Hot answers tagged

27

In late 2012 / early 2013 there was an issue with automatic root certificate updates. The interim fix was to disable the automatic updates, so partly this issue is historical. The other cause is the Trusted Root Certificate program and Root Certificate Distribution, which (to paraphrase Microsoft)... Root certificates are updated on Windows ...


11

The Automatic Root Certificates Update component is designed to automatically check the list of trusted authorities on the Microsoft Windows Update Web site. Specifically, there is a list of trusted root certification authorities (CAs) stored on the local computer. When an application is presented with a certificate issued by a CA, it will check the local ...


10

Nope. The "Hide extensions for known file types" is a preference that you can set via Group Policy. And if it's only a preference, then the user can undo it. Basically, as long as the user has write/modify access to the file, they can rename it to whatever they wish. It's not a Group Policy thing, but an NTFS thing. The only way to really prevent a user from ...


10

Allowing network logon for local accounts is dangerous and a poor security practice. For administrators group members, I would actually characterize it as negligence. It enables lateral movement, and is difficult to detect and audit due to the account logons are not logged centrally (on the domain controllers). To mitigate this threat, Microsoft actually ...


10

Check the patch joeqwerty link too. There is the important detail: Known issues MS16-072 changes the security context with which user group policies are retrieved. This by-design behavior change protects customers’ computers from a security vulnerability. Before MS16-072 is installed, user group policies were retrieved by using the user’s security context....


8

Are you sure it is not linked at site level? You should check this in the GPMC, under Sites (right click and choose "Show sites" and show all the sites).


8

Yes you can do this. I use Security Groups and Item-Level targeting that apply to the computers and not to users. Users are moving (or graduating) and the computers for the most part are stationary. What you want to do is in active directory you want to create an OU called something like Printer Groups Create a Security Group under Printer Groups for ...


7

To properly disable the Windows 10 upgrade as recommended by microsoft I would advise reading the following article: Ref: https://support.microsoft.com/en-us/kb/3080351 Computer Configuration To block the upgrade by using Computer Configuration, follow these steps Click Computer Configuration. Click Policies. Click Administrative Templates. Click ...


7

You're halfway there if you already have DFS replication set up! What you need to do is configure a DFS namespace. The namespace will give you a single share name that your GPOs can map to, and the DFS service will direct the client to either one of the file servers. (If you have multiple Active Directory sites, one of the functions that it typically does is ...


7

There are two components required for users to log on to a server via RDP: User Rights and Permissions. Rights: Users must have the "Allow logon through Remote Desktop Services" user right. Permissions: Users must have the "User Access" and "Guest Access" permission set to Allow on the RDP-Tcp protocol. By default, users or groups in the local Remote ...


6

Off the top of my head, here are three different ways to do it: You can create an OU for the workstations, move the computer accounts for the workstations to this OU and link the GPO to this OU. You can use Security Filtering to apply the GPO only to your selected workstations. As Greg stated in his answer, you can use a WMI filter to apply it only to ...


6

Use a newer version of the Group Policy Management Console. Ideally, install RSAT on your Windows 7 or newer Workstation and manage it remotely.


5

is my first time i try to help I had this problem also, and i solve it using dns defaul behavior Prioritizing local subnets https://technet.microsoft.com/en-us/library/cc787373(v=ws.10).aspx So in your case just need to create a A Record for your sites fs Servers with the name SRV01 And then just create one gpo to mount And add the default print with ...


5

Create a WMI filter for the GPO: SELECT * FROM WIN32_OperatingSystem where ProductType="1"


5

Think long and hard about deploying a software package merely for the purpose of enabling some shares. Then keep thinking about it until it seems like a bad idea ;-) Instead, maybe try just enabling the admin shares via GPO. The specific values you are interested in are: HKLM\System\CurrentControlSet\Services\lanmanserver\parameters AutoShareServer and ...


5

Use Group Policy Preferences with Item-Level Targeting to create the shortcuts for each group of users.


5

I believe the reason that the boxes are greyed out is because either 1) you are not an administrator on the machine and therefore do not have permission to modify the security policy, or B) the settings are already managed via Group Policy, which supersedes the ability to manage the settings locally.


4

Software Restriction Policy is deprecated by Microsoft (technet effectively claiming SRP is not supported), since Windows 7 Enterprise/Ultimate introduced AppLocker. In practice SRP has certain pitfalls, for both false negatives and false positives. AppLocker has the advantage that it's still being actively maintained and supported. If AppLocker is ...


4

You might be able to run a batch file containing something along the lines of powershell c:\path\to\powershellscript.ps1 or powershell \\servername\share\powershellscript.ps1 (You might have to enable powershell on the workstations first.)


4

You can't effectively deny rights to local administrators, since regardless of what GPO you apply, they can always override it at least temporarily by editing the registry. They can also remove the computer from the domain. In general, you shouldn't use or distribute the local administrator accounts in an environment requiring top-down administrative ...


4

Starting with Windows 8, Microsoft introduced this notion of "fast boot", where, when you shut down the OS, they hibernate OS memory footprint just like Hibernate works in normal hibernation scenarios. This results in the OS coming up faster, but it also has the side effect of disabling per-computer GP processing on startup. That is probably what you're ...


4

I managed to solve this problem myself. For reference here's what solved my problem: First, I was wrong in that disabling all blocking of NTLM resulted in the same symptoms. It resulted in a different symptom, that happened to have the same effect. Without any NTLM blocking policies in effect, the dir command now resulted in an access denied error. Group ...


4

Create your text file as RemoteComputers.txt with each computer/server on its own line...nothing else in the file. From the admin workstation/server: Import-Module GroupPolicy Then run the script below: $RemoteComputers = Get-Content -Path C:\Data\RemoteComputers.txt foreach ($computer in $RemoteComputers) { Get-GPResultantSetOfPolicy -Computer $...


4

All the settings no, but doing the following will allow you to import those settings that can be imported 1) Export using the Group policy from the domain and save/copy it to the local machine 2) Grab this tool Microsoft Security Compliance Manager which after install will give you LocalGPO.wsf 3) cscript LocalGPO.wsf /path:C:\path to backup\{42ADD8FE-...


4

The OS compatibility of a particular policy setting varies from setting to setting. The Group Policy Management console will indicate the OS compatibility in the policy item's description. In general, the answer is yes. But there are also some policy settings that only apply to specific OS versions. I don't know specifically about the compatibility of the ...


4

The Group Policy Setting inhibits the upgrade from actually happening. If you click the upgrade icon, you will get a message that the administrator has disabled upgrades. The setting does not kill the offer program (GWX.exe) if it is already running. The official supported method for opting out of the Windows 10 upgrade is documented here: https://support....


4

Use Terminal Server Drain Mode (log any users with a session on the terminal server off before you engage Drain Mode). Turn it off after the maintenance. https://blogs.msdn.microsoft.com/rds/2007/06/15/introducing-terminal-services-server-drain-mode/ EDIT (4/27/2016) (to include logon restrictions) Also, use logon restrictions in Active Directory to ...


4

If you are using legacy password policies, those apply to the entire domain. You may want to research fine-grained password policies.


3

As a Windows domain administrator it is up to you on how you choose to manage your environment. There are pros and cons to every choice. In a large environment manual tasks are frowned upon, as they will take up a lot of time. Group policy and automation will make your job much easier. If you prefer to install everything manually, go ahead and do that. ...


3

This prompt can be disabled by the following registry edit: HKCU: to affect current user only: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\ProtocolExecute\YOUR_MONIKER] "WarnOnOpen"=dword:00000000 HKLM: to affect local machine – for 32 bit machines [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\YOUR_MONIKER] "...



Only top voted, non community-wiki answers of a minimum length are eligible