Group Policy Central

This weeks group policy setting on the week is one that most IT administrators will probably want to implement. Now for personal use the Windows logon sound is quite nice however when you have an office packed with computers it can sound like a symphony in the morning as everyone turns on their computer. This is a new policy setting for Windows Vista but during the Beta is was not something that could be turned off. Luckily Microsoft heard loud and clear that this was an option they needed to add and by the RTM they had added this option for end users and IT admin.

As I mentioned before this is a Windows Vista or greater setting which can be found under Computer Configuration > Policies > Administrative Templates > System > Logon.

This weeks setting is one that has just been mentioned in the AD Blogs Friday mail sack and until today was a setting/feature of Windows Vista/7 that I didn’t know existed. This setting display information about previous logons during a user logon and is very similar to the last logon screen I see when logging onto an online banking web site. This setting can be found under Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Logon Options and must be applied to workstations AND domain controllers for it to work. The only down side for this setting is that you need to be in 2008 native mode to work so this might exclude some organisations for now.

WARNING: Be sure that you apply this setting to your domain controllers first otherwise they will not be able to logon.

Below is the message a users will see when after the logon successfully when the previous logon was also successful.

In this example we see the message when someone logon successfully where the 5 previous logon events had failed. Obviously this logon count number (see highlighted below) would raise a really big red flag for a users especially if you are sure that you were not the one to logon incorrectly.

For more information check out:

http://blogs.technet.com/b/askds/archive/2009/04/15/the-lastlogontimestamp-attribute-what-it-was-designed-for-and-how-it-works.aspx

http://technet.microsoft.com/en-us/library/dd446680(WS.10).aspx

The setting of the week this week prevents users from running Windows Media Center on Vista or above versions. Unlike Windows XP which had its own dedicated version of Media Center, Vista Enterprise and Ultimate editions and Windows 7 Business, Enterprise and Ultimate had inbuilt support Windows Media Center. This setting would most likely be used in a corporate environment where they wanted to control the running of unproductive applications. This is either a user or computer based setting that can be found under Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Media Center meaning you can either selectively apply it to users or to all the computers in your fleet.

When the setting is enabled the user will still see the shortcut to Windows Media Center however when the user tries to run the program they will be presented with the following dialogue box.

This weeks setting of the week is called “Set up a work schedule to limit the maximum network bandwidth used for BITS background transfers”… Phew…. This policy is used to configure the bandwidth allocation of BITS network transfers in your environment. This is obviously very handy setting manage your bandwidth if you are working in a bandwidth constrained environment such as a remote branch office. Some of the more likely application you have installed in your environment that use BITS are Windows Server Update Services or Branch Cache however third-party application can also use the BITS to transfer information.

This setting is used to control 3 of the 4 levels (see below) of BITS transfer priority that can be used by applications.

• FOREGROUND
• HIGH
• NORMAL
• LOW

The foreground transfer is always meant to be performed in real time so there is no option to control what amount of bandwidth this transfer method uses. For more info on BITS transfer priority see http://msdn.microsoft.com/en-us/library/aa362805(VS.85).aspx.

This setting can be found under Computer Configuration > Administrative Templates > Network > Background Intelligent Transfer Services (BITS) and will only apply to Windows 7 or computers with BITS 3.5 installed.

If you are considering this setting then also look at the other setting called “Set up a maintenance schedule to limit the maximum network bandwidth used for BITS background transfers” which will take precedence over the work schedule rule. You may want to use this maintenance schedule to allow the use of more bandwidth after hours when the network is not as busy.

The group policy setting for the week this week is a new policy setting for Windows 7/2008 R2. This setting is called “Prevent changing mouse pointers” and can be found under User Configuration > Policies > Administrative Templates > Control Panel > Personalization. This setting is handy if you want to tightly control the user environment such as public access computers in a library or a common shared computer.

Below you can see how the “pointers” tab is removed when the policy is enabled.

Not Configured/Disabled	Enabled

 Be careful however when you apply this setting however as it will locks the use into whatever mouse pointer scheme they had active at the time the policy is applied.

P.S. I jumped #30 and #31 because I recently discovered that I had two other setting of the week post’s with the same number. So as to not rename all the other setting of the weeks I have decided to just correct the numbering from this article going forward.