Hot answers tagged

30

This can be done by the means of WMI filtering. The group policy client would execute the WQL query from an attached WMI filter and only apply the GPO if the query would return a non-zero number of rows. So by creating a WMI filter checking if the current system time is within a given time interval and linking this WMI filter to the GPO you want to timebomb ...


25

In late 2012 / early 2013 there was an issue with automatic root certificate updates. The interim fix was to disable the automatic updates, so partly this issue is historical. The other cause is the Trusted Root Certificate program and Root Certificate Distribution, which (to paraphrase Microsoft)... Root certificates are updated on Windows ...


15

According to this article you can add the following registry entry to disable Get Windows 10: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Gwx] "DisableGwx"=dword:00000001 Try HLM\Software\WOW6432Node\RegisteredApplications\GWX and rename it.


14

Yes, there is an option in GPO. Do realize that users can still add or create shortcuts or items on their desktops. You can also prohibit this if needed. If you want to do it using the registry, you can do it in HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideIcons you can still deploy this using GPO. You can find this under ...


10

Nope. The "Hide extensions for known file types" is a preference that you can set via Group Policy. And if it's only a preference, then the user can undo it. Basically, as long as the user has write/modify access to the file, they can rename it to whatever they wish. It's not a Group Policy thing, but an NTFS thing. The only way to really prevent a user from ...


10

The Automatic Root Certificates Update component is designed to automatically check the list of trusted authorities on the Microsoft Windows Update Web site. Specifically, there is a list of trusted root certification authorities (CAs) stored on the local computer. When an application is presented with a certificate issued by a CA, it will check the local ...


10

Allowing network logon for local accounts is dangerous and a poor security practice. For administrators group members, I would actually characterize it as negligence. It enables lateral movement, and is difficult to detect and audit due to the account logons are not logged centrally (on the domain controllers). To mitigate this threat, Microsoft actually ...


8

Yes you can do this. I use Security Groups and Item-Level targeting that apply to the computers and not to users. Users are moving (or graduating) and the computers for the most part are stationary. What you want to do is in active directory you want to create an OU called something like Printer Groups Create a Security Group under Printer Groups for ...


8

Are you sure it is not linked at site level? You should check this in the GPMC, under Sites (right click and choose "Show sites" and show all the sites).


6

Off the top of my head, here are three different ways to do it: You can create an OU for the workstations, move the computer accounts for the workstations to this OU and link the GPO to this OU. You can use Security Filtering to apply the GPO only to your selected workstations. As Greg stated in his answer, you can use a WMI filter to apply it only to ...


6

Use a newer version of the Group Policy Management Console. Ideally, install RSAT on your Windows 7 or newer Workstation and manage it remotely.


6

I don't know of any GPO policy on its own that will do this, but the registry key to do this is HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideIcons Set to 1 to hide the icons. If you change the registry directly you'll need to log off and back on to affect the change.


6

If these systems are members of an Active Directory domain you can use group policy to add a group of admin users to the Local Administrators group. If these systems are members of a domain but the users are local, you can use Restricted Groups to produce the desired effect. If these computers are not members of an AD domain you can use PowerShell to ...


6

There are settings in the Server 2008/2012 policies that aren't accessible on your 2003 server I believe, such as "Do not connect to any Windows Update Internet locations" under the Computer settings you show above. I believe the settings you are looking for in a 2003 environment are: Disable access to Windows Update The correct policy for v6 ...


6

You can specify the managedBy attribute, and check the box for "Manager can update membership list". (This grants write permission for the Member attribute.) The person(s) who need to edit the group may be able to do it with the DSQuery widget, for which you can create the following shortcut: rundll32 dsquery,OpenQueryWindow They can search for the ...


5

is my first time i try to help I had this problem also, and i solve it using dns defaul behavior Prioritizing local subnets https://technet.microsoft.com/en-us/library/cc787373(v=ws.10).aspx So in your case just need to create a A Record for your sites fs Servers with the name SRV01 And then just create one gpo to mount And add the default print with ...


5

Think long and hard about deploying a software package merely for the purpose of enabling some shares. Then keep thinking about it until it seems like a bad idea ;-) Instead, maybe try just enabling the admin shares via GPO. The specific values you are interested in are: HKLM\System\CurrentControlSet\Services\lanmanserver\parameters AutoShareServer and ...


5

The only way for domain computers to get updated group policy settings is if they have connectivity to a domain controller at a time when they are refreshing their group policy settings. Group Policy is refreshed: At computer startup (foreground refresh of Computer settings) At user logon (foreground refresh of User settings) Periodically in the background ...


5

It's this guy: KB3035583. You may want to script a wusa.exe /uninstall for this one if it's already in the wild. This has been big news today, as Microsoft put this out last Patch Tuesday, and somehow forgot to mention the time-delay sales pitch set for June 1st. Normally you would block this update in WSUS/SCCM. Of course, in this case you couldn't ...


5

The laptops at home, if joined to a domain, are still domain members. So no, domain policy is domain policy, regardless of whether or not they're on the same network as the domain. Sorry.


5

Disable Internet Explorer Enhanced Security Configuration (ESC) in Server Manager.


5

Create a WMI filter for the GPO: SELECT * FROM WIN32_OperatingSystem where ProductType="1"


5

Use Group Policy Preferences with Item-Level Targeting to create the shortcuts for each group of users.


5

I believe the reason that the boxes are greyed out is because either 1) you are not an administrator on the machine and therefore do not have permission to modify the security policy, or B) the settings are already managed via Group Policy, which supersedes the ability to manage the settings locally.


4

Create your text file as RemoteComputers.txt with each computer/server on its own line...nothing else in the file. From the admin workstation/server: Import-Module GroupPolicy Then run the script below: $RemoteComputers = Get-Content -Path C:\Data\RemoteComputers.txt foreach ($computer in $RemoteComputers) { Get-GPResultantSetOfPolicy -Computer ...


4

All the settings no, but doing the following will allow you to import those settings that can be imported 1) Export using the Group policy from the domain and save/copy it to the local machine 2) Grab this tool Microsoft Security Compliance Manager which after install will give you LocalGPO.wsf 3) cscript LocalGPO.wsf /path:C:\path to ...


4

Starting with Windows 8, Microsoft introduced this notion of "fast boot", where, when you shut down the OS, they hibernate OS memory footprint just like Hibernate works in normal hibernation scenarios. This results in the OS coming up faster, but it also has the side effect of disabling per-computer GP processing on startup. That is probably what you're ...


4

The ONLY option you have is to stop people being able to access it: you need to find a way to either stop physical access (IE put it in a locked cabinet, move it to a locked office etc) or make console access impossible (disable all HID access, disable all USB/PS2 ports etc)


4

This actually is fairly common in larger environments where there may be a separate domain or forest for administrative accounts. In that case, you definitely cannot add them to Domain Admins and you probably don't want everyone in Enterprise Admins. Paul Williams had a good article documenting the various objects and the permissions required. ...


4

You create the group policy on one of the windows workstations: Download and install the Windows RSAT tools (link is for Win7, it's easy to find them for 8) on one of the windows workstations. Logged in as a domain admin, open Group Policy Management, either create a new policy or pick one that applies to the right users (I'm skipping over some GP ...



Only top voted, non community-wiki answers of a minimum length are eligible