Christos Polydorou

Today I'll talk about a change in the group policy processing design that troubled me today. I created a new GPO, configured the settings and the security filtering in order to restrict it to a test users group and then linked in to the domain. The policy however did not apply to all of the users in security group. I started by running gpresult in order to get the status of the GPO for the users on their computers. The GPO was inaccessible. I then double checked the permissions on the GPO just to make sure that the filtering has applied the correct permissions and that there were no deny permissions. Everything was good so far. I fired up the event viewer on the client computer in order to check the events regarding the group policy processing but there were not events regarding my GPO. After a quick check on the SYSVOL and ADSIEdit, I decided to focus on the client side since the GPO applied to some of the users in the security group and discovered the following. Recently, the...

For quite some time now I have users that complain about the Java update notifications and want me to log in and update with my credentials. Since there is not need to have the latest Java version available as soon as possible, I decided to create a group policy object and disable the update notifications and process for all client computers. I will of course continue to update Java on those computers manually. There are two ways to do this, either create a ADM file with the settings or just add the changes as registry settings. I decided to create a new group policy object with just the registry settings. The keys you have to change are different for every combination of processor architecture and java architecture. Thus, you have three cases: x64 Windows and x86 Java Set REG_DWORD with name EnableJavaUpdat e located at HKLM\Software\Wow6432Node\JavaSoft\Java Update\Policy to 0 x86 Windows and x86 Java or x64 Windows and x64 Java Set REG_DWORD with name EnableJavaUpdate lo...

I've had many cases of accidental file and folder deletion the past months and every time I had to search and restore the files/folders from the backups. Restricting the permissions on t he directories didn't seem to be helpful so I did some research. As it turns out, the dialog to confirm the deletion was not displaying. I fired up Group Policy Management Console, opened the group policy object and navigated to: User Configuration - Administrative Templates - Windows Components - Windows Explorer . There's a setting there named Display confirmation dialog when deleting files.  I set it to enabled and now users have to confirm when deleting a file or folder.