I am putting together my Server 2012 domain and getting ready to deploy Windows 8 with SCCM 2012.

In finding this article: http://www.grouppolicy.biz/2012/11/how-to-use-group-policy-to-change-the-default-lock-screen-image-in-windows-8/ I found that I could finally control the lock screen image.  I did apply the 2770917 update, but that still did not give me the option to Force a Default Lock Screen Image as I had hoped.  I believe it might have something to do with the fact that I've already uploaded Office 2013, IE10, and Windows 8 ADMX files into the central store.  My guess is that these have overridden the "default" settings and so it doesn't show the new settings that were applied with the 2770917 update.

Am I right about the central store overriding the default GPO settings or should they be there along side the default ones that shipped with Server 2012?  Any suggestions on how to get that specific GPO into my domain so that I can use my fancy new lock screen image?

I have a GPO that I have added a ".bat" script to the "Computer Configuration\Windows Settings\scripts\startup/shutdown" section. The batch file is located in the netlogon folder. This script was part of another Old GPO that I want to consolidate into this new GPO. So I am taking the exact settings from the old GPO and  applying it to the new GPO.

The script does not run at startup and when I go into Group Policy Management, highlight the GPO then on the right pane click the settings tab it doesn't display the startup script as being set. It's just not there. If I select edit and go to the"Computer Configuration\Windows Settings\scripts\startup/shutdown\startup" section the .bat script is present though.

Also if I do a gpresult it also shows that it isn't running the script but all other settings in the GPO are being applied.

This GPO has the User Config. side disabled

Why isn't the GPO applying the script or even acknowledging that it is present in the settings tab?

Hi,

I am implementing a migration for a company to a new Windows 7 Build. During this migration Folder redirection is going to be implemented. I want to be able to pre-stage the users data before enabling Folder redirection, is this possible? As I am unable to get this working correctly.

This process in theory is great, this issue is that we are unable to get this to work consistently and most of the attempt’s fail. Share has been created on a NetApp Filer. 

Initial Folder share and permission are listed below:

Share permission:

Authenticated User set to Full control

NTFS Permission:

Local Administrator – Full control – This folder, subfolders and files.

System – Full control – This folder, subfolders and files.

Creator Owner - Full control – Subfolders and files only.

Authenticated User – List folder/read data, Read attributes, Read extended attributes, Create folders and Append data and Read permissions   – This folder, subfolders and files.

Things tried are listed below:

1. Create a folder with the users login name in root of the NetApp filer. Copy data to this folder. Take ownership at top level, set ‘Full control’ to user on ‘This folder only’ and remove and ‘Read only’ and ‘Archive’ attributes. This causes access denied and and duplicate files warning and error with ‘Sync Center’ and creates a brand new ‘My Documents’ folder.
2. Create a folder with the users login name in root of the NetApp filer. Copy ‘Desktop’, ‘Favourites’ and ‘My Documents’ folders that were created using a clean profile. The ‘Desktop’ folder contains ‘Desktop.ini’ and ‘Recycle Bin’. The ‘Favourites’ folder contains ‘Desktop.ini’ and ‘Recycle Bin’. The ‘My Documents’ folder contains the folders(My Pictures, My Music and My Videos0 and ‘Desktop.ini’ and ‘Recycle Bin’. Copy users data to the relevant folders. Take ownership at top level, set ‘Full control’ to user on ‘This folder only’ and remove and ‘Read only’ and ‘Archive’ attributes. This causes access denied and duplicate files warning and error with ‘Sync Center’ and creates a brand new ‘My Documents’ folder in nearly all cases(3 out of 4).
3. Create a folder with the users login name in root of the NetApp filer. Copy ‘Desktop’, ‘Favourites’ and ‘My Documents’ folders that were created using a clean profile. Remove all ‘Desktop.ini’ and ‘Recycle Bin’ files from all folders. Copy users data to the relevant folders. Take ownership at top level, set ‘Full control’ to user on ‘This folder only’ and remove and ‘Read only’ and ‘Archive’ attributes. This causes access denied and duplicate files warning and error with ‘Sync Center’ and creates a brand new ‘My Documents’ folder. This causes access denied and and duplicate files warning and error with ‘Sync Center’ and creates a brand new ‘My Documents’ folder in nearly all cases(3 out of 4).
4. Create a folder with the users login name in root of the NetApp filer. Copy users data to the relevant folders. Take ownership at top level, set ‘Full control’ to user on ‘This folder only’ This causes access denied and duplicate files warning and error with ‘Sync Center’ and creates a brand new ‘My Documents’ folder in nearly all cases (3 out of 4).
5. Created two new GPO’s , one for the user to disable the moving of users data to the redirected folders and the other for the machine to disable the sync. Via the Library add the local ‘My Documents’ ‘Desktop’ and ‘Favourites’ folders to the relevant folders( Desktop with desktop etc.), this allows them access to the original files. This way creates all the folders on the NetApp filer without any data in then. Copy users data to the relevant folders. Now move the user to the relevant OU that enables moving of local files to the redirected folders and the Machine in to the OU that enables Sync. Issue is how to remove the link from the library’s cleanly, but it does sort out the Folder Redirection and Sync’ing or user data. I can access the library’s with notepad.exe and amend them but this is not really very clean. Also will need to delete all old files and folders from the users profile. Implementation of this removal and deletion is not going to be an easy solution to implement.

I know this is a lot of information but basically need help to get this implemented.

I have implemented several patches to fix these issues but they just normally reset the Folder Redirection and recreate a My Documents folder.

Thank you for your help in advance.

Thanks for your help ITUserMan

I have a Windows 2012 server that I've assigned the Print Server role.  I've installed the printer onto the server, and have deployed it with a GPO (in Print Management) that assigns to all the users in our office.  On reboot, the policy pushes the printer out successfully to 64 bit Windows 7 computers, but not 32 bit.  I made sure to install the 32 bit drivers in "Additional Drivers" as well, and have given the user Read and Write permissions.

Any ideas?

Hi,

As soon as I (administrator on my PC) logon to Windows 7, I get a message saying that the Group Policy Client service failed to start. I'm not sure why I'm getting this error even though the dependencies are very much up and running..

Below is the error message I get in the notification area as soon as I logon

Failed to connect to a windows service
Windows could not connect to the Group Policy Client service. This problem prevents stndard users from logging on to the system.
As an administrative user, you can review the System Event Log for details about why the service didn't respond.

We try to copy a group policy from one Windows 2003 Domain Controller to another Domain Controller. We have exported the policy successfully. When attempting to import using Restore, it days” No backup found”. What could be the problem?

Bob Lin, MVP, MCSE & CNE Networking, Internet, Routing, VPN Troubleshooting on

http://www.ChicagoTech.net

http://www.howtonetworking.com

We are planning to deploy AGPM to our organization. Two things concern us are the relatively high latency wan link (200 ms latency, 10 MB link) and the cases when administrator modify the controller GPO directly from GPMC and the changes getting overwritten when another admin modify from AGPM . Any solutions to these cases. I have seen a post explaining how we can restrict domain admins from using GPMC and then end recommending not to use that. 

We have only single forest single domain in our organization so I believe we can have only one AGPM server. Any one using AGPM over slow wan link?

Hemachandran

I'm deploying printers to Remote Desktop Services sessions using Group Policy Preferences. When a user logs in for the first time all printers are created correctly. Every subsequent login I get the follow event log error for each printer in the GPP.

Log Name:      Application
Source:        Group Policy Printers
Event ID:      4098
Task Category: (2)
Level:         Warning
Keywords:      Classic
User:          SYSTEM
Description:
The user 'Printer-A' preference item in the 'RDS Printers {4B82A841-77B3-457A-87CE-87A73C04F63C}' Group Policy object did not apply because it failed with error code '0x80070bc4 No printers were found.' This error was suppressed.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Group Policy Printers" />
    <EventID Qualifiers="34305">4098</EventID>
    <Level>3</Level>
    <Task>2</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-02-14T02:31:14.000000000Z" />
    <EventRecordID>3395</EventRecordID>
    <Channel>Application</Channel>
    <Computer>RDS01.domain.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data>user</Data>
    <Data>Printer-A</Data>
    <Data>RDS Printers {4B82A841-77B3-457A-87CE-87A73C04F63C}</Data>
    <Data>0x80070bc4 No printers were found.</Data>
  </EventData>
</Event>

Printers still appear to work but I get TONS of these errors.

DCs are Windows Server 2008 R2 SP1. RDS server is Windows Server 2008 R2 SP1.

I have found lots of other posts of people having the same issue but never a solid resolution. Below are the various things I have tried.

• Install KB2748246. Updates win32spl.dll (11/8/2012, v6.1.7601.17994) to (11/8/2012, v6.1.7601.22156). Still get the error.
• Domain Admins get the error as well.
• Restarting the spooler, log off, log on, same error.
• Typing the printer name instead of browsing. Same error. http://www.eversity.nl/blog/2011/02/gpp-event-id-4098-warning-0x80070bc4-no-printers-were-found
• Disabling Point & Print Restriction. Same error - http://support.microsoft.com/kb/2618460
• Doesn't matter if the “Action” on the printer is set to Create or Update.
• Doesn’t matter is there is any ILP or not.
• Doesn’t matter if group in ILP is typed or browsed.
• Doesn’t matter is its HP, Canon, or Sharp device.
• Doesn’t matter if Print Processor is WinPrint/RAW or 3rd party.
• Doesn’t matter if using FQDN or hostname to the print server.
• “comp\admin\system\logon\Always wait for the network at computer startup and logon” in base policy. Same error.
• If I add a new printer it appears to not give the error on any printers that follow it. Must have something to do with the fact that it is installing the new printer so subsequent printers are “refreshed” without issue.
• Enabling CSE for Printers logging shows similar error.
  Initial Logon (Gets errors)
  2013-02-14 14:46:13.422 [pid=0x3e8,tid=0x14a4] {9A5E9697-9095-436d-A0EE-4D128FDFBCE5}
  2013-02-14 14:46:13.422 [pid=0x3e8,tid=0x14a4] Starting class <SharedPrinter> - Printer-A.
  2013-02-14 14:46:13.422 [pid=0x3e8,tid=0x14a4] Starting filter [AND FilterTerminal].
  2013-02-14 14:46:13.422 [pid=0x3e8,tid=0x14a4] Adding child elements to RSOP.
  2013-02-14 14:46:13.423 [pid=0x3e8,tid=0x14a4] Session: 3
  2013-02-14 14:46:13.423 [pid=0x3e8,tid=0x14a4] Protocol: 2
  2013-02-14 14:46:13.423 [pid=0x3e8,tid=0x14a4] Client Name: COMP1
  2013-02-14 14:46:13.424 [pid=0x3e8,tid=0x14a4] Passed filter [FilterTerminal].
  2013-02-14 14:46:13.424 [pid=0x3e8,tid=0x14a4] Starting filter [OR FilterTerminal].
  2013-02-14 14:46:13.424 [pid=0x3e8,tid=0x14a4] Adding child elements to RSOP.
  2013-02-14 14:46:13.424 [pid=0x3e8,tid=0x14a4] Session: 3
  2013-02-14 14:46:13.424 [pid=0x3e8,tid=0x14a4] Protocol: 2
  2013-02-14 14:46:13.425 [pid=0x3e8,tid=0x14a4] Client Name: COMP1
  2013-02-14 14:46:13.425 [pid=0x3e8,tid=0x14a4] Failed filter [FilterTerminal].
  2013-02-14 14:46:13.425 [pid=0x3e8,tid=0x14a4] Filters passed.
  2013-02-14 14:46:13.425 [pid=0x3e8,tid=0x14a4] Set user security context.
  2013-02-14 14:46:13.425 [pid=0x3e8,tid=0x14a4] Adding child elements to RSOP.
  2013-02-14 14:46:13.920 [pid=0x3e8,tid=0x14a4] Properties handled. [ hr = 0x80070bc4 "No printers were found." ]
  2013-02-14 14:46:13.921 [pid=0x3e8,tid=0x14a4] Set system security context.
  2013-02-14 14:46:13.929 [pid=0x3e8,tid=0x14a4] EVENT : The user 'Printer-A' preference item in the 'RDS Printers {4B82A841-77B3-457A-87CE-87A73C04F63C}' Group Policy object did not apply because it failed with error code '0x80070bc4 No printers were found.'%100790273
  2013-02-14 14:46:13.929 [pid=0x3e8,tid=0x14a4] Error suppressed. [ hr = 0x80070bc4 "No printers were found." ]
  2013-02-14 14:46:13.930 [pid=0x3e8,tid=0x14a4] Completed class <SharedPrinter> - Printer-A.

• Gpupdate after 2 minutes (No errors)
  2013-02-14 14:47:39.015 [pid=0x3e8,tid=0x1730] {9A5E9697-9095-436d-A0EE-4D128FDFBCE5}
  2013-02-14 14:47:39.015 [pid=0x3e8,tid=0x1730] Starting class <SharedPrinter> - Printer-A.
  2013-02-14 14:47:39.015 [pid=0x3e8,tid=0x1730] Starting filter [AND FilterTerminal].
  2013-02-14 14:47:39.015 [pid=0x3e8,tid=0x1730] Adding child elements to RSOP.
  2013-02-14 14:47:39.015 [pid=0x3e8,tid=0x1730] Session: 3
  2013-02-14 14:47:39.016 [pid=0x3e8,tid=0x1730] Protocol: 2
  2013-02-14 14:47:39.017 [pid=0x3e8,tid=0x1730] Client Name: COMP1
  2013-02-14 14:47:39.017 [pid=0x3e8,tid=0x1730] Passed filter [FilterTerminal].
  2013-02-14 14:47:39.017 [pid=0x3e8,tid=0x1730] Starting filter [OR FilterTerminal].
  2013-02-14 14:47:39.017 [pid=0x3e8,tid=0x1730] Adding child elements to RSOP.
  2013-02-14 14:47:39.017 [pid=0x3e8,tid=0x1730] Session: 3
  2013-02-14 14:47:39.018 [pid=0x3e8,tid=0x1730] Protocol: 2
  2013-02-14 14:47:39.018 [pid=0x3e8,tid=0x1730] Client Name: COMP1
  2013-02-14 14:47:39.018 [pid=0x3e8,tid=0x1730] Failed filter [FilterTerminal].
  2013-02-14 14:47:39.018 [pid=0x3e8,tid=0x1730] Filters passed.
  2013-02-14 14:47:39.019 [pid=0x3e8,tid=0x1730] Set user security context.
  2013-02-14 14:47:39.019 [pid=0x3e8,tid=0x1730] Adding child elements to RSOP.
  2013-02-14 14:47:39.029 [pid=0x3e8,tid=0x1730] Properties handled.
  2013-02-14 14:47:39.029 [pid=0x3e8,tid=0x1730] RunOnce value created [SUCCEEDED(S_FALSE)]
  2013-02-14 14:47:39.029 [pid=0x3e8,tid=0x1730] Handle Children.
  2013-02-14 14:47:39.029 [pid=0x3e8,tid=0x1730] Set system security context.
  2013-02-14 14:47:39.037 [pid=0x3e8,tid=0x1730] EVENT : The user 'Printer-A' preference item in the 'RDS Printers {4B82A841-77B3-457A-87CE-87A73C04F63C}' Group Policy object applied successfully.
  2013-02-14 14:47:39.037 [pid=0x3e8,tid=0x1730] Completed class <SharedPrinter> - Printer-A.

Any thoughts?

Patrick Hoban
http://patrickhoban.wordpress.com

hi i want to push a config file through Group Policy........

so can u tell me where to go in GPO to configure this

i have windows server 2008R2

thnx in advance

istiaq

I'm trying to create a group policy for roaming profiles, and there seems to be some kind of permissions issue with it.  I have 2 windows server 2008 r2 std. servers that I am using for terminal servers (load balancing citrix xenapp 6.5 servers in a farm to be specific).  When my domain user test account connects to the citrix farm, the roaming profile is not created and a 'you have been logged in with a temp profile...' message appears. 

If I give my test user domain admin access, then the profile is created and everything works just fine.  If I leave the profile there and switch my test user back to domain user access, the profile seems like it stays there, but it gives a message when logging off the server that 'roaming profile couild not be saved and to contact you administrator'.  The romaing profiles are created just fine of course for domain admin users. 

I have also created a share for the roaming profiles with full control permissions for both my test domain user and domain admins because there is an 'access denied' message in the event log when I log on as the test domain user (when it gets the temp profile message'.  Domain admins get no errors in event log when their profile is created.

I really need to get these roaming profiles working for domain users, not just for domain admins.  Below is all of the items I have enabled for my group policy for the roaming profiles:

I created a schedule task that would close an application at logon (switch user - second user log on will kill the current application running at the first logon user). It works fine with schedule task setting on the local box, but the same configuration I could not make it work when I do it with domain group policy! I schedule the task in User Configuration. I tried Computer Configuration too but it did not help!

Any hint is appreciated, thanks.

Thang Mo

Hello All,

I have been trying to figure out how something is set for users that log in to terminal server.

The Servers (it is a load balancing cluster) - two servers, both Windows 2008 R2, map a folder (which is on both computers)

C:\Users\Public\Desktop to all users that log in to Remote Desktop (aka terminal services).

I am looking for suggestions on where this might be done.  the folder contains shortcuts to various programs on the system,

like Outlook, etc.  When a user logs in via remote desktop to the server, the desktop is populated with the shortcut icons.

This network has 2 DCs operating as a global catalog, etc.

I have searched thru all the group policies on the domain controller - to no avail - (I could have missed something here)

I have also checked each Terminal server computer local group policy for users that log in, etc.  No luck here.

I have looked for log on scripts - there are none.

Would you have any suggestions as to where else I might look around for this type of sharing?

I know this is not a easy thing to comment on, but there may be other places in the O/S where this might be set up.

Thanks,

ERic

Dear All,

Yesterday, I changed some settings in our Group Policy (Server 2008 R2). I changed following settings,

Password Policy >> Minimum Password Age 

Account Lockout Duration >> 30 Mins

Account Lockout Threshold >> 6 

REset Account Lockout Counter After >> 30 mins.

Today I came across extremely strange problem on one of the user PC (Windows 7, Domain). The user loggedin but Outlook 2007 was constantly asking for password. On typing correct password it still could not take it. I checked the account it was locked in AD, unlocked it but again after logging in outlook kept asking for password. The user again got locket out of AD. This vicious cycle continued and I was puzzled. I reset all the Group Policy back to day 1 and issued gpupdate /force on both client and server but the same problem persisted. The system doesnot seem to get updated GPO. Then I came across an article which mentioned about network shares being mapped on the system and Netwrix Account Lockout Examiner. I got the a culprit shared drive which I removed and then problem got solved. Now I have two questions,

1) I have around 60 user PC's with network drives shared.If I put account lock out policies all of them will be affected. How can I make sure they are not affected.

2) Why the GPO didnot reflected instantly when I issued gpupdate /force command on both server and client.

Thanks

Hi All,

In our organization we have enabled "Interactive logon Message" and "Screen Saver". This was enabled as per our management instructions.

But we have a requirement from one of the Site which has manufacturing machines they don't need to enable the "Interactive Logon Message" and "Screen saver" the count of these machines are approx 10 machines and rest all are Office users machine on which we need to have "Interactive logon Message" and "Screen Saver".

I would like to know is there any way where I can applied the same policy on bunch of computers and for 10 machines I can exclude.

As we dont want to create a separate OU structure, Separate Group Policies for only 10 machines.

Thanks

Thanks HA

Hello,

I am having a win 2008 R2 Domain Controller, and Having 200 Clients recently we bought some new systems with win 7, and none of the group policies are getting updated on these win 7 systems, All the group policies are working fine on XP clients. 

I am getting the following error

The processing of Group Policy failed. Windows attempted to read the file \\Domain\SysVol\xxx.com\Policies\{11050CCA-7B67-4387-9EE1-D3DCA50D5ADE}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following: 
a) Name Resolution/Network Connectivity to the current domain controller. 
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller). 
c) The Distributed File System (DFS) client has been disabled.

I work for a corporate environment supporting multiple domains.

Windows 2008 R2 DC and Windows 7 Clients (fully patched). Local User profiles with Folder Redirection.

We set User Group Policy Preferences for Control Panel\Desktop Registry keys (Wallpaper, screensaver, etc) and then set to "Apply once and don't re-apply".

For existing users the Group Policy applies the first time and the registry key is created in the users profile HKEY_CURRENT_USER\Software\Microsoft\Group Policy\Client\RunOnce so it won't apply again.

The problem is with new profiles. The user logs in, the profile is created, the registry key for the Apply once and don't re-apply for the policies are created BUT NO actual preference settings apply on that first logon (even the ones that are not set to apply once). The preferences keys just don't get added or modified. It is like the profile is built after Group Policy Preference runs.

If you delete the HKEY_CURRENT_USER\Software\Microsoft\Group Policy\Client\RunOnce manually and do GPUpdate then the preferences apply fine.

Also all those preferences set to apply every time will apply at the next logon.

The problem is that the "Apply once and don't re-apply" are flagged that they have applied with they have NOT applied due to the profile creation not applying preferences on first logon.

I did find a Hotfix KB2284538 but the .dll version in the hotfix is two years older than the one we are using so it doesn't apply. 

Our DLL is gpprefcl.dll Version 6.1.7601.22249

Any ideas even for a work-around. We need these settings to apply, but only once, so users can change them.

I think we have narrowed it down to the fact that Microsoft runs Active Setup for new user profiles AFTER User Group Policy which is so ridiculous. It means that Active Setup Overwrites Group Policy Preference files.  I verified by watching it remotely. The user logs in, the settings are set, and then Active Setup deletes them.

lforbes

Hello to all,

I am currently trying to find a solution for enforencing a group policy that auto locks computer after a set interval, but we have users that use their laptops for presenations and the group policy would kick in and lock the computer during the presentation.

So that is why I'm asking/trying to gather ideas or another better way to go about this issue. I want the group policy to lock the computer but also it needs to be able to be changed by the user, if they need to do a presentation.

We are running Server 2008 r2 if that helps any.

Thank you for your time, have a great day.

LT

I need to create File system object shortcut in star menu through group policy for All user , so I can do it on the desktop by I tried more time for start menu but not success .

Note: I am using windows server 2008