<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Kreslavsky IT blog &#187; GPO</title>
	<atom:link href="http://www.kreslavsky.com/category/microsoft/active-directory/gpo-active-directory-microsoft/feed" rel="self" type="application/rss+xml" />
	<link>http://www.kreslavsky.com</link>
	<description>News, guides, and tips to antivirus programmes, scripts, and security</description>
	<lastBuildDate>Sun, 29 Jan 2012 04:57:38 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
		<item>
		<title>Deploy wireless settings with Key using netsh script and GPO</title>
		<link>http://www.kreslavsky.com/2011/05/deploy-wireless-settings-with-key-using-netsh-script-and-gpo.html</link>
		<comments>http://www.kreslavsky.com/2011/05/deploy-wireless-settings-with-key-using-netsh-script-and-gpo.html#comments</comments>
		<pubDate>Tue, 03 May 2011 08:36:13 +0000</pubDate>
		<dc:creator>Gil Kreslavsky</dc:creator>
				<category><![CDATA[Active Directory]]></category>
		<category><![CDATA[GPO]]></category>
		<category><![CDATA[Microsoft]]></category>
		<category><![CDATA[Scripts]]></category>
		<category><![CDATA[Vista]]></category>
		<category><![CDATA[Windows 7]]></category>
		<category><![CDATA[Certificates]]></category>
		<category><![CDATA[Command Prompt]]></category>
		<category><![CDATA[Deploy]]></category>
		<category><![CDATA[Deployment]]></category>
		<category><![CDATA[Export Profile]]></category>
		<category><![CDATA[Folder C]]></category>
		<category><![CDATA[Gpo]]></category>
		<category><![CDATA[Interface]]></category>
		<category><![CDATA[Lan Settings]]></category>
		<category><![CDATA[Lt]]></category>
		<category><![CDATA[netsh]]></category>
		<category><![CDATA[Profile Name]]></category>
		<category><![CDATA[script]]></category>
		<category><![CDATA[Shared Key]]></category>
		<category><![CDATA[Wireless]]></category>
		<category><![CDATA[Wireless Lan]]></category>
		<category><![CDATA[Wireless Management]]></category>
		<category><![CDATA[Wireless Profile]]></category>
		<category><![CDATA[Wlan]]></category>
		<category><![CDATA[Workstation]]></category>
		<category><![CDATA[Yourkey]]></category>

		<guid isPermaLink="false">http://www.kreslavsky.com/2011/05/deploy-wireless-settings-with-key-using-netsh-script-and-gpo.html</guid>
		<description><![CDATA[Tweet &#160; Windows 2008 has built in policy GPO for wireless setting management. You can configure your network setting using Certificates. It is the most recommended and secure way But if you like to deploy the wireless settings using static key, you will have to use other way. The steps bellow describe the way to deploy Wireless LAN settings with a Pre-Shared Key The purpose is to Automate Adding Wireless Profile in Windows. Preparations Configure Wireless settings on one workstation from command prompt run netsh wlan export profile name=&#34;NameOfyourProfile&#34; folder=c:temp interface=&#34;wirelesssettings” Confirm that under c:temp you have wirelesssettings.xml file Open wirelesssettings.xml file locate the following line &#60;protected&#62;true&#60;/protected&#62; Change it to &#60;protected&#62;false&#60;/protected&#62; Under you will see encrypted line &#60;keyMaterial&#62;01000000D08C9DDF0115D1118&#60;/keyMaterial&#62; Change it to your key like that &#60;keyMaterial&#62;Yourkey&#60;/keyMaterial&#62; Note: It means that your wireless key will be in clear text and everyone who has access to the file will be able to read your wireless key&#34; Deployment Copy your wireless settings xml file to NETLOGON Create a bat or cmd file with the following line netsh wlan add profile filename=&#34;\yourserverNETLOGONwirelesssettings.xml&#34; user=all Run the bat file from some domain member computer and confirm that it works After finishing all steps above you can deploy the script from GPO Note: Setting are applicable for Windows Vista Windows 7 and Windows 2008 Only]]></description>
			<content:encoded><![CDATA[<div class="bottomcontainerBox" style="border:1px solid #808080;background-color:#F0F4F9;">
			<div style="float:left; width:85px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;">
			<iframe src="http://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.kreslavsky.com%2F2011%2F05%2Fdeploy-wireless-settings-with-key-using-netsh-script-and-gpo.html&amp;layout=button_count&amp;show_faces=false&amp;width=85&amp;action=like&amp;font=verdana&amp;colorscheme=light&amp;height=21" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width=85px; height:21px;" allowTransparency="true"></iframe></div>
			<div style="float:left; width:80px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;">
			<g:plusone size="medium" href="http://www.kreslavsky.com/2011/05/deploy-wireless-settings-with-key-using-netsh-script-and-gpo.html"></g:plusone>
			</div>
			<div style="float:left; width:95px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;">
			<a href="http://twitter.com/share" class="twitter-share-button" data-url="http://www.kreslavsky.com/2011/05/deploy-wireless-settings-with-key-using-netsh-script-and-gpo.html"  data-text="Deploy wireless settings with Key using netsh script and GPO" data-count="horizontal">Tweet</a>
			</div><div style="float:left; width:105px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;"><script type="in/share" data-url="http://www.kreslavsky.com/2011/05/deploy-wireless-settings-with-key-using-netsh-script-and-gpo.html" data-counter="right"></script></div>			
			<div style="float:left; width:85px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;"><script src="http://www.stumbleupon.com/hostedbadge.php?s=1&amp;r=http://www.kreslavsky.com/2011/05/deploy-wireless-settings-with-key-using-netsh-script-and-gpo.html"></script></div>			
			</div><div style="clear:both"></div><div style="padding-bottom:4px;"></div><p>&#160;</p>
<p>Windows 2008 has built in policy GPO for wireless setting management.    <br />You can configure your network setting using Certificates. It is the most recommended and secure way     <br />But if you like to deploy the wireless settings using static key, you will have to use other way.</p>
<p>The steps bellow describe the way to deploy Wireless LAN settings with a Pre-Shared Key   <br />The purpose is to Automate Adding Wireless Profile in Windows.</p>
<p>Preparations</p>
<ul>
<li>Configure Wireless settings on one workstation </li>
<li>from command prompt run      <br />netsh wlan export profile name=&quot;<em>NameOfyourProfile</em>&quot; folder=<em>c:temp</em> interface=&quot;wirelesssettings” </li>
<li>Confirm that under c:temp you have wirelesssettings.xml file </li>
<li>Open wirelesssettings.xml file locate the following line      <br />&lt;protected&gt;true&lt;/protected&gt; </li>
<li>Change it to &lt;protected&gt;false&lt;/protected&gt; </li>
<li>Under you will see encrypted line &lt;keyMaterial&gt;01000000D08C9DDF0115D1118&lt;/keyMaterial&gt; </li>
<li>Change it to your key like that &lt;keyMaterial&gt;<em>Yourkey&lt;/keyMaterial&gt;</em><br />
<blockquote>
<p>Note: It means that your wireless key will be in clear text and everyone who has access to the file will be able to read your wireless key&quot;</p>
</blockquote>
</li>
</ul>
<p>Deployment</p>
<ul>
<li>Copy your wireless settings xml file to NETLOGON </li>
<li>Create a bat or cmd file with the following line      <br />netsh wlan add profile filename=&quot;\yourserverNETLOGONwirelesssettings.xml&quot; user=all </li>
<li>Run the bat file from some domain member computer and confirm that it works </li>
</ul>
<p>After finishing all steps above you can deploy the script from GPO</p>
<blockquote><p>Note: Setting are applicable for Windows Vista Windows 7 and Windows 2008 Only</p>
</blockquote>
]]></content:encoded>
			<wfw:commentRss>http://www.kreslavsky.com/2011/05/deploy-wireless-settings-with-key-using-netsh-script-and-gpo.html/feed</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Show only specified Control Panel items GPO doesn’t apply on Windows 2008R2 Terminal Servers</title>
		<link>http://www.kreslavsky.com/2010/08/show-only-specified-control-panel-items-gpo-doesnt-apply-on-windows-2008r2-terminal-servers.html</link>
		<comments>http://www.kreslavsky.com/2010/08/show-only-specified-control-panel-items-gpo-doesnt-apply-on-windows-2008r2-terminal-servers.html#comments</comments>
		<pubDate>Tue, 24 Aug 2010 10:23:11 +0000</pubDate>
		<dc:creator>Gil Kreslavsky</dc:creator>
				<category><![CDATA[Active Directory]]></category>
		<category><![CDATA[GPO]]></category>
		<category><![CDATA[Server 2008]]></category>
		<category><![CDATA[Canonical Names]]></category>
		<category><![CDATA[Control]]></category>
		<category><![CDATA[Control Panel]]></category>
		<category><![CDATA[Control Panel Applets]]></category>
		<category><![CDATA[File Names]]></category>
		<category><![CDATA[Gpo]]></category>
		<category><![CDATA[Previous Version]]></category>
		<category><![CDATA[Rsquo]]></category>
		<category><![CDATA[Show Control]]></category>
		<category><![CDATA[Terminal Servers]]></category>
		<category><![CDATA[Windows 2008R2]]></category>
		<category><![CDATA[Windows Servers]]></category>

		<guid isPermaLink="false">http://www.kreslavsky.com/2010/08/show-only-specified-control-panel-items-gpo-doesnt-apply-on-windows-2008r2-terminal-servers.html</guid>
		<description><![CDATA[Tweet &#160; In Previous version we used to work with CPL File Names&#160; to define which one of control panel applets will be displayed. In order to make it work Use Canonical names instead. It should Look like that You can get the full list from here]]></description>
			<content:encoded><![CDATA[<div class="bottomcontainerBox" style="border:1px solid #808080;background-color:#F0F4F9;">
			<div style="float:left; width:85px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;">
			<iframe src="http://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.kreslavsky.com%2F2010%2F08%2Fshow-only-specified-control-panel-items-gpo-doesnt-apply-on-windows-2008r2-terminal-servers.html&amp;layout=button_count&amp;show_faces=false&amp;width=85&amp;action=like&amp;font=verdana&amp;colorscheme=light&amp;height=21" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width=85px; height:21px;" allowTransparency="true"></iframe></div>
			<div style="float:left; width:80px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;">
			<g:plusone size="medium" href="http://www.kreslavsky.com/2010/08/show-only-specified-control-panel-items-gpo-doesnt-apply-on-windows-2008r2-terminal-servers.html"></g:plusone>
			</div>
			<div style="float:left; width:95px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;">
			<a href="http://twitter.com/share" class="twitter-share-button" data-url="http://www.kreslavsky.com/2010/08/show-only-specified-control-panel-items-gpo-doesnt-apply-on-windows-2008r2-terminal-servers.html"  data-text="Show only specified Control Panel items GPO doesn’t apply on Windows 2008R2 Terminal Servers" data-count="horizontal">Tweet</a>
			</div><div style="float:left; width:105px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;"><script type="in/share" data-url="http://www.kreslavsky.com/2010/08/show-only-specified-control-panel-items-gpo-doesnt-apply-on-windows-2008r2-terminal-servers.html" data-counter="right"></script></div>			
			<div style="float:left; width:85px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;"><script src="http://www.stumbleupon.com/hostedbadge.php?s=1&amp;r=http://www.kreslavsky.com/2010/08/show-only-specified-control-panel-items-gpo-doesnt-apply-on-windows-2008r2-terminal-servers.html"></script></div>			
			</div><div style="clear:both"></div><div style="padding-bottom:4px;"></div><p>&#160;</p>
<p>In Previous version we used to work with <a href="http://www.kreslavsky.com/2009/11/windows-control-panel-cpl-files-list-and-description.html" target="_blank">CPL File Names</a>&#160; to define which one of control panel applets will be displayed.</p>
<p>In order to make it work Use Canonical names instead.    <br />It should Look like that     <br /><a href="http://www.kreslavsky.com/wp-content/uploads/2010/08/image.png"><img style="border-right-width: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px" title="Canonical Names of Control Panel Items" border="0" alt="Canonical Names of Control Panel Items" src="http://www.kreslavsky.com/wp-content/uploads/2010/08/image_thumb.png" width="515" height="264" /></a> </p>
<p>You can get the full list from <a href="http://msdn.microsoft.com/en-us/library/ee330741(VS.85).aspx#">here</a></p>
]]></content:encoded>
			<wfw:commentRss>http://www.kreslavsky.com/2010/08/show-only-specified-control-panel-items-gpo-doesnt-apply-on-windows-2008r2-terminal-servers.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Block Access to  My Computer Properties Menu in Windows 7 and Vista</title>
		<link>http://www.kreslavsky.com/2009/10/block-access-to-my-computer-properties-menu-in-windows-7-and-vista.html</link>
		<comments>http://www.kreslavsky.com/2009/10/block-access-to-my-computer-properties-menu-in-windows-7-and-vista.html#comments</comments>
		<pubDate>Fri, 30 Oct 2009 10:05:00 +0000</pubDate>
		<dc:creator>Gil Kreslavsky</dc:creator>
				<category><![CDATA[GPO]]></category>
		<category><![CDATA[Microsoft]]></category>
		<category><![CDATA[Vista]]></category>
		<category><![CDATA[Windows 7]]></category>

		<guid isPermaLink="false">http://www.kreslavsky.com/2009/10/block-access-to-my-computer-properties-menu-in-windows-7-and-vista.html</guid>
		<description><![CDATA[Tweet In System properties window you can various information about  Windows system . You may wish to block it to prevent users from accessing it  and do changes. You can easily disable access to My Computer context menu through AD Group Policy. This solution doesn’t block access to menus, only hides it from right click. Menu  can still be accessed Windows key + Pause/Break key. To disable it Open Group Policy Manager Navigate to User Configuration &#62; Policies &#62; Administrative Templates &#62; Desktop Double Click on “Remove Properties from the Computer icon context menu” and change it to “Enabled” Windows 7 Trial Download]]></description>
			<content:encoded><![CDATA[<div class="bottomcontainerBox" style="border:1px solid #808080;background-color:#F0F4F9;">
			<div style="float:left; width:85px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;">
			<iframe src="http://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.kreslavsky.com%2F2009%2F10%2Fblock-access-to-my-computer-properties-menu-in-windows-7-and-vista.html&amp;layout=button_count&amp;show_faces=false&amp;width=85&amp;action=like&amp;font=verdana&amp;colorscheme=light&amp;height=21" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width=85px; height:21px;" allowTransparency="true"></iframe></div>
			<div style="float:left; width:80px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;">
			<g:plusone size="medium" href="http://www.kreslavsky.com/2009/10/block-access-to-my-computer-properties-menu-in-windows-7-and-vista.html"></g:plusone>
			</div>
			<div style="float:left; width:95px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;">
			<a href="http://twitter.com/share" class="twitter-share-button" data-url="http://www.kreslavsky.com/2009/10/block-access-to-my-computer-properties-menu-in-windows-7-and-vista.html"  data-text="Block Access to  My Computer Properties Menu in Windows 7 and Vista" data-count="horizontal">Tweet</a>
			</div><div style="float:left; width:105px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;"><script type="in/share" data-url="http://www.kreslavsky.com/2009/10/block-access-to-my-computer-properties-menu-in-windows-7-and-vista.html" data-counter="right"></script></div>			
			<div style="float:left; width:85px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;"><script src="http://www.stumbleupon.com/hostedbadge.php?s=1&amp;r=http://www.kreslavsky.com/2009/10/block-access-to-my-computer-properties-menu-in-windows-7-and-vista.html"></script></div>			
			</div><div style="clear:both"></div><div style="padding-bottom:4px;"></div><p>In System properties window you can various information about  Windows system .<br />
You may wish to block it to prevent users from accessing it  and do changes.</p>
<p>You can easily disable access to My Computer context menu through AD Group Policy.<br />
This solution doesn’t block access to menus, only hides it from right click. Menu  can still be accessed <strong>Windows key + Pause/Break</strong> key.</p>
<p>To disable it Open Group Policy Manager<br />
Navigate to <strong>User Configuration &gt; Policies &gt; Administrative Templates &gt; Desktop<br />
</strong>Double Click on<strong> “Remove Properties from the Computer icon context menu”</strong> and change it to <strong>“Enabled”</strong></p>
<p><a href="http://www.kreslavsky.com/wp-content/uploads/2009/10/image26.png"><img style="border-bottom: 0px; border-left: 0px; display: inline; border-top: 0px; border-right: 0px" title="Remove Properties from the Computer icon context menu" src="http://www.kreslavsky.com/wp-content/uploads/2009/10/image_thumb26.png" border="0" alt="Remove Properties from the Computer icon context menu" width="497" height="330" /></a></p>
<p><a href="http://www.kreslavsky.com/2009/11/windows-7-90-days-trial.html" target="_blank">Windows 7 Trial Download</a></p>
]]></content:encoded>
			<wfw:commentRss>http://www.kreslavsky.com/2009/10/block-access-to-my-computer-properties-menu-in-windows-7-and-vista.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Prevent users from disjoining from domain using GPO</title>
		<link>http://www.kreslavsky.com/2009/10/prevent-users-from-disjoining-from-domain-using-gpo.html</link>
		<comments>http://www.kreslavsky.com/2009/10/prevent-users-from-disjoining-from-domain-using-gpo.html#comments</comments>
		<pubDate>Thu, 29 Oct 2009 09:54:00 +0000</pubDate>
		<dc:creator>Gil Kreslavsky</dc:creator>
				<category><![CDATA[Active Directory]]></category>
		<category><![CDATA[GPO]]></category>
		<category><![CDATA[Microsoft]]></category>
		<category><![CDATA[Vista]]></category>
		<category><![CDATA[Windows 7]]></category>
		<category><![CDATA[Windows XP]]></category>
		<category><![CDATA[Disjoin from Domain]]></category>
		<category><![CDATA[Gpo]]></category>
		<category><![CDATA[Windows]]></category>

		<guid isPermaLink="false">http://www.kreslavsky.com/2009/10/prevent-users-from-disjoining-from-domain-using-gpo.html</guid>
		<description><![CDATA[Tweet &#160; There is no 100% foolproof&#160; solution that blocks local admin users access the option of disjoining their computer from domain , but you can make it harder to get to system menu. I remove the &#34;properties&#34; from when you right click on my computer. Then i also remove system applet from control panel menu ,and disable registry editing. To disable right click on my computer go to Group Policy. Navigate to&#160; User Configuration&#62;Administrative templates&#62;Desktop Locate “Remove Properties from the My Computer context menu” and set it to “Enable” You should check also How disable&#160; Right Click Properties on my computer on windows 7/Vista Than navigate to User Configuration&#62;Administrative templates&#62;Control PanelLocate “Hide specified Control Panel applets”Set it to “Enabled” and add Sysdm.cpl to the list of disallowed Control Panel applets. To block Sysdm.cpl&#160; from executing Navigate to User Configuration&#62;Administrative Templates&#62;System Navigate to “Don’t run specified Windows application” set it to “Enabled” and add Sysdm.cpl&#160; to the list of disallowed applications]]></description>
			<content:encoded><![CDATA[<div class="bottomcontainerBox" style="border:1px solid #808080;background-color:#F0F4F9;">
			<div style="float:left; width:85px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;">
			<iframe src="http://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.kreslavsky.com%2F2009%2F10%2Fprevent-users-from-disjoining-from-domain-using-gpo.html&amp;layout=button_count&amp;show_faces=false&amp;width=85&amp;action=like&amp;font=verdana&amp;colorscheme=light&amp;height=21" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width=85px; height:21px;" allowTransparency="true"></iframe></div>
			<div style="float:left; width:80px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;">
			<g:plusone size="medium" href="http://www.kreslavsky.com/2009/10/prevent-users-from-disjoining-from-domain-using-gpo.html"></g:plusone>
			</div>
			<div style="float:left; width:95px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;">
			<a href="http://twitter.com/share" class="twitter-share-button" data-url="http://www.kreslavsky.com/2009/10/prevent-users-from-disjoining-from-domain-using-gpo.html"  data-text="Prevent users from disjoining from domain using GPO" data-count="horizontal">Tweet</a>
			</div><div style="float:left; width:105px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;"><script type="in/share" data-url="http://www.kreslavsky.com/2009/10/prevent-users-from-disjoining-from-domain-using-gpo.html" data-counter="right"></script></div>			
			<div style="float:left; width:85px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;"><script src="http://www.stumbleupon.com/hostedbadge.php?s=1&amp;r=http://www.kreslavsky.com/2009/10/prevent-users-from-disjoining-from-domain-using-gpo.html"></script></div>			
			</div><div style="clear:both"></div><div style="padding-bottom:4px;"></div><p>&#160;</p>
<p>There is no 100% foolproof&#160; solution that blocks local admin users access the option of disjoining their computer from domain , but you can make it harder to get to system menu.</p>
<p>I remove the &quot;properties&quot; from when you right click on my computer.    <br />Then i also remove system applet from control panel menu ,and disable registry editing.</p>
<p>To disable right click on my computer go to Group Policy.    <br />Navigate to&#160; User Configuration&gt;Administrative templates&gt;Desktop     <br />Locate “Remove Properties from the My Computer context menu” and set it to “<strong>Enable</strong>” </p>
<p>You should check also <a href="http://www.kreslavsky.com/2009/10/block-access-to-my-computer-properties-menu-in-windows-7-and-vista.html" target="_blank">How disable&#160; Right Click Properties on my computer on windows 7/Vista</a>    </p>
<p><a href="http://www.kreslavsky.com/wp-content/uploads/2009/10/image23.png"><img style="border-right-width: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px" title="Remove Properties from the My Computer" border="0" alt="Remove Properties from the My Computer" src="http://www.kreslavsky.com/wp-content/uploads/2009/10/image_thumb23.png" width="365" height="405" /></a> </p>
<pre>Than navigate to User Configuration&gt;Administrative templates&gt;Control PanelLocate “Hide specified Control Panel applets”Set it to “Enabled” and add <strong>Sysdm.cpl</strong> to the list of disallowed Control Panel applets.</pre>
<p><a href="http://www.kreslavsky.com/wp-content/uploads/2009/10/image24.png"><img style="border-right-width: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px" title="list of disallowed Control Panel applets" border="0" alt="list of disallowed Control Panel applets" src="http://www.kreslavsky.com/wp-content/uploads/2009/10/image_thumb24.png" width="399" height="376" /></a> </p>
<p>To block <strong>Sysdm.cpl</strong>&#160; from executing </p>
<p>Navigate to User Configuration&gt;Administrative Templates&gt;System </p>
<p>Navigate to “Don’t run specified Windows application” set it to “Enabled” and add <strong>Sysdm.cpl</strong>&#160; to the list of disallowed applications</p>
<p><a href="http://www.kreslavsky.com/wp-content/uploads/2009/10/image25.png"><img style="border-right-width: 0px; display: inline; border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px" title="Don’t run specified Windows application" border="0" alt="Don’t run specified Windows application" src="http://www.kreslavsky.com/wp-content/uploads/2009/10/image_thumb25.png" width="400" height="240" /></a></p>
]]></content:encoded>
			<wfw:commentRss>http://www.kreslavsky.com/2009/10/prevent-users-from-disjoining-from-domain-using-gpo.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Prevent users from deleting start menu items via GPO</title>
		<link>http://www.kreslavsky.com/2009/03/prevent-users-from-deleting-start-menu-items-via-gpo.html</link>
		<comments>http://www.kreslavsky.com/2009/03/prevent-users-from-deleting-start-menu-items-via-gpo.html#comments</comments>
		<pubDate>Sun, 29 Mar 2009 21:51:00 +0000</pubDate>
		<dc:creator>Gil Kreslavsky</dc:creator>
				<category><![CDATA[Active Directory]]></category>
		<category><![CDATA[GPO]]></category>
		<category><![CDATA[Vista]]></category>
		<category><![CDATA[Windows 7]]></category>
		<category><![CDATA[Windows XP]]></category>
		<category><![CDATA[Block taskbar]]></category>
		<category><![CDATA[Gpo]]></category>
		<category><![CDATA[preven task bar changes]]></category>
		<category><![CDATA[Windows Server]]></category>

		<guid isPermaLink="false">http://www.kreslavsky.com/2009/03/prevent-users-from-deleting-start-menu-items-via-gpo.html</guid>
		<description><![CDATA[Tweet Open Group Policy Editor: Link Policy to relevant OU Navigate to User Configuration&#62;Administrative Templates&#62;Start menu and taskbar. Edit “Prevent Changes to Taskbar and Start Menu Settings” Set it to enable Pres OK Note: To enforce group policy: Navigate to Start&#62;Run type gpupdate /force and hit Enter]]></description>
			<content:encoded><![CDATA[<div class="bottomcontainerBox" style="border:1px solid #808080;background-color:#F0F4F9;">
			<div style="float:left; width:85px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;">
			<iframe src="http://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.kreslavsky.com%2F2009%2F03%2Fprevent-users-from-deleting-start-menu-items-via-gpo.html&amp;layout=button_count&amp;show_faces=false&amp;width=85&amp;action=like&amp;font=verdana&amp;colorscheme=light&amp;height=21" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width=85px; height:21px;" allowTransparency="true"></iframe></div>
			<div style="float:left; width:80px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;">
			<g:plusone size="medium" href="http://www.kreslavsky.com/2009/03/prevent-users-from-deleting-start-menu-items-via-gpo.html"></g:plusone>
			</div>
			<div style="float:left; width:95px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;">
			<a href="http://twitter.com/share" class="twitter-share-button" data-url="http://www.kreslavsky.com/2009/03/prevent-users-from-deleting-start-menu-items-via-gpo.html"  data-text="Prevent users from deleting start menu items via GPO" data-count="horizontal">Tweet</a>
			</div><div style="float:left; width:105px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;"><script type="in/share" data-url="http://www.kreslavsky.com/2009/03/prevent-users-from-deleting-start-menu-items-via-gpo.html" data-counter="right"></script></div>			
			<div style="float:left; width:85px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;"><script src="http://www.stumbleupon.com/hostedbadge.php?s=1&amp;r=http://www.kreslavsky.com/2009/03/prevent-users-from-deleting-start-menu-items-via-gpo.html"></script></div>			
			</div><div style="clear:both"></div><div style="padding-bottom:4px;"></div><ul>
<li>Open Group Policy Editor:</li>
<li>Link Policy to relevant OU</li>
<li>Navigate to User Configuration&gt;Administrative Templates&gt;Start menu and taskbar.</li>
<li>Edit “Prevent Changes to Taskbar and Start Menu Settings”</li>
<li>Set it to enable     <br /><a href="http://www.kreslavsky.com/wp-content/uploads/2009/03/preventchangestotaskbar.jpg"><img title="Prevent Changes to taskbar" style="border-right: 0px; border-top: 0px; display: inline; border-left: 0px; border-bottom: 0px" height="244" alt="Prevent Changes to taskbar" src="http://www.kreslavsky.com/wp-content/uploads/2009/03/preventchangestotaskbar-thumb.jpg" width="220" border="0" /></a> </li>
<li>Pres OK</li>
</ul>
<blockquote><p>Note: To enforce group policy: Navigate to Start&gt;Run type gpupdate /force and hit Enter</p>
</blockquote>
]]></content:encoded>
			<wfw:commentRss>http://www.kreslavsky.com/2009/03/prevent-users-from-deleting-start-menu-items-via-gpo.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>How to apply Windows 2008 gpo when you have 2003 DC&#8217;s only</title>
		<link>http://www.kreslavsky.com/2009/02/how-to-apply-windows-2008-gpo-when-you-have-2003-dcs-only.html</link>
		<comments>http://www.kreslavsky.com/2009/02/how-to-apply-windows-2008-gpo-when-you-have-2003-dcs-only.html#comments</comments>
		<pubDate>Mon, 02 Feb 2009 13:55:46 +0000</pubDate>
		<dc:creator>Gil Kreslavsky</dc:creator>
				<category><![CDATA[Active Directory]]></category>
		<category><![CDATA[GPO]]></category>
		<category><![CDATA[Microsoft]]></category>
		<category><![CDATA[Server 2003]]></category>
		<category><![CDATA[Server 2008]]></category>
		<category><![CDATA[Vista]]></category>
		<category><![CDATA[Adm]]></category>
		<category><![CDATA[Administration Tools]]></category>
		<category><![CDATA[Adprep]]></category>
		<category><![CDATA[Amp Features]]></category>
		<category><![CDATA[Desktop]]></category>
		<category><![CDATA[Domain Controler]]></category>
		<category><![CDATA[Domain Controller]]></category>
		<category><![CDATA[Forestprep]]></category>
		<category><![CDATA[Goodies]]></category>
		<category><![CDATA[Gpo]]></category>
		<category><![CDATA[Infrastructure Operations]]></category>
		<category><![CDATA[New Features]]></category>
		<category><![CDATA[Policy Management Tools]]></category>
		<category><![CDATA[Relevant Feature]]></category>
		<category><![CDATA[Schema]]></category>
		<category><![CDATA[Terminal Servers]]></category>
		<category><![CDATA[Vista X86]]></category>
		<category><![CDATA[Windows Features]]></category>
		<category><![CDATA[Windows Templates]]></category>

		<guid isPermaLink="false">http://www.kreslavsky.com/?p=549</guid>
		<description><![CDATA[Tweet Recently I installed 2 2008 terminal servers , and when I started configuring them I realized that I can&#8217;t use lot of new features that are available only via 2008 Group Policy . The network was 2003 , and adding or upgrading current DC to 2008 domain controller rises project costs ( 2008 CAL&#8217;s for entire domain ) I had to look for other solution . Since windows 2008 GPO templates changed their format from ADM to ADMX I couldn&#8217;t import windows 2008 templates to windows 2003 DC. So here how you solve this. You must use Vista +sp1 Desktop First , you need to extend your schema to 2008 The first schema updates need to be applied to the Active Directory Forest. In order to apply them you need to run the adprep application from the domain controller that holds the schema role master. To run the forest schema updates use the following command: adprep /forestprep Once the forest updates have been updates, the next step is to run the adprep for each domain in the forest. This should be run on the domain controller that holds the Infrastructure operations master role. The command to run is: adprep /domainprep After you finish with with schema expansion Go to your Vista desktop. Download RSAT tool for vista x64 and for vista x86 and install it After instalation is completed. Go to Control Panel click on Program &#38; Features Locate and click on Turn Windows features on or off Install relevant Feature Administration and Role Administration tools (For group policy install Group Policy Management Tools) Now you can use all Windows 2008 and Vista  GPO goodies on your windows 2003 domain .]]></description>
			<content:encoded><![CDATA[<div class="bottomcontainerBox" style="border:1px solid #808080;background-color:#F0F4F9;">
			<div style="float:left; width:85px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;">
			<iframe src="http://www.facebook.com/plugins/like.php?href=http%3A%2F%2Fwww.kreslavsky.com%2F2009%2F02%2Fhow-to-apply-windows-2008-gpo-when-you-have-2003-dcs-only.html&amp;layout=button_count&amp;show_faces=false&amp;width=85&amp;action=like&amp;font=verdana&amp;colorscheme=light&amp;height=21" scrolling="no" frameborder="0" style="border:none; overflow:hidden; width=85px; height:21px;" allowTransparency="true"></iframe></div>
			<div style="float:left; width:80px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;">
			<g:plusone size="medium" href="http://www.kreslavsky.com/2009/02/how-to-apply-windows-2008-gpo-when-you-have-2003-dcs-only.html"></g:plusone>
			</div>
			<div style="float:left; width:95px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;">
			<a href="http://twitter.com/share" class="twitter-share-button" data-url="http://www.kreslavsky.com/2009/02/how-to-apply-windows-2008-gpo-when-you-have-2003-dcs-only.html"  data-text="How to apply Windows 2008 gpo when you have 2003 DC&#8217;s only" data-count="horizontal">Tweet</a>
			</div><div style="float:left; width:105px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;"><script type="in/share" data-url="http://www.kreslavsky.com/2009/02/how-to-apply-windows-2008-gpo-when-you-have-2003-dcs-only.html" data-counter="right"></script></div>			
			<div style="float:left; width:85px;padding-right:10px; margin:4px 4px 4px 4px;height:30px;"><script src="http://www.stumbleupon.com/hostedbadge.php?s=1&amp;r=http://www.kreslavsky.com/2009/02/how-to-apply-windows-2008-gpo-when-you-have-2003-dcs-only.html"></script></div>			
			</div><div style="clear:both"></div><div style="padding-bottom:4px;"></div><p>Recently I installed 2 2008 terminal servers , and when I started configuring them I realized that I can&#8217;t use lot of new features that are available only via 2008 Group Policy . The network was 2003 , and adding or upgrading current DC to 2008 domain controller rises project costs ( 2008 CAL&#8217;s for entire domain ) I had to look for other solution .</p>
<p>Since windows 2008 GPO templates changed their format from <strong>ADM to ADMX</strong> I couldn&#8217;t import windows 2008 templates to windows 2003 DC.</p>
<p>So here how you solve this.</p>
<p>You must use Vista +sp1 Desktop</p>
<p>First , you need to extend your schema to 2008<br />
The first schema updates need to be applied to the Active Directory Forest. In order to apply them you need to run the adprep application <strong>from the domain controller that holds the schema role master</strong>. To run the forest schema updates use the following command: <strong><em>adprep /forestprep </em></strong></p>
<p><strong><em><br />
<img class="alignleft size-full wp-image-550" title="forest-prep" src="http://www.kreslavsky.com/wp-content/uploads/2009/02/forest-prep.png" alt="forest-prep" width="559" height="276" /></em></strong><br />
Once the forest updates have been updates, the next step is to run the adprep for each domain in the forest. This should be run on the domain controller that holds the Infrastructure operations master role. The command to run is: <strong><em>adprep /domainprep</em></strong></p>
<p><strong><em><img class="alignleft size-full wp-image-551" title="domain-prep" src="http://www.kreslavsky.com/wp-content/uploads/2009/02/domain-prep.png" alt="domain-prep" width="565" height="281" /></em></strong></p>
<p><span style="font-family: tahoma,arial,helvetica,sans-serif;">After you finish with with schema expansion </span></p>
<p><em>Go to your Vista desktop.<br />
Download </em>RSAT tool for vista <a href="http://www.microsoft.com/downloads/details.aspx?FamilyId=D647A60B-63FD-4AC5-9243-BD3C497D2BC5&amp;displaylang=en" target="_blank">x64</a> and for vista <a href="http://www.microsoft.com/downloads/details.aspx?FamilyId=9FF6E897-23CE-4A36-B7FC-D52065DE9960&amp;displaylang=en" target="_blank">x86 </a>and install it</p>
<p>After instalation is completed.</p>
<ul>
<li>Go to Control Panel click on <strong>Program &amp; Features</strong></li>
<li>Locate and click on <strong>Turn Windows features on or off</strong></li>
<li>Install relevant Feature Administration and Role Administration tools (For group policy install Group Policy Management Tools)<strong></strong><strong></strong></li>
</ul>
<p><strong></strong><img class="alignleft size-full wp-image-552" title="vista_remote_server_admin_tools" src="http://www.kreslavsky.com/wp-content/uploads/2009/02/vista_remote_server_admin_tools_13.png" alt="vista_remote_server_admin_tools" width="388" height="339" /></p>
<p><strong><br />
</strong></p>
<p>Now you can use all Windows 2008 and Vista  GPO goodies on your windows 2003 domain .</p>
]]></content:encoded>
			<wfw:commentRss>http://www.kreslavsky.com/2009/02/how-to-apply-windows-2008-gpo-when-you-have-2003-dcs-only.html/feed</wfw:commentRss>
		<slash:comments>10</slash:comments>
		</item>
	</channel>
</rss>

