Tag Info

New answers tagged

0

I wrote a script which runs as a computer policy with administrative rights on the local workstation. It checks the last logged on user's Description in AD which a Domain Admin can set from "Active directory Users and Computers", if it contains the workstation name, the script adds the user to local admin group, if the workstation name is not in the user's ...


1

Your biggest problem at the moment is you need to seize the FSMO roles and assign them to your remaining domain controller. Seize the Operations Master Role https://technet.microsoft.com/en-us/library/cc816779(v=ws.10).aspx Probably a good idea to install a second domain controller.


0

Sorry, reputation is too low to reply to comment, so posting this as an answer. The Powershell commandlet New-ADFineGrainedPasswordPolicy requires the active directory module to be loaded. First try "Import-Module ActiveDirectory" If that doesn't work, see if it is available. "Get-Module –ListAvailable" will show you what is available. If it is not ...


1

There is no primary or secondary domain controller, these are old, old, concepts that no longer exist, and a lot of people will get a bit huffy if you carry on referring to a primary and secondary domain controller. In a Windows domain the domain hierarchy time sync has the PDC Emulator domain controller syncing from an internet time source (eg. ...


0

Ok so I finally figured it out. It was what I expected, the GPO refresh was causing the settings to be dropped, this caused some registry keys to momentarily revert to their default. Specifically: HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Terminal Server/fDenyTSConnections The problem is that even if you set this registry key by hand, it will ...


0

Default access for "Administrators" and "Remote Desktop Users" doesn't come back if you modify "Allow log on through Terminal Services" settings with some specific account and then again set it to "Not Configured". You need to explicitly define "Administrators" and "Remote Desktop Users" in this case.


0

Excel points made out of the two of them, make an 1:1 comparison for the points that are the same, add everything that you have more on 2012r2 as an separate project , profit!


0

I was having the same issue when using Detect Now. Any time I changed the security filtering on a GPO, the ACLs for sysvol would show as having a problem. On one DC, the policy in sysvol had the permission change, but on the other it did not. For over an hour this was the case. Then when I came to work the next day, everything was fine. In my case, it ...


1

The script is almost right, I would change it to this as the WUServer and WUStatusServer paths need to be in the parent key. example: # Set the values as needed $WindowsUpdateRegKey = "HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" $WindowsUpdateRootRegKey = "HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\" $WSUSServer = ...


0

I realised my question did not go into detail about the .msp file. Originally my .msp file had the installation to be in a basic view. Basically, this stopped the installation from completing so no message would appear as the setup.exe process was still running. So to confirm, I set the installation view to 'none' in the msp file, and my message commands ...


5

You can specify the managedBy attribute, and check the box for "Manager can update membership list". (This grants write permission for the Member attribute.) The person(s) who need to edit the group may be able to do it with the DSQuery widget, for which you can create the following shortcut: rundll32 dsquery,OpenQueryWindow They can search for the ...


0

I've run into this behavior, where MSI installation is prevented with "The system administrator has set policies to prevent this installation" before. I believe it is due to default Windows Software Restriction policy and I've seen it on both Windows Server 2008 R2 and Windows Server 2012. There is probably a better GUI based way to alter the policy, but ...


2

Based on my experience of removing items from AD, group policy continues to apply and settings do not revert. Since there was an policy disabling the local administrator account in group policy, this caused no end of vexation at $former_employer. I cannot, of course, speak to every item you might have defined via group policy. You might want to ...


3

You are probably using a central group policy store. Copy the contents of C:\Windows\Policy Definitions from the newest / most up-to-date server and place them in SYSVOL\domain\policies\PolicyDefinitions. This ensures that whenever you use the group policy management console it will be reading from the same central set of ADMX policy templates. When you ...


1

I'm not sure you can achieve this - Item Level Targeting is a feature of Group Policy Preferences and, to my knowledge, there's no GPP way of assigning the "Log on as a service" rights. If you could find an equivalent registry key, you may be able to do this but a quick Google has turned up nothing. So, barring that, you'd need a GPO at each "System [x]" ...


0

You do not need a 2012 domain controller or functional level to get newer Group Policy settings. You can get the newer ADMX/ADML files from Microsoft and install them into SYSVOL. They are backwards compatible. Microsoft Downloads: ADMX for IE 11 As for the nuts and bolts of what you're trying to do an the issues you're encountering: What method are you ...


0

the simple solution in this case would be running the gpupdate /force command throughout the specified OU. although i'm eager to know if you found another solution.


0

You can do this by redirecting the whole AppData folder. if you need the recent items only, then through scripting or a 3rd party software as far as i'm concerned.


0

It's either "no," with a "but," or "yes," with a "however." We'll take the "no" approach first - no, group policies overrule configurations made by applications, not the other way around, and this is by design. If you really want, with some creative application of security ACLs to the relevant registry keys, you can prohibit SYSTEM from being able to apply ...


0

This is usually in relation to AGPM - do you have it installed anywhere? I typically run it on my local machine (I am running Windows 8.1) and then I pull the PC in question. AGPM = Advanced Group policy management It comes with MDOP if you have MSDN/TechNet. If not, you need to run Group Policy management from a machine with windows 8 kernel (2012 R2, ...


1

"Load and unload device drivers" should do the trick. (Computer Settings -> Policies -> Security Settings -> Local Policies -> Load and unload device drivers) Be aware that this may grant more privileges than you intend. That said, granting "Load and unload device drivers" to Power Users is arguably more secure than making your users local administrators. ...


5

There are settings in the Server 2008/2012 policies that aren't accessible on your 2003 server I believe, such as "Do not connect to any Windows Update Internet locations" under the Computer settings you show above. I believe the settings you are looking for in a 2003 environment are: Disable access to Windows Update The correct policy for v6 ...


1

As I was figuring out Group Policy I also ran into this problem where the wallpaper wasn't changing even though group policy had been applied and the picture in the menu had changed. This was because Wallpaper settings are a policy that requires a log off before they will apply properly. It took me ages to find a place that actually said that and it was ...


0

My first usual suspect would be a bug in the Windows client. GPO's may not be re-applied unless the client detects that they have changed or if not on a slow link. You may want to test if the following setting helps: Computer > Policies > Administrative Templates > System > Group Policy: Folder Redirection Policy Processing Note this is a computer ...


2

Authenticated Users includes computer accounts. If you want the GPO to apply to only specific computers then remove Authenticated Users from the Security Filtering and add the specific computer object to the Security Filtering (or better yet, a security group containing the computer object).


2

Not sure I follow... that is the definition of a one-way trust. Users in the trusted domain can access resources in the trusting domain, but not the other way around. Now if you wanted to block users in one domain from even attempting authentication... like not even having network connectivity, then... firewalls.


0

Since I have no rep I can't upvote or comment, but I had the same misunderstanding as the OP and Joao da Silva's answer helped me so I wanted to contribute in some way. He is correct about the URL. I did the policy simply by saying gighmmpiobklfepjocnamgkkbiglidom;https://clients2.google.com/service/update2/crx One gpupdate /force later and the extension ...


1

I figured out what's causing this, as my GPO settings are correct. The script that I need to run uses a function to force the 32bit version of the scripting host. Function fncForce32bitCscript() Dim strCurrentScriptHost : strCurrentScriptHost = lcase(wscript.fullname) dim strRequiredScriptHost: strRequiredScriptHost = ...


4

I'm not 100% on how you mean you don't have the original ADM file. I'm assuming it means you don't have them on a local or central store that you have access to. Apologies if I've picked it up wrongly! You should be able to get the ADM files back taking a backup of the GPO looking in the DomainSysVol\GPO\ADM folder of the backup and picking up a copy of the ...


1

So, there is no way to directly set up file permissions in a GPO using Powershell. (Computer/Policies/Windows Settings/Security Settings/File System) However, I was able to work around this by creating a GPO and manually backing it up (one time thing). In respect to the specific answer I was looking for, there are 3 files that need to be edited in the GPO ...



Top 50 recent answers are included