Hot answers tagged

7

There are two components required for users to log on to a server via RDP: User Rights and Permissions. Rights: Users must have the "Allow logon through Remote Desktop Services" user right. Permissions: Users must have the "User Access" and "Guest Access" permission set to Allow on the RDP-Tcp protocol. By default, users or groups in the local Remote ...


7

You're halfway there if you already have DFS replication set up! What you need to do is configure a DFS namespace. The namespace will give you a single share name that your GPOs can map to, and the DFS service will direct the client to either one of the file servers. (If you have multiple Active Directory sites, one of the functions that it typically does is ...


3

Assuming you have not granted the Everyone object access to any resources, you can just make a local account on the computer(s) that the guest will use. They log on to the computer(s) with that account, and they have not even logged on to the domain, so by default they have no access to any domain resources. If you must use a domain account, create a brand ...


3

This is a poor use case for login scripts. A startup script or a scheduled task can both easily run as the SYSTEM account take care of your software installation. Generally I suggest using some kind of deployment system - SCCM, Patch Manager, Puppet, etc - but there is a quick and dirty solution available if you have a 2008+ domain. Basically it is ...


2

The domain Remote Desktop Users group is for granting access to your Domain Controllers, not your RDS servers. You need to add your domain users and/or groups to the local Remote Desktop Users group on each of your RDS servers. This article was written for Windows Server 2003 but is applicable as it relates to the usage and purpose of the domain Remote ...


2

If the guest user account is an Active Directory account, why don't you go to the user account in Active Directory, go to Properties, go to the Account Tab, Click the Log On To... button, and enter the names of the computers you are going to allow the guest user to logon to? Todd's points should also be considered before you decide how to implement this. If ...


2

@Sentator14 was on the right track, but not quite there. Your problem is that there is no such thing as a local Administrators group on domain controllers. When a DC is promoted, the local SAM database goes away and AD becomes the only source of users and groups. So by configuring a group policy to add a group to the Administrators group on a DC, you are ...


2

The default location for user logon scripts is the NETLOGON share, which, by default, is replicated on all DC in your forest, and is physically located in %SystemRoot%\SYSVOL\sysvol\<domain DNS name>\scripts. If you set a user logon script (ADUC > User > Properties > Logon > Logon-Script > hello.cmd), it is executed from NETLOGON. "Official" best ...


2

Both location are sync'ed between domain controller, thus for me it's only a personal's choice. My personal's opinion is that after over a certain numbers of GPO, having all in netlogon can be hard to manage. (as when you delete a GPO, the script would not be erased in example)


2

Introduction One thing to keep in mind is that unless you're getting into extravagances like containers with blocked inheritance, or security-filtered GPO's, it's redundant to configure the same setting on more than one policy, especially if both policies are linked to the same container. As such, you normally want to create a new GPO, not copy an existing ...


2

You're misunderstanding what Group Policy Inheritance is and what it means. Group Policy Objects don't inherit settings from each other. Changes you make to one GPO are applicable to that GPO, other GPO's won't inherit the settings from another GPO. I'm sure someone else here will post a lengthy and educational answer about Group Policy Inheritance, so I'll ...


2

You are correct that it's generally advisable to leave the Default Domain GPO alone. If I understand your question correctly, you want another GPO that is linked at the same level (i.e. to the domain at the top level,) but if there are any settings in your custom GPO that conflict with what is in the Default Domain GPO, then the settings in your custom GPO ...


2

Are the user accounts in the Windows 10 OU? If not, then that's the problem. The user accounts are outside of the Scope of Management (SOM) of the GPO if they're not in the Windows 10 OU.


2

Set applocker in audit mode, run the install and the eventlog will show you what would have been blocked.


1

As you said, you need to add the to the local Remote Desktop Users group. If you want to set it up "server side", the solution is to create an AD group, add the needed accounts to that group, then create a GPO setting "Restricted groups": http://social.technet.microsoft.com/wiki/contents/articles/20402.active-directory-group-policy-restricted-groups.aspx


1

If you have a numeric keypad on your keyboard you can try to use the ASCII code: Alt+072 for H or ALT+104 for h. Keep the Alt key pressed while entering the numbers on the key pad. You can enter any Unicode characters this way. I often use exotic Unicode characters in my passwords.


1

Outlook will auto download images for addresses in the Safe Senders list. You can push out a Safe Senders list to all clients via Group Policy and/or Registry settings. https://support.microsoft.com/en-us/kb/2252421


1

what I want is for the VMs to be paused before the shutdown script runs. You can't choose when your shutdown script runs with that kind of granularity. But you can pause the VMs yourself from within your script, with a command such as Get-VM | Suspend-VM, before your script does whatever it does that requires that the VMs are paused first. Just spin ...


1

As you suspect, there isn't an easy way to achieve this without an exponential explosion of GPOs. Or by manually assigning groups, which probably isn't an option for you, either. Try looking at your clients from the perspective of roles instead of "what software is installed?" and/or "where is this machine at?" The physical location of the client, after ...


1

Typically you would run the client configuration tool first, which adds the IP address to the MSI. It is in the CAD installation guide. The client configuration package includes an MSI configuration tool and a stand-alone directory structure. The MSI configuration tool prompts the deployment engineer to provide the environment-specific configuration data, ...



Only top voted, non community-wiki answers of a minimum length are eligible