Tag Info

Hot answers tagged

6

I've dealt with similar problems in the past. That being said your organization doesn't look too far from ordinary. A lot of small business are built just like you outline. If you really want to restructure the best solution I have found is setting up an OU with block group policy inheritance at the root of your domain. Build your new structure under this ...


5

That's not a very sound recovery strategy. You cannot simply re-create the same naming and expect things to work. Every object in AD has a security identifier (SID). Creating a lot of objects with the same names might look the same to you, but to AD they are all completely different because the SIDs will differ. You should look into the proper way to backup ...


4

I'm going to differ with Tim's answer and say that you ought to look at solving your problem by figuring out why your intended GPO settings aren't working, not by "restructuring" your current setup. Restructuring your current setup isn't going to solve your problem if you're configuring the wrong GPO to begin with. With the exception of a few additional ...


3

The article you linked to says, immediately below those values: To implement multiple exceptions, add the appropriate DWORD value for the desired exception(s) to form a cumulative value. (In actuality, since it's a bit field, you bitwise OR the values together, but arithmetic addition gives you the same result here.)


2

You're looking for Group Policy Loopback Processing. This ensures that the User Settings of a policy applied to a computer is applied to the user account logging on, even if that policy does not directly apply to the user account in question. Combine this with security filtering to ensure that only the members of the AD group that you want to get the ...


2

This is where I'd make the change, in the CurrentControlSet location. You don't need gpedit.msc or anything special, just a registry setting. Set-ItemProperty -Path "registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fSingleSessionPerUser" -Value 0 and to re-enable, set it back to '1'. Set-ItemProperty -Path ...


2

I'm not in the position to confirm this, however the "Policies" registry key is designed for Group Policy and will take precedence. The registry key should be protected from user changes and, depending on the implementation at a software level, it may also prevent changes within the application. There are other considerations with regards to the "Policies" ...


2

This should get you started. Foreach($Policy In Get-ChildItem \\$((Get-ADDomain).DNSRoot)\sysvol\$((Get-ADDomain).DNSRoot)\Policies) { Get-GPO -Guid $Policy.Name | Select * # Now you have an individual GPO. Do something useful with it. # # DisplayName : Terminate Idle and Disconnected RDP Sessions # DomainName : ...


2

You may have to troubleshoot a little further. Are you able to backup other GPOs? Did you try using an alternative admin account? Can you create a test one and back that up? If you can, then I would check permission on the previous GPO where you are receiving the error. There is a powershell command you can use: Backup-Gpo -Name MYGPO -Path ...


1

You can't. At the very least, someone with access to your network will be able to do a network scan and get the hostnames directly from the hosts. Host names are public information that aren't secure and can't be secured, so don't put information you want to secure or restrict in a hostname.


1

You do this at the router, not the PCs. Don't allow the PCs in question to go outside the network; only allow the proxy to go outside the network. Use ACLs or NAT or whatever works for your router. You do need to configure the PCs to use the proxy of course, and either a GPO or WPAD is a good method of doing that.


1

I don't have any authoritative references, but the $HOME, $env:HOMEDRIVE and $env:HOMEPATH variables are user-specific environment variables. It's unlikely that they would get assigned when you start a PowerShell host in the security context of the machine and not the user


1

Hate to answer so late to the party, but this is worth noting... c:\stinger_dl\psexec.exe /accepteula -u domain\admin -p MagicPassword .exe... A login script must of course be on the network where users' accounts can see it. While the chance of most users having both the curiosity and the resourcefulness to find it is low, it's still there, where ...


1

From my tests, the physical shortcut file needs to exist in the following path for it to display on the start screen: %homeshare%\start menu\Programs\ Like you, I couldn't find a way of archiving this using "Export-startlayout". Instead what I've done is put the shortcuts I want deployed in the GPT part of a GPO, I've then created a simply ROBOCOPY ...


1

Your most suitable solution would be to use group policy. Using group policy will allow you to apply a standard path for all computers. This policy can be set by performing the following: Launch 'Group Policy Management Console' and locate the policy called 'Set roaming profile path for all users logging onto this computer'. This is located under ...


1

I solved it by the following procedure: Set every advanced audit configuration item to "Not configured" Run gpupdate /force on the relevant systems Re-set all advanced audit configuration according to your requirements I have created the failing GPO from a template which already had set the advanced audit settings. I guess there was an internal mismatch ...


1

Create a WMI filter that returns TRUE when run on any machine other than your Terminal Server: SELECT * FROM Win32_ComputerSystem WHERE NAME <> 'COMPUTER_NAME_HERE' Create a GPO just for your file-copying logon script and apply the WMI filter to the GPO. Replace the GPO's default Authenticated Users group in Security Filtering with the security group ...



Only top voted, non community-wiki answers of a minimum length are eligible