Group Policy on Anything About IT

PowerShell 7 – Group Policy Settings and Eventlogs

Mon, 30 Dec 2019 11:54:36 +0000

On December 16th Joey announced the availability of the PowerShell 7.0 release candidate. Time to look at the configuration options. Since I’m interested in the aspects of managing these settings within an enterprise environment, I closely followed the discussions on GitHub here https://github.com/PowerShell/PowerShell/pull/10468 and here https://github.com/PowerShell/PowerShell/issues/9309 and the outcome of these discussions is documented here https://github.com/PowerShell/PowerShell-RFC/blob/master/4-Experimental-Accepted/RFC0041-Policy.md

Installation

Now let’s look what options we have for the configuration of logging PowerShell 7 events. Let’s start with installing PowerShell 7.0 RC1. All download packages are listed here https://github.com/PowerShell/PowerShell/releases/tag/v7.0.0-rc.1 There are multiple options available for installing PowerShell 7 on Windows (AppX, ZIP, MSI) but for this demonstration I use the MSI based installer. https://github.com/PowerShell/PowerShell/releases/download/v7.0.0-rc.1/PowerShell-7.0.0-rc.1-win-x64.msi

How to identify orphan Group Policy content within the Sysvol folder

Tue, 19 Nov 2019 22:22:16 +0000

G’day everyone. Today I was working on a Microsoft Security Configuration baseline implementation and while browsing through the Sysvol folder I got the impression that there are less GPO objects stored within AD compared to the number of GPO content folders located within the Sysvol\Policies folder. As we speak about several hundred folders here, too many to count manually, and so another PowerShell script was born.

Now if the terms SYSVOL, policies folder doesn’t mean anything to you, I suggest you first read this article from Darren (@grouppolicyguy) Understanding Group Policy Storage.

PowerShell Core logging configuration

Tue, 16 Jan 2018 22:41:16 +0000

After having browsed through the PowerShell code a bit, found some references as to how to configure PowerShell Core logging options through GPO or via a configuration file.

There are no GPO Templates available for PowerShell Core, but the same settings as are written for Windows PowerShell also apply for Core, they just live within another registry key.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft*PowerShellCore*

So when you apply the folllowing registry settings , you can enable ScriptBlock logging and Transcripting for PowerShell Core.

ToolTip: IEDigest

Mon, 04 Jul 2016 19:49:26 +0000

IEDigest is collecting all relevant Internet Explorer settings and generates a well formated HTML report. In addition to this there is an XML output as well which can be taken for comparing reports coming from different environments. This is helpfull for troubleshooting purposes when having working and non-working machines.

IEDigest can also be executd in commandline mode.

IEDigest can be downloaded from the Microsoft download center here. Although not fully up to date, documentation can be downloaded from here

The GroupPolicy Xtended PowerShell Module

Thu, 11 Feb 2016 09:42:48 +0000

Good day everyone. Today I would like to share with you the Group Policy Xtended PowerShell module that i’ve written recently. Histrocially I used to have various cmdlets stored in individual files and ran them when needed, I also shared them among my peers and with the public via my blog and the Microsoft Script repository. The challenge with this approach is that it’s hard to ensure eveyone has the latest versions of the cmdlets available and that when someone needs a cmdlet that he’s actually able to find it or actually knows that there’s one available.

ToolTip: Policy Analyzer

Sat, 30 Jan 2016 15:27:20 +0000

Aaron Margosis recently released Policy Analyzer, a utility for analyzing and comparing sets of Group Policy Objects (GPOs). Here’s a brief description on how to use the tool to compare two Domain GPOs.

I created two GPOs in my test domain, both starting with the name “Foo” and then configured some settings. The Policy Analyzer can import GPO settings based on a GPO backup so as a next step we create a GPO backup. The quickest way is to do this via PowerShell.

Group Policy Template file for Windows 10 Wi-FI Sense

Mon, 19 Oct 2015 20:20:48 +0000

Wi-FI Sense is a new feature in Windows 10 that automatically connects you to suggested open hotspots or networks shared by your skype or outlook.com contacts or facebook friends. Sounds like a nice feature, but I’m sure Enterprise Security won’t be to keen about it.

Microsoft has published a KB - How to configure Wi-Fi Sense on Windows 10 in an enterprise that describes the registry settings to configure for disabling Wi-FI sense. The recently publsihed Security Compliance Baseline for Windows 10 “ DRAFT” now also provides a custom Group Policy template for Wi-FI Sense.

Group Policy Settings for Microsoft Edge Browser in Windows 10 Build 10.0.10240

Fri, 17 Jul 2015 09:00:34 +0000

Continuing exploring the Windows 10 preview builds for new Group Policy settings, I come across some new settings for the Microsoft Edge browser.

**Location** **Setting** **Description** Computer Configuration / Administrative Templates / Windows Components / Microsoft Edge Allows you to run scripts like Javascript This setting lets you decide whether to let people run scripts, like JavaScript. This setting is enabled by default.

If you enable this setting, scripting is turned on for all your computers.

Citrix Receiver 4.3 now with ADMX support for Receiver group policy, well almost

Wed, 01 Jul 2015 17:53:36 +0000

Last night Citrix released Citrix Receiver 4.3 that includes ADMX templates to manage Citrix Receiver Group Policy settings. Microsoft introduced the ADMX templates when Vista/Server 2008 was introduced in 2006, so it was about time for Citrix to come up with template files in that format instead of the old ADM based files.

After installing the Citrix Receiver 4.3 that can be downloaded from here you’ll find the new ADMX/ADML files in the following location:

Group Policy Settings in Windows 10 Build 10.0.10130

Fri, 05 Jun 2015 12:25:54 +0000

Windows 10 build 10.0.10130 brought a couple more new Group Policy settings, here they are:

 **Location** **Setting** **Description** Computer Configuration

Administrative Templates
Windows Components
Windows Update Defer Upgrade If you enable this policy setting, in Pro and Enterprise SKUs you can defer upgrades till the next upgrade period (at least a few months).
If you do not have it set you will receive upgrades once they are available that will be installed as part of your update policies.

Group Policy Settings in Windows 10 Build 10.0.10074

Sat, 16 May 2015 13:29:30 +0000

Like with every new version of the Windows operating system we can expect new Group Policy settings. Today I took a look at Windows 10 build 10.0.10074 and found the follownig settings.

 **Location**

Setting

Description

Computer Configuration Windows Components DataCollectionAndPreviewBuilds

Disable user control over preview builds

This policy setting determines whether users can access the preview build controls in the Advanced Options for Windows Update. These controls are located under “Choose how preview builds are installed,” and enable users to make their devices available for downloading and installing Windows preview software. If you enable or do not configure this policy setting, users can download and install Windows preview software on their devices. If you disable this policy setting, the item “Choose how preview builds are installed” will be unavailable.

Group Policy Management expanding into MDM

Sat, 01 Nov 2014 11:36:11 +0000

During the Channel 9 session “Windows 10 Client Goodness with Joe Belfiore” (at 12 minutes 04 of the recorded session) there was an interesting comment from Joe about Group Policy Management in Widows 10. If you’re dealing with Group Policy Management today, the following comments from Joe might be of interest.

*What we’re trying to do in Windows 10. And here’s another case where you think of a core operating system that shares among a bunch of
different devices. Today many companies are using Group Policy to manage PCs and companies are using MDM systems as they are getting from
a wide range of vendors to manage their diverse populations of tables and phones and so on. Well with Windows 10 we want to make sure that
all of our customers can have the flexibility to pick the system that makes sense for them so we are going to continue to have terrific group
policy support for PC’s as you would expect but we are also going to enable MDM systems to manage PCs as well. So if you have an MDM system that you like and you are managing phones and tablets, you can use that MDM system and now manage your PCs as well. *

Use PowerShell to Troubleshoot Group Policy

Thu, 04 Sep 2014 21:44:17 +0000

While I was on vacation last summer Ed Wilson aka Microsoft Scripting Guy asked me if I would like to write a guest post for the Hey Scripting Guy Blog. Of course !! was my immediate response.

And here it is: Weekend Scripter: Use PowerShell to Troubleshoot Group Policy

The script referenced can be downloaded from here http://gallery.technet.microsoft.com/scriptcenter/Get-GPProcessingTime-a124aaf5

New IE Group Policy Settings for blocking out-of-date ActiveX controls

Sun, 10 Aug 2014 20:26:04 +0000

As anounced by Microsoft last week on their IEBlog Internet Explorer will start blocking out of date ActiveX controls For managed environments there are updated administrative templates for Internet Explorer to control the behaviour of the ActiveX blocking feature.

Although the link brings you to a site called “Administrative Templates for Internet Explorer 11” the settings are set to work for Internet Explorer 8,9, 10 and 11. If you haven’t updated your administrative templates since a while, beware of the missing IE maintenance settings.

PowerShell Script - Get Group Policy events by CorrelationID

Thu, 17 Jul 2014 15:00:44 +0000

Update: 22. August 2014: I have posted an updated version of the script here.

During his Group Policy: Notes from the Field - Tips, Tricks, and Troubleshooting session at TechEd Group Policy MVP Jeremy Moskowitz demonstrates how to filter the event log using the correlation ID. Now because I love using PowerShell I thought I create a function for that using Jeremy’s XMLquery.

function Get-GPEventByCorrelationID
{
<#
.Synopsis
 Get Group Policy Eventlog entries by Correlation ID
.DESCRIPTION
 This function retrieves Group Policy event log entries filtered by Correlation ID
.EXAMPLE
 Get-GPEventByCorrelationID -CorrelationID A2A621EC-44B4-4C56-9BA3-169B88032EFD

 TimeCreated Id LevelDisplayName Message
 ----------- -- ---------------- -------
 7/17/2014 3:00:27 PM 5117 Information Group policy session completed successfully.

#>
 [CmdletBinding()]
 Param
 (
 # CorrelationID
 [Parameter(Mandatory=$true,
 ValueFromPipelineByPropertyName=$true,
 Position=0)]
 [string]$CorrelationID 
 )

 Begin
 {
 $Query = '*[System/Correlation/@ActivityID="{CorrelationID}"]'
 $FilterXML = $Query.Replace("CorrelationID",$CorrelationID)
 }
 Process
 {
 Get-WinEvent -FilterXml $FilterXML
 }
 End
 {
 }
}

New Group Policy Settings for Office 365

Fri, 02 May 2014 17:58:18 +0000

On April 28th 2014 Microsoft finally released an fix for the Office 2013 SP1 Office customization tool as the version released with SP1 caused some issues with Lync 2013 and OneDrive for Business. But there’s more in this update.A few new Group Policy settings for Office 365 are included as well.

Important. These new Group Policy settings only apply to Office 365 (click to run installations) and not to Office 2013 MSI based installations. The reason for this is because the settings relate to the update mechanism that’s build in to the Office 365 product.

Theme Configuration Group Policy support for Office 2013

Mon, 30 Sep 2013 21:29:49 +0000

As announced on the Office IT Pro blog a few days ago, there are updated Office 2013 administrative templates and Office updates that allow an administrator to pre-configure the Office 2013 Theme.

The term pre-configure is important, because the setting only applies as long as the user has not changed the theme before themselves via the GUI. When configuring the Theme via Group Policy, User Configuration \ Administrative Templates \ Microsoft Office 2013 \ Global Options Customize \ Default UI Theme, the setting is stored under HKEY_CURRENT_USER\Software\Policies\Microsoft\office\15.0\common\default ui theme

How to enable Group Policy Preferences Logging via the Local Group Policy Editor

Wed, 21 Aug 2013 15:54:44 +0000

When opening the local Group Policy Editor (gpedit.msc) you will notice that on a default Windows 7 SP1 Enterprise client there is no logging and tracing node for Group Policy Preferences logging underneath the Group Policy node.

The reason for this is because Group Policy Preferences can only be managed within domain based Group Policy objects and therefore a Windows 7 SP1 client does not have the Group Policy Preferences related administrative template GroupPolicyPreferences.admx installed that also includes the logging settings.

ConfigMgr 2012 local GPO settings

Tue, 13 Aug 2013 22:26:06 +0000

When configuring ConfigMgr 2012 client settings, notice that some of these settings result in Local Group Policy Settings being applied to the client. If you’re sure that you have not configured any other local GPOs, then a simple way to find out what settings are applied by ConfigMgr is to open the Local Group Policy Editor (gpedit.msc( and filter for configured settings.

When configuring the Background Intelligent Transfer Settings within ConfigMgr, the settings are applied into a local GPO.

How to reapply a Group Policy Preference that is configured to Apply Once

Sat, 25 May 2013 11:03:43 +0000

When creating a Group Policy Preference you can configure it to only apply once. The exact wording is “Apply once and do not reapply”. But when you are implementing such a GPP you most likely want to test the setting prior moving it into production. So here’s a brief explanation how to reapply a GPP when it’s configured to apply once.

The below screen shot illustrates a GPP that is configured to write a registry key to HKLM\Software\Demo\RunIT with the value set to True.

Group Policy changes included in the Windows Management Framework 3.0

Tue, 26 Feb 2013 06:48:22 +0000

While creating a new Group Policy object to enable WinRM (Windows Remote Management) on clients, I noticed some Group Policy changes that are introduced with the Windows Management Framework 3.0. The Windows Management Framework 3.0 contains the following updates:

Windows PowerShell 3.0
Windows Management Instrumentation (WMI) 3.0
Windows Remote Management (WinRM)
Management OData IIS Extension
Server Manager CIM Provider

I became aware of the changes as I was referring to a blog post I had written a while back about how to enable Windows Remote Management via Group Policy.I noticed that the name of the Group Policy setting located under Computer Configuration \ Windows Components \ Windows Remote Management (WinRM) \ WinRM Service \ Allow automatic configuration of listeners was changed to Allow Remote Server management through WinRM

How to configure and deploy local Group Policy settings for ThinKiosk

Sun, 16 Dec 2012 11:36:27 +0000

In my previous post Repurpose PCs with Windows ThinPC I used Andrew Morgan’s ThinKiosk to replace the default Windows Shell to limit the user’s access to the local machine. ThinKiosk can be configured via the command line, the Registry and via Group Policy. Now unless you like to write lengthy registry manipulation scripts, configuring the settings via Group Policy is definitely the way to go.

When clients are member of a domain we would of course use domain based group policy settings, but when not joined to a domain must use local Group Policy settings. In this blog post I describe in detail how to prepare and deploy a local GPO Pack. Note that the hereunder described process is not limited to the use of ThinKiosk but can be used for any local Group Policy configuration task for Windows ThinPC (Embedded 7), Windows 7 and Windows 8. (Note that for Windows 8 you’ll have to wait until SCM 3.0 comes out which is currently in beta).

Windows 8–Metered Connections

Wed, 17 Oct 2012 21:26:17 +0000

One of the new features in Windows 8 is that we can configure WLAN and WWAN cost settings. In the Windows UI this is called a metered connection.

Why are these settings important? Well, when a Network is configured to be a Metered Connection, Windows will make several changes to the way that it uses the network to reduce overall network traffic through that connection, including the following:

·Only Critical Windows Updates are downloaded.

How to partially remove the SkyDrive option in Office 2013 using Group Policy

Thu, 02 Aug 2012 19:05:46 +0000

If you have tried out the Office 2013 Preview you probably noticed the SkyDrive integration within the File Open and Save dialogs in Word, Excel and other Office Applications. Personally have started using SkyDrive all the time, but I can imagine that some companies rather do not want to see their users storing sensitive data on SkyDrive. So I wondered if this option could be disabled.

Well apparently there is a Group Policy setting for this called “Show SkyDrive Sign in” located under User Configuration / Policies / Administrative Templates / Microsoft Office 2013 / Miscellaneous

The Group Policy Setting “Verbose vs normal status messages” has a new name in Windows 8

Sun, 24 Jun 2012 15:45:04 +0000

If you want to show your users more details of what is going on during start, logon, logoff and shutdown of a system you can enable a Group Policy setting that is called “Verbose vs normal status messages’ in Windows 7 and earlier versions of Windows, but in Windows 8 the setting has a new name and is now called “Display highly detailed messages”.

You can find the setting under Computer Configuration / Administrative Templates / System.

How to use Group Policy to configure default Library definition files in Windows 8

Sun, 10 Jun 2012 14:52:23 +0000

There is a new Group Policy setting for Windows 8 and Server 2012 called “Location where all default Library definition files for users/machines reside”. The policy can be found under Computer or User Configuration / Administrative Templates / Windows Components / Windows Explorer.

If you enable this policy setting, administrators can specify a path where all default Library definition files for users reside. The user will not be allowed to make changes to these Libraries from the UI. On every logon, the policy settings are verified and Libraries for the user are updated or changed according to the path defined.

Group Policy setting's behavior related to reboots, logoffs and schema extensions

Fri, 01 Jun 2012 20:33:40 +0000

The Group Policy Settings Reference for Windows 8 and Windows Server 2012 now includes 3 additional columns providing additional information about each policy setting’s behavior related to reboots, logoffs, and schema extensions.

Reboot Required: A “Yes” in this column means Windows requires a restart before it applies the described policy setting.
Logoff Required: A “Yes” in this column means Windows requires the user to log off and log on again before it applies the described policy setting.

Microsoft UE-V and PolicyPak - Better Together

Tue, 24 Apr 2012 21:19:42 +0000

In this video Group Policy MVP Jeremy Moskowitz demonstrates why customers planning using Microsoft User Environment Virtualization (UE’V) might also want to consider using PolicyPak.

More details about PolicyPak and the video transcript can be found here

GPO Template for UE-V SettingsTemplateCatalogPath configuration

Tue, 17 Apr 2012 10:58:35 +0000

To simplify my testing activities with Microsoft’s User Experience Virtualization (UE-V( Beta, I created a Group Policy template that configures the User’s SettingsTemplateCatalogPath. The SettingsTemplateCatalogPath is the location where UE-V looks for new or updated templates once a day.

The SettingsTemplateCatalogPath setting is stored within the Windows Registry under
HKEY_CURRENT_USER\Software\Microsoft\UEV\Agent\Configuration

To get the GPO working I had to create another “custom” registry value called GP_SettingsTemplateCatalogPath_Set which defines whether the setting is enabled or disabled. (Well possible that this workaround isn’t required, but I couldn’t find another way to get my home-brew policy working).

ToolTip: GPO Deny Finder

Sat, 03 Mar 2012 15:11:17 +0000

GPO Deny Finder is a FREE tool from sdmsoftware that helps you to find GPOs that have deny ACEs. The below video explains how to use the tool.

More details about the tool can be found here or just download the tool directly from here

New Group Policy Settings in Windows 8 Consumer Preview

Wed, 29 Feb 2012 23:45:24 +0000

Today, oh that was yesterday already, Microsoft released the Windows 8 Consumer Preview, so I did what I always do when there is a new Windows Operating system and that is looking for any new Group Policy settings. I do that by simply opening the group policy editor (gpedit.msc) select the Administrative Templates node and then go to All Settings, sort them alphabetically by Setting name and just go down the list and look for any policies where the requirement is defined to “At least Windows 8”. And this is what I have been doing for the last 3 hours. The task might look boring but I can tell you this is a good way to learn about new things.

Skype Group Policy Settings

Sat, 31 Dec 2011 10:26:34 +0000

Just recently one of our customers requested the Skype (Business version) Application to be packaged for software distribution, so I wondered what the status is these days with regard to locking down Skype with Group Policy. Well the results are sobering. Despite the fact that Skype is part of Microsoft since a while, there has not been much progress in making Skype more Group Policy aware.

The settings that can be configured using Group Policy are documented within the Skype IT Administrators Guide but note that this document relates to Skype version 4.2 and there isn’t a newer version for Skype version 5.x. Also note that the number of settings is rather limited, in fact the only setting I consider as useful for Enterprise Administrators is to disable the Check for Updates setting that prevents Skype form automatically checking for new versions and updates.

ReadTip: Group Policy Central Access Policies Extension Specification

Fri, 23 Dec 2011 00:50:06 +0000

If you are interested in Group Policy stuff, here’s a new Open Specifications Documentation for Group Policy: Central Access Policies Extension that appears to be something new coming with Windows 8. To be honest with you, I guess I need to read this doc a few more times, until I could really explain in detail what this is all about, Some other articles mentioning this are Exploring Windows Server 8: Dynamic Access Control and Windows Server 8 Gets Serious about Security.

Enable Windows Remote Management through Group Policy

Sun, 27 Nov 2011 19:43:21 +0000

In today’s post I am going to show you how to enable Windows Remote Management through Group Policy.If you haven’t heard of Windows Remote Management yet I recommend you read the articles I have referenced below. When enabled and configured Windows Remote Management provides an easy way for IT Administrators to remotely access and manage Windows Clients and Servers. If you have used the Microsoft Sysinternals PSTools suite, you’re going to like this one as well.

Windows 8 – New GPO stuff

Thu, 15 Sep 2011 20:53:16 +0000

I have just compared the C:\Windows\PolicyDefinitions folder on the Widows 8 preview build with a Windows 7 Enterprise build. And unless I missed one, the below ADMX/ADML files are new.

AppxPackageManager.admx
dam.admx
DeviceCompat.admx
EAIME.admx
EarlyLaunchAM.admx
EdgeUI.admx
ExternalBoot.admx
msched.admx
ProximityCommon.admx
srm-fci.admx
UserState.admx
WindowsHistoryVault.admx
WinStoreUI.admx
wlansvc.admx
WPN.admx
WPN.Provider.admx
wwansvc.admx

When you open the related ADML files stored under C:\Windows\PolicyDefinitions\en-US you will find some interesting hints about what these new policies are supposed to do. You will find stuff about Windows to Go, the App Store, Profiles and more.

Group Policy Settings for Microsoft Lync 2010 Client

Tue, 06 Sep 2011 21:57:40 +0000

Just in case you missed this one, Microsoft released documentation and an ADM template for the Microsoft Lync 2010 client. The following settings can be configured.

Specify transport and server
Enable strict DNS naming for server name
Configure SIP security mode
Configure SIP compression mode
Prevent users from running Microsoft Lync
Allow storage of user passwords
Require logon credentials
Disable HTTP fallback for SIP connection
Disable server version check
Additional server versions supported

Taking Group Policy beyond what’s in the box – Part2

Mon, 22 Aug 2011 10:01:29 +0000

In my previous post I provided a brief overview of how PolicyPak can take you beyond default Group Policy management. In today’s post I am going to show you how easy it is to get PolicyPak up and running in your test environment.

You can test PolicyPak on a local computer or within an Active Directory environment.

Now beside the awesome things PolicyPak can do, what I really like about this solution is that it just sits on top of what you already have, there is no need for any additional infrastructure to get PolicyPak going.

Taking Group Policy beyond what’s in the box – Part1

Mon, 15 Aug 2011 07:15:03 +0000

Group Policy is a fundamental part of a managed Windows infrastructure. Using Group Policy Objects (GPO) allows IT administrators to configure and lock down clients and servers providing a standardized and secure environment. But despite the fact that Group Policy technology is around since the introduction of Windows 2000 its use seems to be limited to the Windows operating system and Microsoft Application product suite. Unfortunately not many 3rd party software vendors provide built-in Group Policy based configuration support for their applications. If an application doesn’t provide native Group Policy support, the only possibility for IT administrators to configure and deliver application configuration settings is either by creating a custom ADM/ADMX template or use Group Policy Preferences. Here are the main problems with ADM/ADMX solutions:

How to disable Office Ribbon Items using Group Policy

Thu, 04 Aug 2011 20:20:56 +0000

Today I am going to show you how to disable a Ribbon Item using Group Policy, Okay, what’s the deal you might think, simply find the item within the Office GPO settings and enable it. Right,almost, it’s just that Microsoft didn’t list all possible settings within the Office ADMX/ADML file, probably because there are too many of them. But there is a setting called “Disable command bar buttons and menu items” that you can enable and specify the Ribbon Policy ID.

All you need to know about Group Policy versioning

Thu, 04 Aug 2011 07:52:21 +0000

Ever wondered how the Group Policy versioning works? Below you find a number of articles and resources that provide a good insight how GPO versioning works.

Group Policy Team Blog – Understanding the Domain based GPO version number

TechNet - Displaying Version Properties of a Group Policy Object

MSDN - Group Policy: Core Protocol Specification (Details in section 3.3.5)

Get the latest version of the GPOTool.exe

Sat, 23 Jul 2011 20:49:13 +0000

The latest version of the GPOtool is the one that is included within the Microsoft Windows 2003 Resource kit. That’s what we all used to know. BUT hey I just figured out a few days ago that there is actually an official newer version around it’s included within the Microsoft Product Reports Utility.

Here’s how to get it. When launching the mpsreports_x86.exe or mpsreports_x64.exe the utility extracts the files into the temp folder.

Have you checked your Group Policy Health lately?

Sat, 23 Jul 2011 20:19:35 +0000

Group Policies are an essential part of every Windows Client infrastructure and it’s therefore critical to regularly spend some effort to ensure that things are in a healthy state. I would define a healthy Group Policy infrastructure as following:

All Group Policies are correctly synched across all domain controllers
There are no unlinked Group Policies (unless it’s by purpose because we use them only ad-hoc for testing purposes)
There are no Group Policies that are completely disabled (unless it’s by purpose because we use them only ad-hoc for testing purposes)

Group Policy Settings for Silverlight 4 – FIXED

Mon, 06 Jun 2011 13:29:23 +0000

On the Microsoft Silverlight website you will find a page that describes the available Group Policy Settings for Silverlight as well as the content for the ADMX and ADML file. But… it doesn’t work because the code on the web contains a bug and a section is missing.

Within the silverlight.admx there is an unnecessary space and within the silverlight.amdl the section for SET_ALLOW_MAXIMUM_ISOLATED_STORAGE and ALLOW_MAXIMUM_ISOLATED_STORAGE_HELP is completely missing.

To get the Silverlight GPO working remove the space from ALLOW_MAXIMUM_ISOLATED_STORAGE_HELP and add the following section to the silverlight.adml file.

Group Policy Settings to control BITS Bandwidth usage

Wed, 11 May 2011 23:32:59 +0000

I just read the article BITS – More Flexible Bandwidth Limit Policies on the Windows Management Infrastructure Blog which describes how BITS bandwidth usage can be configured through Group Policy settings. For Windows 7 (or computers with BITS 3.5 installed) there are 2 Group Policies that provide more granular control of BITS bandwidth usage during working / non-working days/hours and during scheduled maintenance days/hours.

The 2 GPOs can be found under Computer Configuration -> Administrative Templates -> Network -> Background Intelligent Transfer Service

ReadTip: Group Policy for Beginners

Fri, 29 Apr 2011 06:41:23 +0000

Microsoft has released a document called Group Policy for Beginners which provides an overview of what you can do with Group Policies, the essential concepts and some step by step instructions to get you going. If you haven’t done anything with GPOs before and are just about to learn how this all works, this document is for you. I also recommend this document for project managers that haven’t done anything with GPOs in the past.

Group Policy Settings for Windows Games

Mon, 25 Apr 2011 15:05:56 +0000

In Windows 7 Professional and Enterprise the Windows Games are not enabled by default. But if you have decided to include them in your corporate standard image or users with administrative rights enable them by themselves, you should consider using the following Group Policy settings.

 **Location** **Location** **Setting** **Description** Computer Configuration Administrative Templates\Windows Components\Game Explorer Turn off downloading of game information Manages download of game box art and ratings from the Windows Metadata Services.

 If you enable this setting, game information including box art and ratings will not be downloaded. 

 If you disable or do not configure this setting, game information will be downloaded from Windows Metadata Services.

 Computer Configuration Administrative Templates\Windows Components\Game Explorer Turn off game updates Manages download of game update information from Windows Metadata Services.

 If you enable this setting, game update information will not be downloaded. 

 If you disable or do not configure this setting, game update information will be downloaded from Windows Metadata Services.

 Computer Configuration Administrative Templates\Windows Components\Game Explorer Turn off tracking of last play time of games in the games folder Tracks the last play time of games in the Games folder.

 If you enable this setting the last played time of games will not be recorded in Games folder. This setting only affects the Games folder. 

 If you disable or do not configure this setting, the last played time will be displayed to the user.

Custom GPO Template for Start Menu–Highlight newly installed programs

Thu, 21 Apr 2011 12:18:49 +0000

This morning at the GP Answers community forum someone asked how to configure the Start Menu option “Highlight newly installed programs” via GPO. As it turns out this setting is not included within the out of the box GPO templates. Since I have a few days off I thought let’s give a little help here.

But before jumping into the custom ADMX template, let’s quickly look at the configuration setting itself. When installing an application the new created shortcut within the Start Menu is highlighted.

GPO Settings for Microsoft Security Essentials

Tue, 15 Mar 2011 18:52:34 +0000

With the release of the latest version of Microsoft Security Essentials 2.0 in December 2010, Microsoft also changed the licensing terms.

***Small Business. *If you operate a small business, then you may install and use the software on up to ten (10) devices in your business.

Now although 10 PCs isn’t a lot, some Administrators might be interested in configuring their Microsoft Security Essential clients with a GPO. Fabien Duchene has created an Administrative template for MSE. Read more here

Microsoft Open Specifications Documentation for Group Policy

Sun, 20 Feb 2011 18:51:10 +0000

If you want to learn more about Group Policies then I suggest that you download and read the following documents:

MS-GPSOD]: Group Policy System Overview Document
http://download.microsoft.com/download/C/6/C/C6C3C6F1-E84A-44EF-82A9-49BD3AAD8F58/%5bMS-GPSOD%5d.pdf

MS-GPOL]: Group Policy: Core Protocol Specification
http://msdn.microsoft.com/en-us/library/cc232478(v=PROT.13).aspx

MS-GPDPC]: Group Policy: Deployed Printer Connections Extension
http://msdn.microsoft.com/en-us/library/cc232156(v=PROT.13).aspx

MS-GPEF]: Group Policy: Encrypting File System Extension
http://msdn.microsoft.com/en-us/library/cc232218(PROT.10).aspx

MS-GPFR]: Group Policy: Folder Redirection Protocol Extension
http://msdn.microsoft.com/en-us/library/cc232290(v=PROT.13).aspx

MS-GPIE]: Group Policy: Internet Explorer Maintenance Extension
http://msdn.microsoft.com/en-us/library/cc232356(v=PROT.13).aspx

MS-GPIPSEC]: Group Policy: IP Security (IPsec) Protocol Extension
http://msdn.microsoft.com/en-us/library/cc232415(v=PROT.13).aspx

MS-GPPREF]: Group Policy: Preferences Extension Data Structure
http://msdn.microsoft.com/en-us/library/cc232587(v=PROT.13).aspx

Retrieve Group Policy size in SYSVOL folder with PowerShell

Mon, 24 Jan 2011 18:07:28 +0000

Needless to say that there are quite some benefits in using a central store for Group Policies, one of them is that you can prevent the so-called SYSVOL bloat. A good description of the SYSVOL bloat is described here. So how much size do my GPOs currently consume within the SYSVOL folder? I asked myself that question a few days ago and ended up with let’s say my first version of the GetGPOSize PowerShell script.

ReadTip: How to use Group Policy Preferences to Secure Local Administrator Groups

Sat, 18 Dec 2010 14:27:41 +0000

As we come to the year’s end I was doing some housekeeping in my home lab. Too many unused VMs, ad-hoc created Accounts etc. In the end I thought why not apply the same methods we apply within our enterprise environments and so I did. I was actually just about to blog how I solved the local Administrators group management through group policy preferences, but before I started writing that down I thought let’s see if this has been blogged already on one of the well known Group Policy blogs, and so it was. Alan Burchill wrote a very good article about How to use Group Policy Preferences to Secure Local Administrator Groups. Now even if you already know about Group Policy Preferences and local Administrator group management, I recommend that you read the “How to add individuals to a single computer?” section, very smart approach I hadn’t considered yet.

Control Windows 7 Scheduled Maintenance Behavior Through Group Policy

Sun, 07 Nov 2010 15:35:23 +0000

This week one of my customers send me the Microsoft support article KB978980 – Desktop Shortcuts disappear in Windows 7 and the request to make sure this wouldn’t happen to his clients. In short, if a user creates a shortcut that points to a location that isn’t available at the time when the weekly scheduled system maintenance task is running, the shortcuts are considered as broken and therefore automatically deleted.

In the support article Microsoft doesn’t really provide a fix to solve this problem but rather describes 2 workarounds that don’t sound feasible to me.

Creating Group Policy Objects with PowerShell

Sat, 16 Oct 2010 16:52:03 +0000

In my previous post I wrote about how to create Group Policy reports using the Group Policy PowerShell CmdLets. Today I want to share with you my first hands-on experiences with creating a Group Policy using PowerShell.

But first, why would one use PowerShell to create Group Policies? Well here are a few use cases:

You are a Consultant and always start your Group Policy Implementation with a set of GPOs including your best practice settings.

Creating Group Policy Reports with PowerShell

Sun, 03 Oct 2010 19:14:43 +0000

I’ve had this on my “must do some hands on” list for months, finally found some time to play a bit with the new PowerShell Group Policy CmdLets that where introduced with Windows 7. For today i decided to work with the Get-GPO and the Get-GPOReport CmdLets.

The Get-GPO CmdLet allows you to list one or all GPOs that exist in a domain. If you know the name and want to know when it was last modified, simply type Get-GPO

Creating a Steady State for Windows 7

Mon, 13 Sep 2010 19:20:10 +0000

For those who manage Windows XP or Windows Vista computers in a school computer lab, internet cafe or library, Microsoft provides a tool called Windows SteadyState. If you want to know more about Windows SteadyState then I recommend reading the Windows SteadyState Handbook or FAQ.

But hey, who cares about Windows XP or Vista nowadays? What about Windows 7? Well unfortunately Windows SteadyState doesn’t support Windows 7 and it appears that Microsoft has no plans to provide a newer Version that does support Windows 7. But Microsoft did recently publish some guidance on how to get a Steady State for Windows 7.

Finding Group Policy Settings through Windows 7 Search Connector

Thu, 02 Sep 2010 20:44:18 +0000

Since the release of Windows 7 and Server 2008-R2 we have about 3000 Group Policy Settings available to centrally configure and manage Windows clients and servers. Though some among us might have worked with GPO settings from the early days on, knowing about the existence of each and every available setting is nearly impossible. It still happens to me that while I am configuring a specific GPO setting, I do come across other GPOs I didn’t knew of yet.

What you should know about the Win32_Product Class

Wed, 02 Jun 2010 20:55:15 +0000

I just read this very interesting article “Why Win32_Product is Bad News!” and if you’re a Desktop Systems Administrator I strongly recommend to the read that article as well. To simulate what Darren is writing about, simply open an elevated command prompt (on a Test system) and type WMIC, once WMIC has started type Product and confirm with Enter.

All installed Products will be listed. Now open the Windows Event Viewer. (Eventvwr.msc) and open the Applications log. As shown in the picture below that simply query caused all installed applications to be reconfigured.

BookTip: Group Policy – Fundamentals, Security and the Managed Desktop

Fri, 07 May 2010 16:34:15 +0000

Today I’ve received a signed copy of Jeremy Moskowitz latest Book “Group Policy – Fundamentals, Security and the Managed Desktop”, so instead of using my laptop I guess I’ll be holding a real book in my hands this weekend.

Jeremy also published 3 FREE chapters:

**Bonus Chapter 1 **- Scripting Group Policy Operations with Windows PowerShell (co-written with PowerShell MVP Jeff Hicks.)
**Bonus Chapter 2 **- Advanced Group Policy Management (AGPMv4)
**Bonus Chapter 3 **- Full Lockdown with Windows SteadyState

Office 2010 Administrative Template files and Office Customization Tool

Thu, 29 Apr 2010 19:06:40 +0000

Microsoft published the Office 2010 Administrative Template files (ADM, ADMX/ADML) and Office Customization Tool. Get it from here

ToolTip: Group Policy Search

Fri, 23 Apr 2010 11:44:37 +0000

Reading my e-mails near the end of my vacation I received a link to this great web based GPO Search Tool. The tool is quite self explaining, so if you’re dealing with Group Policies have a look here

ReadTip: Optimizing Group Policy Performance

Sun, 04 Apr 2010 16:48:57 +0000

This is an excellent article written by Darren Mar-Elia author of gpoguy.com and founder of sdmsoftware. The article provides guidance for optimizing Group Policy Performance. Read the entire article here

Group Policy Script Processing Behavior

Mon, 29 Mar 2010 19:18:11 +0000

If you are preparing for a Windows 7 deployment and use GPO based startup and logon scripts you should be aware of the default processing behavior in Windows 7. Read the details here

Source: Ask the Directory Services Team blog

BlogTip: Group Policy Center

Mon, 22 Mar 2010 23:49:20 +0000

Being generally interested in Group Policy Management I was more than happy to stumble upon this blog today called the Group Policy Center – A very nice blog with News, Tutorials, Tips and Tricks about Microsoft Windows Group Policy.

Configuring App-V Standalone Mode through Group Policy

Tue, 02 Mar 2010 00:17:58 +0000

If you plan to use the Microsoft App-V Stand-Alone Mode some Registry Settings are required for the Application Virtualization Client as described in detail on this App-V site here. But instead of setting these registry keys manually or through a custom script, you can also manage these settings through Group Policy.

First download the Microsoft Application Virtualization Administrative Template (ADM Template). The ADM Template provides configuration options for the App-V 4.5/4.6 Client settings such as Client Permissions, Client Interface behavior and Client Communication Settings.

Updating the Central Store for Windows 7 Group Policy Administrative Templates

Sun, 22 Nov 2009 20:21:52 +0000

One of the things to consider when deploying Windows 7 clients is to update the Central Store on your domain controllers. If you haven’t created a Central Store yet, I recommend you watch the video or read the documentation I have listed at the end of this post.

If you do have a Central Store already, updating it with the Windows 7 Group Policy Administrative templates is very straight forward. You simply copy the templates that are stored under C:\Windows\PolicyDefinitions on your Windows 7 client to the Central Store which is located at \FQDN\SYSVOL\FQDN\policies\PolicyDefinitions (FQDN = fully qualified domain name)

Going beyond the standard Group Policy Preferences

Wed, 29 Apr 2009 19:40:36 +0000

Group Policies and Group Policy Preferences are great technologies to manage your enterprise desktops. But what if you want to go beyond the features Microsoft has build into the Group Policy Management Console?

With PolicyPak you can consistently manage ANY application’s settings using the Windows native Group Policy technology. have a look at the PolicyPak introduction video below to learn what PolicyPak can do and how it works.

Learn more about PolicyPak and watch the video tutorials.

Group Policy: Restrict Hardware like a pro

Thu, 12 Mar 2009 10:00:14 +0000

Here’s another video from GPanswers explaining how to restrict the use of certain devices within your managed environment.

Group Policy - How to Configure the Central ADMX Store

Tue, 10 Mar 2009 22:32:01 +0000

Well as you might notice Group Policy management currently is my favorite topic. I’ve been doing GPOs since the year 2000, then for a long while due to my job role I haven’t been doing a lot with GPOs, but that didn’t matter since there wasn’t too much changing in that space except that with each OS release the number of GPO settings has been growing.

But since the introduction of Windows Vista, there have been some bigger changes around GPO management. One of these changes is the use of the Central ADMX Store. The Central ADMX Store plays an important role, so it is important understanding the concept.

Group Policy Management Videos from GPanswers.com

Tue, 10 Mar 2009 21:43:35 +0000

Jeremy Moskowitz from GPanswers.com has posted 2 free GPUniversity videos.

Default Group Policy Objects

](http://www.youtube.com/watch?v=1-9huZgxOSI&hl=en&fs=1)

Group Policy Backup and Restore

](http://www.youtube.com/watch?v=YKoTLGPHZIU&hl=en&fs=1)

Interested in more ? Check out the Group Policy Online University.

Updated Group Policy Online University

Fri, 06 Mar 2009 10:41:03 +0000

In January 2009 Jeremy Moskovitz launched the Online University for Group Policy Management. I wrote about that earlier in my blog post “Online Group Policy University”.

In the past weeks Jeremy has put an additional great amount of effort in reworking the offerings, so that now you have the possibility of selecting and ordering individual Modules and and options. Additionally there are some very attractive payment options as well that might be interesting for those that don’t get their company paying it for them, but want to invest in their personal knowledge.

Online Group Policy University

Tue, 27 Jan 2009 22:59:23 +0000

Today Jeremy Moskowitz has launched the Group Policy Online University. Taking into account that many companies in these days have restrictive travel and training policies, the Online University seems to be an excellent way how you can further extend your knowledge around Group Policy Management without the need to attend a live training e.g. you can attend the training at any time, from everywhere.

The only thing you need to do now is to convince your manager that it is worth the money :-)

IE8 Group Policy Settings and more

Tue, 27 Jan 2009 22:29:12 +0000

Yesterday Microsoft released the Release Candidate for Internet Explorer 8 that of course contains a lot of new features that I am not going to rewrite here again, as others did so already.

Reading the IE8 product group blog 100 additional group policy settings are being introduced to extend manageability of IE8 through Group Policy Management. The updated Group Policy Reference including the new IE8 settings can be downloaded here and updated Group Policy Settings ADM files can be found here. Also worth reading is the IE8 Deployment Guide.

Expanded Control with Group Policy Preferences article from TechNet Magazine

Mon, 19 Jan 2009 21:02:00 +0000

For those interested in Group Policy Preferences I recommend reading the “Expanded Control with Group Policy Preferences” that is published in the January 2009 issue on TechNet Magazine.

And as always the full January 2009 help file version can be downloaded here.

GPO Survival guide

Mon, 19 Jan 2009 20:04:35 +0000

Just came across this handy document from Microsoft called the “[Group Policy Documentation Survival Guide](http://download.microsoft.com/download/2/1/2/212db64c-3e9c-44d3-b822-b2508e0eccf3/Group Policy Survival Guide.pdf)”.

The guide contains all the links to the resources you need when dealing with Group Policies.

The document can be downloaded here

Win7 - GP Features

Mon, 12 Jan 2009 22:01:09 +0000

Jeremy Moskowitz from GPanswers.com just uploaded 2 videos on YouTube demonstrating some of the new GP features in Windows 7.

GPO Preferences require XMLLite

Tue, 02 Dec 2008 20:28:26 +0000

Reading the Group Policy Preferences Overview Whitepaper from SDM software, I just notice an interesting prerequisite for using GPO Preferences - XMLLite.

XmlLite Runtime Files

The XmlLite runtime file, Xmllite.dll, is integrated into the following operating systems and products:

Windows Server 2008
Windows Vista
Windows Server 2003 with Service Pack 2 or later.
Microsoft Internet Explorer 7.0 and later.

The XmlLite runtime is also available as a download from the XmlLite Update Page for the following operating systems:

Creating GPO reports

Thu, 13 Nov 2008 22:00:05 +0000

Usually when you need a report for a given Group Policy object, you would launch the Group Policy Management Console, select the GPO and then select the settings tab that produces the report.

But what if you need a report for multiple or even all your GPOs you have within your Active Directory ? Going through each GPO and produce the report manually is going to take ages and is boring.

GPO Logging custom ADM

Mon, 20 Oct 2008 18:40:50 +0000

Last week we have been doing some GPO troubleshooting. Instead of setting all GPO logging options manually the custom GPO logging ADM(x) files found on GPOGUY.COM appeared to be very handy.

You can download the cutom ADM files here.

Wireless GPO settings for XP

Wed, 17 Sep 2008 22:49:48 +0000

In the last 2 days i have spend some time in getting Wireless GPO settings applied to a Windows XP client.

I was actually about to describe what i have done to get it working, but just noticed that there is already a similar article published on Technet Magazine related to Vista, so i am not going to rewrite things in detail again.

The Cable Guy Wireless Group Policy Settings for Windows Vista

GP Preferences

Fri, 15 Aug 2008 15:58:36 +0000

In 2006 Microsoft acquired the company DesktopStandard known for its extending Group Policy products GPVault and PolicyMaker.

While GPVault has become part of Microsofts MDOP suite that is available only for Enterprise customers that have a Software Assurance contract, the Policy Maker features have been available to everyone.

The PolicyMaker GPO extensions are now called GP Preferences.

GPO Preferences can be managed directly from a Windows 2008 system that has the latest GPMC installed or through a Windows Vista client with RSAT installed. With GP Preferences you can now manage Windows 2008 server, Windows Vista, Server 2003 SP1 and Windows XP SP2.