User Tools

Site Tools


networking:windows:active_directory:group_policy

Windows Group Policy

Applying Group Policies

:!: You must create Active Directory Organizational Units (OUs) to apply group policies against. You can't apply policies to the built-in AD containers.

:!: Policies apply to either users or computers. Loopback processing can make user policies apply to certain computers.

:!: Group policies often seem not to 'take effect' when you think they should.

:!: Time plays an underestimated role in the activation or roll-out of group policies. Test it again in the morning!

  1. Make the policy change on the domain controller
  2. Run gpupdate /force on domain controller
  3. Run gpupdate /force on workstation computer
  4. Reboot workstation computer
  5. Test the policy

Tools

Use Group Policy Management to manage group policies.

  • Start → Run → gpmc.msc

Use Group Policy Editor to edit a specific Group Policy Object (GPO).

  • Start → Run → gpedit.msc

View resultant policies:

  • Start → Run → rsop.msc

Use the CLI:

https://mashtips.com/how-to-use-the-group-policy-results-gpresult-exe-command-line-tool/

gpupdate /force

gpresult /R

gpresult -H GPResult.html

Check computer group membership:

Get-ADComputer "tucson-svr" -Properties MemberOf

gpresult /scope computer /v

net localgroup

Multiple AD Sites

Group Policies 'flow down', so you may need to Block Inheritance to a container using Group Policy Management.

  • Right-click container → Block Inheritance

Without Windows Servers

Logon as Batch Job

http://technet.microsoft.com/en-us/library/gg563788.aspx

Edit an existing group policy, or add a new one, and add 'Administrators':

Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → User Rights Assignment → Log on as Batch Job

RDS Desktop Backgrounds

:!: By default, background images are not displayed nor can users change the background unless the RDP client is set to 'Lan' or the best connection speed in the client settings.

:!: If you set a solid color background at a fast speed, the setting will 'stick' even when going back to slower connection speeds

:!: You have to have Desktop backgrounds enabled in the client before any of the following server-side stuff will work.

Using Registry

Using Group Policy

Using ADM Templates

networking/windows/active_directory/group_policy.txt · Last modified: 2021/03/18 09:07 by gcooper