Tag Info

New answers tagged

0

Note the setting the GPO apply, erase the GPO and re-create it.


1

You can do it easily via Group Policy's User Preferences setting Shortcuts (Your Group Policy\User Configuration\Preferences\Shortcuts). Go through this step-by-step guide: http://www.morgantechspace.com/2014/12/Add-start-menu-shortcut-via-Group-Policy.html If you want to Pin a Program to Start menu via GPO, There is no direct Group Policy Preference ...


3

If you want one GPO configuration for all types of OSs, then you must either use "%UserProfile%\Desktop" (and then the policy should apply on each user separately) or use a custom script.


0

i think this topic will help you Click here http://blogs.technet.com/b/askds/archive/2014/02/17/adding-shortcuts-on-desktop-using-group-policy-preferences-in-windows-8-and-windows-8-1.aspx


0

In enterprise environments it is not possible. You will have to publish new code signing certificates via group policies manually: Computer Configuration\Windows Settings\Security Settings\Public Key Services\Trusted Publishers section.


1

I presume your certificate requests are made using a template. If that's the case then use the Public Key Policies/Certificate Services Client - Auto-Enrollment Settings GPO to enforce auto enrollment. You'll also want to ensure the template ACL has Enroll and AutoEnroll marked for either domain computers or domain users (or whatever acl object, depending ...


3

The Windows 8.1 and Server 2012 R2 .admx files are one and the same, so you should be able to fully manage Windows 8.1 clients from your Server 2012 R2 domain controller's GPO/ADMX store.


1

I agree with Nitz, and if you got loopback processing for user setting that target computer, powershell or wmi can't guess that, a bit why the gpresult need the user logged on to list the actual policy.


1

You can use powershell group policy commandlets. You can get the users information using Get-ADUser. You can then follow this up by using Get-GPInheritance on the users OU. After this you can run Get-GPOReport on the resulting GPO's. I haven't tried this before, but it should be possible with the new commandlets. However this will be quite a bit of work ...


3

Group Policy: The user's policy isn't solely dependant on the user object - it can be affected by wmi filters, foreign domain groups or Authentication Mechanism Assurance, meaning your group membership is changed according to the way you provided your credentials. In short - the only 100% accurate way is actually logging in and checking GP results. You ...


0

I don't have a complete solution, however, I can advice start points. My PowerShell PKI module has an ability to register enrollment service endpoint starting with Windows 7/Windows Server 2008 R2 (note that Windows Server 2008 do not support enrollment services). Here is an example how to register a policy: ...


1

For posterity... I have no idea what I was doing wrong before, but I revisited this and was able to get it to work twice (a second time just to make sure I wasn't crazy) using the exact process I described above with a group policy object. The only thing I can think of that I might have done differently was giving the Backup user Read privileges as well as ...


0

Because you're working with a non-Microsoft program, there's no built-in way of controlling settings and preferences. In this case, you have to write your own. Creating a custom policy object for a third party application is fairly straightforward. Applications store settings in two places: files and registry keys. All you need to do is find where the ...


4

You need to acquire the new administrative templates for Server 2012 from Microsoft's Download Center called Administrative Templates (.admx) for Windows 8 and Windows Server 2012 If you need help with making use of the .admx files, there's a good TechNet article titled Managing Group Policy ADMX Files Step-by-Step Guide and also one on Editing Domain-Based ...


10

Provided you have a Windows 2012 Domain controller, yes! Where can we find group membership details? When you look into the member attribute of an AD group you’ll find a list of all members in distinguished name format. But that’s it. There is no smoking gun or finger prints that tell you how they got there. However, there is a little-known piece of ...


5

The only thing I can think of to solve this is a trick where you use an intermediate group as a dynamic object and then nest that into the primary group so that the user has the permissions conferred to the primary group by way of nested group membership, however, the intermediate group has a TTL (time to live, the entry-TTL attribute) and when that TTL ...


2

I used partly the powershell you linked and partly Zoredache's stuff, and found the icon for the shortcut myself (not that huge a deal; I had an example in my start menu). Create a shortcut to rundll32.exe shell32.dll,#61 or c:\windows\explorer.exe Shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0} like Zoredache suggested. Name it "Run." Right-click ...


0

I've changed the drive mapping to the FQDN of the server, and haven't has any issues since.


0

You are essentially describing a computer startup script which you could apply via GPO, which would be run as local computer (and as such basically local admin) on every machine startup. See here for the relevant documentation.


0

Make it a computer GPO, will run with full local privilege. (computer startup script)


2

DNS clients that spend more time appending suffixes to ambiguous names and retrying their searches will take longer before giving up. This can cause significant slowdowns in applications that perform a lot of DNS queries. It can also create a security concern if DNS clients erroneously resolve a name that is under the control of an external, malicious ...


0

Populate the Central Store with ADMX Files There is no user interface for populating the central store in Windows Vista. The following procedure shows how to populate the central store using command line syntax from the domain controller. To populate the central store: Open a command window: Press the Windows logo key + R, and then type cmd. To copy all ...


0

@Zoredache's comment is partially correct, but it's missing some information. Pinned taskband items are actually comprised of two components: a .lnk shortcut in %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\ AND a registry entry in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband. You have to have both or ...


0

I found the full answers here: http://community.spiceworks.com/how_to/show/11413-group-policy-preferences-printer-deployment and an addendum here: https://social.technet.microsoft.com/Forums/windowsserver/en-US/60a1bfa0-1313-40fa-a103-16c3d54dc983/tcpip-printer-via-gpp?forum=winserverGP Together, they seem to have solved my problem. However, a minute ago ...


3

As shown in the quote below, there is no GPO for this action. You could use the dsquery command to create a script that finds users who have been inactive for 30 days with the -inactive switch To display the distinguished names of all users in the current domain only whose names end with "Smith" and who have been inactive for three weeks or more, ...


0

You need to link the GPO to the Domain as well. Drag your GPO to the Domain you want it to apply (ads that to the "Location")


4

Printers can be assigned by script, or GPO/GPP, with or without the presence of a print server. A print server just makes centralized management easier... and provides a convenient place for all the damn printer drivers to be found. There are bunch of good examples of scripts for assigning printers here in this Q&A. In your case, you'd just remove the ...


0

I have deployed the GPO successfully with a working EMIE_Sites.xml list hosted on IIS. To test, can you try targeting the GPO location to both an HTTP URL as well as a local file path and see if either location updates the CurrentVersion value (Reads the GPO correctly, and updates as appropriate)? And to be clear, the registry value you're looking at is: ...


0

When this policy was showing applied to computers, did the computers restart since or has the BITS service been restarted since the change took effect? I recently applied a BITS policy and was wondering why it didn't work until the BITS service was restarted. I don't know when you applied this so this might not be your issue. I used the other policy ...


1

Remove the checkmark in the "ignore bandwidth limits..." if your computers are on the same subnet as the WSUS server.


0

You can follow this ServerFault article and deploy the registry keys using Group Policy Preferences. Instructions for creating a registry key for deployment in Group Policy can be found in this TechNet article. You want to set this up as a computer configuration policy.


1

As there already mentioned, ADMX files contains rules definitions, not settings themselves. If there is no AD, you, however, can transfer these settings to another computer: Start group policy editor and configure desired settings Copy \Windows\System32\GroupPolicy folder content to another computer (to same folder) Run gpupdate /force on destination ...


6

.admx files are written in XML and contain settings that the Group Policy Management Console can read. Group Policy then translates those settings to registry keys (which may not exist prior to the policy being applied). Windows update settings live in HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate. When I worked in a setting without ...


6

Your conception is incorrect. ADM/ADMX files are nothing like exports from the registry. Administrative Templates (both the old-style ADM and newer-style ADMX files) exist to drive the user interface in the Group Policy editor. They define the settings that can be managed, not the settings themselves. These settings amount to registry values which are ...


0

Turns out that the function of storing the TPM info to AD (or the attempt of storing the TPM info to AD) only occurs when you change password. I was not changing the password but using the same password. Due to the fact that shamefully our AD schema is super-duper old school [looks like server 2008 SP1, not even R2], I used BitLockerTPMSchemaExtension.ldf ...


2

I solved this as I was writing the question, and thought I'd share. I deceived myself when banging out the WMIC command and didn't think about the requirement for quoted values in the rather strict WQL syntax used here: SELECT * FROM Win32_OptionalFeature WHERE Caption = "Microsoft-Windows-Server-Gui-Shell-Package-DisplayName" AND InstallState = "2" ...



Top 50 recent answers are included