In our Active Directory we have a group policy to allow users to manage the server via Remote Desktop.
I have to apply this to my user EVERYDAY because it seemingly removes itself overnight on it's on. 5:30 pm yesterday it was working properly. Today (no reboot) I login and the remote connection says the permission is missing.
Has anyone experienced this and can anyone help?
Are you sure you are applying it to the correct user group?
I’ve had trouble in the past with this, being a novice. I would suggest doing running the following from command prompt Gpresult /h report.html /f
This will generate a HTML document that you can see what has been applied to this machine. If it’s not on there then it’s probably a wrong target from the GPO end. If it’s there but fails you should have a reason why.
One more thing to check too is what your GPOs are on your computer itself. there might be something that is overwriting/blocking what the AD is sending?
Related
I'm an IT Support Engineer for a company with around 60,000 workstations on our domain. We use AD for most things, but have just begun migrating to VMware's Workspace One.
Recently, we've had a bunch of reports from users that when they manually lock their workstations, it instead logs them out. All apps they had opened close and they need to reopen and login to all of them all over again.
We've checked the GPO and see no issues there, even tried deleting the .pol file and running gpupdate /force but cmd returned an error of unable to update group policy. The bizarre part is that if the machine auto-locks instead of manually locks, it behaves as it should; users log back in and their apps are all still opened.
Anyone have any clue what's going on?
I have noticed that on all these workstations running dsregcmd /status returns that WorkplaceJoined:NO DefaultWamSet:Error (0x80070520) and no details for any connected work accounts despite settings saying they are connected. Not sure if that could be the problem and why it can't get a GP update or if its entirely unrelated.
Attempted fixes:
Deleting .pol and running GPupdate /force to have it recreate the gpo. Update failed in cmd with no error code.
Unenrolling/renrolling in Workspace One.
Proposed next step:
Disconnecting work accounts from settings, clearing the tpm and reinitializing it, reconnecting work accounts and retrying gpupdate /force
I wanted to setup a computer with a variety of settings which I basicly have to do over and over and over again everytime a new user joins our company or changes the computer and I wanted to know if there was a possible way to configure those with a script like I already did with an information colletor script (batch file) and which now works perfectly fine thanks to this webside.
So since I know that here are some really awesome IT Guys with way more experience then me I would love to so something automatic as the next step to save loads of time by simply running a script to configure things like setting up the screensaver, InternetOptions, removing Apps/Softwarelinks in the Start Menu or perhaps even adding links to the bookmark list in firefox or chrome so the user can just start to work and I got loads of time for other important things.
For now it would already be a help to setup a script for Windows 7 but I think we will move more and more to windows 10 so would it be possible to write something to use on both systems without any big changes?
... configure things like setting up the screensaver, InternetOptions,
removing Apps/Softwarelinks in the Start Menu or perhaps even adding
links to the bookmark list in firefox or chrome so the user can just
start to work and I got loads of time for other important things.
Everything you ask about can be configured in a centralized fashion via Active Directory Group Policy. Check the Group Policy Survival Guide page to get started designing the policy for your organization and users.
Group Policy can be defined using PowerShell and via Group Policy Management Console which is GUI-based.
Note that the above will only work if you are in Active Directory domain. If you are not, you still can use Local Group Policy, but you will have to run a script on every user's computer. I am not sure whether there are native PowerShell cmdlets to manage Local Group Policy, but AFAIK you can do that via Windows Registry or using special tools.
i am having an issue a little bit strange.
I installed autocad lt 2015 in some computers in my network with administrator account, and i'm having issues with one user in particular. When he starts autocad, nothing happen, although if i run as administrator it works like a charm.
I did the next tests:
-Uninstalled and reinstall autocad.
-Gave user admin rights to the program.
-Login with other users (same permissions as this one) and they are able to run it.
-Check the user account on the active directory and it's exactly the same as the others.
Any ideas?
Thanks in advance.
Best regards.
I wonder if the user could have a profile locally on that machine that is causing issues?
Before I start, another post for something similar to this request for help is located at Running a process at the Windows 7 Welcome Screen, but the responses were not quite what I believe I am looking for, and the post is over a year old so I thought it best to start a new thread for my needs.
In Windows 7 Ultimate, I am trying to create a script or task scheduler event that will run a Windows "rundll32.exe" process with arguments at the logon, lock, and switch user screens (basically any screen that is waiting for user to log into the machine).
I have tried using the startup script controls in group policy editor as well as creating a task scheduler event, but so far I am unable to get the process to display on the logon screens.
The command line I am using does work while logged into any account at any user level via the "Run.." dialog as well as via CMD prompt, and is only creating a popup that already exists in the Windows OEM Environment.
The hardest part is this: My friend just bought a new laptop. The new laptop came with this specific feature already enabled, but I have no idea what is making it happen and do not have access to the computer to check out gpedit.msc and task scheduler for possible solutions.
There are two reasons why I need this info: 1) I want the feature to work on my own laptop, and 2) my friend would like help disabling it on his as he doesn't like it.
I have been all over Google, posted at Microsoft Answers, and also posted on the laptop manufacturer's user forums. I have found very few pages that refer to the same question as I have, but none have answers that work, and since I have seen and know that this is possible, I am compelled to continue looking.
The laptop that this is currently working on was purchased with a fresh install of Win 7 Ultimate and no manufacturer bloatware/additional software added, so we know that the feature was made to happen by whomever it was that installed the OS and configured it for sale. Therefore I am certain it is just a matter of the right task or script in Windows itself before I see the results I need and then know how to direct my friend to disable his via phone.
The specific call is "rundll32.exe van.dll,RunVAN". In task scheduler I have set this to run as "SYSTEM" and set the triggers for startup, workstation lock, and local disconnect. I have tried using full path to rundll32.exe as well as the bare command. In gpedit startup scripts I have tried full path and bare command. Neither of which for either case is making this popup show on the logon screens.
Any and all help and/or advice on this would be greatly appreciated by both myself and my friend.
dynamic display of images for the credential provider
The title says it. I'm looking for a way to determine exactly which file/registry key this executable is attempting to access. I have attempted to use Windows auditing capabilities and Process Monitor to determine where the failure is happening but, this failure does not produce audit failure events or show as access denial in Process Monitor.
Of course, If someone has experienced this and can provide a solution to resolve the error directly that would be almost as nice.
Background:
I am using moveuser.exe which is part of the Windows Server 2003 Resource Kit Tools to convert the security of local user profiles on a number Windows XP workstations.
Symptom:
Occasionally, moveuser.exe will fail to convert the security of a profile with the error "Error: 5 access denied". I have not been able to determine any commonality among the failing accounts or the computers they reside upon. A given computer may have host 6 profiles, 5 of which convert without issue and 1 which produces the error.
There are a few factors that I'm as sure as I can be about:
-The account I'm using to run moveuser.exe with has full Administrator rights to the local machine and the domain to which the profile security is being converted.
-The failure is not related to file permissions within the profile directory (the entire directory can be moved, renamed, deleted, or successfully converted via a workaround).
I've developed a reliable workaround for these cases but, it is fairly involved and I would much rather understand the root cause of this error and correct it pre-emptively.
My workaround (glad to share it, left out for brevity) seems to indicate that the failure is related to HKEY_LOCAL_MACHINE \ SOFTWARE\ Microsoft\ Windows NT \ CurrentVersion \ ProfileList registry keys but, I cannot determine exactly how/why.
Did you try to use the "regini" command line tool to grab registry permissions for the administrator account?
Use FileMon and RegMon (now Microsoft, formerly SysInternals, still free) to monitor what exactly is being accessed, how, and what rights/access are being requested.
I don't have a URL handy, but a Google search should be able to hook you up with these tools.
A couple items I would try. First, could it be that the user was logged in and the computer hasn't been rebooted. Microsoft has a product called UPHClent which helps in unloading unneeded user hives.
Next thing I wanted to know, is if you try rebooting before running the moveuser executable. This Conversation seems to indicate this would help with this kind of error.
Two days after posting this I got to the bottom of the problem. It turned out, just as Rob Haupt suggested to be related to a stuck user hive. The program I was running, moveuser, was reading the Refcount key found under HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows NT\ CurrentVersion\ ProfileList\ <SID>\ and ending immediately.
Setting Refcount to 0 solved the problem immediately
Pushing out UPHClean to all the target machines pre-emptively has all but elimated the problem and we were able to successfully convert profiles on several hundred machines over the last week.
An important note about UPHClean:
I'd tried installing it previously but, it didn't appear to help. I was too impatient, the UPHClean ReadMe revealed that the service just takes time to do its job.