Tag Info

Hot answers tagged

14

When I've had occasion to do this, the way I've effectively disabled log off (and shutdown/restart) is by doing three things. Use GPOs or local security policies (or a registry setting) to remove the logoff option available through the Ctrl+Alt+Del menu. To remove the option from the Ctrl+Alt+Del menu, you need to navigate to User Configuration -> ...


12

There's no stock functionality in the product to do what you're looking for. I'm sure somebody could come up with a crazy hack that would give you 85% of what you wanted, but that last 15% to make it work would likely have to involve rather invasive modifications to Windows (or, at least, third-party software). Group Policy will let you run arbitrary code on ...


11

Provided you have a Windows 2012 Domain controller, yes! Where can we find group membership details? When you look into the member attribute of an AD group you’ll find a list of all members in distinguished name format. But that’s it. There is no smoking gun or finger prints that tell you how they got there. However, there is a little-known piece of ...


8

You're running into a design-limitation of Offline Files. It is a per-machine cache, enabled and disabled at a per-machine level. Offline Files limits visibility of items to users who are authorized to view them, but there is a single cache on the machine. You can't disable the caching functionality for just certain users on a machine. There just isn't a ...


7

To backup your GPO's: In the GPMC select the Group Policy Objects node. Right click and select "Backup All". Browse for a backup destination. Click "Back Up". Done. To restore a GPO: In the GPMC select the Group Policy Objects node. Right click and select "Manage Backups". Find and select the GPO you want to restore. Click "Restore". Click "OK". Done. ...


7

You can perform GPO backups two ways, one with the Group Policy snap-in as described by joeqwerty, or with Powershell. You'll need RSAT installed for the Group Policy Powershell cmdlets. Then just do a simple Backup-GPO: Import-Module GroupPolicy Backup-GPO -All -Path C:\somepath That's it for backup. For restore, you'll do a Restore-GPO, with the ...


7

There are a few different ways to do it. Do you want to force everyone's home page, and disallow changes? Or do you just want to set a default home page that people can modify? If you want to force a home page: (Do what HopelessN00b said) Create a new GPO or edit the existing one. (I'm assuming you know how to do this already. Let me know if you ...


7

Add the specified machines to an Active Directory Security Group and add the Group to the GPO with a "Deny" for "Apply Policy" (Don't fall for doing a full deny as it will stop the GPO name from enumerating, making troubleshooting difficult). Then, add the machines to that Group as required.


7

As with many Group Policies, the setting are stored in a Policies key in the registry. The Windows Firewall machine policy key is located at: HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall If you delete this key the "old" GP firewall settings are gone. If you restart the machine, it should able to pull down a fresh copy of your firewall GPO.


6

You shouldn't be storing user data files on client computers. You should be using something like Folder Redirection, which can be configured via Group Policy, to store user data files on server computers (where they can have all kinds of fun redundancies applied to their storage). If your users need access to their files when disconnected from the network ...


6

This can dramatically slow down logons (as expected), but you can force all logon scripts to run before giving a desktop with the GPO policy User Configuration\Administrative Templates\System\Scripts\Run logon scripts synchronously See http://technet.microsoft.com/en-us/library/cc975925.aspx for more details


6

My take is "Group policy needs to be run synchronously". Seriously. The default in Windows 2000 was to run all Group Policy (computer and user) synchronously. Microsoft had materials in their "Official Curriculum" back then that even describe asynchronous policy application as potentially unreliable. You can change this default behavior by using a ...


6

I've dealt with similar problems in the past. That being said your organization doesn't look too far from ordinary. A lot of small business are built just like you outline. If you really want to restructure the best solution I have found is setting up an OU with block group policy inheritance at the root of your domain. Build your new structure under this ...


6

I think you need to read The Machine SID Duplication Myth: http://blogs.technet.com/b/markrussinovich/archive/2009/11/03/3291024.aspx Machine SIDs and domain SIDs/RIDs are two different things, which is why you see two different things when you run a local tool on the machine, versus an Active Directory Powershell cmdlet. A couple of notes from the ...


6

donL, So I was curious enough about this one to research it out. I don't have a 2003 server environment to test on, so it was up to "Google Fu" to check into this. Turns out it is a "bug" in the GUI. The policy you applied did work correctly, it just doesn't show up correctly in IE's GUI on the client. Stupid, yes...but true. Here's an example accepted ...


6

As already commented, the "Account is sensitive and cannot be delegated" flag is a user account attribute, not a GPO setting. If you've checked this box and want to make sure that the change is immediately replicated everywhere, you can use repadmin to force it: repadmin /replsingleobj * source-dc01.domain.tld CN=SensitiveUser,OU=Users,DC=domain,DC=tld


6

Your conception is incorrect. ADM/ADMX files are nothing like exports from the registry. Administrative Templates (both the old-style ADM and newer-style ADMX files) exist to drive the user interface in the Group Policy editor. They define the settings that can be managed, not the settings themselves. These settings amount to registry values which are ...


6

.admx files are written in XML and contain settings that the Group Policy Management Console can read. Group Policy then translates those settings to registry keys (which may not exist prior to the policy being applied). Windows update settings live in HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate. When I worked in a setting without ...


5

There are always way to hack around central policies if you have local admin access - at a minimum you can make your changes locally to the registry and hack the security settings so they can't be updated by the group policy agent - but it isn't the best way to go. I'll admit to doing it 10 years ago.. but really.. don't. There are unanticipated results in a ...


5

There is no "right" answer here. My personal preference would be use Group Policy for settings/policies, but for application deployment use PowerShell (or even legacy WSH scripts or batch files), assuming you have a single domain with no complex trust issues. However, there are tradeoffs. Doing everything in PowerShell is certainly legal. Application ...


5

Most software installation programs for Windows require Administrator rights to function properly. This is an artifact of the design (or lack thereof, some might say) of the Windows platform. While there is an increasing trend toward software that installs only within the writable directories accessible to a limited (i.e. non-Administrator) user (things like ...


5

That's not a very sound recovery strategy. You cannot simply re-create the same naming and expect things to work. Every object in AD has a security identifier (SID). Creating a lot of objects with the same names might look the same to you, but to AD they are all completely different because the SIDs will differ. You should look into the proper way to backup ...


5

Another couple common spots to look for problems like this are listed in my screenshots below. You've likely checked these settings, but in case you haven't, it would be worth your while to do so. Obviously we're dealing with User Preferences here and you already know that, but for the sake of future users reading this question I'll give the location in ...


5

Yes it will be applied. The Winning is relevant to identical settings being applied by each GPO. The Winning GPO has precedence and will have it's settings applied. If another GPO configures other settings (not in common with the Winning GPO) then it will have those settings set. ...


5

Simply use the "Apply to All users except local administrators" setting in the Software Restriction Policies Enforcement... you don't let all your users run as Administrator... do you??? As an alternative, perhaps you could define the Software Restriction Policies in the User Configuration portion of the GPO, then use Security Filtering to allow that GPO ...


5

Using different LUNs for different shares really seems like overkill. I can definitely tell you that I've never seen that done. They're all going to have a random-access pattern, so the workloads are going to be very nearly the same. Putting them on separate LUNs may make reconfiguring the storage w/o taking downtime more difficult down the road. I don't ...


5

Domain Controllers have their own local security policies, just like regular domain members do. Group Policies will also take precedence/override local security policies, just as they do on regular domain members. As you have witnessed, there are plenty of Group Policy settings that have the ability to "tattoo," or leave their mark on a system's local ...


5

The only thing I can think of to solve this is a trick where you use an intermediate group as a dynamic object and then nest that into the primary group so that the user has the permissions conferred to the primary group by way of nested group membership, however, the intermediate group has a TTL (time to live, the entry-TTL attribute) and when that TTL ...


5

What you're talking about is a feature called "fine-grained password policies", and requires a domain functional level of Server 2008 or higher. There's a nice, easy step-by-step instruction guide on enabling and using fine-grained password policies on the Technet blogs, if you'd like to take a look, but it's not all that complicated. The thing that trips ...


4

I'd prefered to add this as a comment, but thank to site policies, I must not comment... Regarding Logoff scripts, I do not know what can be done. But in a C# Windows Forms application, you can register for SystemEvents like SessionSwitch and SessionEnding. The last one even provides a Cancel property in the EventArgs. Such a .Net application could help in ...



Only top voted, non community-wiki answers of a minimum length are eligible