this is no longer in use anywhere on ...