# Tag Info

## Hot answers tagged group-policy

6

Off the top of my head, here are three different ways to do it: You can create an OU for the workstations, move the computer accounts for the workstations to this OU and link the GPO to this OU. You can use Security Filtering to apply the GPO only to your selected workstations. As Greg stated in his answer, you can use a WMI filter to apply it only to ...

6

Use a newer version of the Group Policy Management Console. Ideally, install RSAT on your Windows 7 or newer Workstation and manage it remotely.

5

Create a WMI filter for the GPO: SELECT * FROM WIN32_OperatingSystem where ProductType="1"

4

You can't effectively deny rights to local administrators, since regardless of what GPO you apply, they can always override it at least temporarily by editing the registry. They can also remove the computer from the domain. In general, you shouldn't use or distribute the local administrator accounts in an environment requiring top-down administrative ...

4

You might be able to run a batch file containing something along the lines of powershell c:\path\to\powershellscript.ps1 or powershell \\servername\share\powershellscript.ps1 (You might have to enable powershell on the workstations first.)

2

Software Restriction Policy is deprecated by Microsoft (technet effectively claiming SRP is not supported), since Windows 7 Enterprise/Ultimate introduced AppLocker. In practice SRP has certain pitfalls, for both false negatives and false positives. AppLocker has the advantage that it's still being actively maintained and supported. If AppLocker is ...

2

With 2008 and later, the AGPM console looks for ADMX & ADML files on the sysvol share. Those files are not present until they are manually copied. You can do that with these commands: xcopy %systemroot%\PolicyDefinitions\* %logonserver%\sysvol\%userdnsdomain%\policies\PolicyDefinitions\ xcopy %systemroot%\PolicyDefinitions\EN-US\* ...

2

The trick here is to not have Windows Update do the install via the Automatic Updates mechanism. You can set it to automatically download, but for automatic installs, there's no way to stop the reboot timer from triggering unless there's a user logged into the system, such as with the No auto-restart with logged on users for scheduled automatic updates ...

2

Here's an example of how you can do this to a single user with a script. It's crude but it works well as an example to show the process. $user = Get-ADUser James$homeName = $user.GivenName + " " +$user.Surname $user | Set-ADUser -HomeDirectory \\FileServer\Users\$homeName -HomeDrive H -Credential (Get-Credential) Replace the UNC with your file share, ...

1

Just as a user needs to log out and back in to reflect group membership changes, a computer needs to reboot to reflect group membership changes.

1

GptTmpl.inf is where the security settings are stored, so if that file is not present that would explain why the settings were gone. Hard to determine who or what did this unless you have auditing enabled. Restoring the GPO from backup using Group Policy Management Console is preferred over re-creating it. I would check the antivirus product to ensure it ...

1

As confident and well-written as Joe's answer might be-- and I really wanted to believe him, I think he is wrong. I went back and carefully re-read the explanation of these GPO items. Its clear to me that the 'Retain security log' and the 'Retention method . . ' GPO items are clearly targeting EVENTS (individual line items IN a log), not the archived log ...

Only top voted, non community-wiki answers of a minimum length are eligible