Tag Archives: gpo

Edit an Group Policy object

If you receive this warning in Group Policy Management, when you are trying to edit an Group policy object:

Failed to open the Group Policy Object. You may not have appropriate rights.

Details:
The system cannot find the path specified.

This warning can happen, when one of the following folders are missing:
  • %SystemRoot%\Sysvol\Sysvol\DomainName
  • %SystemRoot%\Sysvol\Sysvol\DomainName\Policies
  • %SystemRoot%\Sysvol\Sysvol\DomainName\Policies\{GUID}
  • %SystemRoot%\Sysvol\Sysvol\DomainName\Policies\{GUID}\Machine
  • %SystemRoot%\Sysvol\Sysvol\DomainName\Policies\{GUID}\User

In my case, I was missing the Machine folder. I just created that folder, and then i could edit the object again.

Deny Dropbox from running with GPO

Start Group Policy Management Editor
Go to:
Computer Configuration\Policies\Windows Settings\Security Settings\Software Restriction Policies

If you see:

Dropbox1

On the right screen, then you need to right click on Software Restriction Policies, and choice “New Software Restricition Policies” first.

Right click on
Additional Rules, and choice “New Path Rule…”

Path should be:
%AppData%\Dropbox\bin\*.exe
Set security level to Disallowed
Dropbox2

Make a another new Path rule, and set path to:
%AppData%\Roaming\Dropbox\bin\*.exe

Set security level to Disallowed

To update GPO right away:
Run CMD as Administrator, and type: gpupdate /force
Dropbox3

This will update the group policy on the machine this command is run at.

Problems with GPO and mapped network drive and shortcut

Today i have to create a GPO with a shortcut to an already mapped network drive.

Both the Shortcut and the mapped Network drive is created by GPO.

The mapped network drive mapped fine, but the shortcut wasen’t created at all. The Event viewer toll me that that the shortcut could not be created because the file was not found.

Instead of using File System object, i created a URL Shortcut, still to the exe file. This works, but now the icon was a Internet Explorer Icon.

In GPO you can customize the icon, under icon file path

.

 

Howto to Push local administrators into domain member computers with GPO

Security Groups

First create a Security groups in you Active directory. I call it IT-Admins.
And add members to it. There members hive will be granted locally administrators rights on member computers.

Group Policy

Create a GPO in the OU where you member computers is located example call it LocalAdministrators.
Right click “LocalAdministrators” group Policy
2. Expand Computer Configuration\Policies\Windows Settings\Security Settings\Restricted Groups
3. Right click on the white place and choice “Add Group…”
4. Type IT-Admins and press OK
5. Click Add under “This group is a member of:”
6. Add the “Administrators” Group.
7. Add “Remote Desktop Users”
8 OK

Please be aware of change  “Members of this group:” it will override the settings you have made in the group members, when you created the group.