2022 Developer Survey is open! Take survey.

Questions tagged [group-policy]

Group Policy is a built-in feature of the Microsoft Windows operating systems. Group Policy allows administrators to automatically configure myriad options within the OS. These policies can be configured, and applied, either locally to the computer via Local Group Policy or remotely within an Active Directory environment.

Filter by
Sorted by
Tagged with
0 votes
0 answers
15 views

Best approach for specific local server permissions?

We are trying to set up a three step permission-structure (Firstline, secondline, thirdline support). Firstline can only RDP with user-rights to all our domain-servers, no problem there with ...
user avatar
  • 11
0 votes
0 answers
16 views

Can you modify or remove a Domain GPO Setting through powershell

I have an issue where I was modifying some settings in the Default Domain Policy (I know I shouldn't have) and I've managed somehow to set the 'Allow log on through Terminal Services' to a null value (...
user avatar
0 votes
0 answers
21 views

Deploy Printers Per Machine With GPO

I have 4 printers being deployed by my Windows Server 2016. They are all the same printer. I am using the latest driver. The printers are deployed by the server using Group Policy. The printers are ...
user avatar
  • 761
0 votes
0 answers
14 views

Printing on hardened windows clients

I have inherited hardened clients with a lot of policies applied to them. There is an application running on this clients, that should show the windows printing dialog, but it does not pop up. There ...
user avatar
-1 votes
1 answer
30 views

GPO policy to give write permissions to java applications in C drive

I wish to run the following instruction in a Windows cmd: java -jar app.jar. App.jar is an application in charge of creating a file in the Temp folder of the Windows user folder but it fails because ...
user avatar
0 votes
0 answers
16 views

Group Policy scheduled task for running .bat file applies, but task does not create

I am trying to add a scheduled task to run a batch file that updates / installs software. I created a GPO to create the task, using these settings: Task Settings Task settings 2 Task settings 3 For ...
user avatar
0 votes
0 answers
11 views

Windows 11 is not storing network credentials when accessing azure files or RDP server [migrated]

My Windows 11 machine (part of a domain) does not store network passwords/credentials. This happens when i try to connect to an azure file share (using windows explorer) or when i connect to a server ...
user avatar
-1 votes
0 answers
20 views

Is there a way to work around TrustedHosts when set by GPO?

I want to PSRemote into machines on another domain, and typically to do that you'd have to add the computers to the TrustedHosts entry. No big deal, you'd think. However, an IT department which I don'...
user avatar
0 votes
1 answer
19 views

Chrome enterprise set custom setting for extension

We have developed a browser extension and wish to distribute it. A license key is required to use our chrome extension. This value should be set by the system administrators and not by individual end ...
user avatar
  • 111
0 votes
0 answers
37 views

WinServer2016 - Access Denied when adding or changing a GPO

I have inherited a network whose GPOs are damaged, the SYSVOL folder shows signs of tampering with the NTFS permissions and folder structure manually, and I am unable to add/edit any GPOs, I receive ...
user avatar
1 vote
1 answer
60 views

GPO and SYSVOL reset

We inherited a network with badly damaged GPOs across 3 DC's (all WinServ 2016). We receive an "Access Denied" error when using GPOs, and the permissions of the SYSVOL folder show signs of ...
user avatar
0 votes
1 answer
54 views

DNS suffix works only when no subdomains are added

We have a DNS suffix for our domain ourdomain.local and it works whenever we have one additional DNS component e.g. test1.ourdomain.local or graphs.ourdomain.local, so that means we only have to type ...
user avatar
  • 11
1 vote
0 answers
111 views

Block or Disable USB tethering using Windows AD GroupPolicy

For Windows based PCs connected with Windows AD with Group policy, we want to block USB phone tethering options. And we have tried following things which seems to be working for some people but not us....
user avatar
  • 251
2 votes
0 answers
22 views

If I set a policy to deny log on locally for a particular AD user, will it affect existing logged on sessions belonging to that user in any way?

Background Historically in my organisation we have used a particular shared domain admin account (let's call it SharedDA) for almost everything. It is currently logged on to several dozen servers. ...
user avatar
  • 129
2 votes
0 answers
36 views

Windows Update fallback plan when system is powered off?

Background I have a Windows domain consisting of ten Windows 2022 servers and five Windows 11 Hyper-V VMs. The servers live at AWS. The Windows 11 VMs live on various laptops. I want to implement a ...
user avatar
2 votes
2 answers
31 views

GPO to add a purpose to root certificate

The root certificate of the DFN-PKI "T-TeleSec GlobalRoot Class 2" is not activated in the Windows certificate store for the certificate purpose "code signing". I can activate it ...
user avatar
  • 295
-1 votes
2 answers
71 views

Can't logon to domain controllers

We have 2 domain controllers with 2019 server, system administrator made something with GPO which deny access for group "Domain Admins" to workstations, now it is distributed throughout the ...
user avatar
  • 9
0 votes
0 answers
31 views

Windows Server 2019 GPO - "User Policy Update Failed"

My clients environment is a mix of Windows 2012, 2016 and 2019 servers. Recently we had a few additional Windows 2019 servers provisioned and added to our domain. When I run gpupdate /force from the ...
user avatar
  • 578
0 votes
0 answers
15 views

Can I change the timeout settings for Group Policy Files Preference policy?

Is there a way to change the amount of time the Group Policy Files Preference Policy takes to timeout when the file server is not available? A setting that affects only this preference item is ...
user avatar
  • 3,120
1 vote
1 answer
171 views

How to Update ADMX Files - Different Server OS Versions in Domain

My clients domain has various 2012R2, 2016 and 2019 Windows Server versions. Two of the four domain controllers are running Windows 2012R2 and the ADMX files haven't been updated in years. The other ...
user avatar
  • 578
0 votes
0 answers
29 views

GPO Audit Policy Issue

This is a Server 2022 Standard box. I want to set a GPO in order log failed login events. So in the Default Domain Controllers Policy I went to Windows Settings>-Security Settings->Local ...
user avatar
0 votes
1 answer
49 views

Windows 11 PC is ignoring domain GPO to allow inbound ICMP

we have joined a Windows 11 machine for the first time to our domain, however something is not working as expected. For instance, the machine cannot be pinged, although the domain GPO sets a rule in ...
user avatar
  • 253
1 vote
0 answers
55 views

Block Windows 11 via GPO without specifying sub-version

as shown in here Group Policy for Blocking Windows 11 Upgrade Prompts Microsoft allows blocking the Windows 11 Update via a GPO, howver as far as it seems you have to specify both the main (e.g. ...
user avatar
  • 113
3 votes
1 answer
416 views

Why does a MS GPO option break SMB shares that use a hosts file for the machine name?

We've set "Microsoft network server: Server SPN target name validation level" to "Required from client" on our test GPO. Our test systems have some custom machine aliases in their ...
user avatar
  • 133
0 votes
0 answers
18 views

Distribute a Secret to users without showing it to users [Active Directory, Group Policy]

I need to distribute a secret token to a group of users, where it would be stored in ODBC configuration in the password field (masked). The goal is to make it accessible for GPO script, but not ...
user avatar
0 votes
1 answer
38 views

kinit Password Expire Warning

I've a Ubuntu desktop client joined to an Active Directory 2008 R2 domain. I need to use "kinit" command on Linux to determine when a user password will expire. That's my way to go due to ...
user avatar
  • 101
0 votes
0 answers
33 views

Best Method For Clearing User Data On Shared Windows Device?

I have had a client request that I setup a user account on a Windows device that will clear all user profile data once the account has been logged off. The computer is a shared device that will be ...
user avatar
  • 1
0 votes
0 answers
58 views

Set configured proxy settings via GPO to read-only

I've created a GPO to configure the Use automatic configuration script (User -> Configuration -> Preferences -> Control Panel Settings -> Internet Settings) and enabled the Prevent ...
user avatar
  • 1
0 votes
1 answer
243 views

Windows Server 2019 GPO won't copy fonts to C:\Windows\Fonts

Link to picture: https://gcdnb.pbrd.co/images/pwQHQ7qj8ere.png I'm trying to deploy Fonts via GPO but they refuse to be installed inside the Window folder. I tried just about every method. I also did ...
user avatar
  • 5
0 votes
1 answer
52 views

Conditional Computer GPO depending on the user

I have a GPO deployement problem that I'm more and more sure it's not doable, but since I don't see how to solve it in any other way, I ask it here. Here is my setup and what I need : if a user from ...
user avatar
1 vote
1 answer
881 views

What is the Windows "OneSettings service"?

Does anyone know what the "OneSettings" service is that is referred to by the following Group Polices? Among the new policies in the Windows 10 21H2 templates I found these two in the ...
user avatar
0 votes
0 answers
27 views

Kerberos is broken domain wide when an SPN is set on the server

I'm trying to investigate a problem we've had for the last 2 years. I am a developer and have familiarity with Windows Server /Active Directory /GPO... but I am not in charge of the network setup of ...
user avatar
  • 101
-1 votes
1 answer
19 views

GPO policy for Enhanced Storage Access

#GPO #usb Hi, Has anyone ever configured a GPO policy for Enhanced Storage Access'? I'm trying to set it so that only users use the dedicated flash drive list. Unfortunately despite specifying "...
user avatar
0 votes
0 answers
127 views

Prevent Auto Logoff Windows 10

I'm trying to find GPO or registry settings for disabling auto sign out when idle. It's okay if the display turns off but it shouldn't ask the user to enter a password. I don't mind the security ...
user avatar
3 votes
1 answer
596 views

Force Windows 10 to load group policy from registry

I would like to apply several group policies (for data protection purposes) on various Windows 10 machines from time to time. The target machines are running with various Windows 10 version (Home, EDU,...
user avatar
0 votes
0 answers
28 views

Google Chrome ADMX GPO allow local file access to specific paths

I try to allow access to local files but only under Downloads and only for TXTs. I tried so far: Block: * Allow: http://*,https://*,file://*C*/Users/*/Downloads/*.txt For the file path I tried already ...
user avatar
0 votes
2 answers
146 views

Group Policy for Blocking Windows 11 Upgrade Prompts

So now that Microsoft has rolled out their Windows 11 push, our company's endusers are getting the prompts. Going into Group Policy I made an change described here and other sources --> https://www....
user avatar
0 votes
1 answer
168 views

RDP Windows server 2019

I'm connecting to one windows server 2019 from another windows server 2019 through RDP, when i close the connection using the "X" button and then try to open new RDP connection i get a ...
user avatar
0 votes
0 answers
22 views

add local users to GPP managed groups

I (hopefully:) understand the usage of GPP management of restricted groups. I do it with Item-Level targetting but have one problem which I have no clue why it is not working. When using Local Group ...
user avatar
0 votes
1 answer
28 views

How can I disable the Windows Game DVR from the command line?

I need to disable the Windows Game DVR for a collection of Windows computers that will be running student exam / testing software, so that students can't use the Game DVR hotkeys to record the test ...
user avatar
0 votes
0 answers
34 views

Allow only specific people use IP printer

In-office we have several printers, which are installed to users, now when we bought another one, there is a task from manager to restrict access for that printer to only 6 people. I have checked GPO, ...
user avatar
0 votes
0 answers
37 views

Migrating 2012 R2 Domain Controllers to Windows 2019 - Missing Group Policy Setting

I currently have two Windows 2012R2 Domain Controllers. I recently stood up two Windows Server 2019 instances and promoted them to Domain Controllers. The plan is to eventually demote/retire the ...
user avatar
  • 578
1 vote
1 answer
107 views

How to enable Windows Hello on stand-alone server

Does anyone know how I can enable Windows Hello facial sign-on a Windows 2019 stand-alone server? I am the administrator of this stand-alone server, and have installed the Windows Biometric Framework, ...
user avatar
  • 145
1 vote
1 answer
54 views

Group Policy Management Tools

My company is currently using NetIQ GPAdmin from Microfocus. It has been a nightmare and is apparently going EOL. We are looking at moving to a different utility and they are attempting to sell us on &...
user avatar
0 votes
0 answers
156 views

Latest Windows 10 Will Not Deploy Printers Per Computer

I have a small offline network with a number of Windows 10 Clients patched to the latest and greatest using Windows 10 (21H1). They are in a GPO with Deployed printers from our Windows Server 2016 ...
user avatar
  • 761
0 votes
1 answer
40 views

How to add users and computers back to server 2012

I have windows 2012 server which I had to nuke due to virus issue, which has active directory setup with users and computers. Now I have installed fresh windows server and setup ad & dc with same ...
user avatar
  • 1
-1 votes
1 answer
143 views

Forcing inactive user log off

Is it possible to force a user log off after a set period of inactivity without the use of a scheduled task? I have tried using the Interactive Logon: Machine Inactivity limit GPO and it does not work....
user avatar
  • 1
0 votes
2 answers
41 views

Restrict GPOs to RD Session Host without loopback processing

My aim would be to divide our huge "User" OU (not the default one!) into different sub-OUs from the respective department. Then, I want to link the GPOs to the different departments, but ...
user avatar
0 votes
0 answers
92 views

powershell script does not run on all pcs in domain via GPO

I have a simple Powershell script in domain group policy that writes Username and PCName to network share into text file. Unfortunatelly not all PCs write info to files on network share. Some of them ...
user avatar
1 vote
1 answer
254 views

Windows 10 Enterprise systems disobeying lock screen background GPO

The following GPO is configured at the domain level for our systems: Local Computer Policy > Computer Configuration > Administrative Templates > Control Panel > Personalization > "...
user avatar
  • 13

1
2 3 4 5
63