Posts tagged ‘Group Policy’

Video: TechEd 2010 NZ – #CLI309 Troubleshooting Group Policy #tenz

While I was at TechEd New Zealand 2010 I was asked to step into Jeremy Moskowitz shoes at the last minute as he had been quarantined in hospital with suspected swine flu. So with very little preparation I hobbled together a troubleshooting session based on his slide deck and a few of my own tips…

Get Microsoft Silverlight

Source http://www.msteched.com/2010/NewZealand/CLI309

Luckily for him he was fine and released out of hospital that night so he was still able to present my his two other session on Wednesday…

Active Directory and Group Policy… Would you like to know more?

Ned Pyle from the Active Directory Service team has just done a super post to the Ask the Directory Services Team called Post-Graduate AD Studies. This is a collection of links to pretty much every AD/Group Policy related TechNet article known to man. Definitely a post that you will want to bookmark to use as a reference whenever you have any AD or Group Policy related problems or questions.

Below is a list of all the Group Policy related articles that are listed in the post:

Check out the whole article at: Post-Graduate AD Studies – Ask the Directory Services Team – Site Home – TechNet Blogs.

P.S. Can anyone pick where I got the inspiration for the title?

Best Practice: Group Policy Design Guidelines – Part 2

In my previous article In this article Best Practice:Active Directory Structure Guidelines – Part 1 I spoke about some of the guidelines I personally use when developing an Active Directory OU structure. In this next part I will discuss some guidelines I use when designing a Group Policy Object infrastructure.

Ideally you should make the the Active Directory OU and GPO design decision together to best ensure that you have the most efficient design possible. However if you have an existing OU structure designed a lot of these guidelines can still be applied to most existing environments.

As in Part 1 these are simply guidelines that I use and should not be taken as hard an fast rules. I quite often finding myself having to break these rules due to real world conflicts or just because one rule might conflict with the other rule. If you do find your self in a situation where you are not sure which path to take try to chose the option that will result in the least administrative effort in the long term.

Continue reading ‘Best Practice: Group Policy Design Guidelines – Part 2’ »

Best Practice: Active Directory Structure Guidelines – Part 1

I have been doing Active Directory and Group Policy work for a while now and I have developed my own set of rules that I try to use where ever possible. So below I have written down all my rules in no particular order for you to go over and use for yourself. You may only chose to use only some of these rules or you might want to use them all depending on your circumstance. This is a two part series where I will first talk about designing you Active Directory Organisation Unit structure and then in part 2 (Best Practice: Group Policy Design Guidelines – Part 2) I will discuss some more ideas for applying Group Policy to the OU structure.

I want to be clear that these are only guidelines and not rules that need to be strictly adhered to. In almost all case there are exceptions to these guidelines and you might even find your self implementing them in a hybrid approach. I intend for this web page to be updated on a regular basis as none of these rules are set in stone and thing obviously change all the time.

Continue reading ‘Best Practice: Active Directory Structure Guidelines – Part 1’ »

How to use Group Policy to allow the users to chose any screensaver except (None)

During Kevin Sullivan Group Policy session at TechEd 2010 in the USA this year he mentioned an example of a being able to configure group policy to allow users to select whatever screensaver they want except the one called “(None)” (see image below). While this method does not prevent the users from select the (None) from the screensaver options list it will set it back to a screensaver of your choice when the user selects (None) option.

image

The logic to implement this policy is to test if the SCRNSAVE.EXE registry key exists and if it doesn’t then create the key with the screensaver that you want to enable.

Note: You can also use this tutorial as a guide for applying  other group policy preferences settings based on weather a registry key exists or not. A good example you might want to do this for is to test to see if a specific application registry key exists before you apply an application specific registry setting. This helps you keep a cleaner configured SOE by not un-necessarily applying configuration settings.

How to use Group Policy to allow the users to chose any screensaver except (None)

 

Step 1. Edit a Group Policy Object (GPO) that is targeted to the users accounts you wan to apply this policy

Step 2. Navigate to User Configuration > Preferences > Windows Settings > Registry then from the menu click on Action > New > Registry Item

image

Step 3. Select “Update” from the Action then type “Control Panel\Desktop” in the Key Path: text field then type “SCRNSAVE.EXE”  in the Value Name text field and “C:\Windows\System32\scrnsave.scr” in the Value data: text field.

image

Step 4. Click on the Common tab and then tick “Item-level targeting” and then click the “Targeting…” button.

image

Now we will target the screen saver to apply only when the “HKCU\Control Panel\Desktop\SCRNSAVE.EXE” registry key does NOT exist as this means the screen saver has been configured to “(None)”.

Step 5. Click on “New Item” then the “Registry Match” option.

image

Step 6. Select the “Value exists” Match type” then type “Control Panel\Desktop” in the key path field and then type “SCRNSAVE.EXE” in the value name field

image

Step 7. Click back on the targeting setting in the top pane and press “F8” which changes the option to “does not exist” then click OK and OK.

image

This policy will now apply the blank screen saver on the next group policy refresh to all targeted users whenever they select the “(None)”.

image

Below is a table that shows the screensaver set to “(None)” (before column) and then the after a policy refresh the screensaver is configured as “Blank” (After column). Then the users has selected the “Photos” (Custom column) screensaver and the policy is refreshed again however this time there is no change as the screensaver is configured with a value so it is not set back to “Blank”.

Before After Custom
image image image

The complete list of Group Policy Hotfix’s in Windows 7/2008 R2 Service Pack 1

windows-7-logoThe beta of Windows 7/Server 2008 R2 Service Pack 1 beta has now been released to the public for testing. For your benefit I have parsed through the complete list of hotfixes and I have listed out all the group policy specific setting. If you just want the service pack right now you can download it here http://technet.microsoft.com/en-us/evalcenter/ff183870.aspx

I have highlighted the two hotfixes that stand out it my mind as the issues that have been most annoying bugs with group policy with Windows 7 RTM.

I have also posted an installation screenshot walk though on my other blog here http://www.smartergeek.info/2010/07/install-screenshots-windows-7-service-pack-1-beta/

Hotfix Description Link to support article
After Internet Explorer Maintenance Group Policy settings are configured in a domain, a 20-second delay occurs when you log on to the domain from a client computer that has Internet Explorer 7 or Internet Explorer 8 installed http://support.microsoft.com/kb/941158
FIX: You cannot import or paste some group policies across domains by using the “Group Policy Management” MMC snap-in http://support.microsoft.com/kb/969867
SceCli 1202 events are logged every time Computer Group Policy settings are refreshed on a computer that is running Windows Server 2008 R2 or Windows 7 http://support.microsoft.com/kb/974639
Roaming user profile cache is not deleted from a Windows Server 2003-based computer if Group Policy preferences and Internet Explorer Maintenance Group Policy settings are used http://support.microsoft.com/kb/975619
LDAP filters in the Group Policy preference settings do not take effect on a computer that is running Windows Server 2008 R2 or Windows 7 http://support.microsoft.com/kb/976398
FIX: You cannot apply Group Policy settings on a computer that is running Windows 7 or Windows Server 2008 R2 when security group filters are used in Group Policy preference settings http://support.microsoft.com/kb/976399
A Group Policy Immediate Task preference item does not run on a client computer that is running Windows 7 or Windows Server 2008 R2 http://support.microsoft.com/kb/977353
The SceCli 1202 events are logged when some Group Policy settings are refreshed in Windows Server 2008 R2 and in Windows 7 http://support.microsoft.com/kb/977695
The “Desktop Wallpaper” Group Policy setting is not applied in Windows 7 or in Windows Server 2008 R2 http://support.microsoft.com/kb/977944
Logoff process stops responding after you create a logoff Group Policy script on a client computer that is running Windows Vista or Windows Server 2008 http://support.microsoft.com/kb/978489
The Group Policy Management Editor window crashes when you apply some changes for NRPT policy settings http://support.microsoft.com/kb/978837
Error message when you view or modify the migrated Group Policy objects in Windows Server 2008 R2: “Attribute cannot be empty” http://support.microsoft.com/kb/979039
After you apply a WMI filter, the GPO does not take effect on a client computer that is running Windows 7 or Windows Server 2008 R2 http://support.microsoft.com/kb/979383
Some Group Policy preferences are not applied successfully on computers that are running Windows 7 or Windows Server 2008 R2 http://support.microsoft.com/kb/979731
The “Allow the printing of background colors and images” Group Policy setting does not take effect on a computer that has Internet Explorer 8 installed http://support.microsoft.com/kb/980077
The “Load a specific theme” Group Policy setting is not applied correctly on a computer that is running Windows 7 or Windows Server 2008 R2 http://support.microsoft.com/kb/980628
The “Configure new tab page default behavior” Group Policy setting does not work on a computer that is running Windows 7 or Windows Server 2008 R2 and that has Internet Explorer 8 installed http://support.microsoft.com/kb/980959
The Group Policy preference settings for the “Terminal Session” item-level targeting item are not applied in Windows 7 or in Windows Server 2008 R2 http://support.microsoft.com/kb/981054
You can still unpin a program from the taskbar unexpectedly when you enable the “Do not allow pinning programs to the Taskbar” Group Policy on a computer that is running Windows 7 or Windows Server 2008 R2 http://support.microsoft.com/kb/981177
You cannot create a software installation Group Policy setting on a read-only domain controller in Windows Server 2008 R2 http://support.microsoft.com/kb/981265
Error message occurs when you use GPMC to view a software restriction Group Policy setting in Windows 7 and in Windows Server 2008 R2: “An error has occurred while collecting data for Software Restriction Policies” http://support.microsoft.com/kb/981750
You cannot open an HTML GPO report that is created by the German version of Windows Server 2008 R2 or of Windows 7 http://support.microsoft.com/kb/981877

Group Policy Setting of the Week 34 – Do not allow Windows Media Center to run

The setting of the week this week prevents users from running Windows Media Center on Vista or above versions. Unlike Windows XP which had its own dedicated version of Media Center, Vista Enterprise and Ultimate editions and Windows 7 Business, Enterprise and Ultimate had inbuilt support Windows Media Center. This setting would most likely be used in a corporate environment where they wanted to control the running of unproductive applications. This is either a user or computer based setting that can be found under Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Media Center meaning you can either selectively apply it to users or to all the computers in your fleet.

image

When the setting is enabled the user will still see the shortcut to Windows Media Center however when the user tries to run the program they will be presented with the following dialogue box.

image