# Tag Info

27

In late 2012 / early 2013 there was an issue with automatic root certificate updates. The interim fix was to disable the automatic updates, so partly this issue is historical. The other cause is the Trusted Root Certificate program and Root Certificate Distribution, which (to paraphrase Microsoft)... Root certificates are updated on Windows ...

14

Check the patch joeqwerty link too. There is the important detail: Known issues MS16-072 changes the security context with which user group policies are retrieved. This by-design behavior change protects customers’ computers from a security vulnerability. Before MS16-072 is installed, user group policies were retrieved by using the user’s security context....

11

The Automatic Root Certificates Update component is designed to automatically check the list of trusted authorities on the Microsoft Windows Update Web site. Specifically, there is a list of trusted root certification authorities (CAs) stored on the local computer. When an application is presented with a certificate issued by a CA, it will check the local ...

10

Allowing network logon for local accounts is dangerous and a poor security practice. For administrators group members, I would actually characterize it as negligence. It enables lateral movement, and is difficult to detect and audit due to the account logons are not logged centrally (on the domain controllers). To mitigate this threat, Microsoft actually ...

8

To properly disable the Windows 10 upgrade as recommended by microsoft I would advise reading the following article: Ref: https://support.microsoft.com/en-us/kb/3080351 Computer Configuration To block the upgrade by using Computer Configuration, follow these steps Click Computer Configuration. Click Policies. Click Administrative Templates. Click ...

8

Yes you can do this. I use Security Groups and Item-Level targeting that apply to the computers and not to users. Users are moving (or graduating) and the computers for the most part are stationary. What you want to do is in active directory you want to create an OU called something like Printer Groups Create a Security Group under Printer Groups for ...

8

You're halfway there if you already have DFS replication set up! What you need to do is configure a DFS namespace. The namespace will give you a single share name that your GPOs can map to, and the DFS service will direct the client to either one of the file servers. (If you have multiple Active Directory sites, one of the functions that it typically does is ...

8

There are two components required for users to log on to a server via RDP: User Rights and Permissions. Rights: Users must have the "Allow logon through Remote Desktop Services" user right. Permissions: Users must have the "User Access" and "Guest Access" permission set to Allow on the RDP-Tcp protocol. By default, users or groups in the local Remote ...

6

Use a newer version of the Group Policy Management Console. Ideally, install RSAT on your Windows 7 or newer Workstation and manage it remotely.

6

Off the top of my head, here are three different ways to do it: You can create an OU for the workstations, move the computer accounts for the workstations to this OU and link the GPO to this OU. You can use Security Filtering to apply the GPO only to your selected workstations. As Greg stated in his answer, you can use a WMI filter to apply it only to ...

6

Azure active directory cannot be used like this. It is not a replacement for Active Directory (well, at least it isn't at the time of writing). What you want to do is use the intune service in combination with AAD to achieve what you want. I do not believe you will be able to do full GPO, but there are a ton of settings you can configure.

5

Create a WMI filter for the GPO: SELECT * FROM WIN32_OperatingSystem where ProductType="1"

5

Think long and hard about deploying a software package merely for the purpose of enabling some shares. Then keep thinking about it until it seems like a bad idea ;-) Instead, maybe try just enabling the admin shares via GPO. The specific values you are interested in are: HKLM\System\CurrentControlSet\Services\lanmanserver\parameters AutoShareServer and ...

5

Use Group Policy Preferences with Item-Level Targeting to create the shortcuts for each group of users.

5

I believe the reason that the boxes are greyed out is because either 1) you are not an administrator on the machine and therefore do not have permission to modify the security policy, or B) the settings are already managed via Group Policy, which supersedes the ability to manage the settings locally.

5

you could replace that with LAPS

4

You might be able to run a batch file containing something along the lines of powershell c:\path\to\powershellscript.ps1 or powershell \\servername\share\powershellscript.ps1 (You might have to enable powershell on the workstations first.)

4

You can't effectively deny rights to local administrators, since regardless of what GPO you apply, they can always override it at least temporarily by editing the registry. They can also remove the computer from the domain. In general, you shouldn't use or distribute the local administrator accounts in an environment requiring top-down administrative ...

4

Software Restriction Policy is deprecated by Microsoft (technet effectively claiming SRP is not supported), since Windows 7 Enterprise/Ultimate introduced AppLocker. In practice SRP has certain pitfalls, for both false negatives and false positives. AppLocker has the advantage that it's still being actively maintained and supported. If AppLocker is ...

4

Starting with Windows 8, Microsoft introduced this notion of "fast boot", where, when you shut down the OS, they hibernate OS memory footprint just like Hibernate works in normal hibernation scenarios. This results in the OS coming up faster, but it also has the side effect of disabling per-computer GP processing on startup. That is probably what you're ...

4

I managed to solve this problem myself. For reference here's what solved my problem: First, I was wrong in that disabling all blocking of NTLM resulted in the same symptoms. It resulted in a different symptom, that happened to have the same effect. Without any NTLM blocking policies in effect, the dir command now resulted in an access denied error. Group ...

4

Create your text file as RemoteComputers.txt with each computer/server on its own line...nothing else in the file. From the admin workstation/server: Import-Module GroupPolicy Then run the script below: $RemoteComputers = Get-Content -Path C:\Data\RemoteComputers.txt foreach ($computer in $RemoteComputers) { Get-GPResultantSetOfPolicy -Computer$...

4

All the settings no, but doing the following will allow you to import those settings that can be imported 1) Export using the Group policy from the domain and save/copy it to the local machine 2) Grab this tool Microsoft Security Compliance Manager which after install will give you LocalGPO.wsf 3) cscript LocalGPO.wsf /path:C:\path to backup\{42ADD8FE-...

4

The OS compatibility of a particular policy setting varies from setting to setting. The Group Policy Management console will indicate the OS compatibility in the policy item's description. In general, the answer is yes. But there are also some policy settings that only apply to specific OS versions. I don't know specifically about the compatibility of the ...

4

The Group Policy Setting inhibits the upgrade from actually happening. If you click the upgrade icon, you will get a message that the administrator has disabled upgrades. The setting does not kill the offer program (GWX.exe) if it is already running. The official supported method for opting out of the Windows 10 upgrade is documented here: https://support....

4

Use Terminal Server Drain Mode (log any users with a session on the terminal server off before you engage Drain Mode). Turn it off after the maintenance. https://blogs.msdn.microsoft.com/rds/2007/06/15/introducing-terminal-services-server-drain-mode/ EDIT (4/27/2016) (to include logon restrictions) Also, use logon restrictions in Active Directory to ...

4

If you are using legacy password policies, those apply to the entire domain. You may want to research fine-grained password policies. (Note: Fine-grained password policies were originally introduced in Windows Server 2008.)

3

I just ran into this issue on a Windows 10 laptop and learned that it's a known issue with Windows 8/10 and Server 2012. If the reconnect option is checked in the drive map, it will just fail, no errors or issues in event viewer that I could see. As soon as I unchecked the reconnect option, replicated changes and then ran gpupdate /force on the Win 10 ...

3

You can create a Group Policy Preference to accomplish this. Under User Configuration > Preferences > Windows Settings > Files create a new file. Set the source file location \\your.domain\NETLOGON\file.txt Set the destination: C:\Users\%logonuser%\myFolder\file.txt . Any non-existent parent folders in the destination will be created. Then ...

3

No, your example scenario is incorrect. If he's using AD credentials to log in, everything's fine. The issue is with local accounts, that is, ones that are created on, and exist only on, individual computers. For example, .\Administrator, but this applies to any account in the computer's domain (COMPUTERNAME\USERNAME). The security risk ", AIUI, is that if ...

Only top voted, non community-wiki answers of a minimum length are eligible