We have a 2003 Terminal Server running on Hyper-V VM. DC=2008

Whenever staff connect they always pickup the US style keyboard.

Is there a GP that I can set to force UK keyboard?

Thanks

HP DL120 G6 8GB, 2TB RAID 10, Server 2012 Standard and System Center 2012 SP1 acting as my iSCSI Shared Storage Target and management server HP DL120 G6 16GB, Hyper-V Server 2012, Node1 HP DL120 G6 16GB, Hyper-V Server 2012, Node2

Hiya,

What permissions are actually required on the share used to put the MSI files? I ask as I've had fun and games getting it to work this morning and came across a (non Technet) article saying Everyone:Read is required, but that didn't solve it for me.

So I realised I had changed the folder structure (moved the MSI) after assigning it in the GPO so it now works affter reassigning it, but now I have Everyone:Read still there, do I need it?

Also, maybe this is the wrong forum, but can some explain the difference between the GPO method of deployment and System Center (as we're no running it).

Thanks

Hey TechNet..

I have kind of a problem with Powerpoint 2010.
When I run the presentation in fullscreen, the screensaver doesn't turn on.
The screensaver only works when I use Powerpoint in normal view.

I want the screensaver to run over the powerpoint-presentation, and if someone touches (it's a touch screen) the screen, it should go back to the presentation in full screen.

Does anyone know where to change these settings?

//Rasmus

I have a power settings GPO set with the following settings:

- Turn off the display after 15 minutes

I also have a screensaver GPO that turns on the blank screensaver after 30 minutes.  It's set to display the logon screen on resume.  Users are part of a security group for the 30 minute screensaver.

In Windows XP & Windows 7, this works flawlessly. After 30 minutes the user is displayed the logon screen.  On my Windows 8 computers, I find that the policies & settings are properly applied but the logon screen is displayed after only 15 minutes.  The only thing I have set to 15 minutes is the above GPO to turn off the monitor.

I can't seem to figure out why this is happening.  Any ideas?

I have been told to cross-post on the GP forum from the following thread -http://social.technet.microsoft.com/Forums/en-US/w7itprogeneral/thread/4c3aa24b-f467-4c80-aa23-48f6bf7fe53b/

This is the 2nd repost of this topic (agan requested in the original thread) previous thread is at - http://social.technet.microsoft.com/Forums/en-US/winserverGP/thread/9e30aa6d-633a-4410-b3c0-0ad1e426020a

Hi,

We have been having problems with printers deployed using Group Policy since we migrated to a 2008R2 print server. I do not know if it’s the 2008R2 print server, or the Group Policy deployment or Windows 7 that is causing the issue. We were previously deploying printers by scripting the installation of printers with a 2003R2 server.

So, printers either disappear from the user’s printers and devices completely, or the printer is in the list but not functioning when printing from an application (some users are able to print, but the defaults deployed with the printers driver are not correct). In the case of a printer being in the list but not able to print to, when the printer selected from “Printers and Devices” an error prompts the user either informing them the printer is not available, or that no driver is installed.

The printers do not disappear in any logical method. It can be when the user first logs in in the morning or they could have just printed a document and when printing another document immediately after, the printer is missing.

They are deployed in a user policy, and “Applying group policy printers policy” happens at logon. A “gpupdate /force” will reinstall the printers without issue, as we have them ordered as “1 – Delete All” followed by 24 printers that are marked with the action to “Update”. They are targeted by the PC’s security group therefore deployed by location. Running “gpupdate /force” with the “Printers and Devices” open you can see it perform the tasks as set in the policy.

I have seen similar issues with the Group Policy mapped drives disappearing, as well as intermittent loss of redirected desktop (for which a refresh restores all icons).

I have followed the following KB articles, and had no luck with any of them resolving the problem.

Mapped Drives -http://support.microsoft.com/kb/297684

Network Cards Sleeping -http://support.microsoft.com/kb/837058

Redirected Folders and Home Drives Disappearing -http://support.microsoft.com/kb/981872

Network Locations and UAC -http://support.microsoft.com/kb/937624

As I cannot replicate the problem due to the nature in which the printers disappear, I cannot open a support request. Any progress in discovering what this issue is would be greatly appreciated, as many of my users are getting frustrated with the need to perform “gpupdate /force” or a log off/on to resolve the issue.

I also noticed the following post when setting up this request, however from reading the details it only applies to Server 2003R2 Print servers, and was resolved in 2008R2 - http://social.technet.microsoft.com/Forums/en/w7itpronetworking/thread/7ab3e2a9-832c-4504-8d97-c7199bcc207e

Clients are Windows 7 Enterprise SP1 (both x86 and x64), server is a Hyper-V 2008R2 SP1 virtual machine on a Server 2008R2 SP1 Hyper-V host. The problems also existed before SP1.

From the previous post’s recommendations are the following updates.

Update 1 – Test with Windows XP

OK. We have a Windows XP machine up and running and will hopefully get some results today / tomorrow.

I have picked up the following Event Logs from a few people's machines that experience the problem, the common error seems to be as follows (I lost 1 printer this morning).

The user 'BURSARY-ColourCopier' preference item in the 'User Policy - Base {E1631A9F-2A31-461C-9FDF-BCD42202FBA4}' Group Policy object did not apply because it failed with error code '0x8007000a The environment is incorrect.' This error was suppressed.

The user 'ACCOUNTS-Laser' preference item in the 'User Policy - Base {E1631A9F-2A31-461C-9FDF-BCD42202FBA4}' Group Policy object did not apply because it failed with error code '0x8007000a The environment is incorrect.' This error was suppressed.

These are two completely difference printers, the Bursary machine is a Sharp MX-3100n MFP, the Accounts machine is a Kyocera FS-6970DN Laser. Not sure if they are of any use, googling them only recommends enabling "wait for network at computer startup" and disabling Fast user switching. Which we already have in place.

Update 2 – XP Machine Update

XP machine running fine so far.

I have lost our office printer (HP LaserJet P2055dn) @ 10:37 (having logged on at 8.55am and not left my machine all morning).

The user 'ITSUPPORT-Laser' preference item in the 'User Policy - Base {E1631A9F-2A31-461C-9FDF-BCD42202FBA4}' Group Policy object did not apply because it failed with error code '0x8007000a The environment is incorrect.' This error was suppressed.

My colleague has lost the photocopier (SHARP MX-3100n) @ 10:40 (having logged in at 8.50am and not left the machine all morning)

The user 'BURSARY-ColourCopier' preference item in the 'User Policy - Base {E1631A9F-2A31-461C-9FDF-BCD42202FBA4}' Group Policy object did not apply because it failed with error code '0x8007000a The environment is incorrect.' This error was suppressed.

Strange thing is I have not lost the BURSARY copier, and my colleague has not lost the ITSUPPORT laser.

Update 3 – Recommended to enforce “RemovePrintersAtLogoff”

Had a printer go missing first thing this morning dispite the RemovePrintersAtLogoff being defined.

The user 'BURSARY-ColourCopier' preference item in the 'User Policy - Base {E1631A9F-2A31-461C-9FDF-BCD42202FBA4}' Group Policy object did not apply because it failed with error code '0x8007000a The environment is incorrect.' This error was suppressed.

I will deploy another reg entry to disable the "Asynchronous RPC" and see if that makes a difference.

Update 4 – Recommended to remove Asynchronous RPC on Clients

Having applied the Asyncronous RPC reg entriy (as below) -

Windows 7 will try to communicate to the print server via the Asynchronous RPC protocol, to disallow the use of the Asyncronous RPC protocol on the client, configure the following registry value:

Path: HKLM\Software\Policies\Microsoft\Windows NT\Printers\EnabledProtocols

Type: DWORD

Data: 6

At 13:16 today I got the following Event

The user 'BURSARY-ColourCopier' preference item in the 'User Policy - Base {E1631A9F-2A31-461C-9FDF-BCD42202FBA4}' Group Policy object did not apply because it failed with error code '0x8007000a The environment is incorrect.' This error was suppressed.

Printer is missing from my Devices and Printers list. Running a "GPUpdate /force" and everything returns to normal.

Hopefully we can get to the bottom of this soon,

Many thanks,

Simon Roberts

Hi All,

If I have an RSOP from a computer from a different domain and I wish to see the results is it possible to open it

The reason I ask is that a friend gave me a report run from his machine, but when I try to open it through the snap-in, the only result I get is from my local PC. What I want to see is the settings from his machine and not from mine. Can this be done?

Failing that, does there exist a Windows 7 config template, that would cover the basics that should be set for any machine in any given organisation?

Any help would be greatly appreciated.

Hi,

We want to restructure / cleanup AD and want to find duplicate settings in GPO's.

Please advise the best way possible.

Regards

Hi all,

I have a company (+70 users). A few of them need to install updates of a specific program. Normaly I would go and install the update for them, but there are updates of the program every week and it needs to be up to date as fast as possible. So I created a group in active directory and gave full rights to the folders where the program is installing. But when I start the installer its still asking for an administrator password. I contacted the company who made the software and they confirmed that I give the correct rights to the correct folders.

My guess is that I need to give them some rights in gpo to, but I don't know what exactly. Can somebody help me? Thanks!

Orange County District Attorney

Hi all,

I have a company (+150 users) and I would like  to allow users to update Java, FLASH and Adobe Reader only.

These software are already installed in the hosts, but there are updates of the program every week and it needs to be updated.

How can I give permissions to every user in the domain to do that? Just "Java, FLASH and Adobe Reader"

Remember that I dont want distribute software because they were installed.

I tried to enable "Enable user to patch evelated products" directive but it didn't work at my domain.

is it possible?

ISSUE: Group Policy processing isn't working when using cross forest authentication, works fine with local accounts in Forest B. Today can we logon a Windows 7 client in Forest/Domain B with user accounts in the single domain forest B and multidomain forest A but the GP processing isn't being executed when logon with cross forest trust user accounts. So with cross forest authentication do we get a Windows 7 desktop without the needed restriction that the computer GP should have set.

Description:

Implementing a new system in a segregated network with it's own single domain Forest B with 2 DCs.
Windows 7 clients and Windows 2008 R2 DCs and application servers.
Loopback replace is defined so that all GP have to be defined in Forest B.

One way cross forest trust: Forest B with computer resources trust in Forest A with user accounts.

Forest A is a multidomain environment based on Windows 2003 (30 DCs in the root, 80 DCs in subdomain A1 and 40 DCs in subdomain A2, there are other subdomains but they are not involved in the solution).

Using conditional DNS forwarder cross the forests.

We have managed to activate the one way trust between all 2 DC in Forest B with 30 root DCs in Forest A, all top DC have full ip connectivity on all ports for the transitive design.

Forest A with AD functional level 2003 and Forest B with AD functional level 2008.

Logon and GP processing works perfect on the Windows 7 client when using an user account in the Forest B.

The symptoms is that when using an user account in subdomain A1 or A2 in Forest A to logon to the Windows 7 client (in the segregated network with forest B) is that we see error messages in the Pre-Authentication phase.

Windows 7 is by default using AES and my expectations were that the negotiation would have solved this via the AS_REQ / AS_REP negotiations.

.

Today can I see in the gpevent log that the winlogon process tries 4 times to retrieve user account information but fails.

I have spent several days searching but without finding the right perfect workaround (have found many threads about DES encryption of Kerberos but our corporate system uses RC4 in Forest A).

The gpevents records below is when we manage to logon to the Windows 7 client using cross forest trust but the Forest B GP processing isn't working with the Loopback replace mode as expected.
The response time are rather short 0-1 seconds so I do expect that the DC in the local Forest B is responding but why isn't the GP executed as with the Forest B user account?

### Login with Domain-A1 account

2012-12-06 09:56:37.993 4001 14a33e7d-06a2-4c03-85a8-c4d061b42e54 Starting user logon Policy processing for Domain-A1\User-je.                                                                   Activity id: {14A33E7D-06A2-4C03-85A8-C4D061B42E54}
2012-12-06 09:56:37.993 5320 14a33e7d-06a2-4c03-85a8-c4d061b42e54 Attempting to retrieve the account information.
2012-12-06 09:56:37.993 4017 14a33e7d-06a2-4c03-85a8-c4d061b42e54 Making system call to get account information.                                                                  
2012-12-06 09:56:37.993 7017 14a33e7d-06a2-4c03-85a8-c4d061b42e54 The system call to get account information completed.                                                                                                                                    
The call failed after 0 milliseconds.
2012-12-06 09:56:37.993 5320 14a33e7d-06a2-4c03-85a8-c4d061b42e54 Retrying to retrieve account information.
2012-12-06 09:56:38.508 4017 14a33e7d-06a2-4c03-85a8-c4d061b42e54 Making system call to get account information.                                                                  
2012-12-06 09:56:38.508 7017 14a33e7d-06a2-4c03-85a8-c4d061b42e54 The system call to get account information completed. 
The call failed after 0 milliseconds.
2012-12-06 09:56:38.508 5320 14a33e7d-06a2-4c03-85a8-c4d061b42e54 Retrying to retrieve account information.
2012-12-06 09:56:39.023 4017 14a33e7d-06a2-4c03-85a8-c4d061b42e54 Making system call to get account information.                                                                  
2012-12-06 09:56:39.023 7017 14a33e7d-06a2-4c03-85a8-c4d061b42e54 The system call to get account information completed.  The call failed after 0 milliseconds.
2012-12-06 09:56:39.023 5320 14a33e7d-06a2-4c03-85a8-c4d061b42e54 Retrying to retrieve account information.
2012-12-06 09:56:39.538 4017 14a33e7d-06a2-4c03-85a8-c4d061b42e54 Making system call to get account information.                                                                  
2012-12-06 09:56:39.538 7017 14a33e7d-06a2-4c03-85a8-c4d061b42e54 The system call to get account information completed.  
The call failed after 0 milliseconds.
2012-12-06 09:56:39.538 7320 14a33e7d-06a2-4c03-85a8-c4d061b42e54 Error: Retrieved account information. Error code 0x54B.
2012-12-06 09:56:39.538 7320 14a33e7d-06a2-4c03-85a8-c4d061b42e54 Error: Failed to register for connectivity notification. Error code 0x4CE.
2012-12-06 09:56:39.538 7001 14a33e7d-06a2-4c03-85a8-c4d061b42e54 User logon policy processing failed for Domain-A1\user-je in 1 seconds.
2012-12-06 09:56:39.538 5315 00000000-0000-0000-0000-000000000000 Next policy processing for Domain-A1\User-je will be attempted in 95 minutes.
2012-12-06 09:56:39.538 7320 14a33e7d-06a2-4c03-85a8-c4d061b42e54 Error: Failed to register for connectivity notification. Error code 0x4CE.
2012-12-06 09:56:39.538 1053 14a33e7d-06a2-4c03-85a8-c4d061b42e54 The processing of Group Policy failed. Windows could not resolve the user name.
         This could be caused by one of more of the following:
                                                                        a) Name Resolution failure on the current domain controller.
                                                                        b) Active Directory Replication Latency (an account created on another domain controller has not replicated to t

 Anyone recognizing the symptoms or have recommendation to share.

/Stefan

Hi! Two problems:

1) I recently reorganized the shared folder structure. Now that the old folders are empty they should be removed. The problem is, some of these old folders are syncronized (as offline folders) on the endpoints (in\\SERVERNAME section) and I haven't figured out how to undo the syncing configuration. So, the folders are in online mode and connected to servers but folders are syncronized. I have deleted the old folders' sync setting in GPO (User Config: Adminly assigned offline files), but these folders are still synced on the endpoints. I have even tried to remove some user profiles and then logged them on again; Windows still configures these folders as syncronized. If I delete one share, the folder naturally goes in offline mode and still appears on the endpoints.How can I force the old shares as "not syncronized" in GPO so I can delete them so that they correctly disappear on the endpoints as well (in\\SERVERNAME section) and Windows doesn't try to sync them anymore?

2) I have earlier removed some deployed software in GPO. The software didn't remove on the endpoints (= Windows logs say the software failed to remove). After that I've succesfully installed the same software again and it works perfectly. Windows still seems to try to remove the old version on every startup... Is there any way to "tell" Windows not to try to do it anymore :P

Thank you for your replies already beforehand :) / Aleksi

I have a group policy that maps shared printers from two different print queue servers. Server A hosts HP printers and has the HP UPD 5.4 driver for it's queues and Server B hosts Konica Minolta copiers with at least 8 different drivers. Both servers A and B have the x64 and x86 drivers installed for clients. The queues from Server A map with no problem, but the queues from Server B do not map. Clients' Application Logs show the following error.

I've spent almost a 3 days trying to figure this out (which is apparently not a lot compared to what others have spent). I've read a lot of technet forums and blogs, it seems lots of others havehad this issue. Their issues have been fixed by updating 'Point and Print Restrictions' to State = Disabled. I've done this but still I experience the issue (see below).

I've verified replication with repadmin /replsum and all is OK. I've also browsed to the sysvol paths on each of my DCs for this policy and all is in sync (at least by time stamp anyway). 

e.g.

Some forums\blogs suggested the print processor to be the culprit. I've tried changing Server B's queues to use WinPrint, but still no luck. Below is my GPP setup, only the bottom Server A mapping works.  

A few things that do work. 1) Manually mapping the print queues from Server B works fine. If I then disconnect the printer and run gpupdate, Server B's print queues map fine. 2) Starting from scratch on a new machine, if I use the Deploy Printer GP (user config\windows settings\deployed printers) will successfully map Server B's queues. While that is a solution, there are some features sets (i.e default printer) of GP Preferences I'd like to use.

Not sure what else to try, thanks for the help! 

Hi

We currently have a majority Windows XP SP3 client estate on a Windows 2003 FL domain

We have recently moved Computer Accounts to another OU and have tried adding GPO to the container.

The one in question is for File Permissions. However, we are finding that the Group Policy does not apply.

When we run a gpresult we get

===============================

An error has occurred while collecting data for Security Configuration Engine (SCE) Extension.

An unknown error occurred while data was gathered for this extension. Details: Invalid class

==============================

We have also enabled verbose logging and find that it says

USERENV(3a0.bc0) 16:10:22:283 ProcessGPO:  Found display name of:  <name>
USERENV(3a0.bc0) 16:10:22:298 ProcessGPO:  Found user version of:  GPC is 0, GPT is 0
USERENV(3a0.bc0) 16:10:22:298 ProcessGPO:  Found flags of:  0
USERENV(3a0.bc0) 16:10:22:298 ProcessGPO:  No client-side extensions for this object.
USERENV(3a0.bc0) 16:10:22:298 ProcessGPO:  GPO <name>doesn't contain any data since the version number is 0.  It will be skipped.

=====================================

We have checked that the Sysvol and AD version are being reported as the same and they are

We have validated that Authenticate Users, Domain Users and domain computers are added in the read and apply

We only want the GPO to be added to the Computers in the given OU

We have linked the OU to the GPO

We have enforced the policy and can see that its applied when we review the Site based policy view

In GPRESULT on the Client I get

===================

    Applied Group Policy Objects
    -----------------------------

<Desired GPO is listed>

    The following GPOs were not applied because they were filtered out
    -------------------------------------------------------------------
        Local Group Policy
            Filtering:  Not Applied (Empty)

    The following GPOs were not applied because they were filtered out
    -------------------------------------------------------------------
   
        <required GPO>
            Filtering:  Not Applied (Empty)

=====================================

Anyone come across this or can help?

KB's that I have referred to

http://support.microsoft.com/kb/942412?wa=wsignin1.0

I had an old GPO that was deploying Java 7 update 9 at a few clients. There was NO check in the "Uninstall when it falls out of the scope..." for the original GPO.

Recently, I created a new GPO pushing the new Java 7 update 11. I just deleted the old GPO but now I'm having problems with the new Java version (getting installation failed). Any ideas why the new Java won't install (even when run directly from the MSI - no GPO involved)?

The new GPO is firing, BTW, it's just not installing. Also the old version seems to be corrupted now...[sigh]

Hi All,

I have a server 2008R2 that has 3 printers connected via  a USB hub.  I have all the Print Role setup and deployed the printer via the GPO.  I also replaced the 'pushprinterconnections.exe' with a 32 bit one to support Windows XP.  Here is my issue when I login with an admin account on the XP machine I can see all three printers with no issue.  That same machine when I login as a user all the printers are listed but say "access denied, unable to connect".   With that same users account I can view the properties of the printer, printer a test page and even print a word doc.  However I am trying to figure out why it says access denied, unable to connect.  I have read all the forums and tried just about every setting mentioned.  If anyone has a solution for this please let me know.

-Brandon

Hi, 

I have CS6 package in .VBS format. Is there a way I can deploy this software using GPO. Can any one explain me in steps?

Thanks very much for your help

Regards,

SNRRK

I had tried to install adobe reader through GPO on my client machines. but that didn't work and was giving some error when I tried to install manually on a machine. removed (deleted) the domain policy object from the domain controller. but the client machines still show that policy when running gpresult /z. I think the machine's startup is slow due they r trying to install the software. how to remove the policy from th clients

Getting the following application event log warnings but can't seem to trace where they are coming from.  Have tried unlinking all GPOs & GPPs but that doesn't seem to stop the warnings.  Any suggestion how we can trace the source of these.

Thanks,

Log Name:      Application
Source:        Microsoft-Windows-Winlogon
Event ID:      6005
Description:
The winlogon notification subscriber <GPClient> is taking long time to handle the notification event (CreateSession).
Additional details:
 Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}"
 EventSourceName="Wlclntfy"

Log Name:      Application
Source:        Microsoft-Windows-Winlogon
Event ID:      6006
Description:
The winlogon notification subscriber <GPClient> took 66 second(s) to handle the notification event (CreateSession).
Additional details:
 Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}"
 EventSourceName="Wlclntfy"