Group Policy Central » Setting of the Week

Group Policy Setting of the Week 41 – Prevent the computer from joining a Homegroup

Alan Burchill — Mon, 20 Sep 2010 08:00:00 +0000

Last week I talked about the “Remove Homegroup link from the Start Menu” option that removed removed the links from the start menu to the Homegroup option without it being disabled. However the setting by itself does not stop a computer from joining a homegroup. So this weeks setting is of course called “Prevent the computer from joining a Homegroup” and is a per computer setting that can be found under Computer Configuration > Administrative Templates > Windows Components > Homegroup.

Note: Unlike the name suggests if you enable this setting and the computer is already joined then the next time it is reboot it will not connect the homegroup it is already a member (See image below). Therefore I recommend you implement this in conjunction with the “Remove Homegroup link form the Start Menu” setting so as to not confuse the users by allow them access to something that will not work.

Also note that if you were to then remove of disable the “Disable Homegroup” policy then that computer would also no longer be a member of that homegroup anymore.

For more information on this policy see http://gps.cloudapp.net/Default.aspx?PolicyID=2358

Group Policy Setting of the Week 40 – Remove Homegroup link from Start Menu

Alan Burchill — Tue, 14 Sep 2010 08:00:00 +0000

Homegroup is a new feature in Windows 7 that allows users on a small network to easily share all their files and printers with each other with a single share password. This greatly simplifies the process to securely share information on a home network and it can include both domain and non-domain joined computers. As an IT administrator you may not want to encourage the use of this feature for your domain joined computers so there is an option to remove the Homegroup link from the Start Menu. This setting can be found under User Configuration > Policies > Administrative Templates > Start Menu and Taskbar and as a Homegroup is a Windows 7 feature this can obviously only be configured on Windows 7 computers.

Start Menu with Homegroup – Before	Start Menu with Homegroup – Before

Start Menu without Homegroup – Enabled	Customize Start Menu – Enabled

Note: This only removes the shortcut from menu so users can still configure a homegroup via the control panel.

For more information on this setting see http://gps.cloudapp.net/Default.aspx?PolicyID=4668

Group Policy Setting of the Week 39 – Always use custom logon background

Alan Burchill — Mon, 16 Aug 2010 12:00:00 +0000

This week setting of the week allows you to prefer a custom logon background image in Windows 7. This setting is called “Always use custom logon background” and can be found under Computer Configuration > Policies > Administrative Templates > System > Logon.

Microsoft brought back the option to easily customise the logon background in Windows 7 as this was previously possible in Windows XP but it was removed with Windows Vista which left people with some pretty messy workarounds.

Once you have enabled this option all you have to do to create the “%windir%\system32\oobe\info\backgrounds” folder and populate it with a backgroundDefault.jpg image and your computer will then use that as the background image when logging on and off.

Note: Some sites will direct you to configured the OEMBackground or UseOEMBackground in the HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\Background however this setting will negate the need to set this key.

For more info on how to configure a custom background check out Windows 7 to officially support logon UI background customization

Group Policy Setting of the Week 38 – Remove pinned programs from the Taskbar

Alan Burchill — Mon, 09 Aug 2010 08:00:00 +0000

The setting of the week this week disables one of the features in Windows 7 that allowed users to pin programs to the taskbar. This option will be handy if you are in an environment where you want to prevent users from customising the taskbar such as a kiosk or library style computer. The setting can be found under User Configuration > Policies > Administrative Templates > Start Menu and Taskbar and only applies to Windows 7.

Note: If you do apply this setting to your existing users all the existing pinned taskbar programs will be removed on the next logon.

Below are some screenshots of the UI with the setting enabled.

“Pin to Taskbar” is removed

“Pin this program to taskbar” is removed

All existing pinned programs will be removed.

Group Policy Setting of the Week 37 – Change Start Menu power button

Alan Burchill — Tue, 03 Aug 2010 08:00:00 +0000

This week setting of the week is called “Change Start Menu power button” which allows you to configured the start menu shutdown button in Windows 7 and Windows Server 2008 R2. You can find this setting under User Configurations>Policies>Administrative Templates>StartMenu and Taskbar.

If you have setup your computer to support Hybrid-Sleep then you should consider configuring this option to help ensure that your users select the “sleep” option.

Before

After

Note: If you select the “Sleep” or “Hibernate” options and the computers does not support that power mode then the option of shutdown will be used instead.

Group Policy Setting of the Week 36 – Turn off Windows Start-up Sound

Alan Burchill — Mon, 26 Jul 2010 11:10:33 +0000

This weeks group policy setting on the week is one that most IT administrators will probably want to implement. Now for personal use the Windows logon sound is quite nice however when you have an office packed with computers it can sound like a symphony in the morning as everyone turns on their computer. This is a new policy setting for Windows Vista but during the Beta is was not something that could be turned off. Luckily Microsoft heard loud and clear that this was an option they needed to add and by the RTM they had added this option for end users and IT admin.

As I mentioned before this is a Windows Vista or greater setting which can be found under Computer Configuration > Policies > Administrative Templates > System > Logon.

Group Policy Setting of the Week 35 – Display information about previous logons during user logon

Alan Burchill — Sun, 18 Jul 2010 11:34:22 +0000

This weeks setting is one that has just been mentioned in the AD Blogs Friday mail sack and until today was a setting/feature of Windows Vista/7 that I didn’t know existed. This setting display information about previous logons during a user logon and is very similar to the last logon screen I see when logging onto an online banking web site. This setting can be found under Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Logon Options and must be applied to workstations AND domain controllers for it to work. The only down side for this setting is that you need to be in 2008 native mode to work so this might exclude some organisations for now.

WARNING: Be sure that you apply this setting to your domain controllers first otherwise they will not be able to logon.

Below is the message a users will see when after the logon successfully when the previous logon was also successful.

In this example we see the message when someone logon successfully where the 5 previous logon events had failed. Obviously this logon count number (see highlighted below) would raise a really big red flag for a users especially if you are sure that you were not the one to logon incorrectly.

For more information check out:

http://blogs.technet.com/b/askds/archive/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works.aspx

http://technet.microsoft.com/en-us/library/dd446680(WS.10).aspx

Group Policy Setting of the Week 34 – Do not allow Windows Media Center to run

Alan Burchill — Wed, 07 Jul 2010 10:58:54 +0000

The setting of the week this week prevents users from running Windows Media Center on Vista or above versions. Unlike Windows XP which had its own dedicated version of Media Center, Vista Enterprise and Ultimate editions and Windows 7 Business, Enterprise and Ultimate had inbuilt support Windows Media Center. This setting would most likely be used in a corporate environment where they wanted to control the running of unproductive applications. This is either a user or computer based setting that can be found under Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Media Center meaning you can either selectively apply it to users or to all the computers in your fleet.

When the setting is enabled the user will still see the shortcut to Windows Media Center however when the user tries to run the program they will be presented with the following dialogue box.

Group Policy Setting of the Week 33 – Set up a work schedule to limit the maximum network bandwidth used for BITS background transfers

Alan Burchill — Mon, 28 Jun 2010 08:00:00 +0000

This weeks setting of the week is called “Set up a work schedule to limit the maximum network bandwidth used for BITS background transfers”… Phew…. This policy is used to configure the bandwidth allocation of BITS network transfers in your environment. This is obviously very handy setting manage your bandwidth if you are working in a bandwidth constrained environment such as a remote branch office. Some of the more likely application you have installed in your environment that use BITS are Windows Server Update Services or Branch Cache however third-party application can also use the BITS to transfer information.

This setting is used to control 3 of the 4 levels (see below) of BITS transfer priority that can be used by applications.

FOREGROUND
HIGH
NORMAL
LOW

The foreground transfer is always meant to be performed in real time so there is no option to control what amount of bandwidth this transfer method uses. For more info on BITS transfer priority see http://msdn.microsoft.com/en-us/library/aa362805(VS.85).aspx.

This setting can be found under Computer Configuration > Administrative Templates > Network > Background Intelligent Transfer Services (BITS) and will only apply to Windows 7 or computers with BITS 3.5 installed.

If you are considering this setting then also look at the other setting called “Set up a maintenance schedule to limit the maximum network bandwidth used for BITS background transfers” which will take precedence over the work schedule rule. You may want to use this maintenance schedule to allow the use of more bandwidth after hours when the network is not as busy.

Group Policy Setting of the Week 32 – Prevent changing mouse pointers

Alan Burchill — Wed, 23 Jun 2010 08:00:00 +0000

The group policy setting for the week this week is a new policy setting for Windows 7/2008 R2. This setting is called “Prevent changing mouse pointers” and can be found under User Configuration > Policies > Administrative Templates > Control Panel > Personalization. This setting is handy if you want to tightly control the user environment such as public access computers in a library or a common shared computer.

Below you can see how the “pointers” tab is removed when the policy is enabled.

Not Configured/Disabled	Enabled

Be careful however when you apply this setting however as it will locks the use into whatever mouse pointer scheme they had active at the time the policy is applied.

P.S. I jumped #30 and #31 because I recently discovered that I had two other setting of the week post’s with the same number. So as to not rename all the other setting of the weeks I have decided to just correct the numbering from this article going forward.

Group Policy Setting of the Week 29 – Assign a default domain for logon

Alan Burchill — Thu, 17 Jun 2010 00:13:56 +0000

This weeks setting is a native policy for Windows Vista (or greater) called “Assign a default domain for logon”. As the name suggest it configured the default domain name when a user logs on to the computer. This is very handy in a multi domain environment or if you want to make sure that your newly built computer default to the correct domain when the users logon for the first time. This setting can be found under Computer Configuration > Administrative Templates > System > Logon and it requires requires at least Windows Vista.

How to set Default Logon Domain Name for Windows XP via Group Policy

Its nice that this is now a native policy as you use to have to set the registry manually for you to set this option in Windows XP but I often find that this method is very often hit an miss. If you do want to try configuring this for Windows XP you could set it via Group Policy Preferences then here are the key you would set

Key: HKLM\software\microsoft\windows nt\currentversion\winlogon\
Value: altdefaultdomainname (REG_SZ)
Data: DOMAINNAME

and

Key: HKLM\software\microsoft\windows nt\currentversion\winlogon\
Value: defaultdomainname (REG_SZ)
Data: DOMAINNAME

Group Policy Setting of the Week 28 – Maximum wait time for Group Policy scripts

Alan Burchill — Tue, 08 Jun 2010 02:00:00 +0000

This weeks Group Policy setting should be used in environments where you still use a logon script. While I implore you stop using logon scripts (see http://www.ihatelogonscripts.com ) they are still out there for a majority of customers and as such still need to be properly managed. This setting is called “Maximum wait time for Group Policy scripts” but it can also be referred to as a “dead man’s switch” which will kill any logons script from running if it ever locks up which of course NEVER happens . This setting can be found under Computer Configuration > Policies > Administrative Templates > System >Scripts.

The default value for this option is 600 seconds (10 minutes) but I recommend that you do configured this to something more reasonable between 60 seconds (1 minute) to 180 seconds (3 minutes) depending on your environment.

For more information on this option check out http://technet.microsoft.com/en-us/library/cc780635(WS.10).aspx

Group Policy Setting of the Week 27 – Turn off numerical sorting in Windows Explorer

Alan Burchill — Sun, 30 May 2010 22:54:45 +0000

In this weeks setting I look at a new Windows 7 setting that reverts the sort order of folders back to the old way it would sort files and folder the same as Windows 2000 (and earlier). This policy setting is called “Turn off numerical sorting in Windows Explorer and can be found under User Configuration > Policies > Administrative Templates > Windows Components > Windows Explorer.

As you can see from the “Numerical Sorting” example below the folder list will sort based on the numerical value of the folder name. This means that a single digit number will be ordered higher than a two or more digit number when sorting alphabetically.

Numerical Sorting (Setting Disabled or Not Configured)

If you take a look at the Literal Sorting example you can see that the number “10” is in position 2 because the sorting is treating the number as a literal text. You can get around this sorting problem by padding with zero’s however you need to add enough zero’s to match the same number of digits as the largest number.

Literal Sorting (Setting Enabled)	Literal Sorting with padded Zero’s (Setting Enable)

While it is unlikely that you will need to turn this on for all users in your organisation it is possible that you have some folder on your file server that have been created in such a ways that the new view method would cause a problem. Obviously in this case you would need to consider carefully if you just need to turn this on for selected users.

Group Policy Setting of the Week 26b – Do not allow Windows Messenger to be Run

Alan Burchill — Tue, 25 May 2010 00:10:08 +0000

(Wow… I have been doing this for 6 months now… how time flies… )

This weeks setting of the week is another old one however it is very important for any environment that is still running Windows XP SOE. The “Do not allow Windows Messenger to be run” will prevent any user from running Windows Messenger that comes out of the box with Windows XP. Now Windows Messenger 4.6 that comes with Windows XP is no longer supported but disabling the program should help avoid any confusion for user that also have Windows Live Messenger installed.

This is a user setting that can be found under User Configuration > Policies > Administrative Templates > Windows Components > Windows Messenger and while it does say it applied to Windows XP this in reality is only a Windows XP setting as there is no Windows Messenger in Windows Vista or above.

While most organisation already have this program removed from the SOE (see image below) this is a good safety net setting for anyone who has joined their non-SOE version of messenger to the domain.

Now to be clear this will only prevent the user running Windows Messenger and not the live of Windows Live Messenger or other third-party messenger programs.

This setting will not remove messenger from the computer but when the users clicks on the Windows Messenger link.

Group Policy Setting of the Week 26 – Do not automatically make redirected folders available offline

Alan Burchill — Sun, 16 May 2010 20:00:00 +0000

This weeks setting is called “Do not automatically make redirected folders available offline and can be found under User Configuration > Policies > Administrative Templates > System > Folder Redirections and will work with Windows XP or later. As the name suggest this prevents any users redirected folder from being made available for offline use which is enabled by default.

This setting is particularly useful to configure on computers that are as used by multiple users as it eliminates the build up of multiple offline file caches on the hard drive. This is particularly important on Windows XP as all offline files try to synchronise even if the user does not have access to the files which causes file sync errors. The option also improves logon performance as it does not attempt a full offline sync of the cache when the user log’s on for the first time.

Group Policy Setting of the Week 25 – Remove the Action Center icon

Alan Burchill — Mon, 10 May 2010 10:34:15 +0000

The setting of the week is called “Remove the Action Center icon” and as the name says it is used to remove the Action Center icon (a.k.a. Flag) from the system tray (see below).

You might want to enable this setting if you are in a corporate environment and you centrally managed Backups, Firewall and Updates using other programs. However disabling this means that your users will not receive any alerts if the is some critically wrong with thier computer so please use this option after careful consideration.

If you decided that you don’t want to completely disable the Action Center and only disable certain alerts then check out my other post How to use Group Policy to turn off the Backup Notification in the Windows 7 Actions Center

This is a user setting and can be found under User Configuration > Policies > Administrative Templates > Start Menu and Taskbar and is of course only for Windows 7 and Windows Server 2008 R2.

Group Policy Setting of the Week 24 – Remove Properties from the Computer icon context menu

Alan Burchill — Wed, 05 May 2010 06:26:19 +0000

Sorry that this weeks setting of the week was a little late however as you can see I have been a little busy.

This weeks setting is called “Remote Properties from the Computer icon context menu” and can be found under User Configuration > Policies > Administrative Templates > Desktop. This setting might seem a little mundane compared some other setting however it could be very useful if you are in an environment where many of your users have admin access to their computers. Enabling this setting makes it much more difficult for users to remove their computer from the domain which they might want to do because of those pesky restrictive group policies.

Note: If you do enabled this option be sure not to apply it to specific IT staff so that they can still manage the computer account. You could do this by using using the Deny “Apply Group Policy” of the Advanced security setting of the policy.

Setting Enabled on Windows 7

Setting Enabled on Windows XP

Note that this does not prevent users from removing the computer from the domain as all you are doing is disabling the System Properties dialogue box that has the computer name tab (see image below) where domain membership is normally configured. While just disabling the UI is not a 100% effective it should at least stumble most users from changing this setting.

In case you were wondering, a user with admin access to their computer could still install either the Windows XP Support tools or the Remote Server Admin Tools (RSAT) to use the NETDOM JOIN and NETDOM REMOVE commands to change the computer domain membership.

Group Policy Setting of the Week 23 – Outlook 2003 RPC Encryption

Alan Burchill — Mon, 26 Apr 2010 09:56:18 +0000

This weeks setting is a little bit different as this is the first time that I have selected a non-managed policy setting, but I have chosen this one as it is probably a setting that will be used in a lot of organisations as they start to rollout Exchange 2010. This setting is called “Enable RPC Encryption” and it is a Outlook 2003 specific setting that enables encrypted RPC communication with the exchange server. The reason why this setting is now so important is that starting with Exchange 2010 all RPC communication with the server requires encryption by default. This setting can be found under User Configuration > Policies > Administrative Templates > Classic Administrative Templates > Outlook 2003 RPC Encryption > Exchange Settings however remember as this is a non-managed policy you may need to enable option to see non-managed settings.

For more information on how to install this custom adm see Outlook connection issues with Exchange 2010 mailboxes because of the RPC encryption requirement and for more information about making Outlook 2003 with with Exchange 2010 then see Common Client Access Considerations for Outlook 2003 and Exchange 2010 .

Group Policy Setting of the Week 22b – DNS Servers

Alan Burchill — Sun, 18 Apr 2010 20:00:00 +0000

I used to think that it was not possible to set IP address information via Group Policy however I did some checking this week and was pleased to find that there was a way to configure your computers DNS Server addresses. Unfortunately this setting only applies to Windows XP, however lots of people still use XP so it is still somewhat relevant. This setting is simple called “DNS Servers” and can be found under Computer Configuration > Administrative Template > Network > DNS Client.

Figure 1.

To configure this setting simple check Enabled and type each IP address of the DNS Servers with a space between them.

While DNS Server settings are normally configured via DHCP this option can be really handy when you have two separate Active Directory forests on the same LAN. This is common where two companies have physically merged but still run separate AD’s forests connected to the same network. Now for name resolution you can setup DNS forwarders from forest A to forest B however this does not work for dynamic DNS registrations of the computer names.

Note: When this setting is applied its a little bit tricky to confirm that it has actually applied as both the network properties (see figure 2.) and even and ipconfig /all will show the manually configured IP DNS setting (see figure 3.). However if you do a NSLOOKUP (also see figure 3.) you will notice that the DNS server that it uses is the DNS Server that is configured in the Group Policy or alternatively you can just rely upon an rsop.msc report.

Figure 2.

Figure 3.

Group Policy Setting of the Week 22 – Enable Transparent Caching (Offline Files)

Alan Burchill — Sun, 11 Apr 2010 21:00:00 +0000

This week is another setting that controls a new offline files settings that was introduced in Windows 7 and this setting seems to be nothing short of AMAZING!!!

This setting is used to “Enabled Transparent Caching” and can be found under Computer Configuration > Policies > Administrative Templates > Networks > Offline Files. Unfortunately I have not had a chance to try this option for my self but reading the description it seems to be nothing short of hidden killer feature for Windows 7. The transparent cache feature kicks in on any offline files whenever latency to the file server goes above a certain limit. Now everyone’s environment is going to be different based on file server performance and network latency so be sure you do some testing first to get the right balance. When this setting is combined with last weeks “Configure Background Sync” option then you could drastically reduce latency to the file server and decrease bandwidth consumption. This options sound ideal for Direct Access and VPN users as their latency to the file server could vary drastically depending on the networking conditions or it could be configured to mask any performance issues that are noticed when a file server is being backed up.

If you are working in an environment that has Windows 7 deployed then this is definitely one setting you need to look at enabling. That being said deploy a Brach Cache to a remote site would still deliver more benefits as files that are cached as one computers cache can be users for other computers on the same LAN segment. This is as opposed to this option which only gives a bandwidth saving benefit for any files that have already been made available offline on that particular computer.

Group Policy Setting of the Week 22 – Configure Background Sync (offline files)

Alan Burchill — Mon, 05 Apr 2010 11:04:44 +0000

This weeks setting of the week is second is another one of the new Windows 7 offline file settings called “Configure Background Sync” which can be found under Computer Configuration > Policies > Administrative Templates > Networks > Offline Files. This setting allows you to configured the new Windows 7 feature that background sync’s offline file when a computer is in “Slow Link” mode.

Configured this setting would be very useful if you have a large number of computers at a single site that sync their files over a WAN link. In this case the background sync of a large number of users could cause a large amount of traffic. You could then use this setting to back off the sync interval. You may also want to do the opposite and crank up the sync interval to ensure that users files are being saved to the server as soon as possible.

The other scenario where this could be used if for users that are running Direct Access mode or a VPN and you just want to control the amount of traffic they push via their connection.

There is also and option called “Enabled Background Sync for shares in users selected “Work Offline” mode” which forces offline files to sync even when the users has manually chosen offline mode. I would be careful of this setting however as this behaviour might confuse as they might create the document thinking that it was not going to be saved to the server straight away for other people to view.

Group Policy Setting of the Week 20 – Exclude File form being cached

Alan Burchill — Sun, 28 Mar 2010 10:02:42 +0000

This weeks setting is a new configuration setting in Offline Files called “Exclude files form being cached”. This setting can be used by IT administrators to block any un-wanted file types from being made available for offline use. You can find this setting under Computer Configuration > Policies > Administrative Templates > Network > Office Files and it will only work on Windows 7.

This setting can be really useful when you have user policies in your environment that block certain types of files on your file servers such as *.jpg or *.mp3. When combined with Windows Server File System Filters you can use it to make some very tight controls on your corporate file servers.

Group Policy Setting of the Week 19 – Set roaming profile path for all users logging onto this computer

Alan Burchill — Sun, 21 Mar 2010 10:04:43 +0000

Back to another profile setting this week and this one can save any organisation using Windows Vista or greater a lot of time if you manual provision your accounts. The setting is called “Set roaming profile path for all users logging onto this computer” and it configures the users roaming profile path that is normally configured on a per account basis in Active Directory Users and Computers (see below). Being able to apply this setting via Group Policy means it is one more user attribute that you no longer need to configure on the users account. This of course makes provisioning users account just that little bit simple which should save both time and the possibility for human errors.

This setting can be found under Computer Configuration > Policies > Administrative Templates > System > User Profiles but as its a computer based setting this also means that you need to be careful how you apply this setting. Applying this setting to laptop could be undesired as they may try to log into a remote location with a slow WAN link to the profile server. So if you do apply this to the laptop you might want to configured it to point to a DFS namespace path or a DNS alias (if you have subnet masking filtering enabled) which can help point them to a faster more local path. This of course means it would be really useful to have a OU structure that separate your laptops from your desktop computer.

But I would definitely recommend use this setting if you are using Windows Vista or Windows 7 in your SOE.

Group Policy Setting of the Week 18 – Allow file download (Internet Explorer)

Alan Burchill — Tue, 16 Mar 2010 10:47:49 +0000

This weeks setting is one that you would use if you are in an environment that you want a very high level of security (e.g. Kiosk computers). The “Allow file download” option is used to prevent the downloading of files via Internet Explorer. This setting does not prevent the browser form downloading files such as images to display in the browser page but it does prevent users from downloading of files when a user click on a file download link. This could also be useful if you want to help limit the security attack vector of users being tricked into download and running malicious files on their computers from the internet which could help mitigate some Zero day attacks.

Note: This does not prevent users from running Firefox or Chrome to get around this restriction (although they would have difficulty in downloading it) therefore you may also want to consider deploying AppLocker or Software Restriction Policies to prevent the running of those apps.

To enable this restriction you need to first “Enable” the policy and then set the Allow file downloads option to “Disable” . This setting can be found under Configuration > Policies > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page > Internet Zone. This setting can also be configured on the other zone’s under the Security Page section however the Internet Zone is what most web sites are classified as and therefore will have the largest affect.

When this policy is applied to a user and the user clicks on a hyperlink to a file to download they will then receive this dialogue box.

If you did enabled this setting and you wanted to let users download file from particular web sites you could add the site URL to the trusted sites zone list. I have previously blogged how to do here http://www.grouppolicy.biz/2010/03/how-to-use-group-policy-to-configure-internet-explorer-security-zone-sites/

P.S. Sorry i am a day late with this one… have been a bit busy lately. But don’t worry i will make sure that i always have time to do a setting of the week post each week.

Group Policy Setting of the Week 17 – Background upload of a roaming user profile’s registry file while user is logged on

Alan Burchill — Sun, 07 Mar 2010 16:00:00 +0000

Another one…? yes… Another roaming profiles group policy for this weeks setting of the week. But this is a really super cool policy I found while reading the “What’s New in Folder Redirection and User Profiles” (via @stealthpuppy ) document that Microsoft recently published. This document mainly goes through the new features with folder redirections in Windows 7 however it also mentions the new group policy/feature called “Background upload of a roaming users profile’s registry file while user is logged on”.

This setting can be found under Computer Configuration > Administrative Templates > System > User Profiles and is specific to Windows 7 or Windows Server 2008 R2.

This policy setting would be very useful as a way to ensure that at least part of a users profile is save to the network if they are they type that never like to log off their computer at night.

There are a few points about this policy which I have summarised below:

Only synchronises the users registry profile (ntuser.dat) so things like desktop icons and favourites wont sync. (This is what folder redirection is for any way).
There are two modes of scheduling the update
- Run at set interval – Between 1 hour and 720 hours (30 days).
- Run at specified time of day – useful if you only want to run this at 3am so that it only applies to users who stay logged on over night.
The schedule will run randomly any time up to an hour after it is supposed to run so to not load the file server with a large number of concurrent requests.
If you choose one method of scheduling then it will ignore the set value of the other schedule.

I also have a very strong suspicion that this setting is only compatible if you have Windows 2008 (or later) as the file server so that it can handle the copying of the locked file (ntuser.dat). Please ping me if you can confirm this.