Questions on ADMX in Windows XP and Windows 2003 environments

We had a question a couple of days ago about the usage of ADMX template formats in Windows XP/Server 2003 environments. Essentially the question was: “…What’s the supported or recommended way of getting W2k8 ADMX templates applying in a W2k3 domain with or with no W2k8 DCs. What I’ve done in test is, created a…


Locking down AGPM for least privilege

I actually wrote this post awhile ago on my blog and forgot to cross post this to the GP blog. Bad me…though I have updated it recently with new information! Essentially its the minimum permissions you need to run AGPM without Domain Admins access given to the service account… Hope this helps!  Michael Kleef, Program…


Group Policy in Windows 7

PowerShell! The name alone should get you excited. Wait until you see all the cool stuff you can do with PowerShell in the Windows Server 2008 R2 and Windows 7 release of the Group Policy management tools. For those of you who have yet to learn PowerShell, hopefully this will help motivate you. You will…


Do I need to update my server to support new policies? When do I need to separate policies?

I just blogged about this very question over on my blog. Essentially the question we hear a lot is do I need to update Schema/Active Directory/Servers/functional modes etc to support a new client OS version. I wont revisit that Sometimes theres a need to separate policies for specific OS functions but not to “update” them….


Troubleshooting: Quick Fixes

  Everyone has their own troubleshooting quick checks; here are some that you may know well, and others you haven’t tried yet.   Logon/Logoff    Some policies applied only after the second logon, not after the first logon. What’s the deal?  Anything that is set to run synchronously won’t run until after the second logon….


AGPM 3.0 doesnt preserve all the Deny ACEs

We had a great customer question today on AGPM 3.0 that would probably interest quite a few of you using AGPM.   “…A customer imports some GPOs [into AGPM] in order to change control them. Some of the GPOs have Deny permission for particular users’ that have administrative rights or similar. After changing the GPOs with…


Red / Green Underlining continued: Using Preferences to set IE settings like preference, or like policy

How to: use F5-F6-F7-F8 to control what settings you want pushed out, lock down the Advanced tab with a preference setting to act like policy   Last time I talked about how to use F5-F8 keys to use the glanularity that we love so much about Preferences.  Now, time for an example of using GP Preferences, then creating a…


Restoring Default Domain Policies and SYSVOL to their defaults

We have stated a number of times through a number of forums that its not a great practice to muck around with the Default Domain Policy and the Default Domain Controllers Policy. In fact its actually a really bad practice…same goes with the SYSVOL. Just dont screw around with it. We recommend if you want…


Red / Green: GP Preferences doesn’t work even though the policy applied and after gpupdate force

I set a Preference setting, but it didn’t work.  The answer? Probably F5-F6-F7-F8.   GP Preferences has a ton of compelling reasons to use it; the functionality allows admins to configure settings that are difficult to impossible to achieve through policy (deploying shortcuts, setting up drive maps, managing devices…) and the configuration UI is eerily…


PolicyMaker Preferences Migration tool

To keep you in the loop, many of you have asked whether we intend to provide support for PolicyMaker Preferences and migrate to Windows Server 2008’s Group Policy Preferences.   I can confirm we are currently testing a tool that will be able to perform this migration. We are pleased with the quality of the…