Group Policy (Active Directory) - Revision history

Sstrutt: /* Common Policy Paths */ Added "Remote Desktop"

2013-09-19T15:28:05Z

Common Policy Paths: Added "Remote Desktop"

← Older revision		Revision as of 15:28, 19 September 2013
Line 65:		Line 65:
	! [[#Internet Explorer\|Proxy]]		! [[#Internet Explorer\|Proxy]]
	\| User Configuration<nowiki>\|</nowiki> Policies <nowiki>\|</nowiki> Windows Settings <nowiki>\|</nowiki> Internet Explorer Maintenance <nowiki>\|</nowiki> Connection <nowiki>\|</nowiki> Proxy Settings		\| User Configuration<nowiki>\|</nowiki> Policies <nowiki>\|</nowiki> Windows Settings <nowiki>\|</nowiki> Internet Explorer Maintenance <nowiki>\|</nowiki> Connection <nowiki>\|</nowiki> Proxy Settings
			\|-
			! Remote Desktop
			\| Computer Configuration <nowiki>\|</nowiki> Polices <nowiki>\|</nowiki> Administrative Templates <nowiki>\|</nowiki> Windows Components <nowiki>\|</nowiki> Remote Desktop Services <nowiki>\|</nowiki> Remote Desktop Session Host <nowiki>\|</nowiki> Connections
	\|-		\|-
	! [[#Screen_Saver\|Screen Saver]]		! [[#Screen_Saver\|Screen Saver]]

Sstrutt: /* Group Policy Object (GPO) Examples */ Added Fonts

2013-09-11T11:49:32Z

Group Policy Object (GPO) Examples: Added Fonts

@@ Line 120: / Line 120: @@
 # Put your background file on a share that can be read by all
 # Configure a rule to copy the file to the local machine
-## <code> Computer Configuration <nowiki>|</nowiki> Preferences <nowiki>|</nowiki> Windows Settings <nowiki>|</nowiki> Files </code>
+#* <code> Computer Configuration <nowiki>|</nowiki> Preferences <nowiki>|</nowiki> Windows Settings <nowiki>|</nowiki> Files </code>
-##* EG ''Source'' - <code>\\file-svr\priv$\Branding\MyCompany_1680x1050.jpg</code> - update as required
+#** EG ''Source'' - <code>\\file-svr\priv$\Branding\MyCompany_1680x1050.jpg</code> - update as required
-##* EG ''Destination'' - <code>C:\Backgrounds\MyCompany_1680x1050.jpg</code> - note that you must specify the filename, even if its unchanged by the copy
+#** EG ''Destination'' - <code>C:\Backgrounds\MyCompany_1680x1050.jpg</code> - note that you must specify the filename, even if its unchanged by the copy
 # Configure a rule to update the registry
 ## <code> User Configuration <nowiki>|</nowiki> Polices <nowiki>|</nowiki> Administrative Templates <nowiki>|</nowiki> Desktop <nowiki>|</nowiki> Desktop</code>
@@ Line 157: / Line 157: @@
 #* Links (which appear in the Favorites bar above the webpage in IE, if viewable) can be added to the '''Links''' section
 #* Don't check ''Delete existing Favorites and Links, if present'' unless you're sure users won't have their own links there already
 [[Category:Microsoft]]
 [[Category:Windows]]
 [[Category:Active Directory]]

Sstrutt: /* Filter by Security Group */ Fix typo

2013-09-10T11:08:33Z

Filter by Security Group: Fix typo

← Older revision		Revision as of 11:08, 10 September 2013
Line 29:		Line 29:
	=== Filter by Security Group ===		=== Filter by Security Group ===
	To only apply to certain to groups		To only apply to certain to groups
	# On the '''Scope'' tab, within the '''Security Filtering''' field		# On the '''Scope''' tab, within the '''Security Filtering''' field
	# Remove the ''Authenticated Users'' groups		# Remove the ''Authenticated Users'' groups
	# Add the appropriate groups		# Add the appropriate groups

Sstrutt: /* Policy Application */ Added "Filter by Security Group"

2013-09-10T11:07:36Z

Policy Application: Added "Filter by Security Group"

@@ Line 26: / Line 26: @@
 To see the results of the last refresh (open the created HTML file)
 * <code> gpresult /H GPreport.html </code>
 == Policy vs Preference ==

Sstrutt: /* Getting Started */ Added "Precedence"

2013-08-30T16:40:38Z

Getting Started: Added "Precedence"

← Older revision		Revision as of 16:40, 30 August 2013
Line 34:		Line 34:
	* Preferences		* Preferences
	** Are applied, but can be changed by the user. However they will be applied when the policy refreshes, unless the ''Apply once and do not reapply'' is selected		** Are applied, but can be changed by the user. However they will be applied when the policy refreshes, unless the ''Apply once and do not reapply'' is selected

			== Precedence ==
			Policy's that get applied 1st (have a lower Precedence number when viewed in the ''Group Policy Inheritance'' tab of an OU) overrule any subsequent policies. Therefore any policy applied to an OU, will take precedence of an inherited rule from a parent OU.

	= Common Policy Paths =		= Common Policy Paths =

Sstrutt: /* Common Policy Paths */ Added "Windows Update"

2013-08-22T10:30:42Z

Common Policy Paths: Added "Windows Update"

← Older revision		Revision as of 10:30, 22 August 2013
Line 53:		Line 53:
	\| User Configuration<nowiki>\|</nowiki> Policies <nowiki>\|</nowiki> Windows Settings <nowiki>\|</nowiki> Internet Explorer Maintenance <nowiki>\|</nowiki> Connection <nowiki>\|</nowiki> Proxy Settings		\| User Configuration<nowiki>\|</nowiki> Policies <nowiki>\|</nowiki> Windows Settings <nowiki>\|</nowiki> Internet Explorer Maintenance <nowiki>\|</nowiki> Connection <nowiki>\|</nowiki> Proxy Settings
	\|-		\|-
	! Screen Saver		! [[#Screen_Saver\|Screen Saver]]
	\| User Configuration <nowiki>\|</nowiki> Polices <nowiki>\|</nowiki> Administrative Templates <nowiki>\|</nowiki> Control Panel <nowiki>\|</nowiki> Personalization <nowiki>\|</nowiki> Enable screen saver		\| User Configuration <nowiki>\|</nowiki> Polices <nowiki>\|</nowiki> Administrative Templates <nowiki>\|</nowiki> Control Panel <nowiki>\|</nowiki> Personalization <nowiki>\|</nowiki> Enable screen saver
	\|-		\|-
	! Security Policy Options		! Security Policy Options
	\| Computer Configuration <nowiki>\|</nowiki> Polices <nowiki>\|</nowiki> Windows Settings <nowiki>\|</nowiki> Security Settings <nowiki>\|</nowiki> Local Polices <nowiki>\|</nowiki> Security Options		\| Computer Configuration <nowiki>\|</nowiki> Polices <nowiki>\|</nowiki> Windows Settings <nowiki>\|</nowiki> Security Settings <nowiki>\|</nowiki> Local Polices <nowiki>\|</nowiki> Security Options
			\|-
			! Windows Update
			\| Computer Configuration <nowiki>\|</nowiki> Polices <nowiki>\|</nowiki> Administrative Templates <nowiki>\|</nowiki> Windows Components <nowiki>\|</nowiki> Windows Update
	\|}		\|}

Sstrutt: /* Getting Started */ Added "Policy vs Preference"

2013-08-07T14:48:41Z

Getting Started: Added "Policy vs Preference"

← Older revision		Revision as of 14:48, 7 August 2013
Line 26:		Line 26:
	To see the results of the last refresh (open the created HTML file)		To see the results of the last refresh (open the created HTML file)
	* <code> gpresult /H GPreport.html </code>		* <code> gpresult /H GPreport.html </code>

			== Policy vs Preference ==
			Within both the User and Computer configuration sections of a GPO are two sub-sections, Policies and Preferences

			* Policies
			** Are enforced on users and cannot be changed or overridden by them
			* Preferences
			** Are applied, but can be changed by the user. However they will be applied when the policy refreshes, unless the ''Apply once and do not reapply'' is selected

	= Common Policy Paths =		= Common Policy Paths =

Sstrutt: /* Logon Screen */ Added note

2013-08-07T14:36:33Z

Logon Screen: Added note

← Older revision		Revision as of 14:36, 7 August 2013
Line 88:		Line 88:
	##* ''Value'' - <code>REG_DWORD 1</code>		##* ''Value'' - <code>REG_DWORD 1</code>

	Note that if a previously customised logon screen exists on target computers, you will need to ~~delete~~ any files that aren't overwritten by the new background files. So in <code> Computer Configuration <nowiki>\|</nowiki> Preferences <nowiki>\|</nowiki> Windows Settings <nowiki>\|</nowiki> Files</code>, create a new entry with the following parameters		Note that if a previously customised logon screen exists on target computers, you will need to ensure that new files are copied over with the ''Action'' field set to '''Replace''' to ensure that they are overwritten, and also ensure that any files that aren't overwritten by the new background files are deleted. To delete, in <code> Computer Configuration <nowiki>\|</nowiki> Preferences <nowiki>\|</nowiki> Windows Settings <nowiki>\|</nowiki> Files</code>, create a new entry with the following parameters
	* ''Action'' - '''Delete'''		* ''Action'' - '''Delete'''
	* EG ''Destination'' - <code>%windir%\system32\oobe\info\backgrounds\background1024x768.jpg</code>		* EG ''Destination'' - <code>%windir%\system32\oobe\info\backgrounds\background1024x768.jpg</code>

Sstrutt: /* Branding */ Minor updates

2013-08-07T13:18:07Z

Branding: Minor updates

← Older revision		Revision as of 13:18, 7 August 2013
Line 70:		Line 70:
	== Branding ==		== Branding ==
	=== Logon Screen ===		=== Logon Screen ===
	The following steps allow a customised logon background, if you have multiple versions of background at different sizes these can all be used. The files need to end up in <code>%windir%\system32\oobe\info\backgrounds\</code> and must follow this naming convention...		The following steps allow a customised logon background, if you have multiple versions of background file at different sizes these can all be used. The files need to end up in <code>%windir%\system32\oobe\info\backgrounds\</code> and must follow this naming convention...
	* <code>backgroundDefault.jpg</code> - Must exist		* <code>backgroundDefault.jpg</code> - Must exist - will be used if no proper fit file can be found
	* <code>background1280x800.jpg</code> - Optional, copy on as many different files as you have different size versions available		* <code>background1280x800.jpg</code> - Optional, copy on as many different files as you have different size versions available, using the appropriate resolution in the filename

			To set-up...
	# Put your background file(s) on a share that can be read by all		# Put your background file(s) on a share that can be read by all
	# Configure a rule to copy the file(s) to the local machine		# Configure a rule to copy the file(s) to the local machine
Line 79:		Line 80:
	##* EG ''Source'' - <code>\\file-svr\priv$\Branding\MyCompany_1680x1050.jpg</code> - update as required		##* EG ''Source'' - <code>\\file-svr\priv$\Branding\MyCompany_1680x1050.jpg</code> - update as required
	##* EG ''Destination'' - <code>%windir%\system32\oobe\info\backgrounds\background1680x1050.jpg</code>		##* EG ''Destination'' - <code>%windir%\system32\oobe\info\backgrounds\background1680x1050.jpg</code>
			##* ''Suppress errors on individual file actions'' - '''Check'''
	# Configure a rule to update the registry		# Configure a rule to update the registry
	## <code> Computer Configuration <nowiki>\|</nowiki> Preferences <nowiki>\|</nowiki> Windows Settings <nowiki>\|</nowiki> Registry </code>		## <code> Computer Configuration <nowiki>\|</nowiki> Preferences <nowiki>\|</nowiki> Windows Settings <nowiki>\|</nowiki> Registry </code>
Line 85:		Line 87:
	##* ''Value name'' - <code>OEMBackground</code>		##* ''Value name'' - <code>OEMBackground</code>
	##* ''Value'' - <code>REG_DWORD 1</code>		##* ''Value'' - <code>REG_DWORD 1</code>

			Note that if a previously customised logon screen exists on target computers, you will need to delete any files that aren't overwritten by the new background files. So in <code> Computer Configuration <nowiki>\|</nowiki> Preferences <nowiki>\|</nowiki> Windows Settings <nowiki>\|</nowiki> Files</code>, create a new entry with the following parameters
			* ''Action'' - '''Delete'''
			* EG ''Destination'' - <code>%windir%\system32\oobe\info\backgrounds\background1024x768.jpg</code>
			* ''Suppress errors on individual file actions'' - '''Check'''

	=== Desktop Background ===		=== Desktop Background ===
Line 98:		Line 105:
	=== Screen Saver ===		=== Screen Saver ===
	# Put your screen saver executable on a share that can be read by all		# Put your screen saver executable on a share that can be read by all
	#* It must be a SCR file - if your screen saver is distributed/installed by an installer (.MSI or .EXE), look at the <code>HKCU\Control Panel\Desktop\SCRNSAVE.EXE</code> to find the .SCR file on a machine running the screen saver		#* It must be a SCR file - if your screen saver is distributed/installed by an installer (.MSI or .EXE), look at the registry entry <code>HKCU\Control Panel\Desktop\SCRNSAVE.EXE</code> to find the .SCR file on a machine running the screen saver
	# Configure a rule to copy the file to the local machine		# Configure a rule to copy the file to the local machine
	## <code> Computer Configuration <nowiki>\|</nowiki> Preferences <nowiki>\|</nowiki> Windows Settings <nowiki>\|</nowiki> Files </code>		## <code> Computer Configuration <nowiki>\|</nowiki> Preferences <nowiki>\|</nowiki> Windows Settings <nowiki>\|</nowiki> Files </code>
	##* EG ''Source'' - <code>\\file-svr\priv$\Branding\CompanyScreenSaver.scr</code> - update as required		##* EG ''Source'' - <code>\\file-svr\priv$\Branding\CompanyScreenSaver.scr</code> - update as required
	##* EG ''Destination'' - ~~<code>~~<code>%windir%\system32\CompanyScreenSaver.scr</code> - note that you must specify the filename, even if its unchanged by the copy		##* EG ''Destination'' - <code>%windir%\system32\CompanyScreenSaver.scr</code> - note that you must specify the filename, even if its unchanged by the copy
	# Configure the following to enable the screensaver		# Configure the following to enable the screensaver
	## In <code> User Configuration <nowiki>\|</nowiki> Polices <nowiki>\|</nowiki> Administrative Templates <nowiki>\|</nowiki> Control Panel <nowiki>\|</nowiki> Personalization		## In <code> User Configuration <nowiki>\|</nowiki> Polices <nowiki>\|</nowiki> Administrative Templates <nowiki>\|</nowiki> Control Panel <nowiki>\|</nowiki> Personalization</code>
	## Set ''Enable screen saver'' to '''Enabled'''		## Set ''Enable screen saver'' to '''Enabled'''
	## Set ''Screen Saver Timeout'' to the appropriate number of seconds, eg <code>900</code> for 15 mins		## Set ''Screen Saver Timeout'' to the appropriate number of seconds, eg <code>900</code> for 15 mins

Sstrutt: /* Getting Started */ Updated

2013-08-07T11:06:57Z

Getting Started: Updated

← Older revision		Revision as of 11:06, 7 August 2013
Line 1:		Line 1:
	= Getting Started =		= Getting Started =
			To start the Group Policy Managment Console (GPMC)...
	# Start <code>mmc.exe</code>		# Start <code>mmc.exe</code>
	# Go to '''File <nowiki>\|</nowiki> Add/Remove Snap-in...'''		# Go to '''File <nowiki>\|</nowiki> Add/Remove Snap-in...'''
Line 6:		Line 7:
	# Right-click and create a new GPO		# Right-click and create a new GPO

	By default group policies are refreshed by client machines every 90 mins, with a random offset of up to 30 mins in order to load balance. Additionally, Computer Configuration policies are refreshed at boot~~, and~~ User Configuration polices are refreshed at login.		== Policy Application ==
			=== Interval ===
			By default group policies are refreshed by client machines every 90 mins, with a random offset of up to 30 mins in order to load balance. Additionally...
			* Computer Configuration policies are refreshed at boot
			* User Configuration polices are refreshed at login

			To change the interval for
			* Computers
			** In <code>Computer Configuration <nowiki>\|</nowiki> Policies <nowiki>\|</nowiki> Administrative Templates <nowiki>\|</nowiki> System <nowiki>\|</nowiki> Group Policy </code>
			** Update ''Group Policy refresh interval for computers''
			* Users
			** In <code>User Configuration <nowiki>\|</nowiki> Policies <nowiki>\|</nowiki> Administrative Templates <nowiki>\|</nowiki> System <nowiki>\|</nowiki> Group Policy </code>
			** Update ''Group Policy refresh interval for users''

			=== Manual ===
	To refresh polices on the current machine		To refresh polices on the current machine
	* <code> gpupdate </code>		* <code> gpupdate </code>
	To see the results of the last refresh (open the created HTML file)		To see the results of the last refresh (open the created HTML file)
	* <code> gpresult /H GPreport.html </code>		* <code> gpresult /H GPreport.html </code>


	= Common Policy Paths =		= Common Policy Paths =