Group Policy Centralhttps://grouppolicy.biz/atom.xmlHistorical tutorials, news and guidance for Windows Group Policy administrators.Group Policy Central2019-07-25T01:17:05ZEdge Chromium IE Mode Now Workshttps://grouppolicy.biz/2019/07/edge-chromium-ie-mode-now-works/2019-07-25T01:17:05Z2019-07-25T01:17:05ZIn the past few weeks there has been a lot of post about the new Enterprise features coming with the new Edge Chromium version of the browser. Unfortunately the main feature that enterprises were waiting for did not work... until today. One of the key new policy setting that came with the Edge 77 ADMX/ADML files is called "Configure Internet Explorer integration". This setting can be found under "Edge Chromium Group Policy Settingshttps://grouppolicy.biz/2019/06/edge-chromium-group-policy-settings/2019-06-19T23:00:17Z2019-06-19T23:00:17ZFor all of its issues, Internet Explorer has been the most prolific Group Policy enabled applications ever released. Even the recent versions of Edge with Windows 10 still does not hold up to the old versions of IE when it comes to sheer number of supported settings. This rightly or wrongly gave Group Policy administrators a near infinite of ways to configure the browser. However the far more popuSecurity Baseline template for Windows 1903https://grouppolicy.biz/2019/05/security-baseline-template-for-windows-1903/2019-05-27T00:40:18Z2019-05-27T00:40:18ZMicrosoft has released the latest security template for Windows version (Windows 10 and Windows Server) 1903. These templates contain updated guidance and recommendations as to what setting should or should not be configured to your domain joined PC. The security template is actually just a bunch of reports, documents, GPO backups and tools that are consolidated in a s single ZIP file. They are reNew and Fixed Group Policy Setting with Windows 10 KB4490481https://grouppolicy.biz/2019/04/new-and-fixed-group-policy-setting-with-windows-10-kb4490481/2019-04-02T22:32:38Z2019-04-02T22:32:38ZMicrosoft has just released a new rollout KB hotfix for Windows 10 on the 1st April (not joking). What is notable about this update is there is a couple of Group Policy settings that have been fixed and added. First one is only minor and they have resolved an issues with the policy setting "Turn off app notifications on the lock screen" which can be found under Computer Configuration > AdministratSecurity Baseline Recommendation for Windows 10 1809https://grouppolicy.biz/2018/11/security-baseline-recommendation-for-windows-10-1809/2018-11-21T02:55:04Z2018-11-21T02:55:04ZAfter its initial release and then withdrawal of Windows 10 1809 update due to a number of potential data loss issues, Microsoft has now again released the OS to wide scale deployment. As a such a number of other release have now come from Microsoft, namely the Security Baseline templates GPO's, documentation with recommended guidance and scripts to help secure your OS. With each version release oNew Microsoft Edge MDM and Group Policy Settingshttps://grouppolicy.biz/2018/07/new-microsoft-edge-mdm-and-group-policy-settings/2018-07-19T04:47:32Z2018-07-19T04:47:32ZMicrosoft just documented the new policy setting for Microsoft Edge. These settings can be configured via both MDM and Group Policy. To get use the policy settings you need to be running at least Windows 10 Preview build 17718. Then you can then install Group Policy management Console (now part of Core OS) and trial the new Policy settings. For a full list of policy settings and documentation checMicrosoft releases V2 of the Windows 1803 Administrative Templates Packhttps://grouppolicy.biz/2018/07/microsoft-releases-v2-of-the-windows-1803-administrative-templates-pack/2018-07-17T03:07:11Z2018-07-17T03:07:11ZBack in May 2018 Microsoft released the Windows 1803 ADMX/ADML file pack . This was par for the course as with each release of Windows Microsoft would also release a new version of the ADMX/ADML Administrative Templates Pack. However, the release in May could cause an error in GPMC if you had previously had an old version of the SerachOCR.ADMX file. This was due to the SearchOCR.ADMX file being miGroup Policy Hotfix for Defender Mitigation Options Errorhttps://grouppolicy.biz/2018/07/group-policy-hotfix-for-defender-mitigation-options-error/2018-07-12T07:54:00Z2018-07-12T07:54:00ZJust a quick note that Microsoft has recently release a hot fix KB4338819 that fixes and issue with the Mitigation option. This is a Windows Defender setting that can be found under the Administrative Templates>Computers>System>Mitigation Options setting. The fix is described as: Addresses an issue that may cause the Mitigation Options Group Policy client-side extension to fail during GPO processiRemote Server Admin Tools Now provided in Windows 10https://grouppolicy.biz/2018/06/remote-server-admin-tools-now-provided-in-windows-10/2018-05-31T23:55:22Z2018-05-31T23:55:22ZIf you have followed this blog you would know that the Remote Server Admin Tools are an essential set of tools for managed Group Policy, Active Directory and almost all other core components of Windows Server. These tools can be installed on demand if you are running Windows Server. But if you wanted to do the remote management from a Windows Client OS then you needed to download and install the RChanges to how the Start Menu is Managed using Group Policyhttps://grouppolicy.biz/2018/05/changes-to-how-the-start-menu-is-managed-using-group-policy/2018-05-29T16:02:31Z2018-05-29T16:02:31ZMatt Call from Microsoft has just blog the different with describes the impact of no longer being able to customise the Windows Start menu using the Default Users Profile. In case you did not know you could previously set a users start menu by baking the layout into the Windows OS image default users profile by using a CopyProfile process. This has now been removed and his article goes into how toWindows 10 1803 Group Policy and Security Baseline Templatehttps://grouppolicy.biz/2018/05/17238/2018-05-28T16:00:45Z2018-05-28T16:00:45ZThe latest version of the Windows 10 1803 security templates have been released to the public. These are the new Microsoft recommend guidance for securing Windows in an organisation. These settings are normally tighter than the Out of the Box settings, but are normally acceptable in a workplace environment. Historically these used to be available via the Microsoft Security Management Tool, howeverGroup Policy Updated to support 20 Character Minimum Password Lengthhttps://grouppolicy.biz/2018/05/group-policy-updated-to-support-20-character-minimum-password-length/2018-05-28T00:33:05Z2018-05-28T00:33:05ZUntil recently it was not possible to set the default domain password length via GPMC to anything longer that 14 characters (see below). This limit was enforced via the UI but it was possible to set a password value longer manually if the user chose a longer password. Most likely the reason that this limit was enforced was that the LM Password hash limit for Windows 98 and NT 4 was 14 characters. Remote Server Admin Tools for Windows 10 1803https://grouppolicy.biz/2018/05/whats-new-with-group-policy-in-windows-10-1803/2018-05-27T22:42:26Z2018-05-27T22:42:26ZMicrosoft has now release the production version of the Remote Server Admin Tools. These are of course the essential tools that for managing Group Policy (and many other server functions). As I always remind you it is imperative that you always have the latest version of GPMC as this is the most current version of the Group Policy tools. You can now download them now from https://www.microsoft.comHow to fix SearchOCS.ADMX Error after upgrade to Windows 1803 ADMX fileshttps://grouppolicy.biz/2018/05/how-to-fix-searchocs-admx-error-after-upgrade-to-windows-1803-admx-files/2018-05-21T00:09:27Z2018-05-21T00:09:27ZWith the recent release of the Windows 10 1803 Microsoft also released a new version of the ADMX/ADML files that corresponds to the new Group Polices with the OS (see https://www.grouppolicy.biz/2018/05/administrative-template-for-windows-10-1803/ ) . Normally upgrading these policy files are as simple overwriting them into your "PolicyDefinitions" folder in your SYSVOL. However the SearchOCR.ADMXAdministrative Template for Windows 10 1803https://grouppolicy.biz/2018/05/administrative-template-for-windows-10-1803/2018-05-20T13:58:05Z2018-05-20T13:58:05ZWith every new version of Windows Microsoft releases more Group Policy settings to support newer features. Ever since the release of Windows 7 all the new Group Policy settings have been exclusive released as Administrative Templates. These Administrative Templates (a.k.a. ADMX) files are text files that are used to define the Group Policy Administrative Template settings. There are always two wayWhat is Windows Admin Centerhttps://grouppolicy.biz/2018/05/17240/2018-05-16T05:57:14Z2018-05-16T05:57:14ZHave you ever found it hard to figure out what tool you need to manage Windows, sometime it's an MMC other times you need to go via Control Panel or you need to launch Server Manager? To help with this Microsoft has now released Windows Admin Center so that IT admin can now use a single UI pane to manage the most common admin tasks. This tool is a web-based system that works with either Chrome or How to implement the ASD Essential 8 via Group Policyhttps://grouppolicy.biz/2018/03/how-to-implement-the-asd-essential-8-via-group-policy/2018-03-28T00:28:10Z2018-03-28T00:28:10ZThe Australian Government Department called the Australian Signals Directorate has a list of mitigation strategies that is used to help protect IT system against security risks. This list is called the " ASD Essential 8 ". While this its generated by the Australian Government department it is an excellent starting point for securing any organisation or government IT Assets. The really great thing Remote Server Admin Tools (a.k.a RSAT) for Windows 10 v1803 Redstone 4https://grouppolicy.biz/2018/03/remote-server-admin-tools-a-k-a-rsat-for-windows-10-v1803-redstone-4/2018-03-27T23:11:55Z2018-03-27T23:11:55ZMicrosoft has release a new version of the Windows 10 Remote Server Admin Tools for builds of Windows 10 17110 or higher. While it was normally practice for Microsoft to release a new RSAT version with every release of a Windows client OS in recent years they have been releasing these tools less frequently (see https://www.grouppolicy.biz/2017/04/microsoft-will-not-be-releasing-remote-server-adminSecurity Baseline Teamplate for Windows 10 v1803 Redstone 4 "Drafthttps://grouppolicy.biz/2018/03/security-baseline-teamplate-for-windows-10-v1803-redstone-4-draft/2018-03-27T22:47:17Z2018-03-27T22:47:17ZMicrosoft is hurtling toward the end of development of the latest version of Windows 10 v1803 (which ironically will be released in April) and as such they have now release the near final version to the Windows Insider Fast Ring . In conjunction with this they have also released a new draft security baseline configuration to be used for securing the OS with recommended settings. In case you missedBlocked Site Based GPO due to Blocked SOMhttps://grouppolicy.biz/2018/01/blocked-site-based-gpo-due-blocked-som/2018-01-19T03:58:51Z2018-01-19T03:58:51ZI recently came across a problem with applying a site linked GPO to some Citrix servers that were giving Blocked SOM (see below) as the reason for being denied. For the longest time I could not figure out why the GPO was being blocked. It was then with some help that I found out that the computer was in an OU that had blocked Inheritance enabled. This meant that Windows also blocked site link GPO Group Policy Resources for Windows 10 build 1709https://grouppolicy.biz/2017/10/group-policy-resources-windows-10-build-1709/2017-10-24T05:53:46Z2017-10-24T05:53:46ZWindows 10 a.k.a. Redstone 3, a.k.a. 1709 a.k.a. Fall Creators Update has now been released to the public for download. If you would like to get a copy of the new version early to start testing you can download the PRO version using the Windows 10 ISO/USB download tool at https://www.microsoft.com/en-au/software-download/windows10 . Alternatively, you can download the images from your MSDN or VoluWhy you should never use a Preshared Key with IPSEChttps://grouppolicy.biz/2017/08/why-you-should-never-use-preshared-key-with-ipsec/2017-08-07T00:28:00Z2017-08-07T00:28:00ZIPSEC is an amazing, but not often used technology that allows you to authenticate, allow, deny, protect and/or encrypt network traffic between windows and non-window computers. It has been around since at least Windows 2000 days but it is some time difficult to set up. Recently, Microsoft has released a how to article explaining how you can use it to restrict network connections to your domain coHow to Disable SMB1 using Group Policy Administrative Templateshttps://grouppolicy.biz/2017/06/disable-smb1-using-group-policy-administrative-templates/2017-06-16T04:51:21Z2017-06-16T04:51:21ZSo, incase you have not heard, SMB1 is Bad... Really BAD. Not only is it woefully old and inefficient protocol it's also now widely known to be the attack vector for the recent WannaCry virus. By now you probably have seen my very popular previous blog post called How to disable SMB 1 on Windows 7 via Group Policy to Prevent WannaCry . This article explains how to disable SMB1 Server and Client prDoes Windows 10 S Support Group Policy?https://grouppolicy.biz/2017/06/windows-10-s-support-group-policy/2017-06-06T03:55:23Z2017-06-06T03:55:23ZRecently Microsoft has revealed there will be a new SKU of Windows 10 that will only run signed Apps from the Windows App Store. This new version of the OS will be called Windows 10 S. This version of the OS is specifically designed to only be able to run Universal Windows Platform (a.k.a. UWP) or Centennial packaged apps. This give the OS the advantage of being able to run only application that hWindows 10 on ARM Group Policy Supporthttps://grouppolicy.biz/2017/06/windows-10-arm-group-policy-support/2017-06-02T03:50:36Z2017-06-02T03:50:36ZMicrosoft has release a video on Channel 9 called Windows 10 on ARM which mostly answers the question, does Windows 10 on ARM support Group Policy. This is of course an important question as the earlier version of Windows that ran on an ARM processor was Windows RT and it only have very limited local group policy support (see How to enable and configure Group Policy settings in Windows RT ). So doManaging ADMX and ADML files for Windows 10https://grouppolicy.biz/2017/05/managing-admx-adml-files-windows-10/2017-05-05T04:30:55Z2017-05-05T04:30:55ZWith the release of Windows 10 1703 (a.k.a. Redstone 2, a.k.a. Creators update) Microsoft has again release the ADMX files for the new version of the OS. It's important to update these files every time there is a new OS release as they contain all the new Administrative Template policy settings. ADMX/ADML files were introduces over 10 years ago with Windows Vista, there were two type of files; ADMMicrosoft will not be releasing Remote Server Admin Tools (RSAT) for Windows 10 Redstone 2https://grouppolicy.biz/2017/04/microsoft-will-not-be-releasing-remote-server-admin-tools-rsat-for-windows-10-redstone-2/2017-04-09T22:35:02Z2017-04-09T22:35:02ZEvery time Microsoft releases a version of Windows 10 they also release a new version of the Remote Server Admin Tools. These tools are of course very important for any Group Policy Administrator as they contain the latest version of the Group Policy Management Console (GPMC). However, with this release of Windows 10 history is going to change. This time, Microsoft is NOT going to be releasing a nHow to disable SMB 1 on Windows 7 via Group Policy to Prevent WannaCryhttps://grouppolicy.biz/2017/03/how-to-disable-smb-1-on-windows-7-via-group-policy/2017-03-27T04:49:48Z2017-03-27T04:49:48ZUpdate 1: These instructions will mitigate WannaCry / Wcry / WannaCrypt virus propagation on Windows 7 and later (Windows 10 is not affected). For more technical details about the virus see Troy Hunts blog at https://www.troyhunt.com/everything-you-need-to-know-about-the-wannacrypt-ransomware/ In case you have not got the message yet SMB 1 protocol Bad and that according to Microsoft you should "SHow to disable SSL v2 and SSL v3 on Windows Server via Group Policyhttps://grouppolicy.biz/2017/03/disable-ssl-v2-ssl-v3-windows-server-via-group-policy/2017-03-22T04:17:36Z2017-03-22T04:17:36ZIn this article I will show you how to disable the SSL v2 and SSL v3 protocols on the Windows Server so that it no longer offers the depreciated (a.k.a. Broken) SSL v2 and v3 security protocols. It also does not hurt if you apply this policy settings to your Windows client computers in case any of them have IIS with digital certificate enabled. Note: That if you are running a non Microsoft web serHow to disable SSL v2 and SSL v3 on the client via Group Policyhttps://grouppolicy.biz/2017/03/disable-ssl-v2-ssl-v3-client-via-group-policy/2017-03-15T01:07:49Z2017-03-15T01:07:49ZThis article will show you how to disabled SSL v2 and SSL v3 on browsers on the client using Group Policy. SSL v2 and SSL v3 protocols for a long time has been considered to be broken protocols thanks to the many vulnerabilities found in these protocols like BEAST and POODLE to name but a few. While all newer browsers no longer have these protocols supports enabled by default you still might be Bu