How to use Group Policy to turn off the Backup Notification in the Windows 7 Actions Center

Check out his blog too while you’re at it.

Download

Technet resource

A reference file (in Excel format) for all settings you can get here.

ADML-files are still only for standard languages (de, en, es, fr, it, jp, kr, cn, tw).

http://blogs.technet.com/grouppolicy/archive/2010/02/24/troubleshooting-group-policy.aspx

Use it and develop it further to add you “standard” checks to have your standard procedure.

We all need to troubleshoot Group Policies sooner or later…

Scenario:
Trying to create a shortcut to a fixed drive letter using Group Policy Preference that points to a location on the network. After login there is no shortcut created and if you look in eventlog you see an error “0×80070002 The system cannot find the file specified”. If you run GPupdate /Force the shortcut is created.

This is an issue where it’s trying to create the shortcut before the drive’s are connected and Windows can’t create new shortcuts to locations not connected.

Workarounds:

1. Create the shortcut using UNC-path
2. Create the drives and shortcuts using logonscript
3. Create a scheduled task (using GPP) to run GPupdate after user logon or use logonscript to run GPupdate

Hope someone benefits from this information.

When you do a settings report of a GPO which contains references to an adm-template (not admx-template) and for some reason this adm-template doesn’t exist in the default paths anymore (you may have cleaned them out) you get “Extra registry settings” in the report instead to show these settings.

http://support.microsoft.com/default.aspx?scid=KB;EN-US;981704

Of course the better way is to convert the adm-template to an admx-template instead and use the central store!

http://gps.cloudapp.net/

I think you will have it more easier to find your setting for a GPO here instead of trying to find it in GPO-editor.

Well done!

If you haven’t copied them from your Windows Server 2008 to SYSVOL for management download this package and move it into SYSVOL for all your administrators.

Instructions and everyhing is on the download page which you find here

These Starter GPO’s are recommended settings for Windows XP and Windows Vista. It contains Settings for “Specialized Security— Limited Functionality (SSLF)” and “Enterprise Client (EC)”.

Of course you need RSAT to manage these Starter GPO’s

Download them here

Don’t forget to install Service Pack 1 for Vista first (it’s mandatory).

Windows Vista Service Pack 1

RSAT for Windows Vista x86

RSAT for Windows Vista x64

Knowledgebase Article

http://www.microsoft.com/downloads/details.aspx?FamilyID=A46F1DBE-760C-4807-A82F-4F02AE3C97B0&displaylang=en

This program contains a lot of templates (GPO’s) which are for securing your environment. This to save loads of workhours for securing and preparing a your environment.

Don’t forget to read the documentation and please try the settings on a few computers first before applying to everyone.

http://forums.microsoft.com/TechNet/ShowForum.aspx?ForumID=2023&SiteID=17

If you don’t find the existing forums enough then you can always check and ask you questions also here.

They are now here for XP, Server 2003 and Vista

Download:

Group Policy Preference Client Side Extensions for Windows XP (KB943729)
Group Policy Preference Client Side Extensions for Windows XP x64 Edition (KB943729)
Group Policy Preference Client Side Extensions for Windows Vista (KB943729)
Group Policy Preference Client Side Extensions for Windows Vista x64 Edition (KB943729)
Group Policy Preference Client Side Extensions for Windows Server 2003 (KB943729)
Group Policy Preference Client Side Extensions for Windows Server 2003 x64 Edition (KB943729)

This file contains all Group Policy settings since Windows 2000 so this is the only file you need. For Windows Server 2008 24 new settings are available where 12 of them are for Terminal Services functionallity.

This reference file is also for the new admx/adml-format so to know for sure you can use settings described in this file you need to start using Windows Vista or Windows Server 2008 to configure your GPO’s.

Download the new reference file here (xls and xlsx file available)

This is version 1.2 of this tool and as stated on the download page these are the changes:

• Enhancements and bug fixes to support a wider range of ADM templates for conversion to ADMX.
• Enhancements to code and documentation for conversion error reporting and warnings.
• Improved handling of internationalized ADMX templates.

A first look at the tool and it seems to work as expected. I haven’t tested to convert any adm-files expect a small one which seemed to work just fine. It’s also easy to build your own admx-files using the tool which can be handy when you want to stop creating adm-files in notepad

Picture:

Download the new tool from here

If you have problem with the tool please report it here

You can now benefit here also to have those stored in your Central Store so that you decrease the load for replicating GPO’s between servers etc.

These new templates is of course not with all languages and I wouldn’t be to sure that they will be released either.
The download file also contains an excel-file for reference.

Download the new templates here

At first I wasn’t sure why but then I could see that this package also includes all language files for the admx-files which will make it easier if you have people in different countries all creating GPO’s and they want to create them in their own language. So it’s much easier way to collect the adml-files rater than needing to install different Vista’s just to get the adml-files.

Download the files from here: http://www.microsoft.com/downloads/details.aspx?FamilyID=05d0598b-95f9-4bdd-af36-b365d68ec5f6&DisplayLang=en

The answer is that it won’t install on a localized version but you can install it on an English Windows XP and then transfer the files to your localized version and then run it. The files are located at %ProgramFiles%\GPDBPA\

They don’t guarantee success but you might want to try it (in LAB-environment first of course).

Darren Mar-Elia (MS MVP) has created a GPO logging ADM & ADMX which you can use in a GPO to enable some logging features without having to know where to enable it manually.

It wont help you resolve your problem but it gives you some options on how to troubleshoot depending on what it is.

Find his custom adm/admx here: http://www.gpoguy.com/gpolog.htm

First thing to notice is that SRP is a very powerful tool so try in a test-environment before you apply it to users in production.

First you need to choose your default level which you do at Security Levels:

Default when you start using this, the default level is “Unrestricted” which allows all programs to run. Which means you can use SRP to block specific programs but the power is that you can change this so “Disallowed” is the default level which means you specify which programs you can run (all others are blocked) instead of blocking specific programs.

So to start with change so “Disallowed” is default. Double-click on “Disallowed” and press the button “Set as Default”

This means that all clients affected by this policy now would be able to run anything except what you define as exclusions which you do at “Additional rules”:

As you can see in the above picture you have two default values already included. These two values are registry paths which makes all programs defined in these two registry paths to unrestricted which of course makes them available to run even if you selected “Disallowed” as your default choice in the above selection at “Security Levels”.

There are four different choices on how to enable/disable programs to run:

• Hash-rule
• Path-rule
• Network zone-rule
• Certificate-rule

The normal ones to use is HASH or PATH. HASH is always something you should prefer to use since if the user tries to run a program it looks at the hash-value and evaluates if you can run the program or not. Sometimes when you have different versions of a program for example it might be a problem to use HASH, then you use PATH instead. Also if you don’t have the program installed in the same location on each computer but you know somewhere in the registry where it types the path to the program you can use PATH and use the registry location instead.

I will show you the two ways of allowing Windows Live Messenger to run

Hash:

As what you can see above is that it takes the values from the executable and stores the hash-value of the file. When someone tries to run the program the system evaluates this hash-value and compare it with the one you defined and then selecting if you can run the program or not.

Path:

As you can see above is that you need to select the path to the executable. This path needs to be same on each computer you would like to use this on but of course you can use environment variables as I have done in the above picture. You could also use a registry location if you did know where the path to the program where stored.

You can of course also use this to block programs instead of allowing them. This is not really the preferred method on how to use SRP but fully functional.
On my computer I have “Unrestricted” as my default and I added an application on my desktop named radio.exe as “Disallowed”

So the result if I’m trying to run the file is:

As conclusion you can see that this is a powerful way of giving your users minimal rights in the system with the result that your users will have a large problem messing up the computer

This only covers some parts of SRP. For example local administrators also get these rules but that you can exclude in the “Enforcement” choice and also dll-files are excluded by default but you can change that too. Make sure to try this in a safe environment before applying it to production as you might get a big headache if you have made some wrong turns in setting this up.

This is to include all events etc. for troubleshooting problems with Group Policy.

Here you will find the information: http://technet2.microsoft.com/windowsserver2008/en/library/e695eea4-01c4-429e-8fd1-c98e3ef6f7791033.mspx