Over 1 million tech questions and answers.

i can't Using group policy to copy files to all windows10 user's at the domain

Q: i can't Using group policy to copy files to all windows10 user's at the domain

i cant Using group policy to copy file to windows10 user's on the domain,but everything is ok in windows 7 user's and the folder copied in all windows7 machines,

- iam using this script on Windows server 2008


xcopy \\WIN-5PKBDU5IFVH\testfolder c:\COMPANY /e /i

can you help me solving this problem with all
windows 10 user's???

thank you

Read other answers
Preferred Solution: i can't Using group policy to copy files to all windows10 user's at the domain

I recommend downloading and running Reimage. It's a computer repair tool that has been proven to identify and fix many Windows problems with a high level of success.

I've used it in the past to identify and fix everything from blue screens (BSOD's), ActiveX errors, corrupt files and processes, dll/exe/sys errors, recover lost memory, Windows update problems, defragging, malware removal etc.

You can download it direct from this link http://downloadreimage.com/download.php. (This link will automatically start a download of Reimage that you can save to your computer.)


I have an SCCM Client deployed to several test PC. The client configures LGPO directing the PC to receive Windows Update from our SCCM server.  However, it fails. WUAHANDLER.LOG shows the following errors:
Enabling WUA Managed server policy to use server:http://xxxxx.xxx.net:8530
Waiting for 2 mins for Group Policy to notify of WUA polucy chnage...
Unable to read existing WUA resultant policy. Error = 0x80070002.
Group Policy settings were overwritten by a higher authority (domain controller) to: Server and Policy NOT CONFIGURED
Failed to Add Update Source for WUAgent of type (2) and id{{.......}}. Error=0x80040692.
I checked domain GPOs and there is no GPO that would cause this conflict.  I ran RSOP to verify.  What I noticed is that gpresult did not show LGPO as being applied. But when I unlinked all the domain GPOs (linked to the PC OU), gpresult showed
LGPO as being applied.
Any ideas or suggestions welcome.

A:Group Policy settings were overwritten by a higher authority (domain controller) to: Server and Policy NOT CONFIGURED

For this issue, please try to refer to the following article;
Troubleshooting Group Policy Configuration for Software Updates
If this issue persists, for a better support service, please kindly post at the SCCM forum for further help:
System Center Configuration Manager Category
Alex ZhaoPlease remember to click ?Mark as Answer? on the post that helps you, and to click ?Unmark as Answer? if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Read other 4 answers

Hey guys, i just recently made a OU on our Domain Controller and added about 10 computers to it (computers, not users) and had a Startup script applyed to that OU through Group Policy, now this start up script works for all machines but one, which is our problem machine.. it won't apply the GPO. i did a gpupdate /force on it, restarted and still no-go.

If anyone can at least give me an idea of what the hells going on i'd greatly appreteate it.

A:Domain Group Policy Problem.

Read other 6 answers

Is anyone here using Win7 Pro in a 2003 Functionality level Active Directory environment?

On multiple Windows 7 boxes, my laptop, and my desktop I ALWAYS get the error attached in the screenshot "Failed to connect to a windows service" when I log onto the Domain. I have looked at the event log and it is very, very vague. Most our IT users who have 7 just don't log onto the Domain at all, but i'd like to figure out what the issue is.

The Aero service also does not work when I log on, so i have the win2k look, and then after about 2 minutes the service starts again, by itself and all is well.

Any ideas??

A:Troubles with AD Domain / Group Policy?

Not exactly a "crashes and debugging" issue, but perhaps sufficiently interesting for this section of the forum

Can you please post the text of the event(s) which relate to this error using the "copy" button (to copy details to the clipboard) in the lower left-hand corner of the event details dialog.

Read other 6 answers

I downloaded that 120 day eval copy of Windows 2003 a long time ago, but never used it. I've been wanting to check out the server-side of Active Directory, permissions, and whatnot, and plan to install it on Virtual PC later, and play with it.

My question is: Here at work they've got a few DCs, and computers with XP Pro. Permissions on the client computers are restricted based on Group Policy. I'd like to mess with the same stuff at home.

Basically, the question boils down to: I'd like to experiment with restricting groups and/or individual users with GPO, however, from what I can see, in the GP editor, it seems that there is only one Group Policy, which govens the entire computer, and all users regardless of their group.

I'd like to apply different restrictions, sort of like assigning one Group Policy to one user, and another Group Policy to an entire group, etc.

Any of you know where I can find information on this? I've definitely tried Google, and a few other search engines, but the sites that it turned up weren't really helpful at all.

Thanks in advance,


Read other answers


Not sure if this is the right place for this sort of question, but here goes.

My organisation includes approx 100 computers. A mix of 2000, XP, Vista and 7.

I installed WSUS on one of the servers, and all of the 2000/XP/7 systems reported in gracefully. However, there were 0 windows Vista systems in the WSUS console. Diagnosing this problem I went to a couple systems with Vista, and ran gpupdate /force on them. This is what I got back

Updating Policy... User Policy update has completed successfully. Computer Policy Update Failed. To diagnose the failure, review the event log or invoke gpmc.msc to access information about Group Policy results.
Checked the event log. Here's what's in it:

The processing of Group Policy failed. Windows attempted to read the file \\<FQDN>\sysvol\<FQDN>\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.
I have verified that the UNC path "\\<FQDN>\sysvol\<FQDN>\Policies\{31B2F340-016D-11D2-945F-00C04FB9... Read more

A:Vista not getting Group Policy in Domain environment


Check the Vista PC's Windows features to see if the service is active.

Read other 1 answers

Running Server 2003 with AD. Lately I've been seeing errors in XP clients EVENT VIEWER. Errors are as follows:

Event ID: 1202 Source: SceCli
Security policies were propagated with warning. 0x4b8 : An extended error has occurred.
For best results in resolving this event, log on with a non-administrative account and search http://support.microsoft.com for "Troubleshooting Event 1202's".

Event ID: 1085 Source: Userenv
The Group Policy client-side extension Security failed to execute. Please look for any errors reported earlier by that extension.

I've tried all the MS solutions and have even gone as far as re-loading the default "compatibility" GP template on the server (making all options "Undefined"), then refreshing the policy on the clients with no success. The errors do not seem to be affecting usability at all on the network. Anyone else?

A:Group Policy errors on XP clients in Domain

What is your AD Config like, do you have trusts, have you tried to delete the user account and then recreate it. I found a MSKB article that describes your issue to the tee from what you described, here http://support.microsoft.com/default.aspx?scid=kb;en-us;324383

Hope this helps

Read other 3 answers

I don't know why but some of the machines don't apply the group policy from my Windows 2000 Server Domain Controller. I have Windows XP Pro SP2 Clients joined to the domain that run the policy just fine and a certain number that all just don't apply either my policy or the default domain policy.

At first I thought it could be the user was in the deny list because of group association, but then I logged into a computer that I knew applied the policy and everything worked just fine. I tried logging in as one of the users I knew worked on a machine that didn't apply the policy and the policy was not applied.

To make things clear the problem must be with the computer configuration itself and not a problem with the user account.

I have spent some time googling my problem and some things said to make exceptions for certain ports in my firewall, but that didn't help any either (I turned the firewall off completely and still nothing).

If you have any suggestions as to things to look at that may help that would be greatly appreciated.

A:Some XP Clients don't accept group policy from Domain Controller

I couldn't get any PC's to "take notice" of the group policy on the Server! I tried searching the web and went through instructions websites given...still no luck months on!

Read other 1 answers


I'm not sure where to post this as it's not really a network issue due to the computers not being domained.

At the moment I am applying local group policy settings for each computer (many computers) manually on each machine (Taking about 20 minutes per machine due to the MANY settings that need checking).

Is there any way I can cut this time down by saving a set of policy options from one computer and applying that set to multiple other computers (via a usb stick etc?)

Thanks in advance,


A:Automating Local Group Policy on non-domain machines?

Hi and welcome to TSF not quite sure but you may find something here Group Policy management for IT pros

Read other 13 answers

I recently purchased a new Windows 8.1 computer for use in our organization.  The default logon option for the device is for a Microsoft Account (the default username field prompt is for an e-mail address, rather than for a username.)  However,
I would prefer that the default logon option be for a Windows domain account logon, so that users don't have to click the "Sign-in options" link and select "Local or domain account password" each time they need to log onto the computer.
I have learned that setting the "Interactive logon:  Do not display last user name"
policy (located under Computer Configuration / Policies / Windows Settings / Security Settings / Local Policies / Security Options) to
Disabled allows the domain logon option to be retained across sessions.  However, I would prefer to keep this option set to Enabled so that the previous user name is not displayed.
Does anyone have any suggestions on how the default logon option can be forced to a domain logon, while still suppressing the display of the last username?

A:Windows 8.1 Group Policy to Force Domain Logon as Default?

Hi Arowitv,
According to your description, we can use the following policy to check the result.
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options:
Accounts: Block Microsoft accounts
Click this option, and select" Users can't add or log on with Microsoft account"
Note: Selecting this option might make it impossible for an existing administrator on this computer to log on and manage the system.
Computer Configuration\Administrative Templates\System\Logon :Assign default domain for logon
Set the option to Enabled, and add the Default Logon domain.
Hope this helps.

Kelvin Xu
TechNet Community Support

Read other 4 answers

Whenever I log in to windows 7 using my test AD account I only see 3 icons inside control panel.... When I log in to XP using the same AD account I see all the control panel icons that Im supposed to see according to my GP settings. So it looks like my GP is NOT working properly for windows 7 machines any ideas on what I can do to fix this issue?

A:Domain Group Policy 2003 environment & Windows 7 clients

Could it be the admin of Active Directory has set a group policy for Win 7 users that limits what is available in the Control Panel? They may not be administering XP the same way.

**EDIT** I just realized you are probably the network admin. Duh...

Read other 2 answers

I have a laptop with all the latest updates installed. Legally licensed Windows 7 Home Premium 32bit ed. Running Avast anti virus.
Last thing I did was install a single windows update, I don't remember the update's number, but I remember the download size was less than 2Mb. I don't think the update has anything to do with this.. After successfully installing and rebooting, the laptop boots up normally and I get to the logon screen. After I enter my password I get the following error::
the group policy client service failed the logon access is denied
​ Most of the posts I've found online are for computers part of a domain. For independent machines, the common advice is to logon with another user, which I don't have. What I've tried so far ::
boot to repair mode and create another user and add to users group via command prompt >> user still not showing on logon screen
boot to repair mode and create another user with administrator rights via command prompt >> user still not showing on logon screen
Boot to repair mode and scanning hard drive >> clean Repair startup 3 consecutive times >> same error message boot to safe mode >> same problem
Then I narrowed down the problem ::
boot to repair mode and run regedit. The registry key

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\gpsvc key data
has the value

%windir%\system32\svchost.exe -k netsvcs instead of GPSvcGroup

Reboot,... Read more

A:group policy client service failed non-domain laptop

Read other 7 answers

I have a large network of about 500 machines on a domain. I have set up a local account for exams, with a special local Group Policy that is for non-administrators. The group policy restricts almost everything apart from a few applications.

I need to copy this GP over to another 20-30 machines. Is there any way i can do this.

Copying %systemroot%\system32\grouppolicy didn't work.

A:How to copy local Group Policy?

Welcome to Sevenforums theslowminded!

After you copied the policy over, did you force the update?

gpupdate /force

Read other 4 answers

I want to set all my domain controllers (DC and RDC) to pull time from time.windows.com. In order to achieve this I am planing to create a gp (Computer Configuration/Policies/Administrative Templates/System/Windows Time Service/Time Providers)and
link to Domain Controller OU.
My question is, is it the best thing to do, or is there any risk or best practices with respect to this.

Read other answers

Ok, so I have been searching google for an easy walk through on how to block sites such as MySpace, Youtube, Facebook and other related sites where my father's employees like to waste company time on. **HOWEVER** After reading, blocking sites through IE's block list and adding domains with IP's seem to have easy work arounds compared to IPSEC/Group Policy.

This route allows for all of xxxxx.myspace.com's (subnets) from being accessed as apposed to finding them all out and entering the domain/subnet combos individually in the host file. So if ANYONE has seen a very easy walkthrough (cause the ones i have seen are win 2000 and/or are vague and more complicated than required, I would greatly appreciate it.

I am going to continue to search the web, and if I find something i'll post just in case this topic benefits others. I'm determined to solve this issue!!!

Take Care!

A:Blocking websites either by IP or Domain with Group Policy / IPSEC (not host file)

Read other 12 answers

Is it possible to set administrators to one GP and standard users to another? I want to disable Command Prompt, Task Mgr and lockout all USB and CD drives for standard users but allow administrators to access all of those.

How do i set different group polices depending on user?

Thanks in advance

A:Set Group Policy different for each user group?

Yep. As long as the policies you want to deploy to those groups are per-user (i.e. within the user configuration section of GP Editor), then you can use a tool like Microsoft's GPMC to "security filter" the effects of a GPO to a particular user group. Or, you might want to check out Desktop Policy Manager--www.sdmsoftware.com/desktop_management, which provides a simplified web interface into Group Policy and makes targeting by group much simpler (full disclosure--I work for this company).


Read other 2 answers

I need to set block inheritance on a local user's machine for the screen saver from the domain level. Here's what we have: On the domain controller, we have a Group Policy Object set to automatically set the user's Desktop to Screen saver after 10 minutes
(600 seconds) of inactivity. My boss has tasked me with being able to override this Group Policy on a local user's machine and set the screen saver to turn on after 20 minutes or more, since the user continually has to log back in and get's whatever session
he had going cut off and has to log back into that site as well.
My question is this:

Where in the local machine's Local User Policy would I create this policy?
Desired outcome: Override Group Policy from the domain. set local user policy for screen saver timeout to 1200 seconds. Please provide me as detailed a response as possible as where to go in Local User Policy and how to create this.

Thank you,


A:Override domain group policy for screensaver timeout and set it on local machine to 20 minutes or more

We cannot override domain policy via local policy, processing of multiple domain-linked GPOs is in the order specified by the administrator, on the Linked Group Policy Objects tab for the domain in GPMC. The GPO with the lowest link order is processed last,
and therefore has the highest precedence.Alex Zhao
TechNet Community Support

Read other 3 answers


I`m looking into creating a custom domain-wide default user for my company, but we have two major types employees depending on their tasks (this means - Software A is used by employee A and not by employee B and the other way around). In the Active Directory they are (of course) separated into OUs and Groups.

So I was wondering is it possible to create two default user profiles and somehow link them to a OU or Group in Active directory?

Read other answers

anyone know where i can learn to use User, Group Policy and the registry on a network as admin?

A:User, Group Policy

What exactly do you want to do? This maybe a start for you http://safari.ibmpressbooks.com/0735617880/ch06.

Read other 1 answers

I would like to give software Installation restriction for Domain Admin users but he can have all of remain admin rights.
If he want to install any software it should be ask for password.please suggest to me is there any Group Policy for that one.
Server : windows 2012 R2
Clients : windows 10 

Read other answers

Hi all,
I received this message when i tried to look at the local group policy setting on one of my machines (Windows XP SP3), which is joined in my domain.
"Failed to open group policy object on this computer. You may not have appropriate rights.
Unspecified error."
note that I am local admin.
It's all started when I was troublshooting WSUS connectivity and i looked at the WinsdowsUpdate.log, the WSUS server was <Null> & WSUS status server <Null>, I tried to force the domain GP by using GPupdate /force, it went fine and asked to
log off, but nothing changed in the WindowsUpdate.log still <Null>. Then i tried to look at the local policy setting.
I searched the internet nothing related to my case.
Thanks in advance for advising.
Mohammed Adel

A:Group policy error: Failed to open group policy object on this computer.

I guess reinstall windows is the solution, I also found one log "event id 1096", related to "registry.pol" it was corrupted.
Mohammed Adel

Read other 9 answers

Ok not sure where to post this but im sure i will be told if its in the wrong place.

i have around 15 out of 36 vista biz 32bit computers that will not update group policy's for the user that works on that computer. i have done gpupdate with /force and /sync and everything else that you can add to it. but still nothing happens.

but if i log the user's account into another computer everything is updated like it should be. but when i log them back into their own computer it goes back to the old policy. I have tried everything I konw to fix this hope you guys can help.

a litte more info for you guys is the problem computers are still looking for an old server to redirect files to. even tho the new policy has it pointing to the new server. we have even removed the redirect to see if that would help but it doesn't they still look for the old server and lock up every few mins looking for those files.

A:can't get Group Policy to update for user

Hi Cliffmarcum,

Welcome to Vista Forums!

I'm not certain how you are deploying the GPO's, but the following article may help with procedures, guidelines, hints, troubleshooting tips, and so forth: Deploying Group Policy Using Windows Vista.

On a computer that isn't working, go to Start / All Programs / Accessories / right click on Command prompt and click on Run as Administrator. Type gpresult /v and enter. This should provide a great deal of information about how GP is affecting that machine (and possibly why it is not affecting that machine). Now login as that user on a computer that is working and do exactly the same thing. Compare the two results. I'd be willing to bet SOMETHING is different that's causing the problem.

The Event Viewer has a wealth of information regarding Group Policy. Unfortunately, it requires you to look at all of the different log files to find entries for Group Policy. There you'll find entries related to policy application, policy replication, and policy refresh, all of which can be useful when trying to track down a problem. There is not always a lot of information on specific Group Policy errors in the event logs, but remember that you can always search TechNet if you find errors you can't identify (or post them here and we'll see if we can help). The following article may help here: Troubleshooting Group Policy Using Event Logs.

(From: http://technet.microsoft.com/en-us/m...eshooting.aspx - which may contain additional helpful informat... Read more

Read other 4 answers

Is there any way to add an user to a Group Policy without specifying the location?
If I understood it properly, It seems that when you add an user using the Group Policy Manager Editor, it searches for the name and adds the location as a prefix of the name automatically. For example:
My-Computer/MyUser or Workgroup/MyGroup
I supose that it is not the same to add an user with the location specified for one place or another. For example, If MyUser has a prefix of My-Computer, the rules won't be applied for the Workgroup.
Becuase of that, I was wondering if there is anyway to specify it for a general location. I mean, I would like to have the same as in the default setup, where there is only "Administrator" in the policies without any kind of prefix.

Read other answers

My employer has a group policy to default all sites in a particular domain to IE compatibility View.  They sent me meta tag instructions on how to override that in my pages.  That meta tag works so long as the domain in question is not in trusted
sites. But they also have a Group Policy to force that domain into trusted sites. 
In compatible view I have JQuery syntax that does not run or runs with errors.  From home in an unmanaged PC my pages work great.  At work (managed pc), if I remove the domain from trusted sites the pages work great as well.
Any ideas?
Question, can the groups managing the group policy make exceptions for a particular sub domain?

Read other answers

group policy which is related to a user does not work when we run a program as user(runas).wh have to login with user on local system(ntuser.dat get updated) and then runas user works with group policy setting.(such as hiding all hard drives).how can i update group policy in user profile without login with user? or runas a program with group policy for the first time?

A:how to apply group policy to a runas user?

Read other 6 answers

Hey all, I was wondering if there was any way I can bypass GP. I am on a system at an extension college campus with no designated IT. I have been asking them to fix the resolution on the PCs for over a month now and nothing has been done. It is stretched something awful and no one here likes it. I'd like to bypass the GP and change it. Is this doable?

A:Bypass Group Policy as limited user

Hi AmTheMan and welcome to the Forums.

Sorry but I cannot help you on this, and I don't think any other member will as, your I.T stop normal user's for a reason. Doing this will break the policy and you could get into trouble. I would suggest to keep at them about it

Read other 6 answers

I am having trouble with one of my users profiles. When they log on to their machine, the group policy will not update. When the user is in the department OU in active directory there should be restrictions on what they can change in IE etc and when I put them in a temp OU it should remove all group policy restrictions so that admin can make changes. This works for all except this one user. When I move them to the temp OU it still has all the restrictions in place. I have tried forcing gpupdate to no avail. Is there anything else I need to look at. It is only happening with a single user.


Read other answers


I have a set up two Windows 10 Education Edition laptops. I would like to configure them both with the same settings/permissions.

How can a I make a "User Group" and add policies to it.

For example: Have a "User Group" called "Kids" and then be allowed to configure the windows settings, deploy them to a different printer ect.

I can load lusrmgr.msc and add a Group called "Kids" but if I go into mmc.exe and add the Group Policy Object, I have no option to pick "Kids"

Any suggestions.


Read other answers

I've tried about every method to access Group Policy Editor but it keeps saying snap in restricted by administrator. I've tried using cmd but its disabled by system administrator also regedit.exe so I don't know what to do, would like to know if theres
anything that i can do.  Thanks.

Read other answers


I'm trying to customise the user accounts on a standalone XP Pro PC. I want to apply different settings to the admin and non-admin accounts.

Iím using this fix here detailed in Knowledge Base article Q293655 (would post url but it's against the forum rules).

I apply the settings, log into and out of all the relevant accounts copy Registry.pol from the User folder in group policies (tried copying both and just from machine, seems to have no effect). Once I have a copy of Registry.pol I reverse the settings Iíve applied, log into and out of the user account, then copy the old version of Registry.pol back into the User folder of group policies.

Everything works fine: the restrictions are applied to all accounts accept the admin accounts. Until, that is, I reboot, at which point the changes I made in the admin account take effect and the restrictions are lifted from the non-admin accounts.

For reference, the setting Iíve been using to test this workaround was the Disable changing Advanced page settings under User Configuration > Administrative Templates > Windows Components > Internet Explorer.

Can anyone tell me why this wonít stick after a reboot and what I have to do to get it to stick?

Many Thanks


Read other answers

On Windows Vista and 7, there is a screen, which asks for an administrators authentication whenever something needs editing on the system (such as installing stuff). I have a GPO (group policy object) for all the workstations, and I've navigated to "Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment". Is there a setting that let's the specified users/groups authenticate on the Windows Vista/7 administrator screen (as described at the begining), without them actually being administrators?

Read other answers

Hey all,

I'm in the same boat as CIS was when he posted this thread:

Help with Group Policy?

I've googled and googled and read so much my head is about to explode but still haven't found what I'm looking for.

My end-goal is to change the shell for just a single user account. I poked around the registry for quite a bit after looking at some dated information on how to do it in there but couldn't find an equivilent key in Windows 7 (I believe the information was for XP). Then I discovered it can be done in the Group Policy Editor under User Configuration -> Admin Templates -> Sytem under "Custom User Interface", but this will change it for everyone it appears. My searching eventually led me here, so I decided to stop, and post for help

If anyone could point me in the right direction it would be greatly appreciated


A:Help with Group Policy/shell change for a single user?

New ou... put that computer account in that ou and create a new GPO for that OU. done.

Read other 1 answers

Hi All,
I'm having trouble in an AD environment whereby group policy fails to apply if the user has saved passwords (control panel > user accounts > advanced > manage passwords) to access resources on the DC

Microsoft recommend deleting the saved passwords and running gpupdate /force, however this is far from ideal as users will simply cache their passwords and GP once again breaks. I cant be removing saved passwords from 40 pc's every time theres a change in group policy.

Event viewer logs the following:

Event ID: 1030 Source: Userenv
Windows cannot query for the list of Group Policy objects. A message that describes the reason for this was previously logged by the policy engine.

Event ID: 40961 Source: LSASRC Category: SPNEGO (Negotiator)
The Security System could not establish a secured connection with the server ldap/XXXX. No authentication protocol was available.

Does anyone know of, or can anyone think of a workaround for this problem?

Read other answers

Windows Vista Home Premium, How can I turn off group policy, If I try to run defender or change startup programs, it will not allow me. Message to contact your system administrator to turn off group policy.  Please help

Read other answers

I try to add a domain User to local administrator group
We are a intertanional Company (Austria French Sweeden)
The commandline is: net localgroup s-1-5-32-544 domain\user /add
i recive the error
System Error 1376 has occurred
The specified local group does not exist
Please helpe

A:Add Domain User to Local Group with SID

"Net localgroup" allows adding a domain local group from a trusted domain. The membership is there but will never work as the SID will not appear in the access token
of a user or computer connecting to the machine. the security identifier (SID) of the domain controller is not identified in the operation. For more reference, please see:
Domain local group from foreign domain can be added using "net localgroup" and GC search
Best Regards

Read other 7 answers

I come to you again seeking help. We have a problem with our logon and startup to our Windows 7 Enterprise system. We have more than 3000 Windows Desktops situated in roughly 20+ buildings around
campus. Almost every computer on campus has the problem that I will be describing. I have spent over two months peering over etl files from Windows Performance Analyzer (A great product) and hundreds of thousands of event logs. I come to you today humbled
that I could not figure this out. The problem as simply put our logon times are extremely long. An average first time logon is roughly 2-10 minutes depending on the software installed. All computers are Windows 7, the oldest computers being 5 years old. Startup
times on various computers range from good (1-2 minutes) to very bad (5-60). Our second time logons range from 30 seconds to 4 minutes. We have a gigabit connection between each computer on the network. We have 5 domain controllers which also double as our
DNS servers.
My original posts on:
Technet: http://social.technet.microsoft.com/Forums/en/w7itproperf/thread/e8400dbe-e6b8-4b1d-8851-a03e7af32e6e
Reddit: http://www.reddit.com/r/sysadmin/comments/w5f38/network_logon_issues_with_group_policy_and/
I followed a lot of what you all told me to do from testing the domain controllers with dcdiag and also completing netlogon tests. I did group policy tests where I got rid of the group policy
and just did default policy and it only slightly fixed the prob... Read more

A:Major Network Logon Issues (8 Domain Controllers and 3.5 thousand workstations) DNS, Time Server, DHCP, and Group Policy Errors


I would like to suggest using Network Monitor to troubleshoot the issue.


Jeremy Wu
TechNet Community Support

Read other 4 answers

I was setting up local group policies on a laptop so I could apply them to non-admin accounts. Well I goofed and accidentally applied the policies to all users including the admin. The problem is I was restricting access to all programs except a certain few like internet explorer, remote desktop, etc as users will only need to access their webmail and remote desktop to access the terminal server. Now I cannot do anything with the admin profile because the policy was applied to my account as well. What can I do??

A:Accidentally applied local group policy to all user groups

Which Administrator account did you apply this to? The default or did you enable the built-in Administrator account and apply it to that also?

If you didn't go through any steps to activate an admin account previously, you could probably enable the built-in one and change the settings for the normal Administrator account.

Built-in Administrator Account - Enable or Disable

Read other 2 answers

There are systems where users login for general activity and they pile up almost every day. Is there a group policy to delete the local profiles after the user logs off. I came across policies where the profiles are deleted after x number of days or using
delprof.exe or using scripts or remove cached roaming profiles but we do not want to use them.

We want to use only group policies to delete local profiles immediately after the user logs off. Any help would be appreciated.

A:Group policy to delete local profiles after user logs off

Not Roaming profile? for Local profile, I haven't found a policy to delete it after user logoff, but if what you want to achieve is prevent user saving settings to the desktop, then you can use mandatory user profile instead,.
This profile does not save changes made by the user to the desktop settings. Users can modify the desktop settings of the computer while they are logged on, but none of these changes are saved when they log off. The mandatory profile settings are downloaded
to the local computer each time the user logs on.
http://technet.microsoft.com/en-us/library/gg241183(v=ws.10).aspxYolanda Zhu
TechNet Community Support

Read other 4 answers

When I try to add a domain user to the local administrators group, I receive an error saying that the user is already a member of the administrators group. The thing is, that user is not in the member list of the administrators group. Why do I receive that message.

I did a copy of the problematic user in the Active Directory and I am able to add that "testuser" to the local administrators group without any problem.

From my point of view, the problem is not related to user's permissions because I did an exact copy of that user and I can add that "testuser" in the group.

Any solution?


Read other answers

I'm creating a local group policy to lock down a Win7 Pro Workstation for use in the Staff room.
It's the first time I've used it, previously I've worked a bit with AD. but I've been following on line tutorials and using google and I'm nearly there with it.
But I'm stuck on one thing. My approach has been to remove access to pretty much everything apart from IE, Firefox and Skype icons on the task bar.
I've got the start menu empty apart from the shutdown button, which is what I want but at the top of the start menu is the users icon/picture thing and if i click on it it takes me to "user accounts". I can't for the life of me work out how to get rid of the picture or just stop this happening.

Can anyone help please?

A:How to use Local Group policy to prevent access to User Account settin

Have you tried anything from this thread (especially second page)?

Read other 1 answers

I'm running a Windows Server 2008 Enterprise Edition server that is currently the domain controller, and a Windows 7 Ultimate client. I have a 'Test' user for messing around with group policy - anyway, on the client Start Menu it has 'Test User' which leads to some form of libraries folder. Is it possible to restrict the link without removing their name?

A:Remove Start Menu user link - Windows 7 Group Policy

You could always force a classic start menu with group policy. All the eye candy takes up system resources anyway.

Read other 3 answers

Hi all
I am facing a confusion with group policy on server 2003.I wants to install multiple application on 4 PC's.I used method of ZAP files.like putting on share drive and then installing from add/remove programs.

Now,as far as my reading goes.I can create a new group policy to install one package in ZAP.Since I have multiple packages I wants to create one policy or one ZAP file.

Is it possible if anyone can guide me through.


Read other answers


I think the best place for this question is in Networking, so forgive me if it's not.

I have a Vista Business laptop with a wireless connection to a small network of about 5 machines. I having a problem opening a "Select Users or Groups" dialog box during a MS wizard (ConnWiz30.exe). When I am supposed to open that dialog box I get the error mesasage...

"The program cannot open the required dialog box because no locations can be found. Close this message, and try again."

If I try the same thing, using the same wizard, on a wired computer on the network I get no problems. If I try to get to the same dialog box by using share permissions on the laptop I can do that, it's just the wizard that doesn't work.

The only major difference I can tell between the wireless and wired connections is that the wireless/laptop LAN connection has a SSID, the wired computers do not. Although when I tried connecting the laptop via a wired connection I got the same problem.

This network is not run off a domain.

Any help with this is really appreciated, I'm pulling my hair out over this.


A:Wireless/Wired Domain/User & Group Issues.

Take a look at: Windows XP And Vista On The LAN Together.

See if this site: File and Printer Sharing in Windows Vista helps you if the previous one isn't doing the trick.

Read other 1 answers


I work in a school with a CC3 (RM) network basically modified windows xp and 2000, i have joined a standard windows xp machine to the domain and added a user on the domain local admins group, however when this user logs in they can see the c drive and access other usually restricted parts of windows what they can not do is change the screen resolutions or right click on the task bar.

what would cause this to happen? my understanding is that once the user is in the local admin group they should have full access to everything on that laptop and rm will not supplt support because they do not support standard windows.

there is no way to block this kind of use from active directory is there ??

A:domain user, in local admin group being restricted why ?

Read other 13 answers

I try the following command to add a domain user into local Administrators group of my Windows 7 computer and my computer has already joined domain.
net localgroup administrators mydomain.local\user1 /add /domain
It returns successful added, but I don't find it in the local Administrators group.
How can I do it?

A:Add domain user to local group by command line

Because you are using the /domain parameter you are executing the command on the PDC instead of on the local computer. Try this command:
net localgroup administrators mydomain.local\user1 /add

More information: http://technet.microsoft.com/en-us/library/cc725622(v=ws.10).aspx

Read other 6 answers

After creating a new organizational unit folder folder I moved a user to that folder and setup a disk quota group policy and gpupdate /force in a domain controller and also a client computer.
However if I set the same disk quota group policy to computer folder in Active Directory it works.

Read other answers