I have an issue as mention below.
OS: Windows 2008 R2 with Domain Controller / Terminal Server on the same Server
Want to disable USB Pen Drive
Try to disable pen driver via GPO it gets disable for all users including Admins.
Want to disable for few users and allow to admins.
Regards,
GJ
I added a Server 2012 to our domain back a couple months back and I've just noticed that the \\domain.local\SYSVOL\domain.local\Policies isn't being synchronized
We have 6 x 2008 DCs, 1 x 2008 R2 & 1 x 2012
I did a test and created a test file in \\domain.local\SYSVOL\domain.local\ on each of the servers i.e. dc1.txt, dc2.txt etc
Each of the 7 older servers ended up with all 7 test files, but the new 2012 server only contains the text file I created on this server.
I can confirm active directory is replicating fine.
I've checked the event log on the new DC and it isn't showing any errors in the DFS Replication event log.
I ran GPOTOOL.EXE and it is showing what I was expecting:
Example 1, new GPO not in policies folder on older DCs
Policy {4EB455D8-030C-4F5F-BC0C-3937946D1970}
Friendly name: Install - Test GPO Replication
Error: Cannot access \\DC1.domain.local\sysvol\domain.local\policies\{4EB455D8-030C-4F5F-BC0C-3937946D1970}, error 2
Error: Cannot access \\DC2.domain.local\sysvol\domain.local\policies\{4EB455D8-030C-4F5F-BC0C-3937946D1970}, error 2
Error: Cannot access \\DC3.domain.local\sysvol\domain.local\policies\{4EB455D8-030C-4F5F-BC0C-3937946D1970}, error 2
Error: Cannot access \\DC4.domain.local\sysvol\domain.local\policies\{4EB455D8-030C-4F5F-BC0C-3937946D1970}, error 2
Error: Cannot access \\DC5.domain.local\sysvol\domain.local\policies\{4EB455D8-030C-4F5F-BC0C-3937946D1970}, error 2
Error: Cannot access \\DC6.domain.local\sysvol\domain.local\policies\{4EB455D8-030C-4F5F-BC0C-3937946D1970}, error 2
Error: Cannot access \\DC7.domain.local\sysvol\domain.local\policies\{4EB455D8-030C-4F5F-BC0C-3937946D1970}, error 2
Example 2, out of date version
Friendly name: Internet Explorer - v8 Settings
Error: Version mismatch on DC1.domain.local, DS=3538947, sysvol=2490371
Error: Version mismatch on DC2.domain.local, DS=3538947, sysvol=2490371
Error: Version mismatch on DC3.domain.local, DS=3538947, sysvol=2490371
Error: Version mismatch on DC4.domain.local, DS=3538947, sysvol=2490371
Error: Version mismatch on DC5.domain.local, DS=3538947, sysvol=2490371
Error: Version mismatch on DC6.domain.local, DS=3538947, sysvol=2490371
Error: Version mismatch on DC7.domain.local, DS=3538947, sysvol=2490371
I actually tried this (Step 1: Check Group Policy infrastructure health)
And when I click detect it pops up the error
"A processing error occurred collecting data using this base domain controller. Please change the base domain controller and try again"
Update:
I found a post that talks about checking the userAccountControl attribute in ADSIEdit. I found that the new DC is set to 532512 and all the rest are 532480.
Looking at this page
http://support.microsoft.com/kb/305144
I'm guessing this means it has PASSWD_NOTREQD enabled where as the others don't
Not sure if this has anything to do with it?
Please help :)
Thanks
Can anyone help me on this error? My client is Windows 7 and DC is Windows 2008, thanks.
The client-side extension could not apply user policy settings for 'Block Internet {616A9AA1-3B09-4B9E-A4D6-3D90D9FD1344}' because it failed with error code '0x80070003 The system cannot find the path specified.' See trace file for more details.
Hello Guys,
I have some issue that our upper management wants to happen. they want to set a GPO for local Administrator on a single workstation.
Example User1 will set as local admin on PC1 only and same thing with User2 will be set as local admin PC2 only. They want this to be set via GPO.
Help guys . .
Thank you in advance . .
Happy new year . .
Regards,
Trish
thanks
I wonder if its possible to set a GPO or script or similar that sets the conditions for "Turn off the display" only after working hours.
So for example between 07.00 and 18.00 the monitors do NOT turn off due to inactivity.
But after 18.00 the monitor will turn off after e.g. 20 minutes of inactivity
---
PCs are running Windows 7 Enterprise 64bit
DC is a Windows Server 2008 R2 Standard 64bit
---
Any help is much appreciated!
Thx :)
Hi All,
Is there any way we can disable Print Screen through group policy?.We are running with Windows Server 2008 R2 DCs and Windows 7 clinets.Please suggest.
Please let me know the steps
Thanks
Amit
Hello,
We have DSCP values configured for server and client and was working fine
Exactly like this : http://www.shudnow.net/2011/11/04/enabling-qos-for-lync-server-2010-part-1/
After upgrade to win 8 + lync 2013, its no longer working
I have copied existing GPO and just renamed communicator.exe to lync.exe and attached to same OU
I left even old GPO present as old machine s are still running win 7 and lync 2010
but even after gpdate in Win 8, rejistries still say "commuinicator.exe' and not changed to "lync.exe", with DSCP values.
How should I correctly set new GPO for lync.exe, without affecting one for communicator.exe
Hello,
Can anyone think of a way of disabling the system restore button without disabling system restore? We've already disabled the system restore configuration button via GP, but there doesn't appear to be an obvious way of disabling the system restore button itself. (Windows 7 clients)
Any help would be greatly appreciated!
Thanks!
Hello,
I have 5 Windows Server 2008 R2 terminal servers that I push printers to via Group Policy Preferences. These are shared printers on the user side of the GPO. I have loopback processing turned on to make it apply for anyone who logs on to these servers. The print server is Windows Server 2008 R2 also. For random users on the terminal server the printers fail to push out and I have the following message in the Event Viewer
The user '<Printer Name>' preference item in the '<GPO Name> {CBA32780-09FF-4222-90F7-50BA260AAC39}' Group Policy object did not apply because it failed with error code '0x80070bc4 No printers were found.' This error was suppressed.
I have point and print restrictions disabled on both the user side and the computer side. I have also tried checking the option to use the user's security context. If I log in to one of the terminal servers and the printers don't get pushed out, I can manually add the printer with no problem.
Does anyone have any idea what's going on here?
Thanks.
Hopefully this title makes sense, Basically I want to put a GPO on my root servers GPO which installs a software agent.
The GPO is an assigned application which would install on reboot, so after dropping the GPO onto an OU and typing GPUPDATE /FORCE it wants to update.
Question is: If I drop the GPO on the OU and don't manually GPUPDATE /FORCE all the servers, will they reboot automatically when they inherit this new GPO? at ANY point? there are a lot of critical servers.
Thanks!
Hi Guys,
I'mtrying to installAGPMin my environment,but
the error occurs:
WindowsInstallerinstalledtheproduct.Product Name:
Microsoft AdvancedGroup Policy Management- Server.Product Version:4.0.ProductLanguage:1033.Installation
successorerrorstatus:1603.
Ialreadystopped theWindows Firewallservice, Ialreadystarted theWindows Firewallservice,butthe errorremains.
Alreadyhave disabledthe option to
automatically addtheport 4600as an exceptionin thefirewall, howeverthe error stillremains.
The userI'musingto installisDomainAdminand the
OSisWindowsServer2008 R2x64
You guysknowwhat else can Ibe missing?
Hi
I want to ask if workstations registry disable auto share by edit [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters]
Add "AutoShareWks"=dword:00000000
Then, C$, admin$ will be removed.
Any setting on GPO can re-enable those share again.
Thanks
Q K
I have a need to disable the action center from notifying the user about the firewall being disabled. I have found a method to disable the action center (http://technet.microsoft.com/en-us/library/ee617161%28WS.10%29.aspx), but it only stopped the icon from being up for a second or so then it pops up.
There was a second and a preferred method of just disabling the firewall notification, but it required getting into the registry. I attempted this method but it said this was an invalid item when I attempted to copy the exported registry file into the GPO. (http://social.technet.microsoft.com/Forums/en-US/w7itproui/thread/83dc3de6-70b7-450f-992c-60511e4a6c4f)
Is there any suggestions on how to perform this?
Hello
I have an Acronis backup image that I am trying to restore to a new machine - to do this, I need to disable the Device Installation Restrictions in the image. I have the ability to modify the image's registry and file system before the restore.
I have deleted the following key: HKLM/Software/Policies/Microsoft/Windows/Device Installation, but it apparently did not work correctly.
Are there any other registry keys or local policy files that I can delete so that the restored machine does not enforce these policies until it rejoins the domain and pulls the policies back down from the DCs?
Thanks
hi we have a backup circuit that is on another default gateway. is there a way to push through gpo another default gateway meaning
right click on ipv4\properties\advanced\default gateways\
currently I have the one gateway in their and the metric says automatic
is there a way to push another gateway and set the metric to 2? that way when that circuit goes it will flip to the backup one and when the circuit comes back up it goes back to the first one. please advise asap.
Hi all. We have a need to set the following registry keys on XP workstations for certain users:
HKLM\SOFTWARE\Microsoft\Windows\currentVersion\Internet Settings\BypassHTTPNoCacheCheck"=Dword:1
I was hoping to do this with GPO, and limit the computers it is applied to by the User who logs in to the computer.I have placed the Users I would like to have this setting applied to into a group (not OU) in AD.
I have tried to create a custom ADM to control this setting, however, I must use the CLASS MACHINE type of ADM in order to affect the HKLM branch of the registry (correct?). Furthermore, when I link the GPO to my Workstations OU, and set the Security Filtering to the Group of users I setup earlier, the GPO does not apply because GPRESULT reports it as empty. I think this is because I am trying to apply a MACHINE setting to a filtered group of USERS...correct?
Could someone with more GP experience than me please confirm my above assumptions? Is what I am trying to do even possible with GPO?
Thank you in advance!
One of my servers went down due to a MoBo failure. It was a BDC and a replication partner with my PDC.
PDC Server running Server 2008R2
Other server was Server 2003
Now, I am getting Error 1058, and having Trust issues, even to the point that printers cannot print and docs cannot be opened due to a lack of trust.
I have posted below my DCDIAGS and also an unedited IPCONFIG /ALL
New MoBo has been ordered, expected ot tomorrow, but have still not seen it "ship yet"
I am thinking if I can change the replication server from Main Server, to another Server I have, it might get us back to work?
START IPCONFIG *-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-
C:\Users\Administrator.FIRSTFLORIDA>ipconfig /all
Windows IP Configuration
Host Name . . . . . . . . . . . . : MainServ
Primary Dns Suffix . . . . . . . : Firstflorida.com
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : Firstflorida.com
mailman.firstflorida.com
Ethernet adapter Local Area Connection 2:
Connection-specific DNS Suffix . : mailman.firstflorida.com
Description . . . . . . . . . . . : New Virtual Network
Physical Address. . . . . . . . . : 78-2B-CB-71-5E-C9
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Autoconfiguration IPv4 Address. . : 169.254.191.181(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . :
DHCP Server . . . . . . . . . . . : 255.255.255.255
DNS Servers . . . . . . . . . . . : 192.168.0.6
Primary WINS Server . . . . . . . : 192.168.0.6
Secondary WINS Server . . . . . . : 192.168.0.4
NetBIOS over Tcpip. . . . . . . . : Enabled
Ethernet adapter NIC Card MAIN 2:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Broadcom BCM5709C NetXtreme II GigE (NDIS
VBD Client) #39
Physical Address. . . . . . . . . : 78-2B-CB-71-5E-C9
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.0.18(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.1
DNS Servers . . . . . . . . . . . : 192.168.0.6
NetBIOS over Tcpip. . . . . . . . : Disabled
Ethernet adapter NIC Card MAIN 1:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Broadcom BCM5709C NetXtreme II GigE (NDIS
VBD Client) #38
Physical Address. . . . . . . . . : 78-2B-CB-71-5E-C7
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.0.6(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.1
DNS Servers . . . . . . . . . . . : 192.168.0.6
NetBIOS over Tcpip. . . . . . . . : Enabled
Tunnel adapter isatap.{125D33BC-3645-4254-B173-8F5B07ED1545}:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Tunnel adapter isatap.mailman.firstflorida.com:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : mailman.firstflorida.com
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Tunnel adapter Local Area Connection* 13:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft 6to4 Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Tunnel adapter isatap.{573C4C41-0B75-4D4F-94A9-33671359E0D4}:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #7
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Tunnel adapter Teredo Tunneling Pseudo-Interface:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
C:\Users\Administrator.FIRSTFLORIDA>
-+-+-+-+-+-+-+-+-+END -+-+-+-+-+-+-+-+-+
-+-+-+-+-+-+-+-+-+START DCDIag-+-+-+-+-+-+-+-+-+
The network path was not found..hi,
we have a Windows Server 2008 32bit(dc) with several XP Pro and Windows 7 pro machines . we configured common wallpaper for all user in GPO
The wallpaper shows up fine on the XP ,and win 7 machines but some win 7 pc its showing up as black or whatever the Solid Colors ,while log off time the image will appear. If i switch the user and log on same user its working fine but log off and re log in the same user the wallpaper is blank . please help me to resolve the issue
Arpith shetty
Obviously the software will not be reinstalled on the next reboot/gpupdate.
The questions I have are
# Is this the intended behavior?
# How can I change this behavior?
# What happens internally?
Thanks for your help and best regards!