Comments for Group Policy Central

Comment on Best Practice: Using Group Policy to configure Desktop Wallpaper (“Background”) by Craig

Craig — Thu, 17 May 2012 15:59:50 +0000

Has anyone noticed the reg key path doesn’t exist if you navigate? I’ve tried this also but not working! Like the post and agree we shouldn’t be using a UNC pathway – open to suggestions – I’ve triple checked everything!

Comment on Best Practice: How to use Group Policy Preferences to Secure Local Administrator Groups by Alan Burchill

Alan Burchill — Thu, 17 May 2012 01:15:17 +0000

This method does not STOP them from doing that… however in 2 hours any non-authorised users and groups will be removed. The only way to prevent this from happening it to remove them from the local admin group.

Comment on Best Practice: How to use Group Policy Preferences to Secure Local Administrator Groups by Joe R

Joe R — Wed, 16 May 2012 23:17:04 +0000

I would like to stop users from adding the Domain user to the local administrators group of their pc’s. Can this be done with GPO’s?

Comment on Best Practice: How to use Group Policy Preferences to Secure Local Administrator Groups by Jim S

Jim S — Wed, 16 May 2012 19:51:20 +0000

Phil,
YES. This is exactly what we are experiencing.

Comment on Best Practice: How to manage Windows Firewall settings using Group Policy by velociraptor

velociraptor — Wed, 16 May 2012 10:00:37 +0000

ıf you want to block a program easily through windows firewall just use:
Firewall app blocker (Portable freeware)
http://www.sordum.com/?p=7633

Comment on Best Practice: How to use Group Policy to configure home page settings – Part 3 by Rahul

Rahul — Mon, 14 May 2012 09:16:26 +0000

I have followed the instruction to set a preference mode setting but the homepage settings is still disabled for the users.
What I am planning on implementing is a Primary homepage (editable by the users) and a default secondary(non-editable by the users)homepage.
What I have done is set the Primary homepage in Important URLs (Preference mode ) setting and the Seconday in Admin Template- Windows Components-Internet explorer- Disable changing secondary homepage settings.

I have force updated the GP, also re-looged in but the homepage settings are greyed out and users not able to change the primary homepage settings.

Can you please help.

Regards,

Rahul

Comment on CIAOPS Podcast–Episode 29 – Hear me talk about Windows 8, Windows Server 2012 and Group Policy… by John Arrieta Escobar

John Arrieta Escobar — Thu, 10 May 2012 14:41:50 +0000

Hear me talk about Windows 8, Windows Server 2012 and Group Policy… http://t.co/fVsETHL6 /cc @directorcia

Comment on CIAOPS Podcast–Episode 29 – Hear me talk about Windows 8, Windows Server 2012 and Group Policy… by Robert Crane

Robert Crane — Thu, 10 May 2012 14:35:39 +0000

Hear me talk about Windows 8, Windows Server 2012 and Group Policy… http://t.co/fVsETHL6 /cc @directorcia

Comment on CIAOPS Podcast–Episode 29 – Hear me talk about Windows 8, Windows Server 2012 and Group Policy… by Alan Burchill

Alan Burchill — Thu, 10 May 2012 14:34:17 +0000

Hear me talk about Windows 8, Windows Server 2012 and Group Policy… http://t.co/fVsETHL6 /cc @directorcia

Comment on CIAOPS Podcast–Episode 29 – Hear me talk about Windows 8, Windows Server 2012 and Group Policy… by Alan Burchill

Alan Burchill — Thu, 10 May 2012 14:32:29 +0000

Blog Post: CIAOPS Podcast–Episode 29 – Hear me talk about Windows 8, Windows Server 2012 and Group Policy… http://t.co/fVsETHL6

Comment on Best Practice: Group Policy for Microsoft Security Essentials 2.0 by Bandit

Bandit — Thu, 10 May 2012 02:53:42 +0000

Alan – perhaps a typo. If you search for:

Data (Decimal): 50 (20%)

perhaps you meant 50%?
:=)

Comment on Best Practice: How to use Group Policy Preferences to Secure Local Administrator Groups by Phil

Phil — Wed, 09 May 2012 14:46:13 +0000

My experience is this:

We get an error in the event log if we add BUILTIN\Administrator (without the ‘s’) as described in step 7

This is the log entry:

The computer ‘Administrators (built-in)’ preference item in the ‘Win7-EC-Computer-v1.0 {GUID}’ Group Policy object did not apply because it failed with error code ’0x8007056c A new member could not be added to a local group because the member has the wrong account type.’ This error was suppressed.

0x8007056c A new member could not be added to a local group because the member has the wrong account type.

It seems that either of the following is the case: 1) The local admin account can’t be deleted from the Local Admins group or 2) When it tries to add BUILTIN\Administrator, it fails because the account already exists.

When we remove BUILTIN\Administrator from the GPP the error goes away AND the local administrator is NOT removed from the Local Admins group.

Is this anyone else’s experience?

Comment on Best Practice: How to use Group Policy Preferences to Secure Local Administrator Groups by Lily K

Lily K — Wed, 09 May 2012 13:09:52 +0000

I can answer my own questions now.
Firstly, just need to use Item-level targeting, and target computer’s DNS name. This will identify the PC, and is able to add DESKTOP01 Administrators to DESKTOP01, and adding DESKTOP02 Administrators to DESKTOP02
Secondly, using GPP is better than using gp restricted group in this instance. I created local user account(user configuration–preferences–control panel– local users and groups–, then I add this local user account to the builtin-administrators. So I don’t need to create global security group anymore.

This way, I can achieve in one GPP, adding global security group domain admin/desktop admin for all PCs, then target individual necessary PCs to grant them a unique local user account with administrator right.

This works well for big organisations. We need to have control of all PCs. But there are always a few users need admin rights on their own PC.

Comment on Best Practice: How to use Group Policy Preferences to Secure Local Administrator Groups by Lily K

Lily K — Wed, 09 May 2012 09:02:27 +0000

Alan,

Thank you for your very educational post.

In your scenario, do we have to create separate gpp for each PC if we want to specify DESKTOPxx Administrators? i.e. gpp1 for adding DESKTOP01 Administrators to DESKTOP01, and gpp2 for adding DESKTOP02 Administrators to DESKTOP02 and so on? Is it possible to create only one gpp, and it adds DESKTOP01 Administrators to DESKTOP01, DESKTOP02 Administrators to DESKTOP02?

Also, your scenario can be achieved by using gp restricted groups, and I cannot see any advantage by using gpp in this instance?

Looking forward to your reply.

Comment on “Prohibit connection to non-domain networks when connected to domain authenticated network” is the MUST have Windows 8 Network Group Policy Setting by register a domain

Hi There Grouppolicy,
Thanks you for your post, There are many types of laptops available. Some have basic features only and thus, they are not very reliable. They are the types one buys as he or she saves money for a more powerful and supportive style. Now you need not go this far. With an usb port replicator, you can continue using your boring laptop. This works as a simple docking station, though it is not it.
Wishes

Comment on Best Practice: Using Group Policy to configure Desktop Wallpaper (“Background”) by BjoernG

BjoernG — Wed, 02 May 2012 15:53:30 +0000

Hi Guys

Tried to impelement like the following way: HKCU\Control Panel\Desktop\Wallpaper (the user can change the wallpaper if the dont like it!)

Set the Regkey over CSE to c:\temp\img1.jpg (just for testing) but there is noting changing… I can browse or manually use the jpg from there.
Removed the BGInfo stuff for testing
Its native W2k8R2 with W7 SP1 environment

Still not working, any idea?

Comment on Best Practice: How to use Group Policy to configure Internet Explorer security zone sites by John

John — Fri, 27 Apr 2012 15:48:11 +0000

GPP is server 2008 only and requires client side software correct?
Anyway to do achieve the same results (managed IE Zones without disabling user access) in a 2003 AD environment?

Comment on Best Practice: How to show or hide Control Panel items in Windows 7 using Group Policy by Thilo

Thilo — Fri, 27 Apr 2012 12:58:40 +0000

I use the “show only specific items” GPO. How can I enable the “igfxcpl.cpl” (Intel Extreme Graphics)? Using the filename doesn’t work.

Comment on How to use Group Policy Preferences to dynamically map printers with Roaming Profiles by Claude

Claude — Fri, 27 Apr 2012 07:27:22 +0000

I found this article important to me but all the figures have been dislocated or mis-indexed so they are blank. Please direct me to a page I can see all the figures. Thanks.

Comment on Best Practice: How to use Group Policy Preferences to change account Passwords by Olaf Engelke

Olaf Engelke — Thu, 26 Apr 2012 13:46:46 +0000

One of the main purposes to change the built in Administrator password is to keep the password identical on each domain joined client system.
Be it one installed in a remote location from an OEM machine or one installed from a provided image.
And especially also on such machines, where a user is local administrator himself and is attempting to change the Administrator account password (or has malware doing this for him).
So deleting a related group policy is not very useful to keep such systems in current stage.
An open question is also, how this will act in context with password policies? I know, its for local accounts, but on a domain joined computer I could not alter the expiration settings, remember past passwords etc.
So assuming, I have configured the last 5 passwords to be remembered, what will happen if a user with local admin rights sets the Administrator password away from the default one (net user Administrator blablabla) and then the policy kicks in to revert the password to the default one?

Best greetings from Germany
Olaf

Comment on Best Practice: How to use Group Policy to configure Windows 7 Logon UI Background Wallpaper by John Bryntze

John Bryntze — Thu, 26 Apr 2012 12:33:53 +0000

%windowsDir% obvious what it is, but Windows only resolve %WinDir%
nice article!

Comment on Best Practice: Configuring a Software Library for Group Policy Software Deployment by johan

johan — Thu, 26 Apr 2012 09:54:46 +0000

Nice explanation but as far as i can see, this is only possible for computers in een AD domain.
You dont have a sollution for deploying software to computers in a workgroup?

Comment on What’s changed with the Group Policy Client Service in Windows 8 by Anders Keis Hansen

Anders Keis Hansen — Thu, 26 Apr 2012 08:52:18 +0000

What’s changed with the Group Policy Client Service in Windows 8 http://t.co/46S4J3Hg

Comment on How to remove imported Internet Explorer Group Policy Settings by chris

chris — Wed, 25 Apr 2012 19:19:05 +0000

I just tried to add dcserver to group policy management editor, and now having issues trying to get this off the gpme. Any other suggestions would be fantastic!

Comment on What’s changed with the Group Policy Client Service in Windows 8 by Mr Diagg

Mr Diagg — Tue, 24 Apr 2012 22:56:53 +0000

What’s changed with the Group Policy Client Service in Windows 8 http://t.co/4kODA4ZK