Tag Info

Hot answers tagged

8

You're running into a design-limitation of Offline Files. It is a per-machine cache, enabled and disabled at a per-machine level. Offline Files limits visibility of items to users who are authorized to view them, but there is a single cache on the machine. You can't disable the caching functionality for just certain users on a machine. There just isn't a ...


6

My take is "Group policy needs to be run synchronously". Seriously. The default in Windows 2000 was to run all Group Policy (computer and user) synchronously. Microsoft had materials in their "Official Curriculum" back then that even describe asynchronous policy application as potentially unreliable. You can change this default behavior by using a ...


4

There is no such thing built-in. What you can do is: This takes care of all users who changed their password within the last 76 days (allows for a 14-day-warning-period): Create a group where you apply the 90-day policy Query AD to get all users who have changed the password during the last 76 days Add them to the group This takes care of the rest of ...


3

Most software installation programs for Windows require Administrator rights to function properly. This is an artifact of the design (or lack thereof, some might say) of the Windows platform. While there is an increasing trend toward software that installs only within the writable directories accessible to a limited (i.e. non-Administrator) user (things like ...


3

First, if they are XP, I don't think it'll work at all. But yes, there are firewall settings that must be allowed/set in order for Remote Refresh to work properly. See here: http://technet.microsoft.com/en-us/library/jj572986.aspx Also note: Configure firewall rules by creating a GPO from the Group Policy Remote Update Firewall Ports Starter GPO ...


2

First thing's first. This GPO you reference is a custom GPO. You can't find it for Server 2012 because someone built that option special, and packaged it up into an administrative template for group policy. Therefore, your best option for recreating this as a GPO you can toggle like you have it is to copy the custom admx file and edit in in a text editor ...


2

Here are my notes, i believe you hit the common issue with the Central Store. Installation of GPO files To put the new ADMX files into your Central Store, you need to create a folder like: \domain.example.com\SYSVOL\domain.example.com\Policies\PolicyDefinitions Place the .admx files inside this folder. The existence of the Policies folder is not an ...


1

I suggest looking at Group Policy Preferences - you can set "add this to the registry" directly in a group policy, without the need for a reg file and a script running regedit. Although if you are running XP workstations they need to be on Service Pack 2, possibly with an XML update, to use GPO Preferences.


1

Found a solution to this issue, without needing to go with a full blown synchronous run. Gotta love procmon. The registry keys HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy\Status\GPExtensions\{guid}\ForceRefreshFG are set to 1 whenever a GPP item needs a synchronous run for the currently logged on user. With a little bit of scripting ...


1

Yes - if two enforced policies are applied at the same level, the one that is higher in the list will win. Therefore, if you filter everyone else out of your test policy, this should have the effect that you're looking for.


1

If it is enforced at the same or higher priority level, yes. Here is the order of execution. The setting applied last wins: Local > Site > Domain > OU > OU Enforced > Site Enforced > Domain Enforced The winning enforced settings at the same level are determined by precedence order.


1

I had the same process whoami /priv, causing me to question my own sanity (eventually I manually added the account via secpol.msc and still got "disabled", which made me understand GP isn't the issue). I learnt that backup privileges aren't given by default to any process belonging to a user that has that privilege - processes have to ask for it using ...


1

The note from Microsoft about all subfolders only applies if you specify just a folder, for example C:\Users. This blocks all executables in all subfolders. But as you correctly noted, if you specify C:\Users*.exe to block only files with extension exe, they are only locked in C:\Users, not for example in C:\Users\Tom. I do not have an answer for this ...


1

As best practice, you should be doing this on Exchange but i agree why waste time uploading (especially with limited bandwidth) to a hosted SMTP server when it will be rejected anyway. Open the registry editor and browse to: Outlook 2013: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Preferences Outlook 2010: ...


1

I don't think IP's are the right thing to key off of here. Are you automatically launching your instances into the VPC? If so, you could tag them or give them a 'join_X_group' role that would let them talk to to your DC in that region. Even having a DHCP Options Set that would have them come up with a specific DNS server which could be your DC and then ...


1

In order to get around the issues with deployment using an MSP file, You can use a startup script to call the exe directly and utilize the xml config for additional parameters/ logging. To start, create a share folder and put the Lync 2013 files in it. Make sure you give "domain computers" rights to read and write to this folder (write if you want ...



Only top voted, non community-wiki answers of a minimum length are eligible