Tag Info

Hot answers tagged

18

What can be done to properly re-enable the Windows firewall on a domain? Well, the short answer is that it's going to be a lot of work if you decide to forge ahead, and for the record, I'm not sure I would. In the general case, client firewalls don't provide much security in a corporate network (which typically has hardware firewalls and controls this type ...


14

When I've had occasion to do this, the way I've effectively disabled log off (and shutdown/restart) is by doing three things. Use GPOs or local security policies (or a registry setting) to remove the logoff option available through the Ctrl+Alt+Del menu. To remove the option from the Ctrl+Alt+Del menu, you need to navigate to User Configuration -> ...


12

Edit: I would just like to state that there is nothing inherently wrong with Windows Firewall. It is a perfectly acceptable part of an overall defense-in-depth strategy. The fact of the matter is, most shops are too incompetent or too lazy to be bothered to figure out what firewall rules are needed for the applications that they run, and so they just force ...


12

There's no stock functionality in the product to do what you're looking for. I'm sure somebody could come up with a crazy hack that would give you 85% of what you wanted, but that last 15% to make it work would likely have to involve rather invasive modifications to Windows (or, at least, third-party software). Group Policy will let you run arbitrary code on ...


8

Powershell management of Group Policy sucks w/o third-party (commercial) products, in my opinion. I think you're stuck slinging through the XML (or in HTML if you prefer) in Group Policy Objects to do what you're looking for. Fortunately the XML doesn't look that terrifying. The per-printer UID value (which I believe is what @KatherineVillyard is referring ...


8

You're running into a design-limitation of Offline Files. It is a per-machine cache, enabled and disabled at a per-machine level. Offline Files limits visibility of items to users who are authorized to view them, but there is a single cache on the machine. You can't disable the caching functionality for just certain users on a machine. There just isn't a ...


8

Man, I can hardly imagine how many things in your environment must be broken if remote WMI can't be used, even from domain controllers, SCCM servers, etc. Sounds painful. But anyway, According to this article: http://technet.microsoft.com/en-us/library/cc782152(v=WS.10).aspx No it doesn't rely on WMI. As long as the Group Policy client can access Sysvol, ...


8

Here is Microsoft's statement regarding Universal Groups. Especially the bolded part pertains to you: Universal groups can be used anywhere in the same Windows forest. They are only available in a Native-mode enterprise. Universal groups may be an easier approach for some administrators because there are no intrinsic limitations on their use. Users ...


7

I was hoping that this would die on SU, but since it's moved here, I will give you my professional opinion on the situation. If an end user needs to log into this server, it should not be a domain controller. Period. Nevermind the whole time nonsense and everything else, which only reinforces this statement. End users should not log into servers that are ...


7

I googled pretty hard, and even toyed with backup-GPO in hopes of being able to hack the resultant XML file and reimport it, but I suspect that a PowerShell script is in your future. It's not that bad. You can generate the printer list from the nearest server and then loop through that and map them. Something like this: $net = New-Object -COMObject ...


6

GPOs only apply to user objects and computer objects. You will need to apply the GPO to the Users OU, and use security group filtering to ensure it only applies to the users of the RedTeam group.


6

Your understanding is correct. When your company gets to the size that you need to bring in a dedicated Windows sysadmin they're going to be unhappy that you did this. I can't imagine that your logic is so complex that it couldn't be solved by the built-in functionality in Group Policy. Security Group filtering, WMI filtering (which is ...


6

To backup your GPO's: In the GPMC select the Group Policy Objects node. Right click and select "Backup All". Browse for a backup destination. Click "Back Up". Done. To restore a GPO: In the GPMC select the Group Policy Objects node. Right click and select "Manage Backups". Find and select the GPO you want to restore. Click "Restore". Click "OK". Done. ...


6

You can perform GPO backups two ways, one with the Group Policy snap-in as described by joeqwerty, or with Powershell. You'll need RSAT installed for the Group Policy Powershell cmdlets. Then just do a simple Backup-GPO: Import-Module GroupPolicy Backup-GPO -All -Path C:\somepath That's it for backup. For restore, you'll do a Restore-GPO, with the ...


6

You shouldn't be storing user data files on client computers. You should be using something like Folder Redirection, which can be configured via Group Policy, to store user data files on server computers (where they can have all kinds of fun redundancies applied to their storage). If your users need access to their files when disconnected from the network ...


6

This can dramatically slow down logons (as expected), but you can force all logon scripts to run before giving a desktop with the GPO policy User Configuration\Administrative Templates\System\Scripts\Run logon scripts synchronously See http://technet.microsoft.com/en-us/library/cc975925.aspx for more details


6

Does the CSE update get applied to the Win 2K3 DC's You don't have to install the KB on the DCs. 2k3 domain controllers are capable of pushing GPOs that have 'group policy preferences' in them. If number one is "No", how do I see and edit the GPP to map the drives? You have to have RSAT on a Vista, Server 2008, or better machine. Server 2003 ...


6

Q: "Can it be set in Group Policy?". A: "Yes it can." Go to Computer Configuration>Policies>Administrative Templates>Windows Components>Remote Desktop Services>Remote Desktop Session Host>Connections Specifically the Set rules for remote control of Remote Desktop Services user sessions and change it to Enabled and set the option to Full Control with User's ...


6

Not with any of the vanilla Windows tools, I'm afraid. This is where classroom management solutions (Tutor, Impero etc) come in,


5

Locked the keys in the car, eh? I don't believe that one is configurable via Group Policy. Periodic policy refresh isn't going to help you run a script or install software on the machine since both of those operations only occur on a synchronous policy refresh (i.e. a reboot). I think you're going to be stuck laying hands on the machine. I've forgotten ...


5

GPO doesn't have any reporting mechanism built in. Any decent configuration management software could report what's installed, or you could script it. Warning The following code, recommended by Microsoft, has serious issues. See the comment below this answer with a link to the "Rapid Publishing" (ie Emergency) Knowledge Base article from 2009. If ...


5

No, you can't turn back time on this one. The previous state of the computers from before the GPO was applied was not recorded, so when Group Policy changed the state of those configurations, there is now no recorded previous state to revert back to. If the damage is seriously bad, you'd be looking at restoring the affected computers from a backup after ...


5

It can easily be done via a GPO. See the TechNet article for how to do this, but it is pretty easy if you understand GPOs already: Manage Favorites and Links SPECIAL THING TO NOTE ON THAT PAGE: To delete existing links: If you are a corporate administrator, select the Delete existing Favorites and Links, if present check box to delete the items on ...


5

Yes, you can copy the it-IT folder from %systemroot%\PolicyDefinitions\ to \\domain.com\sysvol\domain\Policies\PolicyDefinitions\ and be able to use either Italian when configuring the ADMX settings from any computer connected to the domain. The ADM files are only in a single language, you can't change that.


5

Honestly - this isn't likely to be an issue. I've seen hundreds (And I mean that literally) of school IT setups - they all have these messages and it's simply just part of the system. You're doing the right things and as @joeqwerty says - it provides feedback to the user that they've been deliberately prevented from doing something. If it's possible to ...


5

This sounds like an absolute mess. Firstly, there's no such thing as PDC and hasn't been for many years. Either you created a domain by adding the ADS role, you joined a domain, or you didn't. I find it bizarre that you can't remember if you built a Domain Controller or not. If the computer properties shows it's in a workgroup, then that's where it is. For ...


5

GPO settings can be copied like this: 1.) Open %systemroot%\system32\grouppolicy\ Within this folder, there are two folders – “machine” and “user”. Copy these to folders to the %systemroot%\system32\grouppolicy – folder on the target machine. All it needs now is a reboot or a “gpupdate /force”. For security settings: 1.) Open MMC and add the Snapin ...


5

There is no "right" answer here. My personal preference would be use Group Policy for settings/policies, but for application deployment use PowerShell (or even legacy WSH scripts or batch files), assuming you have a single domain with no complex trust issues. However, there are tradeoffs. Doing everything in PowerShell is certainly legal. Application ...


4

Group Policy Preferences are a subset of GPO settings. Think of it as an extension to the Policies that form the core of Group Policy. Policies defines the outcome of built-in behaviors that the clients must adhere to, once set. Preferences define settings that clients should implement if applicable (ie. an appropriate CSE installed) The application of ...


4

Group Policy Administrative Template policies don't do anything more than set registry values (typically under Software\Policies in HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE, as well as a couple other locations, or anywhere that a third-party ADM(X) file might want to set them). Personally, I think that thinking about Administrative Template policies like ...



Only top voted, non community-wiki answers of a minimum length are eligible