Group policy

Tutorials Win: Microsoft Windows Forum

- Previous
  - 1
    - AD site to site Replication Hi, I have one domain more than five sites and there is replication betn them. A DC on one site hardware failed, we get new one and re-install system again. the question is "How to Re-connect this site again to make right replication btwn other sites????" thanks for help, Tag: Group policy Tag: 133657
  - 2
    - Password policy customization Hello, We are to implement a password policy that has several items that are not available via the ADUC --> Windows Settings --> Security Settings --> Account Policies --> Password Policies. We are thinking of: 1. Password must begin with a letter. 2. It must have at least 1 number. 3. Special characters are not allowed and 4. Must not contain consecutively repeating characters like aa or 11 etc. Is there a way to customize this or does anyone know of a 3rd party software that can help us out with this. Thanks for view my post, any help or comment will be appreciated. Jayman. Tag: Group policy Tag: 133656
  - 3
    - Win32 Time Service not running on one of the Win2003 DC i found one of my domain Win2003 DC Win32 Time Service is not running from Active Directore Replication Monitor - > Server Flags note that this is the first DC for that domain & its FSMO Roles was PDC Emulator, Rid Pool, Infrastructure Tag: Group policy Tag: 133652
  - 4
    - Place holder root domain advantage I've been struggling with a domain design to choose. I've always read that it is best practice design to create an empty place holder root domain to hold the enterprise admin group and to hold the forest schema operations role. Then have another domain to hold all users/groups/computers. The alternative being one domain, that holds all of the above. There is obviously additional hardware costs associated with the empty place holder domain, but there isn't going to be much administrative overhead since the domain is going to me basically unused. What are the underlying reasons why the place holder root domain is setup and should this domain design be favored in a large enterprise organization vs the single domain model? Thank you. Tag: Group policy Tag: 133649
  - 5
    - Script to create multiple groups I have to create some 50-60 groups in AD. I found a script in the repository that I could make work for only one group. How can I change to work for multiple groups? I am also adding SAM Account and Description field. Thanks Tag: Group policy Tag: 133635
  - 6
    - Integrate an ADAM directory into AD? Our client uses JICS (a web portal solution by Jenzabar Software) to store user information and authentication in an ADAM directory. They also have a standard AD directory as well. Is there a way to get AD to continuously pull all ADAM data into AD? Or vice versa? Tag: Group policy Tag: 133633
  - 7
    - Upgrade to Vista Ultimate OK, I got Vista Ultimate up & running and looked for "recommended" downloads from Microsoft. After 5 attempts, and getting "install failed" and getting the same code each time, code 8024200D. I then went to the knowledge base and found KB947562. Can anyone tell me what any of this is? Thanks in advance Tag: Group policy Tag: 133631
  - 8
    - Explanation of one script Hi, I have one script (from my collegue) where is stored: (memberof=CN=XXX,OU=YYYY,OU=ZZZZZ,DC=server,D=local) -l Can you please explain me what does mean - CN - OU - OU in this script... DC=server,D=local means local domain name Thnx Tag: Group policy Tag: 133625
  - 9
    - Problem running a script I got a script to set the userAccountControl of all users in an OU to 512. This is the script I am using: ' UserAccountControl .vbs ' Sample VBScript to enable a user account ' Author Guy Thomas http://computerperformance.co.uk/ ' Version 2.0 - May 2005 ' --------------------------------------------------------------' Option Explicit Dim objOU, objUser, objRootDSE Dim strContainer, strLastUser, strDNSDomain, intAccValue ' Bind to Active Directory Domain Set objRootDSE = GetObject("LDAP://RootDSE") strDNSDomain = objRootDSE.Get("DefaultNamingContext") ' Here is where we set the value to enable the account ' 512 = Enable, 514 = Disable. intAccValue = 512 ' -------------------------------------------------------------' ' Important change OU= to reflect your domain ' -------------------------------------------------------------' strContainer = "OU=Users " strContainer = strContainer & strDNSDomain set objOU =GetObject("LDAP://" & strContainer ) For each objUser in objOU If objUser.class="user" then ' The heart of this script - Enable users objUser.Put "userAccountControl", intAccValue objUser.SetInfo End if next ' End of Free Sample UserAccountControl VBScript The problem is when I run it I get a script error "The server is unwilling to process the request." Code 80072035. After doing some research it is pointing to domain policy that is restricting this from running. I have 2000+ users that were imported that have the UF_PASSWD_NOTREQD flag set. I need to do a bulk modify to set all these users to 512. My question is, how do I determine which part of domain policy is stopping this from running so that I can disable it. Or can this be done another way? Thanks Tag: Group policy Tag: 133624
  - 10
    - Server keeps rebooting Dear all, After I added my new windows 2008 domain controller to a windows 2000 domain, it keeps rebooting. I do get my log on screen, I can type in my credentials but when I hit Enter I am not able to log on (no error message) and after a while (30 seconds orso) the server reboots. I can start in save mode and if I look in the event viewer these two messages appear: Faulting application lsass.exe, version 6.0.6001.18000, time stamp 0x47918d7c, faulting module ntdsai.dll, version 6.0.6001.18000, time stamp 0x4791a7a8, exception code 0xc0000005, fault offset 0x0004a191, process id 0x20c, application start time 0x01c8f7037b186ecf. A critical system process, C:\Windows\system32\lsass.exe, failed with status code 255. The machine must now be restarted. Can anyone point me in the right direction? Greetings Bas Tag: Group policy Tag: 133623
  - 11
    - Userenv errors We have reconfigured our networks within my organisation from 10.1/16 to 192.168/23 addresses and since doing so we are seeing this error on one out of 5 AD boxes... Event Type: Error Event Source: Userenv Event Category: None Event ID: 1054 Date: 05/08/2008 Time: 15:15:18 User: NT AUTHORITY\SYSTEM Computer: V-AD2 Description: Windows cannot obtain the domain controller name for your computer network. (An unexpected network error occurred. ). Group Policy processing aborted. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. It appears that the handful of clients that are on the new subnet 192.168/23 cannot process group policies. Product: Windows Operating System ID: 1054 Source: Userenv Version: 5.2 Symbolic Name: EVENT_FAILED_DSNAME Message: Windows cannot obtain the domain controller name for your computer network. (%1). Group Policy processing aborted. Any ideas on troubleshooting this? Thanks in advance Oli Tag: Group policy Tag: 133622
  - 12
    - changing an expired password We are running a 2000 sp 4 domain. Most machines have been promoted to 2003Server I still have 2 to promote then I will promote the domain. When users change their password (when it expires), users claim that they change the password, hit enter, and when they try to log back on, the new password does not work. What does work, is nothing or a blank password. Any suggestions? Tag: Group policy Tag: 133612
  - 13
    - Making a change within Group Policy and folder redirect We are running a 2000 sp 4 domain. Most machines have been promoted to 2003Server I still have 2 to promote then I will promote the domain. We are using group policy to do folder redirect, which has been working fine. I am running out of disk space and I need to move the folders. Do I just make the change in group policy? (change the destination) Do I have to move the folders and then change group policy? Any suggestions? Regards Tag: Group policy Tag: 133610
  - 14
    - Connecting Three Domains/Forests Hi. I am trying to determine the best way to connect three domains so that they can share resources and centralise user logons. Ideally once the domains are connected, it would be preferred if users could logon with one user account into a new parent domain/forest and gain access to their old domain resources as well as newly connected domains all using their new user account. The three existing domains are single domains in their own forest, they are all 2003 native domains/forests, Exchange is not used in any of the domains. Networking has been put in place between the three seperate networks such that they are all now connected. What I was hoping to do was to create a new fourth domain/forest and connect the existing three domains using trusts. User accounts and groups would then be created in the new fourth parent domain/forest and user groups would be modified/created in the old domains to give access to the new accounts. The long term plan is to slowly migrate all the resources from the three seperate domains into the new fourth parent domain/forest and eventually retire the old domains. Can anyone recommend if this is the best way to approach this problem ? Do you also have any advice on the types of trusts I would need to create to accomplish this ? Thanks, Alex. Tag: Group policy Tag: 133605
  - 15
    - GPO: Scheduled task to defrag servers Hello, I am using this small script to automatically created scheduled tasks via Group Policy on each one of our servers: Set WshShell = WScript.CreateObject("WScript.Shell") Dim fso, d, dc, i, Command i=0 Set fso = CreateObject("Scripting.FileSystemObject") Set dc = fso.Drives For Each d in dc i=i+1 If d.DriveType = 2 Then Return = WshShell.Run("echo ""N""|schtasks.exe /create /SC WEEKLY /D MON /TN Defrag" &i& " /TR ""defrag.exe "&d &" -f"" /ST 15:50:00 /SD 04/08/2008 /RU SYSTEM", 1, TRUE) End If Next Set WshShell = Nothing The echo ""N"" is necessary because on the second restart, Windows asks to overwrite the scheduled task. If I omit this, the GPO works fine the first time, but the after the second reboot, it prompts to overwrite the task, so I manually have to confirm..... When I run the script now with the echo ""N""|, I get an error "The system cannot find the file specified". My question is now, what's wrong with the "Wshshell.run"-command or is there any possibility like a "/N" to confirm that I do not want to overwrite the scheduled task.... Best regards PR Tag: Group policy Tag: 133595
  - 16
    - Having problems removing a ghost object via ntdsutil, and via the Hi When trying to remove following server I get this error message, have tried to clean up all references to this object in ADSIEDIT not sure what more to do... metadata cleanup: remove selected server Transferring / Seizing FSMO roles off the selected server. LDAP error 0x20(32 (No Such Object). Ldap extended error message is 0000208D: NameErr: DSID-031001CD, problem 2001 (NO_OBJECT), data 0, best match of: 'CN=dc_deleted,CN=Servers,CN=66PdH,CN=Sites,CN=Configuration,DC=master,DC=com' Win32 error returned is 0x208d(Directory object not found.) ) Unable to determine the domain hosted by the DC (5). Please use the connection menu to specify it. Removing FRS metadata for the selected server. Unable to find server reference o "CN=dc_deleted,CN=Servers,CN=66PdH,CN=Sites,CN=Configuration,DC=master,DC=com". LDAP error 0x5e(94 (No result present in message). ) The attempt to remove the FRS settings on CN=dc_deleted,CN=Servers,CN=66PdH,CN=Sites,CN=Configuration,DC=master,DC=com f ailed because "Element not found."; metadata cleanup is continuing. DsRemoveDsServerW error 0x20e3(The DSA object could not be found.) -- Morten Vangsnes Tag: Group policy Tag: 133592
  - 17
    - NAS/SAN Can a Windows 2003/2008 domain controller be installed on a VM with storage on NAS or SAN? Is there any article that yu can point me to. Tag: Group policy Tag: 133587
  - 18
    - Can not remove Global Catalog from Server 2008 I am just bring up a Windows 2008 Server Domain Controller. Windows Server was installed by Dell. For some reason the Global Catalog got turned on. I have been trying to add new domain users. After adding the new users I am trying to give them rights to folders and get an error "Can not Find Object (the user) in Global Catalog" . I have gone into Active Directory Sites and Services and tried to remove the Global Catalog. When I uncheck the Global Catalog check box and select apply I get the error message "The directory property cannot be found in cache" and it will not turn off the Global Catalog. How do I get rid of the Global Catalog? Tag: Group policy Tag: 133577
  - 19
    - VB6 not vbscript Hi, Does anyone have a VB6 sample instead of vbscript as the necessary explicit variable declaration in VB6 is causing me problems. I can list all groups but when i click on the group to pass the groupname to show all members some of the objects complain. I have look at earlier posts and answers and tried the code converted to vb6 with some success e.g. http://www.rlmueller.net/Document%20Domain%20Groups.htm but the passing of variant implicit objects to function within vbscript just works but not in vb6 e.g. Sub GetMembers(ByVal objADObject) ' Subroutine to document group membership. ' Members can be users or groups. Dim objMember, strType For Each objMember In objADObject.Members If (UCase(Left(objMember.objectCategory, 8)) = "CN=GROUP") Then strType = "Group" Else strType = "User" End If Wscript.Echo " Member: " & objMember.sAMAccountName _ & " (" & strType & ")" Next Set objMember = Nothing End Sub called from Set objGroup = GetObject("LDAP://" & strDN) Wscript.Echo objGroup.sAMAccountName _ & " (" & GetType(objGroup.groupType) & ")" Call GetMembers(objGroup) so what is objGroup defined as??? I've tried IADSGroup and also other sample scripts that refer to the NT account name via IADSUser but i just can't get it to work? Any ideas? Thanks Martin Tag: Group policy Tag: 133575
  - 20
    - Frequent Account Lockouts after changing account expiration We recently changed the account expiration date from 120 to 90 days. Since then, user who's accounts have expired, sometimes get the message that their account has expired when they boot their computer and they need to reset their password but often they do not. To make matters worse, there are quite a few people who are having issues with accounts continuously being locked out after this change. One of them is on our IT staff. We have a distributed environment with a mix of DC's that are 2k and 2k3 with some R2 mixed in there. Any ideas what the problem could be? I'm checking the event logs at these sites to see if they shed any light on the problem. I'll also run a dcdiag to make sure everything is healthy and I will let you know if there is anything unusual. Tag: Group policy Tag: 133567
  - 21
    - AD, Kerboros and Domain Controller replication problems Hi Everyone. I am not a Windows person, so please be gentle! We experienced a problem on Friday when we had a powercut in the middle of setting up our VPN using Routing and Remote Access. Now it seems none of the clients can see the Domain anymore, also, you cant ping the server name, but you can its IP, and there is an error (Event IDs are below) relating to a Kerboros and AD replication error. There were several other errors as well but I think between me, google, and the associated Event ID I have managed to sort those. The server is still showing iteself as the Domain Controller, and i am unwilling to demote it and then promote it becuase I do not know how to do it safely. Event IDs on the server: 1925 Error 1307 Error 3018 (Exchange) Error 5782 (DNS) Warning 40960 Warning 1016 Warning Event IDs on the clients: 15 Error 1054 Error 1053 Error DNS seems to be working, i base this on the service is still running, there are no events in its log, and i can ping the server name from the server, just not from any of the clients. Email is still coming in and going out, but we cant connect via Outlook clients, only via the webclient and our blackberrys. I think this is becuase Outlook likes to fully qualify what its connecting to, and seeing as the IP Address cannot be resolved to the server name it will not work. Obviously I rolled back all the changes we had made with Remote Access but still Domain, AD and Authenitcation problems persist. I hope I have provided more than enough information, but obviously if there is anything else anyone can think of dont hesitate to ask! The server is running SP2 for the OS and SP1 (I think) for Exchange. We have one server, running Server 2003 and Exchange 2003, this is our Domain Server and Email server. There are no other servers, we know this is not ideal, but we are only a small company of 4 users. I really hope someone can help us out :) Martin. Tag: Group policy Tag: 133566
  - 22
    - Manually remove 2008 DC I had a 2008 domain controller permanently die on me. All FSMO roles are on other servers, but not sure how to clean everything up properly. I've found kb articles talking about 2003 but not 2008. Thanks for any help. Tag: Group policy Tag: 133560
  - 23
    - Backup/restore ADAM instance Hi folks Does anybody know which files have to be added to backup if I want to backup an ADAM instance? I've read in the ADAM help that Adamntds.dit and the associated log files should be included as part of the regular backup plan. But the ntbackup doesn't allow me to select Adamntds.dit and edb.log files because these files are in the "Exclude file" list. Thanks in advance Tag: Group policy Tag: 133554
  - 24
    - Domain users password change problem. Hi, I'm having an issue with the forced password change for domain users of the AD domain. Everytime the users are forced to renew the password of their domain accounts, when they log on, the MSOffice Outlook, loose the email account passwords, so the users need to retype it. Beside this, the users digital signatures are no longer recognized by the WinXP Pro, so I need to reissue it from the signature provider and reinstall it in the workstation. Only thing I found with this kind of behavior is an article of WinNT4. They claim that issue is solved in later version (Win 2000 server and later) and it was related to AD credentials, but someway I'm suffering it in my Win Server 2003 Active Directory + Win XP Pro workstations. Thanks in advance. Kind regards. Tag: Group policy Tag: 133545
  - 25
    - ADAM Sync error Hi, I tried to sync ADAM with AD using AdamSync.exe. I configured the mapping to convert from AD-user object to ADAM-userProxy object using the config.XML file. Once I run adamsync /fs for the first time, i got the error at the end of the log file. Need some help, please. Thanks in advance. In my ADAM schema, i confirm that the object class "user-Proxy" exist. I import MS-userProxy.LDF and MS-userProxyFull.LDF files to ADAM in the very beginning. My configuration.XML file content for conversion is as follows. <user-proxy> <source-object-class>user</source-object-class> <target-object-class>user-Proxy</target-object-class> </user-proxy> Processing Entry: Page 3, Frame 1, Entry 15, Count 1, USN 0 Processing source entry <guid=b97bee39c3d51743ba16d4644cce4f3e> Processing in-scope entry b97bee39c3d51743ba16d4644cce4f3e. Adding target object CN=Test USER,OU=All Users,dc=mydomain,dc=com. Adding attributes: sourceobjectguid, sn, givenName, instanceType, displayName, sAMAccountName, mail, lastagedchange, objectclass, Updating the configuration file DirSync cookie with a new value. Ldap error occured. ldap_add_sW: No Such Attribute. Extended Info: . Ldap error occured. ldap_add_sW: No Such Attribute. Extended Info: . Saving Configuration File on DC=mydomain,DC=com Saved configuration file. Tag: Group policy Tag: 133542
- Next
  - 1
    - Schema extension delay Hi, I have an LDF which extends the schema by creating a couple of attributes, and adding them to the 'user' class object. Immediately after that, I run another LDF which tries to add a user with the new attributes, but I get the following error: Add error on line 1: Object Class Violation The server side error is: 0x207d An attempt was made to modify an object to include an attribute that is not legal for its class. However, if I run the second script after a minute or so, the script runs successfully (the user is added with the new attributes), as if there is some delay in the update of the schema. I also tried to add the following to the first script (the one which extends the schema), but it didn't help: dn: changetype: modify add: schemaUpdateNow schemaUpdateNow: 1 - Any ideas? What am I missing? Thanks. Tag: Group policy Tag: 133539
  - 2
    - Set Active Directory Password from SQL DB using MIIS/ILM Hi Guys I am using MIIS to Sync identity info. What i have is a SQL DB as the authoritative source; i have the user passwords stored in a plain text column in the SQL DB and will need to copy the password from the SQL text column so that it updates the password in the AD user record. Any ideas or documentation. Thanks in advance. Tag: Group policy Tag: 133534
  - 3
    - select this object - Make Computer Objects searchable by default i When adding members in a group within Active Directory on windows 2003 server, default Object Type is Users, groups and other Object but NOT Computer object. We need to ticked Computer Object box. I need to make Computer Object â??Object Typeâ?? ticked or selected as default. This can be done from Active Directory (AD) Schema but now sure how? Can any one answer this please? Tag: Group policy Tag: 133531
  - 4
    - Does ldap_open() support IPv6? -- It will be over. Tag: Group policy Tag: 133530
  - 5
    - Replication between OpenLDAP and AD Can anyone point out a tool or documentation for replication of user/group and password info between OpenLDAP and AD (one way or two way). Is SFUv3 the way to go? Thanks! Tag: Group policy Tag: 133519
  - 6
    - Changing frequency of time sync How can I set my time to automatically sync more than once a week with a NIST server? Every time I do a manual sync it says that the next one is scheduled for one week from that day. I still lose time over the week so I'd like it to sync 2-3x per week. I'm using XP Media Center 2002, Service Pack 2. Tag: Group policy Tag: 133515
  - 7
    - Cross forest migration advice My company is looking to seperate one of our divisions off to a completely new independent company. We have a parent/child domain with the parent being a place holder domain and the child being the user domain for all dvisions of the company. user.adroot.com. In our DNS structure we have a zone for the division that is seperating "division1.com". Division1 will be creating their own forest/domain structure and were looking to create a similar parent/child domain structure, users.division1.com. We would then create a cross-forest trust and migrate users, Exchange mailboxes and security groups. A few questions: With the original company, adroot.com having "division1.com" in their DNS heirarchy and with the new company wanting to name their adroot "division1.com" would there be a problem once the trust was formed and the migration was attempted? I would think that resolving the name "division1.com" between forests would not work because they both have differnet DNS entries for that name. Please advise. Also, we will be building new file servers for Division1 and moving over the directory structure from former company and want to make sure that once users for Divison1 are moved to their new domain, that they still have all the same file permissions that they had before and we won't need to reset those. I was looking for the best way to accomplish this. I know I can migrate the SID history during the AD migration, but what do I do about the directory/file permissions on the new file servers. The permissions would all read users.adroot.com\groupname and that would not match with the new domain name. Any suggestions? Thank you. If anyone has had experience on a migration similar to this in the past, I would love to hear how things went, pitfalls that were experienced, lessons learned, etc... users.adroot.com is a Windows 2003 AD running in windows 2000 native mode. users.division1.com is likely to be a Windows 2008 AD running in mixed mode. Tag: Group policy Tag: 133514
  - 8
    - can't access logon script using UNC path I have a logon script defined in a group policy. It runs fine when I log on to computers in the domain however, if I try to open the script or run it from explorer by using GPO Mgmt snap-in to open the folder it is in, I'm told that I either don't have the rights to access it or run it. Why would it run just fine as my account during the logon sequence but yet I can't even open the file (let alone run it) by opening the folder it is in using Windows Explorer after I've logged in? No errors were logged pertaining to trying to access the script file. This is insane. thanks Tag: Group policy Tag: 133506
  - 9
    - Domain security I have been asked to find a way to secure our data using the current AD structure. Currently our department OU is in a single forest, single domain AD. We have blocked inheratance from the domain for all policies and have our own policies for our users and computers. I know that a domain or enterprise admin can add them selves to the administrators group and access any of our data, but given the current circumstances, we must have it set up this way. This requires me to look at the policy dates daily to make sure nothing has been changed and to look at random system log files from various systems to ensure no one has been looking at priviledged information. Is there any way we can block the domain and enterprise admins out or prevent them from making changes allowing themselves in? The use of certificates has been discussed, but I dont think they will work, since the domain admins will have access to them. Our department staff is ready to pull away from the current domain and create a new root domain with multiple sub-domains with another department that also requires data isolation. Higher management is requiring us to meet with the domain admins to discuss alternate ways to secure the data, and I need to know what other ways are available before the meeting. Thanks, Tag: Group policy Tag: 133505
  - 10
    - New Win2003 DC DNS into Win2000 AD with DNS Hi all, I really hope someone can offer guidance since this is turning out to be one horrible "ground hog" experience. Our task: Completely moving from Windows 2000 AD to Windows 2003 AD What's already done: We've done the pre-introduction of a Windows 2003 AD controller (Adprep, etc.) The issue in detail: - Install windows 2003 server - this is an original cd (not even sp1). - Install sp2 - join domain - install AD At this point everything is fine, or seems so. Then here's where the problem starts: - install DNS, maybe we're doing it wrong here so advice on the proper options may help. - our selections are, primary and secondary, not to create any new zones, no forwarding - even this seems to go without a hitch since looking at DNS management shows the AD DNS is already replicated.... However, after this successful DNS installation, if we reboot (for whatever reason): - the reboot process "stalls" a bit at "Preparing Network Connections" - then the dreaded "At least one driver....failed" - the reboot takes a long time but, you'll finally get to the login screen - after logging in, and this is where it's driving us nuts, you find that the NETWORK CONNECTIONS container is empty! - you essentially can't see any of "MY CONNECTIONS" - If you do a hardware check, the adapters are fine - but you have absolutely no network connectivity - obviously at this point, the EVENT LOG is stacked with errors... Hope someone has some thoughts...I've gone cross-eyed with this....and yes, the AD cleanup is a chore (manually removing the failed controller from AD...at least that seems to be going smoothly). Thanks in advance! -- Cheers, Ed Chavez A bona fide Microsoft drone Tag: Group policy Tag: 133485
  - 11
    - How to search COMPUTER and USER at the SAME TIME in Active Directory. Hello! I would like to know how I search COMPUTER and USERS in Active Directory at the SAME time. I've heard that you can use queries to do this, but I've also heard that it's hard to do. Can someone please help me? Thanks in advance Fredrik Tag: Group policy Tag: 133479
  - 12
    - SCESRV error with GP Hi, Recently, we've received a small bunch of errors with the following message: Event Type: Error Event Source: SceSrv Event Category: None Event ID: 1003 Date: 7/30/2008 Time: 11:20:49 AM User: N/A Computer: ANYWHERE Description: Notification of policy change from LSA/SAM has been retried and failed. Error 4312 to save policy change for account S-1-5-21-882307712-1741840524-1833608373-1216 in the default GPOs. For more debugging information, please look security\logs\scepol.log under Windows root. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Now the scepol.log has nothing on it [in fact, nothing since 2005!]. Did a search on the support sight for SCESRV and the even log and nothing applies. Ideas? Thanks Tag: Group policy Tag: 133475
  - 13
    - Parent Domain Service account admin rights on Child Domain Compute I'm running in a Single Forest scenerio with a Parent domain and Child domain. I have an application that needs to have administrator rights on both the parent domain computers and child domain computers (using the same account). Because of existing custom local admin rights on several different OUs/Computers in the child domain I can't force an update to all computers using a GPO without potentially damaging those existing permissions. What are my options? Tag: Group policy Tag: 133469
  - 14
    - ---- School BOY & GIRL Enjoying SEX at PARK ------ Watch the Free ==Videos== of All --->LESBIAN College Girl<--- Having Horny VIDEOS...... Here the Huge Collection of Horny Lesbian College Girl & More of School Girls SECRET MMS CLIPStoo... Watch the Free Video Here that will make you satisfied at all.... www.googlemobilesphones.blogspot.com www.secretwebcams.blogspot.com www.netmoney2you.blogspot.com Tag: Group policy Tag: 133464
  - 15
    - Password Never Expires, user still gets prompted to change passwor Hi All, We have a user whose password was supposed to expire after 90 days, but we needed to postpone that for a few more weeks. We selected the option "Password Never Expires" on the Account tab for the user's Active Directory account. The problem is that after doing that, the person was still getting the pop-up box upon login, or upon unlocking his workstation, telling him that his password is about to expire. AND he even got the popup after the password was supposed to originally expire, saying something like "your password expires in 0 days". He has been able to login all of those times by clicking on NO (ie. don't change my password now). I can't find anything on the Internet explaining how to make this popup go away. Any help would be appreciated. Thanks! Tag: Group policy Tag: 133463
  - 16
    - =?ISO-8859-1?B?LqmpqampqakgLS0gQWN0cmVzcyBTZWNyZXQgQk9USCBST09NIHNjZW5lcyAt?= Hi....Friends, watch and enjoy SECRET WEB-CAMS at LADIES HOSTELS and INTERNET CAFE SEX SCANDALS VIDEOS... ** HOT Sexy Girls Nude Video's ** ** Porn Video's ** ** Nude Sexy For Mega Size Big Boobs ** Lesbian ** ** Gay ** Lesbian ** Data Sex ** Pay Sex's *** www.googlemobilesphones.blogspot.com www.secretwebcams.blogspot.com www.netmoney2you.blogspot.com Tag: Group policy Tag: 133462
  - 17
    - ADAMSync configuration XML file to convert AD user to ADAM userProxy object Hi, I found that it is possible to convert the AD user object to ADAM userProxy object when synchronizing through ADAmSync. ADAM Help file doesn't includes the format of "user-proxy, source-object-class and target-object-class usage. Can anyone help me on this? Thanks in advance. Zaw Phyoe Tag: Group policy Tag: 133446
  - 18
    - Object modification in Active Directory Hello, I was checking on the Security logs for my domain but was suprised to see "NT AUTHORITY\ANONYMOUS LOGON" for Event ID 642. User password was reset and i would like to know who did that. Instead of getting to know the user that perform the change, the Event ID shows the users as "NT AUTHORITY\ANONYMOUS LOGON" I've tested out that when i reset a user password from a member server of the domain, it'll show as ""NT AUTHORITY\ANONYMOUS LOGON" instead of the user name. Is there any way, i can get this to work correctly? To display the user name instead of ANONYMOUS LOGON for Event 642. Thanks. Tag: Group policy Tag: 133445
  - 19
    - Swap Primary DC? Hello, First of all, sorry if this is the wrong group to post, but it was the most tentative for my according the name. I have a win2008 acting as a primary domain controller, currently, it is the only DC in our domain. I have to trash that machine and build a new DC, the current one will be totally taken out of the lan, so i have to get working a new primary domain controller, what are the best practices to do that? I was thinking in add the new (future DC) as a secondary domain controller, so it get synched with the primary and get all the AD data, but after that, how do i tell the AD that i want the secondary to become the primary and totally remove the current one? Thanks for the help. BTW, both machines will be running windows 2008 and the AD is running in 2003 native mode., there are currently some exchange and other servers joined to the domain as well... Tag: Group policy Tag: 133434
  - 20
    - Authentication across trusts I hope someone can shed some light on this. We are migrating users from our "ad.company.com" domain to a brand new domain called "company.com". We seem to be having some trouble accessing shares across the domain. When users in "ad.company.com" try to access resources in "company.com" (even though they have been given rights to the share) they are prompted to authenticate. Interestingly when we access the share with just the hostname we are connected but if we try to use FQDN it prompts. One of my peers thinks that we may have a problem since the domain we are adding is actually above the existing domain in the DNS hierarchy. We tried sniffing the connection and the Kerberos packets seem to all be targeted at the "ad.company.com" domain and never ask the "company.com" DCs to authenticate the users to the resource. Any ideas on why we may be having this problem? Tag: Group policy Tag: 133433
  - 21
    - AD, ADAM and LDAP server implementation Hi, I got my Win 2003 AD domain and all users (Exchange recipients) are there. I want to make that information available for the LDAP clients. I also needed to implement SSL for the LDAP connections. My problem is, my AD domain name is ending with ".local" and my certificate and public DNS name for the LDAP service is using public FQDN name. So, I cann't implement SSL (using 3rd party Certificate) on the actual AD domain controllers. I've tested ADAM and synchronized with AD. All mail recipient information are synchronized and I can also implement SSL on that ADAM server using my 3rd party certificate. I'm now having a problem authenticating all LDAP-SSL clients (non Domain member computers) using AD accounts. Even my ADAM server is the member of the AD domain, it still failed to authenticate. I've enable auditing on the ADAM and found the Failure audit entry with the error 0xC0000064 (account does not exist). Any idea? Need your expertise? Thank you. Zaw Phyoe Tag: Group policy Tag: 133430
  - 22
    - Creating account problem We are running Windows 2003 server. I just set up the domain. When I tried to create an account, it alway complain the password does not meet the password policy requirement. I disabled all password policy under domain security policy, but I still get the same error message. Any help will be appreciated! Thanks in advance! Lisa Tag: Group policy Tag: 133426
  - 23
    - Folder Redirection re-setting Hey folks, Earlier today I did the following procedure: 1. Created three new user accounts in AD. 2. Logged all three user accounts on a workstation the users share. (In all reality, one person will likely log in a remain logged in for days. The PC remains on.) 3. I logged into the Domain Admin from that workstation. 4. I copied the Profile from a previous "community" login the users had used up until now. My issue: When I log into any of the users, the My Documents folder redirection is pointing at the community user's location, not the user's own location. I can't edit the Target field, of course. GP enforces the redirection. How can I fix these three users on this workstation? Cheers, m Tag: Group policy Tag: 133422
  - 24
    - Advice on Replacing First Domain Controller in Forest/Domain Hi All, We are planning to replace the original domain controller that was the first dc when we upgraded our network to Windows2000 and then to Windows2003. We have a single Windows2003 native forest, single domain, with 3 domain controllers all running Windows 2003 Server with Service Pack 1. The server to be replaced holds the all the FSMO roles, except for the PDC Emulator. We are running Active Directory Integrated DNS on the server we are replacing and we have a secondary DNS server (integrated DNS) on one of the other 2 DCS. It is critical for us to keep the same server name and IP address for the new server, because all domain controllers and member servers (10 of them) are pointing to the server we are replacing, as well as several devices on our network. I have done some google searches, but I have not been able to nail down any step by step instructions for how to keep the same server name and IP address. I can't find any documents or whitepapers from Microsoft that detail the proper steps on doing this. Thanks in advance for any tips or useful links Zoey Tag: Group policy Tag: 133418
  - 25
    - How does the password complexity affect japanese characters? on the password complexity is states: If this policy is enabled, passwords must meet the following minimum requirements: Not contain the user's account name or parts of the user's full name that exceed two consecutive characters Be at least six characters in length Contain characters from three of the following four categories: English uppercase characters (A through Z) English lowercase characters (a through z) Base 10 digits (0 through 9) Non-alphabetic characters (for example, !, $, #, %) Complexity requirements are enforced when passwords are changed or created. How does this affect japanese characters? Tag: Group policy Tag: 133411

Why am not able to apply group policy to the groups in windows server 20003

Re: Group policy by Marcin

Marcin
Wed Aug 06 04:31:04 PDT 2008

By design. Group policies apply to users and computers. However you can use
security group filtering to emulate the functionality you are looking for...

hth
Marcin

"About group polcy" <Aboutgrouppolcy@discussions.microsoft.com> wrote in
message news:CE33DD70-8665-4094-9CD1-2152B443D0F1@microsoft.com...
> Why am not able to apply group policy to the groups in windows server
> 20003

Top

Re: Group policy by Meinolf

Meinolf
Wed Aug 06 05:32:50 PDT 2008

Hello About,

GPO's can be linked to user or computers.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

> Why am not able to apply group policy to the groups in windows server
> 20003
>

Top