I hear it all the time! You can't apply GPO's to groups or users. GPO's are applied to local PC's, sites, domains and OU's (in that order I might add), but not to groups or users. Well my faithful reader, you can apply them to groups and users too, with a little trickery! In order to follow along I will give you a little background info. I have ...

Group policy is a powerful feature that allows you to secure your domain, control the desktop enviroment, deploy applications and more. There are times when a policy has been edited and needs to be forced. With Windows XP came a new tool called GPUpdate. Using GPUpdate an administrator can enforce the update of group policies manually. Similar to ...

One thing that can speed up Group Policy processing and logins, is to disable the User or Computer portion of a GPO if there are no settings being applied. As an example, if you have a GPO for your an OU that contains only computer accounts, you can disable the User portion of the policy as its setting would not be applied. The same is true for an ...

Using a group policy to deploy software is a god send to those who administer larger Active Directory domains. Imagine having to run around to 100 PC's to install a program, then do it again to update the program, then at least one more time to uninstall it. You won't even get me to do that with 5 PC's if I can use a GPO. While using a group ...

Administrative Templates (ADM) files contain the settings that are applied by a group policy. They are simple files that can be edited or created with a text editor, like Notepad, and you can manage options that are not normally covered in the default group policies. An ADM file is nothing more than a description, a registry setting (or settings), ...

In previous articles I have gone over publsihing applications with Group Policy and assigning applications with Group Policy. Both procedures require applications packaged as MSIs but what if you have an EXE? Non-MSI pacakges can be published to users for automated installations using the native EXE. This is done with .ZAP files. A .ZAP file is a ...

One of the questions I hear often is how to configure roaming profiles and/or folder redirection. The bigggest benefit to roaming profiles and folder redirection is when you replace a user’s workstation for an upgrade or repair. When the user logs on to their new PC their profile will be loaded from the network share and you won't have to worry ...

Assigning an application is a similar process to publishing, but has a few other options you can select. When assigning an application, you can assign it too a user or computer, and you can automatically install it upon logon. To start lets create a new GPO to install Mozilla Firefox. Drill down to User Configuration | Software Settings and ...

Imagine having to install an application to 1000 computers manually, then upgrading that application in a few months! Not fun, luckily we can publish (or assign) applications via group policy. Publishing an application to a user (you can't publish to a computer) is a pretty simple task, and will allow a user to install or uninstall an application. ...

So you set up the Default Domain Policy (or Domain Controllers) and now its hit the fan and you need to get back to the defaults fast! There is a workaround for Windows 2000, but in Windows Server 2003 we can use Dcgpofix which is located in %systemroot%\Repair directory. There are a few prerequisites we need to clear first: must be run on a ...

By default, Windows 2003 Server requires user passwords to meet minimum set complexity requirements including password lengths. A lot of people like short, simple, easy to remember passwords and these just wont work in a Windows 2003 Server unless this option is disabled. Disabling these features allows administrators and users to choose any ...