Tag Info

Hot answers tagged

28

This can be done by the means of WMI filtering. The group policy client would execute the WQL query from an attached WMI filter and only apply the GPO if the query would return a non-zero number of rows. So by creating a WMI filter checking if the current system time is within a given time interval and linking this WMI filter to the GPO you want to timebomb ...


14

Yes, there is an option in GPO. Do realize that users can still add or create shortcuts or items on their desktops. You can also prohibit this if needed. If you want to do it using the registry, you can do it in HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideIcons you can still deploy this using GPO. You can find this under ...


11

According to this article you can add the following registry entry to disable Get Windows 10: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Gwx] "DisableGwx"=dword:00000001


11

Provided you have a Windows 2012 Domain controller, yes! Where can we find group membership details? When you look into the member attribute of an AD group you’ll find a list of all members in distinguished name format. But that’s it. There is no smoking gun or finger prints that tell you how they got there. However, there is a little-known piece of ...


10

Nope. The "Hide extensions for known file types" is a preference that you can set via Group Policy. And if it's only a preference, then the user can undo it. Basically, as long as the user has write/modify access to the file, they can rename it to whatever they wish. It's not a Group Policy thing, but an NTFS thing. The only way to really prevent a user from ...


8

Are you sure it is not linked at site level? You should check this in the GPMC, under Sites (right click and choose "Show sites" and show all the sites).


8

Your conception is incorrect. ADM/ADMX files are nothing like exports from the registry. Administrative Templates (both the old-style ADM and newer-style ADMX files) exist to drive the user interface in the Group Policy editor. They define the settings that can be managed, not the settings themselves. These settings amount to registry values which are ...


7

Add the specified machines to an Active Directory Security Group and add the Group to the GPO with a "Deny" for "Apply Policy" (Don't fall for doing a full deny as it will stop the GPO name from enumerating, making troubleshooting difficult). Then, add the machines to that Group as required.


7

As with many Group Policies, the setting are stored in a Policies key in the registry. The Windows Firewall machine policy key is located at: HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall If you delete this key the "old" GP firewall settings are gone. If you restart the machine, it should able to pull down a fresh copy of your firewall GPO.


7

I think you need to read The Machine SID Duplication Myth: http://blogs.technet.com/b/markrussinovich/archive/2009/11/03/3291024.aspx Machine SIDs and domain SIDs/RIDs are two different things, which is why you see two different things when you run a local tool on the machine, versus an Active Directory Powershell cmdlet. A couple of notes from the ...


6

donL, So I was curious enough about this one to research it out. I don't have a 2003 server environment to test on, so it was up to "Google Fu" to check into this. Turns out it is a "bug" in the GUI. The policy you applied did work correctly, it just doesn't show up correctly in IE's GUI on the client. Stupid, yes...but true. Here's an example accepted ...


6

Using different LUNs for different shares really seems like overkill. I can definitely tell you that I've never seen that done. They're all going to have a random-access pattern, so the workloads are going to be very nearly the same. Putting them on separate LUNs may make reconfiguring the storage w/o taking downtime more difficult down the road. I don't ...


6

.admx files are written in XML and contain settings that the Group Policy Management Console can read. Group Policy then translates those settings to registry keys (which may not exist prior to the policy being applied). Windows update settings live in HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate. When I worked in a setting without ...


6

As already commented, the "Account is sensitive and cannot be delegated" flag is a user account attribute, not a GPO setting. If you've checked this box and want to make sure that the change is immediately replicated everywhere, you can use repadmin to force it: repadmin /replsingleobj * source-dc01.domain.tld CN=SensitiveUser,OU=Users,DC=domain,DC=tld


6

Off the top of my head, here are three different ways to do it: You can create an OU for the workstations, move the computer accounts for the workstations to this OU and link the GPO to this OU. You can use Security Filtering to apply the GPO only to your selected workstations. As Greg stated in his answer, you can use a WMI filter to apply it only to ...


6

Use a newer version of the Group Policy Management Console. Ideally, install RSAT on your Windows 7 or newer Workstation and manage it remotely.


6

I don't know of any GPO policy on its own that will do this, but the registry key to do this is HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideIcons Set to 1 to hide the icons. If you change the registry directly you'll need to log off and back on to affect the change.


6

If these systems are members of an Active Directory domain you can use group policy to add a group of admin users to the Local Administrators group. If these systems are members of a domain but the users are local, you can use Restricted Groups to produce the desired effect. If these computers are not members of an AD domain you can use PowerShell to ...


6

You can specify the managedBy attribute, and check the box for "Manager can update membership list". (This grants write permission for the Member attribute.) The person(s) who need to edit the group may be able to do it with the DSQuery widget, for which you can create the following shortcut: rundll32 dsquery,OpenQueryWindow They can search for the ...


5

The laptops at home, if joined to a domain, are still domain members. So no, domain policy is domain policy, regardless of whether or not they're on the same network as the domain. Sorry.


5

Disable Internet Explorer Enhanced Security Configuration (ESC) in Server Manager.


5

The only way for domain computers to get updated group policy settings is if they have connectivity to a domain controller at a time when they are refreshing their group policy settings. Group Policy is refreshed: At computer startup (foreground refresh of Computer settings) At user logon (foreground refresh of User settings) Periodically in the background ...


5

It's this guy: KB3035583. You may want to script a wusa.exe /uninstall for this one if it's already in the wild. This has been big news today, as Microsoft put this out last Patch Tuesday, and somehow forgot to mention the time-delay sales pitch set for June 1st. Normally you would block this update in WSUS/SCCM. Of course, in this case you couldn't ...


5

There are settings in the Server 2008/2012 policies that aren't accessible on your 2003 server I believe, such as "Do not connect to any Windows Update Internet locations" under the Computer settings you show above. I believe the settings you are looking for in a 2003 environment are: Disable access to Windows Update The correct policy for v6 ...


5

Create a WMI filter for the GPO: SELECT * FROM WIN32_OperatingSystem where ProductType="1"


5

is my first time i try to help I had this problem also, and i solve it using dns defaul behavior Prioritizing local subnets https://technet.microsoft.com/en-us/library/cc787373(v=ws.10).aspx So in your case just need to create a A Record for your sites fs Servers with the name SRV01 And then just create one gpo to mount And add the default print with ...


5

Domain Controllers have their own local security policies, just like regular domain members do. Group Policies will also take precedence/override local security policies, just as they do on regular domain members. As you have witnessed, there are plenty of Group Policy settings that have the ability to "tattoo," or leave their mark on a system's local ...


5

Simply use the "Apply to All users except local administrators" setting in the Software Restriction Policies Enforcement... you don't let all your users run as Administrator... do you??? As an alternative, perhaps you could define the Software Restriction Policies in the User Configuration portion of the GPO, then use Security Filtering to allow that GPO ...


5

Yes it will be applied. The Winning is relevant to identical settings being applied by each GPO. The Winning GPO has precedence and will have it's settings applied. If another GPO configures other settings (not in common with the Winning GPO) then it will have those settings set. ...


5

What you're talking about is a feature called "fine-grained password policies", and requires a domain functional level of Server 2008 or higher. There's a nice, easy step-by-step instruction guide on enabling and using fine-grained password policies on the Technet blogs, if you'd like to take a look, but it's not all that complicated. The thing that trips ...



Only top voted, non community-wiki answers of a minimum length are eligible