Over 1 million tech questions and answers.

Need help with GPOs

Q: Need help with GPOs

I have a new GPO that only one security group can get. What I am running into is if I login to a computer I have login to before I do not get the policy. If I login to a computer for the first time I will get the policy.
Has anyone ever had this problem before?

Read other answers
RELEVANCY SCORE 200
Preferred Solution: Need help with GPOs

I recommend downloading and running Reimage. It's a computer repair tool that has been proven to identify and fix many Windows problems with a high level of success.

I've used it in the past to identify and fix everything from blue screens (BSOD's), ActiveX errors, corrupt files and processes, dll/exe/sys errors, recover lost memory, Windows update problems, defragging, malware removal etc.

You can download it direct from this link http://downloadreimage.com/download.php. (This link will automatically start a download of Reimage that you can save to your computer.)

RELEVANCY SCORE 46.8

I'm pretty new to Group Policy Management. I just got a job at a school and one of my labs is not working like it should. I have done GPRESULT on a computer from another working lab and I'm comparing it to the computer in the lab I'm at now. So, in my
GPM, a couple polices are listed above my designated labs that should be inherited by all the labs, and then I have some of those same policies duplicated in just my troublesome lab. My question is, will having a duplicate GPO break things? I'm probably not
explaining all that right, but I'll try my best to answer any questions to help me find a solution. 

Read other answers
RELEVANCY SCORE 46.8

Is there a way I can punch up a simple batch file script and get it to setup Group Policy Objects on client workstations? I can use the GUI GPEditor if I had to, but I think after about 25 machines, I'd get a little tired of it, and I'm looking to run this on about 400 machines.
 

Read other answers
RELEVANCY SCORE 46

I created a number of GPOs and they have been working ok. Edit the GPOs has also been working.
I now can't create any new GPOs or edit the existing ones. I get the below error message.
1. When editing
"Failed to Open the Group Policy Object. You might not have the appropriate rights."
2. When creating new
"The network name cannot be found."

Read other answers
RELEVANCY SCORE 46

Morning everyone,

I am working with Windows 7 Professional 32-bit, in a network environment and I am trying to test it with our old GPOs we use on XP machines.

I am currently trying to install GPSI's such as Office etc.

When I reboot the machine after a GPUpdate I can only see 'Please Wait' while it installs the updates, but I know some of these updates will hang. I won't know what's hanging if I can't see what stage of the update it is at.

Is there anyway of customising this area of the startup to display which updates are installing?

Like in Windows XP where the box would appear in the middle of the screen saying "Installing Managed Software <Program Name>" etc.

Thanks for any help you can give regarding this.

-- Danoni

A:Changing Display of Installing GPOs

The answer to this I have since found out is to enable 'verbose' messages - we did this through a GPO on the domain controller. Can now fully see what is installing when loading Windows.

Read other 1 answers
RELEVANCY SCORE 46

Bit of a pickle, this one, chaps.

We have a windows 2003 server, with active directory installed, as well as DNS and DHCP services.

Let's say we have a main forest on our domain, called domain.kais - and within this domain, we have two Organisational Units, called OU1 and OU2. Within each OU, let's say we have 10 users.

Go to Group Policy Editor, and apply a new GPO to say OU1. You make all the settings you want, but for simplicity, let's say the only setting you do is something ridiculously simple, like, remove Recycle Bin from the laptop. You make the GPO called something like "OU1 GPO", link it to the OU, make sure it's the only GPO linked to it (so take away the standard Default Domain User GPO).

Go to a workstation, log on with a user from within that OU. Because you can log on, the assumption is that the network works fine, as the user gets authenticated. To make sure it's not a locally cached user, you created a brand new user within the OU.

So, if that works, any idea why the GPO isn;t taking effect? it's really getting to me now!

A.
 

A:Windows 2003 Server / GPOs

Well heres a couple of things -

http://www.activedir.org/gp_faq.htm - A nice who what when why and how of Group policies it does mention 2000 and not 2003 but it still applies in most cases.

On the workstation once logged in go to your command line and do a gpupdate /force and see if that yields its results.

Oh yeah and another thought how is DNS running on your network? if you do an ping of a machine name from the clients not getting the update do you get back the FQDN or does it just show the machine name?
 

Read other 1 answers
RELEVANCY SCORE 45.6

Okay, I really must be doing something wrong, but I don't think I am. We just recently moved to Windows 2000 and I am trying to set up GPOs in our domain. What I did was created a new OU for the domain. In this OU, I created a few OUs for various groups of computers (different PC labs we have), and OU for "students" and and OU for "faculty". I then moved the necessary computers into each computer OU and then placed the student global group and faculty global group into their respective OUs.

From here, using AD Users and Computers, I right click on an OU (Student OU for example) and choose the Group Policy Tab. I create a new GPO, choose to enable "Disable Control Panel" and then rename the GPO and close it out. I tried leaving it like this and did not work.

So I then clicked on the properties of the Student Global Group located inside the Student OU and chose the security tab, where I chose for the student global group READ and APPLY GROUP POLICY.

Still, did not work!!!

What am I doing wrong?? Is there something else I should be looking at??

The same goes for GPOs I set up for any of the Computer OUs, like enabling the option to "Not show the last logged on user". No GPOs are effective right now.

Thank you all so much in advance!!

Pete
 

Read other answers
RELEVANCY SCORE 45.6

In trying to adhere to the disable Dr. Watson crash dumps STIG, I need to locate which GPO setting that disables the crash dumps. I'm aware of the ways to disable the createcrashdump in the regisrty or deleting the AeDebug registry key. However, I have a GPO that is enabling the crash dumps. (I know this because everytime I manually disable it and refresh my group policies it is re-enabled.)

I've been able to isolate which GPO is enabling the crash dumps by unlinking all my GPOs and re-linking them one by one to locate the culprit. I've manually looked through the policy settings of the GPO enabling the crash dumps and can't find anything that would disable the create crash dumps. I was wondering if anyone knew off hand how to disable the Dr. Watson crash dumps or disable Dr. Watson completely through a Group Policy Setting.

I'm all googled out on this one. Any assistance would be great thanks.

OS: Windows Server 2003 SP2, Windows XP SP2
 

Read other answers
RELEVANCY SCORE 45.6

Hello
We are moving to Windows Server 2012 R2 and therefor to Internet Explorer 11. I have already upgraded the administrative template files holded by our domain controller (.admx files on the central store). 
When trying to create a GPO I just can't find a configuration item to set the browser title. I know that IEM has gone in favor of group policy preferences. But there is no such config item there as well. Am I stuck with IEAK11?

Thanks in advance
Matthias

A:Howto to set browser title of IE11 using GPOs

Hello Matze2ooo,
the link is this
Package Type Selection: Internet Explorer Customization Wizard. It creates a *.exe file you have to distribute.

These are useful TechNet Library articles helping you with
IEAK 11:

Good starting point -
IEAK 11: List of tasks and references to create, manage, and deploy Internet Explorer 11 custom packages
How to deploy IEAK 11 -
Internet Explorer 11 (IE11) - Deployment Guide for IT Pros How to distribute
Deploy Internet Explorer 11 using software distribution tools
As written above, you could also distribute a the registry key Windows Title
through GPO to users.
 
Bye,
Luca





Disclaimer: This posting is provided AS IS with no warranties or guarantees, and confers no rights. | Whenever you see a helpful reply, click on Vote As Help and click on Mark As Answer if a post answers your question.

Read other 7 answers
RELEVANCY SCORE 45.6

Hello,

I need to disable the below settings. I have tried using the below GPO settings, ran gpupdate /force and restarted 2 domain computers. I then logged into each computer with a different domain account. The live tiles were still changing. I am still able to add a PIN to the account. I was still able to add a Microsoft account. (I do not have a Work/School account but the option was still available. I added the same Microsoft account to both domain users. The Sync your settings is all grayed out and all set to off. However, I noticed the desktop background synced and the Favorites Synced. How do I disable all these settings so they cannot be used and are turned off?

Disable Live Tiles
Disable Settings - Accounts - Sing-in Options - Create a PIN
Disable Settings - Accounts - Your account - Add Microsoft account
Disable Settings - Accounts - Your account - Add a work or school account
Disable Settings - Accounts - Sync your Settings


Disable Live Tiles
GPO - User Configuration/Policies/Administrative Teplates/Start menu and Taskbar
Clear history of Tile notification on exit Setting: Enabled

GPO - User Configuration/Policies/Administrative Teplates/Start menu and Taskbar/Notifications
Turn off notifications network usage Setting: Enabled
Turn off tile notifications Setting: Enabled

Disable Settings - Accounts - Sing-in Options - Create a PIN
GPO - Computer Configuration/Policies/Administrative Templates/System/Logon
Turn on PIN sign-in Setting: ... Read more

A:GPOs to Disable Account Settings are not working

Where did you find a GPO template for Windows 10?

Read other 6 answers
RELEVANCY SCORE 45.2

Hi all,
I'm trying to set Google as the default search engine when an end-user types something in the navigation bar. Standard this is Bing, and although Bing is wonderful we still would like to go with Google.

What I did:
1. Made a new GUID (PowerShell New GUID thing): {001c1193-09c6-4f56-a5b7-2b031da433a7}
2. Set the following reg keys:









Action
        Replace






Hive
HKEY_CURRENT_USER


Key path
Software\Microsoft\Internet Explorer\SearchScopes


Value name
DefaultScope


Value type
REG_SZ


Value data
{001c1193-09c6-4f56-a5b7-2b031da433a7}









Action
        Replace



Properties



Hive
HKEY_CURRENT_USER


Key path
Software\Microsoft\Internet
Explorer\SearchScopes\{001c1193-09c6-4f56-a5b7-2b031da433a7}


Value name
DisplayName


Value type
REG_SZ


Value data
Google








Action        
Replace



Properties



Hive
HKEY_CURRENT_USER


Key path
Software\Microsoft\Internet
Explorer\SearchScopes\{001c1193-09c6-4f56-a5b7-2b031da433a7}


Value name
FaviconURL


Value type
REG_SZ


Value data
http://www.google.com/favicon.ico








Action
        Replace



Properties



Hive
HKEY_CURRENT_USER


Key path
Software\Microsoft\Internet
Explorer\SearchScopes\{0... Read more

Read other answers
RELEVANCY SCORE 44.8

Hi All,

I have a Windows 7 Enterprise Ed laptop which does not applies the computer GPOs. User GPOs work fine.
In the event log, Event ID 1125 is logged:
?The processing of Group Policy failed because of an internal system error. Please see the Group Policy operational log for the specific error message. An attempt will be made to process Group Policy again at the next refresh cycle.?

In the Details tab:
Error code 19, ?The media is write protected?


When I run ?gpupdate /force? or ?gpupdate /target:computer? After a long time, I get the message: ?Computer Policy update has not completed in the expected time. Exiting??GPRESULT /H GPReport.html gives: ?ERROR: Access Denied? (run as local administrator)RSoP.msc: ?The RSoP snap-in was unable to generate the RSoP data due to the error listed below. Details: This operation returned because the timeout period expired?

The laptop is part of a large domain (more than 10k clients). This is the only one with this error (for as far as I know?)
Any help would be much appreciated.
Johan

Read other answers
RELEVANCY SCORE 44.4

Im running AGPM 4 SP3 using a least privileged access service account, and when ever I deploy a GPO to production all of the users from Change Controls Production Delegation tab (Domain Admins / Enterprise Admins / Enterprise Domain Controllers / SYSTEM
/as well as my personal account I'm logged in with) get added to the security filtering of the deployed GPO. Not only is this for all current production GPOS but also if I create a new GPO within AGPM the same groups get added to the security filter. Any Ideas
what could be causing this?

Read other answers