gptalk

[gptalk] new list should be working now! (Darren Mar-Elia)

All- I just wanted to send a quick note to let you know that I think we fixed the problems with the new list-you should have seen a couple of messages appear on it today. If you tried posting to the old freelists.org address in the last couple of days and didn't see your post, please post again to the new list at gptalk@xxxxxxxxxxxxxxxx ...

[gptalk] update on new list problems (Darren Mar-Elia)

Hi Folks- I'm sending this to the old list address. If you sent me an email indicating you did not get the new list welcome message, I have confirmed that everyone's email address made it over to the new list. However, for some reason my test messages (and I suspect subsequent list posts) are not making to the membership. I'm investigating now so hopefully we can get this cleared up quickly. Sorry for the problems. ...

[gptalk] list migration (Darren Mar-Elia)

Hi folks- I'm sending this to the old list. If you did not get my test message from Sunday night, indicating you were cutover to the new gptalk list, please send me an email to my email address (not the list address) indicating that. I will make sure you get cutover. Darren ...

[gptalk] Re: Can i block certain items in CP? (Jake (sanfranjake))

When you are in the control panel restrictions-section you should have an option called Allow access to these control panel applets only. I'd suggest using that. From: gptalk-bounce@xxxxxxxxxxxxx [] On Behalf Of Craig Meyer Sent: maandag 26 januari 2009 13:29 To: gptalk@xxxxxxxxxxxxx ...

[gptalk] Can i block certain items in CP? (Craig Meyer)

Hi all I have a GP that prevent access to the Control Panel for the normal users. There is now a request for the need to access certain options as some of the staff is busy with courses where they want to go into the options and check it out. Is it possible to only open up Regional settings and Fonts for example in CP and still not give access to the rest of the CP? Thanks in advance ...

[gptalk] Re: Lockdown Policy on Terminal Server (Mark Oliver)

Depending on your configuration, it should be something like Separate OU for your TS environment GPO's within the OU set to loopback mode apply to the Terminal Servers User groups directly. -----Original Message----- From: gptalk-bounce@xxxxxxxxxxxxx [] On Behalf Of McDonald, William Sent: Saturday, 24 January 2009 7:39 a.m. To: gptalk@xxxxxxxxxxxxx ...

[gptalk] Re: Lockdown Policy on Terminal Server (Jeremy Saunders)

A far better approach here, in my opinion, is to create three policies... 1) Terminal Server Policy - will only contain the Machine settings, including enabling Loopback processing, and left applied to Authenticated Users. Don't put user settings in this policy. 2) Terminal Server User Policy - will only contain User settings, ...

[gptalk] Re: Lockdown Policy on Terminal Server (Alan and Margaret Cuthbertson)

Hi Bill, It should work the way you are suggesting, however I am guessing that you are using loop back processing and that this is being set in the same policy. If you remove Authenticated Users from the policy then the machine setting to enable loop back policy will also be removed. ...

[gptalk] Lockdown Policy on Terminal Server (McDonald, William)

A TS policy only works for me if it is applied to the Authenticated Users group, but this applies the policy to all users, including administrators, even if I have admins set to deny applying policy. If I apply the group policy to another group, TS_App_Users, and remove Authenticated users or even just uncheck Apply Policy under Authenticated Users, then it won't get applied at all. How is this supposed to work? ...

[gptalk] Re: AD Integrated DNS (Darren Mar-Elia)

Deepu- This is better answered on a different list than one focused on Group Policy. Try the ActiveDir.Org list. Thanks, Darren -----Original Message----- From: gptalk-bounce@xxxxxxxxxxxxx [] On ...

[gptalk] AD Integrated DNS (Deepu)

Hi, I am running an AD Integrated DNS with Windows Server 2003. Now i want to restore the DNS in case of any disaster... So can anybody plz guide me how to do that... I mean to say, how can we take the authoritative restore of AD Integrated DNS? ...

[gptalk] Important info for gptalk list members (Darren Mar-Elia)

Hi Folks- I wanted to send along some important news about the gptalk list. A while back I mentioned that gpoguy.com was migrated over to a much better web platform. Hopefully you've all had a chance to check it out. The platform we are using is the same on that is used by the ActiveDir.Org mailing list and web site. In fact, those folks are now managing gpoguy.com for me. As a result, we are moving this gptalk list over to the list server that is now on gpoguy.com. As a result, the list address is going to change but YOU DON'T HAVE TO DO ANYTHING IF YOU ARE ALREADY A MEMBER OF THE LIST!!! ...

[gptalk] Re: Software restriction (Shane Williford)

Darren ( others), I heard back from my client who has done a week's worth of testing. This is his response: I have spent the week testing every possible scenario for the designated file types and I have come to the conclusion that Windows Media player files can't be blocked!!! The group policy and file types are being applied to the target computer. Group policy logging doesn't indicate any conflicts or obvious problems. All the files which are being blocked are logged in events. No log is generated for file types that should be blocked but are not (ie MP3). ...

[gptalk] Re: Accounts Policy Seting Missing in RSoP and GPMC Reports (Darren Mar-Elia)

Jerry- I've seen these sections missing from GP Editor in the past, but not from RSOP. In the case of GP Editor, usually it meant re-registering the MMC snap-in to fix the issue. From a CSE perspective, there is only one CSE-the security CSE, that does the work and records the RSOP data. I suppose its possible that there are issues with the CSE but short of trying to re-registering scecli.dll, I'm not sure what would help here. It might be worthwhile to see if its just a reporting issue or really a RSOP issue. They can go into WMI directly to find out if the data is being recorded. It's a ...

[gptalk] Accounts Policy Seting Missing in RSoP and GPMC Reports (Cruz, Jerome L)

Howdy folks, I could've sworn I'd heard of this behavior before, but can't put my fingers on a resolution. Hmmm.. Well , here goes, I have a report from a fellow Admin (separate forest) that his RSoP and GPMC based reports on only one DC in a domain are missing the Account Policy settings sections (Account and Lockout settings are missing...apparently Kerberos is there). [Auditors go crazy on things like this....] Anyway, the other DCs in the domain report the data just fine. ...

[gptalk] Re: General Question about Group Policy / Software Deployment. (Nelson, Jamie)

GP is sufficient for doing Software Deployment, but I've never been a very big fan. It is too unreliable in my opinion, and too hard to verify the end result. When using GP to do software pushes I generally bypassed Software Installation Policy altogether and relied on scripted installs/uninstalls via GP Startup/Logon. Generally, larger environments have a configuration management product such as Microsoft System Center ConfigMgr (formerly known as SMS), Altiris, Novell ZenWorks, or LANDesk. These products are specifically for inventory and software deployment and do a much better job than GP ...

[gptalk] General Question about Group Policy / Software Deployment. (Dave Sharples)

Hi, general question really. Do many people still use group policy for pushing out software or have you migrated onto other means. If you use different tools do you have a way of delegating access to other departments (while maintaining overall control) so they can manage their own machines. If still on group policy how do you deal with uninstalling stuff which wasn't part of an MSI (we have an issue where we do a remove policy) but laptops might not be back on the domain for a few months and might miss it Thanks ...

[gptalk] Re: local security policy & local group policy (daniel)

thanks darren. On 19/01/2009, Darren Mar-Elia darren@xxxxxxxxxx wrote: Daniel- Answers inline below ...

[gptalk] Re: local security policy & local group policy (Darren Mar-Elia)

Daniel- Answers inline below. From: gptalk-bounce@xxxxxxxxxxxxx [] On Behalf Of daniel Sent: Sunday, January 18, 2009 4:40 PM To: gptalk@xxxxxxxxxxxxx ...

[gptalk] Re: local security policy & local group policy (daniel)

thanks darren. so if i'm understanding correctly: - the local security policy is a subset of the security section of the local gpo - the local security policy is stored in a database, not a gpo file? where is the db stored exactly? - settings defined in the local security policy can't be viewed/exported using gpmc? only using secedit? ...

[gptalk] Re: local security policy & local group policy (Dave Clapham)

That is all I am after is the configured settings. Don't need the others. I believe I could be happy if I had a printout of the policy settings in expanded view, then I would have paper copy showing me what I should set under computer and under user. If I am working on several different machines with in a few days, I probably can remember them, but if its been a week or two or more, then... I may not. How do I throw it all into a spreadsheet?? ...

[gptalk] Re: local security policy & local group policy (Cruz, Jerome L)

The problem is that the RSoP.msc and GPMC reports only display 'configured' settings delivered from GPOs, not all the settings that exist. [Even the Security Config and Analysis Snap-in is limited in this manner.] That said, there is a local security settings dump utility called Secedit. For Windows Server 2003, you can use the following command line in a CMD prompt to dump the info: secedit /export /cfg secdump.inf ...

[gptalk] Re: MS Outlook 2003 Option (Darren Mar-Elia)

You can try downloading the ADMs for Office 2003 from the MS download site but I don't know offhand if that setting is exposed. Otherwise you could try running Process Monitor against it while making the setting to capture the underlying reg value change and then create a custom ADM (or use GP Preferences Registry policy) to deploy it. Darren -----Original Message----- ...

[gptalk] Re: local security policy & local group policy (Darren Mar-Elia)

No, sadly it won't. I don't recall if RSOP.MSC has any kind of export capability but you might try that. Darren From: gptalk-bounce@xxxxxxxxxxxxx [] On ...

[gptalk] Re: local security policy & local group policy (Dave Clapham)

Will it still do that for those computers that aren't part of the domain? From: gptalk-bounce@xxxxxxxxxxxxx [] On Behalf Of Nelson, Jamie Sent: Friday, January 16, 2009 1:51 PM To: gptalk@xxxxxxxxxxxxx Subject: [gptalk] Re: local security policy local group policy ...

[gptalk] Re: local security policy & local group policy (Nelson, Jamie)

[gptalk] Re: local security policy & local group policy (Dave Clapham)

I tried the gpresult /z gp.txt but it didn't give the me desired results. Its close but doesn't drill down deep enough to tell me the policy name, etc.. So does anyone make something that will tell me what policies have been set? I would prefer a free solution but that doesn't look very promising. So how about payware?? ...

[gptalk] MS Outlook 2003 Option (Deepu)

Hi All, I am using Microsoft Outlook 2003 with sp3. Now i dont want my users to allow them changing their passwords by going to the tools - options - Other- Advanced options - custom forms... So, is there any group policy or any adm/registry file to achieve this... ...

[gptalk] Re: local security policy & local group policy (Darren Mar-Elia)

Daniel- If you are talking about the Local Security Policy shortcut that you see in Administrative Tools, then that is simply an MMC snap-in tool focused on the security portion of the local GPO. So you are essentially looking at a subset of the Local GPO. That being said, security policy on the local GPO is made against the live system, instead of being stored in settings files like it is for other local GPO settings. That makes it somewhat special and often troublesome to manage. ...

[gptalk] local security policy & local group policy (daniel)

hi all, simple question. what is the difference between the local security policy and the local group policy? daniel. ...

[gptalk] Re: local group policy (Dave Clapham)

Thanks Darren for the info. I will give that a try when I am over there next. I tried some options with gpresult yesterday but couldn't get the /z switch to work. But it seems to be working today. Maybe I had \ instead of / Thanks Dave ...

[gptalk] Re: local group policy (Minesh Pandya)

Try using gpresult and output to a txt file. Sent from my iPhone On 15 Jan 2009, at 18:53, Dave Clapham daveclapham@xxxxxxxxxxxx wrote: I am needing a way to view and print for comparisons sake the enabl ...

[gptalk] Re: local group policy (Darren Mar-Elia)

Dave- Unfortunately, this is really tough to do. There's no export capability on the local GPO. The best you can hope for is, if you don't have any domain-based GPOs applying to these computers, then you can do an RSOP report against each machine, perhaps using gpresult.exe with the /z option. Then you can take the output of those reports and use that to do your comparisons. The thing to keep in mind would be that the local security settings will not be reported reliably in many cases, because they do not generate RSOP data. ...

[gptalk] local group policy (Dave Clapham)

I am needing a way to view and print for comparison's sake the enabled and disabled polices on the local workstation (XP Pro SP3). I have entered local policies using gpedit.msc. Just wanting to make sure I have the same polices on different machines. ...

[gptalk] Re: ADM to Excel tool (tamerm)

The ling to download this tool is not working at all. The file that Ricky sent is a good working one. Thanks Tamer ...

[gptalk] Re: ADM to Excel tool (tamerm)

Thanks Ricky. The one you sent is working great. Thanks again. Tamer ...

[gptalk] Re: ADM to Excel tool (Mark Boeck)

the get it here download from works... will try it out. thx! On Sun, Jan 11, 2009 at 12:30 PM, Rickym61 rickym61@xxxxxxxxx wrote: hi Darren, It does the following This cool little executable from a member of Microsoft's Dutch DPE Group ...

[gptalk] Re: ADM to Excel tool (Rickym61)

hi Darren, It does the following This cool little executable from a member of Microsoft's Dutch DPE Group lets you read an ADM file, and it converts the contents to an Excel spreadsheet. It also appears to read whether the settings in ADM file have been set on the machine where the tool is run--documenting which policies have been implemented. Pretty cool! Get it here ! ...

[gptalk] Re: ADM to Excel tool (Darren Mar-Elia)

Let me see if I can contact the owner to see if its still around. Refresh my memory-what does this tool do (been a long time since I looked at it)? Also, while you can't post the file to the list, its probably ok to email it to someone, given that it's a free tool. ...

[gptalk] Re: ADM to Excel tool (Rickym61)

I have it, but the list doesn't let me send it. BANNED CONTENTS ALERT Our content checker found banned name: multipart/mixed | text/plain,.zip,rebuilt.adm2excel.txt | .exe,rebuilt.adm2excel/adm2excel.exe in email presumably from you to the following recipient: - gptalk@xxxxxxxxxxxxx ...

[gptalk] ADM to Excel tool (tamerm)

I was looking in the free tool library of the gpoguy.com and try to download the ADM to Excel tool but the DPE Group had removed it. Could anyone share this tool with us? Thanks ...

[gptalk] Re: Delete a Custom ADM policy (Alan Cuthbertson)

Hi Tamer, I think Darren's web site covers it well... cleID/5/PageID/5/Default.aspx ...

[gptalk] Re: Delete a Custom ADM policy (tamerm)

Thanks Allan for the help you provide to me. Is there any documentation about the Tattooed policy as I try to search the net for more info and did not find any. Thanks again Tamer ...

[gptalk] Re: Delete a Custom ADM policy (Alan Cuthbertson)

Hi Tamer, Because the key is System\CurrentControlSet\Control\Terminal Server it is considered a Tattooed policy and so by default it is hidden in GPMC. On a Windows 2000 workstation, to see tattooed policies you must select ...

[gptalk] Re: Software restriction (Shane Williford)

Thanks Darren. I'll have them try that and see what we can see... Shane M. Williford Systems Administrator MCSE, MCSA Sec, Sec+, Net+, A+ Mazuma Credit Union 9300 Troost Kansas City, MO 64131 shane.williford@xxxxxxxxxx 816-361-4194 x6012 ...

[gptalk] Re: Software restriction (Darren Mar-Elia)

Shane - One thing you can try is to have them enable Software Restriction Policy logging on their client machines. That will create a log that will show whenever an execution passes or fails a rule, and which rule was involved. Its hard to say why those are not getting blocked but my suspicions are that the rule in use may not be capturing the right thing. ...

[gptalk] Re: Software restriction (Shane Williford)

Darren/All, After further testing by my client, he states that all files are placed in the Designated File Types area and that: MP3, AVI, WAV, WMA, ZIP, PDF file types are not getting blocked. Other files types (i.e. DOCX, CSV, DOC, TXT, etc) are getting blocked. Hmmm..not sure why that is...any other suggestions? Thanks. Shane M. Williford ...

[gptalk] Re: Delete a Custom ADM policy (Darren Mar-Elia)

So, where in GPMC are you looking for it? In the Settings report on the GPO? If so, then you might find it under Extra Registry Settings Darren From: gptalk-bounce@xxxxxxxxxxxxx [] On ...

[gptalk] Re: Delete a Custom ADM policy (tamerm)

Darren, The issue now is not delete the key as I manage to do so by changing the value in GP to not configured and then remove the ADM itself. The issue now is that when I correct the key in the ADM file and add it to the GP, I cannot see the item at the GPMC at all. Thanks ...

[gptalk] Re: Enabling HTTP 1.1 Through Proxy Connections option in IE with Group Policy (Reza Alikhani)

Thanks a lot. ------------------------------------------------ Reza Alikhani Microsoft Certified Network Engineer + Security (MCSE+Security) Cisco Certified Network Associate (CCNA) ------------------------------------------------ --- On Fri, 1/9/09, Darren Mar-Elia darren@xxxxxxxxxx wrote: From: Darren Mar-Elia darren@xxxxxxxxxx ...