Tag Info

Hot answers tagged

5

There are settings in the Server 2008/2012 policies that aren't accessible on your 2003 server I believe, such as "Do not connect to any Windows Update Internet locations" under the Computer settings you show above. I believe the settings you are looking for in a 2003 environment are: Disable access to Windows Update The correct policy for v6 ...


5

You can specify the managedBy attribute, and check the box for "Manager can update membership list". (This grants write permission for the Member attribute.) The person(s) who need to edit the group may be able to do it with the DSQuery widget, for which you can create the following shortcut: rundll32 dsquery,OpenQueryWindow They can search for the ...


3

You are probably using a central group policy store. Copy the contents of C:\Windows\Policy Definitions from the newest / most up-to-date server and place them in SYSVOL\domain\policies\PolicyDefinitions. This ensures that whenever you use the group policy management console it will be reading from the same central set of ADMX policy templates. When you ...


2

Based on my experience of removing items from AD, group policy continues to apply and settings do not revert. Since there was an policy disabling the local administrator account in group policy, this caused no end of vexation at $former_employer. I cannot, of course, speak to every item you might have defined via group policy. You might want to ...


2

Not sure I follow... that is the definition of a one-way trust. Users in the trusted domain can access resources in the trusting domain, but not the other way around. Now if you wanted to block users in one domain from even attempting authentication... like not even having network connectivity, then... firewalls.


2

Authenticated Users includes computer accounts. If you want the GPO to apply to only specific computers then remove Authenticated Users from the Security Filtering and add the specific computer object to the Security Filtering (or better yet, a security group containing the computer object).


1

"Load and unload device drivers" should do the trick. (Computer Settings -> Policies -> Security Settings -> Local Policies -> Load and unload device drivers) Be aware that this may grant more privileges than you intend. That said, granting "Load and unload device drivers" to Power Users is arguably more secure than making your users local administrators. ...


1

The script is almost right, I would change it to this as the WUServer and WUStatusServer paths need to be in the parent key. example: # Set the values as needed $WindowsUpdateRegKey = "HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" $WindowsUpdateRootRegKey = "HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\" $WSUSServer = ...


1

As I was figuring out Group Policy I also ran into this problem where the wallpaper wasn't changing even though group policy had been applied and the picture in the menu had changed. This was because Wallpaper settings are a policy that requires a log off before they will apply properly. It took me ages to find a place that actually said that and it was ...


1

I figured out what's causing this, as my GPO settings are correct. The script that I need to run uses a function to force the 32bit version of the scripting host. Function fncForce32bitCscript() Dim strCurrentScriptHost : strCurrentScriptHost = lcase(wscript.fullname) dim strRequiredScriptHost: strRequiredScriptHost = ...


1

I'm not sure you can achieve this - Item Level Targeting is a feature of Group Policy Preferences and, to my knowledge, there's no GPP way of assigning the "Log on as a service" rights. If you could find an equivalent registry key, you may be able to do this but a quick Google has turned up nothing. So, barring that, you'd need a GPO at each "System [x]" ...


1

There is no primary or secondary domain controller, these are old, old, concepts that no longer exist, and a lot of people will get a bit huffy if you carry on referring to a primary and secondary domain controller. In a Windows domain the domain hierarchy time sync has the PDC Emulator domain controller syncing from an internet time source (eg. ...


1

Your biggest problem at the moment is you need to seize the FSMO roles and assign them to your remaining domain controller. Seize the Operations Master Role https://technet.microsoft.com/en-us/library/cc816779(v=ws.10).aspx Probably a good idea to install a second domain controller.



Only top voted, non community-wiki answers of a minimum length are eligible