Category: Group Policy

Reliabilizing Group Policy
article #1148, updated 19 days ago

In my experience, group policy is the only very nearly absolutely essential tool on a Microsoft domain-controlled LAN which breaks very often and admits of almost zero solid documentation towards fix. A list begins today with two steps towards fix, to be more in the future, Lord willing!

  • Even if there is only one domain controller, change the replication from 180 minutes to 15 minutes. These are in the properties of the site links, in Active Directory Sites and Services, under Inter-Site Transport, under IP. If you have more than one site link enabled, do it for all. Obviously you should moderate carefully, if you are using SMTP or have bandwidth issues.

  • Set services fdPHost and FDResPub as startup Automatic, from Manual.

Categories:   Group Policy   Windows OS-Level Issues

==============

How to Install Microsoft ADMX Group Policy Templates
article #1082, updated 94 days ago

When we install new group policy templates from Microsoft, e.g., the Windows 10 set by which we may upgrade existing networks, they now come in the newer ADMX format. Do this on every domain controller:

  1. The package is downloaded as a self-installing EXE which requires you to specify a folder. Do not try to manually unpack this, for some reason the contents are in small pieces which the installer assembles. Just run the EXE and give a useful path, e.g., C:\IT.
  2. Open an administrative CMD, and CD to the extraction point. Then CD into the folder “admx”, one level down.
  3. Run the following. If your language is not en-us, replace it in the last two lines. If your servers have multiple languages, you’ll need to replicate lines with multiple language specifications.
xcopy *.admx \\%userdnsdomain%\sysvol\%userdnsdomain%\Policies /Y /I
xcopy *.admx %SystemRoot%\PolicyDefinitions /Y /I
xcopy en-US\*.adml \\%userdnsdomain%\sysvol\%userdnsdomain%\Policies\en-us /Y /I
xcopy en-US\*.adml %SystemRoot%\PolicyDefinitions\en-us /Y /I

Another very common set needing this install, is the Office 2016 Administrative Templates.

Multiple versions of Office templates coexist nicely. But the same cannot be said for Windows OS templates. As of this writing, 2017-11-03, it appears that when a complete refresh of OS templates is required, good results obtain by first installing the Windows 8.1 set, then the update, then the latest Windows 10 set on top of that, replacing all each time. This seems to bring everything up to date while not causing conflicts.

Categories:   Group Policy   

==============

Setting Up Printers by Windows Group Policy the Simplest Way
article #1113, updated 117 days ago

There are multiple ways to set printers up by group policy in Windows. There is a printer administration role which can make things easier or harder, depending on how well everything is working. The simplest way, is to open the Group Policy Management Console from a domain controller, open up an appropriate policy, and open it to here:

then right-click in the white box, you’ll get a menu, choose “New”, choose “Shared Printer”, Action should be “Update” or “Replace” if “Update” doesn’t work, and you’ll choose the printer by “Share Path”. You can leave everything else alone unless you need something special. Sometimes it works better to do a Delete and then Create for each printer. The vagueness here is due to unknown but widely experienced vagaries in behavior of Group Policy which are addressed in no known documentation.

Please do note that we set these up under “User Configuration” not “Computer Configuration”. It is possible to do it under Computer, but removals can be far more difficult if we do, there have been messes seen.

Categories:   Group Policy   Printers & Printing

==============

Shortcut on Desktops by Group Policy
article #925, updated 714 days ago

To create a shortcut on client desktops by group policy, browse here in GPMC:

User Configuration, Preferences, Windows Settings, Shortcuts

Categories:   Group Policy   

==============

IE Control by Group Policy
article #45, updated 3547 days ago

To control Internet Explorer settings by group policy, do the following in the Group Policy Management Console (GPMC), after beginning the edit of a policy object:

Open User Configuration, Windows Settings; right-click on Internet Explorer Maintenance, and choose Preference Mode, Advanced. Now on the right pane you will see “Corporate Settings” and “Internet Settings”, and IE can be controlled quite nicely from there. This is a very good way to help control disk space usage on a terminal server, for instance.

Categories:   Group Policy   

==============

Group Policy Settings Reference
article #6, updated 3796 days ago

A reference document, in Excel format.

http://www.microsoft.com/downloads/details.aspx?FamilyId=7821C32F-DA15-438D-8E48-45915CD2BC14&displaylang=en

Categories:   Group Policy   

==============

Turn off Security Center (reporting of firewall, antivirus, etc.) using group policy.
article #5, updated 3796 days ago

From here:

http://www.microsoft.com/technet/security/prodtech/windowsxp/adprtect.mspx#EDHAC

The GP item is under Computer Configuration, Administrative Templates, Windows Components, Security Center.

Apparently, updates to both server and client PCs have to be quite current.

Categories:   Group Policy