Tag Info

New answers tagged

0

Windows 8+ no longer allow these settings to be changed via registry to prevent applications from hijacking preferences. You now have to use specific GPO to set a defaults template, check this article: ...


4

Think long and hard about deploying a software package merely for the purpose of enabling some shares. Then keep thinking about it until it seems like a bad idea ;-) Instead, maybe try just enabling the admin shares via GPO. The specific values you are interested in are: HKLM\System\CurrentControlSet\Services\lanmanserver\parameters AutoShareServer and ...


0

Create GPO: User Configuration->Preference->Windows Settings->Files File (Target Path Source - Empty Destination Path C:\Users\%username%\AppData\Roaming\Microsoft\Windows\Libraries\Library.Name-ms General Tab: Action - Delete Suppress errors on individual files - Enabled Attributes: Read Only -Disabled Hidden: Disabled Archive: Enabled Common Tab:Apply ...


1

Just as a user needs to log out and back in to reflect group membership changes, a computer needs to reboot to reflect group membership changes.


0

To properly disable the Windows 10 upgrade as recommended by microsoft I would advise reading the following article: Ref: https://support.microsoft.com/en-us/kb/3080351 Computer Configuration To block the upgrade by using Computer Configuration, follow these steps Click Computer Configuration. Click Policies. Click Administrative Templates. Click ...


0

I just ran into the same problem. I had filtered the GPO with a security group with all of the computers I wanted this GPO to apply to. However, upon login the application wouldn't load. I ended up realizing it probably had something to do with me filtering out users, even though it doesn't set anything in users. I added authenticated users back, and ...


-2

GPOs cannot have both user AND computer settings applied in one policy. This is usually the cause of what you are experiencing. Another reason is if the computer is on a guest wifi network (subnetted, VLANed, or another segregation, it wouldn't hit the AD server.) I would also try to ping the DNS name of your server: I.e Ping DC1 If that fails then you ...


-1

Windows 2012 R2 In a Group Policy applied to these workstations, navigate to: Computer Configuration > Policies > Administrative Templates > System > Group Policy Enable the Specify startup policy processing wait time. Set Amount of time to wait (in seconds): = 120


0

That's not supported on Windows Server 2012 (R2). If you look at the group policy setting that allows custom logon background in 2008 (Computer Configuration\Administrative Templates\System\Logon\ 'Always use custom login background' ) , it specifically states that it is only supported on Win 7 and 2008 (R2).


0

Regional settings are applied per user. For the system account you can change it via the regisrty, see here Change the HKEY_USERS/.DEFAULT/International/sDecimal key


1

GptTmpl.inf is where the security settings are stored, so if that file is not present that would explain why the settings were gone. Hard to determine who or what did this unless you have auditing enabled. Restoring the GPO from backup using Group Policy Management Console is preferred over re-creating it. I would check the antivirus product to ensure it ...


2

Here's an example of how you can do this to a single user with a script. It's crude but it works well as an example to show the process. $user = Get-ADUser James $homeName = $user.GivenName + " " + $user.Surname $user | Set-ADUser -HomeDirectory \\FileServer\Users\$homeName -HomeDrive H -Credential (Get-Credential) Replace the UNC with your file share, ...


0

if you are still curious about a VBS, this code will set the site name to a system variable. '--- Get Site name --- Set strSysinfo = CreateObject("ADSystemInfo") strCurrentSite=strSysinfo.Sitename '--- Write site name to system variables --- Set objShell = CreateObject("WScript.Shell") Set objSystemEnv = objShell.Environment("SYSTEM") ...


2

The trick here is to not have Windows Update do the install via the Automatic Updates mechanism. You can set it to automatically download, but for automatic installs, there's no way to stop the reboot timer from triggering unless there's a user logged into the system, such as with the No auto-restart with logged on users for scheduled automatic updates ...


4

You can't effectively deny rights to local administrators, since regardless of what GPO you apply, they can always override it at least temporarily by editing the registry. They can also remove the computer from the domain. In general, you shouldn't use or distribute the local administrator accounts in an environment requiring top-down administrative ...


0

Yes, this policy determines which users who are logged on locally to the computer can shut it down. See description on the Explain tab: You may also look at another policy in this location (i.e. under User Rights Assignment:) - Force shutdown from a remote system. Administrators are members by default. Removing Administrators from both policies - would ...


0

If it helps, here's a reg file that does the job. It enables Visual Style and Smoothing Windows Registry Editor Version 5.00 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer] "ShellState"=hex:24,00,00,00,38,28,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 01,00,00,00,12,00,00,00,00,00,00,00,32,00,00,00 ...


0

Use with a new local user profile. As per the GPO description; "If the folder exists before the policy is applied, the folder must be manually deleted since the policy only blocks the creation of the folder".


1

As confident and well-written as Joe's answer might be-- and I really wanted to believe him, I think he is wrong. I went back and carefully re-read the explanation of these GPO items. Its clear to me that the 'Retain security log' and the 'Retention method . . ' GPO items are clearly targeting EVENTS (individual line items IN a log), not the archived log ...


2

With 2008 and later, the AGPM console looks for ADMX & ADML files on the sysvol share. Those files are not present until they are manually copied. You can do that with these commands: xcopy %systemroot%\PolicyDefinitions\* %logonserver%\sysvol\%userdnsdomain%\policies\PolicyDefinitions\ xcopy %systemroot%\PolicyDefinitions\EN-US\* ...


0

Yes Path=%path%;c:\yournewpath;


0

If your non-domain clients connect from an IP address that is not in your domain network's IP address range, then you can do the following to apply a Group Policy Preference Item to a user's session when he connects from a remote, non-domain workstation. Link your Group Policy Object to a WMI filter that is only true when evaluated on the RDSH server (e.g. ...


2

Software Restriction Policy is deprecated by Microsoft (technet effectively claiming SRP is not supported), since Windows 7 Enterprise/Ultimate introduced AppLocker. In practice SRP has certain pitfalls, for both false negatives and false positives. AppLocker has the advantage that it's still being actively maintained and supported. If AppLocker is ...


6

Use a newer version of the Group Policy Management Console. Ideally, install RSAT on your Windows 7 or newer Workstation and manage it remotely.


4

You might be able to run a batch file containing something along the lines of powershell c:\path\to\powershellscript.ps1 or powershell \\servername\share\powershellscript.ps1 (You might have to enable powershell on the workstations first.)


6

Off the top of my head, here are three different ways to do it: You can create an OU for the workstations, move the computer accounts for the workstations to this OU and link the GPO to this OU. You can use Security Filtering to apply the GPO only to your selected workstations. As Greg stated in his answer, you can use a WMI filter to apply it only to ...


5

Create a WMI filter for the GPO: SELECT * FROM WIN32_OperatingSystem where ProductType="1"



Top 50 recent answers are included