https://grouppolicy.biz/Historical tutorials, news and guidance for Windows Group Policy administrators.https://grouppolicy.biz/2019/07/edge-chromium-ie-mode-now-works/https://grouppolicy.biz/2019/07/edge-chromium-ie-mode-now-works/Thu, 25 Jul 2019 01:17:05 GMTIn the past few weeks there has been a lot of post about the new Enterprise features coming with the new Edge Chromium version of the browser. Unfortunately the main feature that enterprises were waiting for did not work... until today. One of the key new policy setting that came with the Edge 77 ADMX/ADML files is called "Configure Internet Explorer integration". This setting can be found under "https://grouppolicy.biz/2019/06/edge-chromium-group-policy-settings/https://grouppolicy.biz/2019/06/edge-chromium-group-policy-settings/Wed, 19 Jun 2019 23:00:17 GMTFor all of its issues, Internet Explorer has been the most prolific Group Policy enabled applications ever released. Even the recent versions of Edge with Windows 10 still does not hold up to the old versions of IE when it comes to sheer number of supported settings. This rightly or wrongly gave Group Policy administrators a near infinite of ways to configure the browser. However the far more popuhttps://grouppolicy.biz/2019/05/security-baseline-template-for-windows-1903/https://grouppolicy.biz/2019/05/security-baseline-template-for-windows-1903/Mon, 27 May 2019 00:40:18 GMTMicrosoft has released the latest security template for Windows version (Windows 10 and Windows Server) 1903. These templates contain updated guidance and recommendations as to what setting should or should not be configured to your domain joined PC. The security template is actually just a bunch of reports, documents, GPO backups and tools that are consolidated in a s single ZIP file. They are rehttps://grouppolicy.biz/2019/04/new-and-fixed-group-policy-setting-with-windows-10-kb4490481/https://grouppolicy.biz/2019/04/new-and-fixed-group-policy-setting-with-windows-10-kb4490481/Tue, 02 Apr 2019 22:32:38 GMTMicrosoft has just released a new rollout KB hotfix for Windows 10 on the 1st April (not joking). What is notable about this update is there is a couple of Group Policy settings that have been fixed and added. First one is only minor and they have resolved an issues with the policy setting "Turn off app notifications on the lock screen" which can be found under Computer Configuration > Administrathttps://grouppolicy.biz/2018/11/security-baseline-recommendation-for-windows-10-1809/https://grouppolicy.biz/2018/11/security-baseline-recommendation-for-windows-10-1809/Wed, 21 Nov 2018 02:55:04 GMTAfter its initial release and then withdrawal of Windows 10 1809 update due to a number of potential data loss issues, Microsoft has now again released the OS to wide scale deployment. As a such a number of other release have now come from Microsoft, namely the Security Baseline templates GPO's, documentation with recommended guidance and scripts to help secure your OS. With each version release ohttps://grouppolicy.biz/2018/07/new-microsoft-edge-mdm-and-group-policy-settings/https://grouppolicy.biz/2018/07/new-microsoft-edge-mdm-and-group-policy-settings/Thu, 19 Jul 2018 04:47:32 GMTMicrosoft just documented the new policy setting for Microsoft Edge. These settings can be configured via both MDM and Group Policy. To get use the policy settings you need to be running at least Windows 10 Preview build 17718. Then you can then install Group Policy management Console (now part of Core OS) and trial the new Policy settings. For a full list of policy settings and documentation chechttps://grouppolicy.biz/2018/07/microsoft-releases-v2-of-the-windows-1803-administrative-templates-pack/https://grouppolicy.biz/2018/07/microsoft-releases-v2-of-the-windows-1803-administrative-templates-pack/Tue, 17 Jul 2018 03:07:11 GMTBack in May 2018 Microsoft released the Windows 1803 ADMX/ADML file pack . This was par for the course as with each release of Windows Microsoft would also release a new version of the ADMX/ADML Administrative Templates Pack. However, the release in May could cause an error in GPMC if you had previously had an old version of the SerachOCR.ADMX file. This was due to the SearchOCR.ADMX file being mihttps://grouppolicy.biz/2018/07/group-policy-hotfix-for-defender-mitigation-options-error/https://grouppolicy.biz/2018/07/group-policy-hotfix-for-defender-mitigation-options-error/Thu, 12 Jul 2018 07:54:00 GMTJust a quick note that Microsoft has recently release a hot fix KB4338819 that fixes and issue with the Mitigation option. This is a Windows Defender setting that can be found under the Administrative Templates>Computers>System>Mitigation Options setting. The fix is described as: Addresses an issue that may cause the Mitigation Options Group Policy client-side extension to fail during GPO processihttps://grouppolicy.biz/2018/06/remote-server-admin-tools-now-provided-in-windows-10/https://grouppolicy.biz/2018/06/remote-server-admin-tools-now-provided-in-windows-10/Thu, 31 May 2018 23:55:22 GMTIf you have followed this blog you would know that the Remote Server Admin Tools are an essential set of tools for managed Group Policy, Active Directory and almost all other core components of Windows Server. These tools can be installed on demand if you are running Windows Server. But if you wanted to do the remote management from a Windows Client OS then you needed to download and install the Rhttps://grouppolicy.biz/2018/05/changes-to-how-the-start-menu-is-managed-using-group-policy/https://grouppolicy.biz/2018/05/changes-to-how-the-start-menu-is-managed-using-group-policy/Tue, 29 May 2018 16:02:31 GMTMatt Call from Microsoft has just blog the different with describes the impact of no longer being able to customise the Windows Start menu using the Default Users Profile. In case you did not know you could previously set a users start menu by baking the layout into the Windows OS image default users profile by using a CopyProfile process. This has now been removed and his article goes into how tohttps://grouppolicy.biz/2018/05/17238/https://grouppolicy.biz/2018/05/17238/Mon, 28 May 2018 16:00:45 GMTThe latest version of the Windows 10 1803 security templates have been released to the public. These are the new Microsoft recommend guidance for securing Windows in an organisation. These settings are normally tighter than the Out of the Box settings, but are normally acceptable in a workplace environment. Historically these used to be available via the Microsoft Security Management Tool, howeverhttps://grouppolicy.biz/2018/05/group-policy-updated-to-support-20-character-minimum-password-length/https://grouppolicy.biz/2018/05/group-policy-updated-to-support-20-character-minimum-password-length/Mon, 28 May 2018 00:33:05 GMTUntil recently it was not possible to set the default domain password length via GPMC to anything longer that 14 characters (see below). This limit was enforced via the UI but it was possible to set a password value longer manually if the user chose a longer password. Most likely the reason that this limit was enforced was that the LM Password hash limit for Windows 98 and NT 4 was 14 characters. https://grouppolicy.biz/2018/05/whats-new-with-group-policy-in-windows-10-1803/https://grouppolicy.biz/2018/05/whats-new-with-group-policy-in-windows-10-1803/Sun, 27 May 2018 22:42:26 GMTMicrosoft has now release the production version of the Remote Server Admin Tools. These are of course the essential tools that for managing Group Policy (and many other server functions). As I always remind you it is imperative that you always have the latest version of GPMC as this is the most current version of the Group Policy tools. You can now download them now from https://www.microsoft.comhttps://grouppolicy.biz/2018/05/how-to-fix-searchocs-admx-error-after-upgrade-to-windows-1803-admx-files/https://grouppolicy.biz/2018/05/how-to-fix-searchocs-admx-error-after-upgrade-to-windows-1803-admx-files/Mon, 21 May 2018 00:09:27 GMTWith the recent release of the Windows 10 1803 Microsoft also released a new version of the ADMX/ADML files that corresponds to the new Group Polices with the OS (see https://www.grouppolicy.biz/2018/05/administrative-template-for-windows-10-1803/ ) . Normally upgrading these policy files are as simple overwriting them into your "PolicyDefinitions" folder in your SYSVOL. However the SearchOCR.ADMXhttps://grouppolicy.biz/2018/05/administrative-template-for-windows-10-1803/https://grouppolicy.biz/2018/05/administrative-template-for-windows-10-1803/Sun, 20 May 2018 13:58:05 GMTWith every new version of Windows Microsoft releases more Group Policy settings to support newer features. Ever since the release of Windows 7 all the new Group Policy settings have been exclusive released as Administrative Templates. These Administrative Templates (a.k.a. ADMX) files are text files that are used to define the Group Policy Administrative Template settings. There are always two wayhttps://grouppolicy.biz/2018/05/17240/https://grouppolicy.biz/2018/05/17240/Wed, 16 May 2018 05:57:14 GMTHave you ever found it hard to figure out what tool you need to manage Windows, sometime it's an MMC other times you need to go via Control Panel or you need to launch Server Manager? To help with this Microsoft has now released Windows Admin Center so that IT admin can now use a single UI pane to manage the most common admin tasks. This tool is a web-based system that works with either Chrome or https://grouppolicy.biz/2018/03/how-to-implement-the-asd-essential-8-via-group-policy/https://grouppolicy.biz/2018/03/how-to-implement-the-asd-essential-8-via-group-policy/Wed, 28 Mar 2018 00:28:10 GMTThe Australian Government Department called the Australian Signals Directorate has a list of mitigation strategies that is used to help protect IT system against security risks. This list is called the " ASD Essential 8 ". While this its generated by the Australian Government department it is an excellent starting point for securing any organisation or government IT Assets. The really great thing https://grouppolicy.biz/2018/03/remote-server-admin-tools-a-k-a-rsat-for-windows-10-v1803-redstone-4/https://grouppolicy.biz/2018/03/remote-server-admin-tools-a-k-a-rsat-for-windows-10-v1803-redstone-4/Tue, 27 Mar 2018 23:11:55 GMTMicrosoft has release a new version of the Windows 10 Remote Server Admin Tools for builds of Windows 10 17110 or higher. While it was normally practice for Microsoft to release a new RSAT version with every release of a Windows client OS in recent years they have been releasing these tools less frequently (see https://www.grouppolicy.biz/2017/04/microsoft-will-not-be-releasing-remote-server-adminhttps://grouppolicy.biz/2018/03/security-baseline-teamplate-for-windows-10-v1803-redstone-4-draft/https://grouppolicy.biz/2018/03/security-baseline-teamplate-for-windows-10-v1803-redstone-4-draft/Tue, 27 Mar 2018 22:47:17 GMTMicrosoft is hurtling toward the end of development of the latest version of Windows 10 v1803 (which ironically will be released in April) and as such they have now release the near final version to the Windows Insider Fast Ring . In conjunction with this they have also released a new draft security baseline configuration to be used for securing the OS with recommended settings. In case you missedhttps://grouppolicy.biz/2018/01/blocked-site-based-gpo-due-blocked-som/https://grouppolicy.biz/2018/01/blocked-site-based-gpo-due-blocked-som/Fri, 19 Jan 2018 03:58:51 GMTI recently came across a problem with applying a site linked GPO to some Citrix servers that were giving Blocked SOM (see below) as the reason for being denied. For the longest time I could not figure out why the GPO was being blocked. It was then with some help that I found out that the computer was in an OU that had blocked Inheritance enabled. This meant that Windows also blocked site link GPO https://grouppolicy.biz/2017/10/group-policy-resources-windows-10-build-1709/https://grouppolicy.biz/2017/10/group-policy-resources-windows-10-build-1709/Tue, 24 Oct 2017 05:53:46 GMTWindows 10 a.k.a. Redstone 3, a.k.a. 1709 a.k.a. Fall Creators Update has now been released to the public for download. If you would like to get a copy of the new version early to start testing you can download the PRO version using the Windows 10 ISO/USB download tool at https://www.microsoft.com/en-au/software-download/windows10 . Alternatively, you can download the images from your MSDN or Voluhttps://grouppolicy.biz/2017/08/why-you-should-never-use-preshared-key-with-ipsec/https://grouppolicy.biz/2017/08/why-you-should-never-use-preshared-key-with-ipsec/Mon, 07 Aug 2017 00:28:00 GMTIPSEC is an amazing, but not often used technology that allows you to authenticate, allow, deny, protect and/or encrypt network traffic between windows and non-window computers. It has been around since at least Windows 2000 days but it is some time difficult to set up. Recently, Microsoft has released a how to article explaining how you can use it to restrict network connections to your domain cohttps://grouppolicy.biz/2017/06/disable-smb1-using-group-policy-administrative-templates/https://grouppolicy.biz/2017/06/disable-smb1-using-group-policy-administrative-templates/Fri, 16 Jun 2017 04:51:21 GMTSo, incase you have not heard, SMB1 is Bad... Really BAD. Not only is it woefully old and inefficient protocol it's also now widely known to be the attack vector for the recent WannaCry virus. By now you probably have seen my very popular previous blog post called How to disable SMB 1 on Windows 7 via Group Policy to Prevent WannaCry . This article explains how to disable SMB1 Server and Client prhttps://grouppolicy.biz/2017/06/windows-10-s-support-group-policy/https://grouppolicy.biz/2017/06/windows-10-s-support-group-policy/Tue, 06 Jun 2017 03:55:23 GMTRecently Microsoft has revealed there will be a new SKU of Windows 10 that will only run signed Apps from the Windows App Store. This new version of the OS will be called Windows 10 S. This version of the OS is specifically designed to only be able to run Universal Windows Platform (a.k.a. UWP) or Centennial packaged apps. This give the OS the advantage of being able to run only application that hhttps://grouppolicy.biz/2017/06/windows-10-arm-group-policy-support/https://grouppolicy.biz/2017/06/windows-10-arm-group-policy-support/Fri, 02 Jun 2017 03:50:36 GMTMicrosoft has release a video on Channel 9 called Windows 10 on ARM which mostly answers the question, does Windows 10 on ARM support Group Policy. This is of course an important question as the earlier version of Windows that ran on an ARM processor was Windows RT and it only have very limited local group policy support (see How to enable and configure Group Policy settings in Windows RT ). So dohttps://grouppolicy.biz/2017/05/managing-admx-adml-files-windows-10/https://grouppolicy.biz/2017/05/managing-admx-adml-files-windows-10/Fri, 05 May 2017 04:30:55 GMTWith the release of Windows 10 1703 (a.k.a. Redstone 2, a.k.a. Creators update) Microsoft has again release the ADMX files for the new version of the OS. It's important to update these files every time there is a new OS release as they contain all the new Administrative Template policy settings. ADMX/ADML files were introduces over 10 years ago with Windows Vista, there were two type of files; ADMhttps://grouppolicy.biz/2017/04/microsoft-will-not-be-releasing-remote-server-admin-tools-rsat-for-windows-10-redstone-2/https://grouppolicy.biz/2017/04/microsoft-will-not-be-releasing-remote-server-admin-tools-rsat-for-windows-10-redstone-2/Sun, 09 Apr 2017 22:35:02 GMTEvery time Microsoft releases a version of Windows 10 they also release a new version of the Remote Server Admin Tools. These tools are of course very important for any Group Policy Administrator as they contain the latest version of the Group Policy Management Console (GPMC). However, with this release of Windows 10 history is going to change. This time, Microsoft is NOT going to be releasing a nhttps://grouppolicy.biz/2017/03/how-to-disable-smb-1-on-windows-7-via-group-policy/https://grouppolicy.biz/2017/03/how-to-disable-smb-1-on-windows-7-via-group-policy/Mon, 27 Mar 2017 04:49:48 GMTUpdate 1: These instructions will mitigate WannaCry / Wcry / WannaCrypt virus propagation on Windows 7 and later (Windows 10 is not affected). For more technical details about the virus see Troy Hunts blog at https://www.troyhunt.com/everything-you-need-to-know-about-the-wannacrypt-ransomware/ In case you have not got the message yet SMB 1 protocol Bad and that according to Microsoft you should "Shttps://grouppolicy.biz/2017/03/disable-ssl-v2-ssl-v3-windows-server-via-group-policy/https://grouppolicy.biz/2017/03/disable-ssl-v2-ssl-v3-windows-server-via-group-policy/Wed, 22 Mar 2017 04:17:36 GMTIn this article I will show you how to disable the SSL v2 and SSL v3 protocols on the Windows Server so that it no longer offers the depreciated (a.k.a. Broken) SSL v2 and v3 security protocols. It also does not hurt if you apply this policy settings to your Windows client computers in case any of them have IIS with digital certificate enabled. Note: That if you are running a non Microsoft web serhttps://grouppolicy.biz/2017/03/disable-ssl-v2-ssl-v3-client-via-group-policy/https://grouppolicy.biz/2017/03/disable-ssl-v2-ssl-v3-client-via-group-policy/Wed, 15 Mar 2017 01:07:49 GMTThis article will show you how to disabled SSL v2 and SSL v3 on browsers on the client using Group Policy. SSL v2 and SSL v3 protocols for a long time has been considered to be broken protocols thanks to the many vulnerabilities found in these protocols like BEAST and POODLE to name but a few. While all newer browsers no longer have these protocols supports enabled by default you still might be Bu