I tend to see a lot of one off fixes for setting up and fixing group policies that either don’t exist or are intended for policies that are broken the majority of the time when I am looking up GP answers on teh google’s. I recently watched a great video over at the channel9 website by Daren Mar-Elia of GPOguy fame about using best practices and design principles for managing your Group Policy environment. Here is the link to that video.
That video really got me thinking about the topic of how I could improve my GP management skills in my day to day environment. So I decided that I would take as many offerings from his talk and elsewhere in my searches across the interwebz to help come up with some of my own best practices and guidelines for managing Group Policy.
The following is an overview of the ideas and techniques that I came up with and what has worked well in my experience with regards to managing Group Policy.
Group Policy organizational best practices:
Use either a “U” “S” or “C” to denote whether Group policy is User, Server or Computer
Tack on a version at the end of the specific Group Policy. Brand new Group Policies begin at v1.0
Every time a policy changes increment the version number. It makes things easier to troubleshoot when using gpresult with this method
Each GPO has one specific use case. DO NOT LUMP MULTIPLE FUNCTIONS INTO ONE POLICY
Use very detailed and descriptive names to denote what a GPO is and does
Here are some example policies that I have been working on in a test environment. I think it captures many of these above best practices quite nicely. Please feel free to adapt this technique to suit your own specific needs, this is only a template and I’d like to see how it can be improved.
As you can see, using this format it is easy to tell whether or not this is a computer policy, what specifically the policy is doing and which version of the policy we’re at currently.
The most crucial part of using this system is to get other Group Policy admins to buy in to this technique. If you don’t clearly lay out your expectations then keeping policies up to date and organized could potentially become a pain point looking on down the road. The other caveat is to get the other GP admins in the habit of creating policies that address only one specific task, that are broken into either user or computer policies and have descriptive names. If the environment utilizes multi-purpose policies that contain both user and computer specific settings then this may be a new concept for many of the admins but the extra effort in setting this type of environment up will be totally worth the extra overhead initially.
I definitely think that this technique can be improved and I am always tinkering with it to see how I can get it to work better but for now it is at a good point. If you make the transition to organizing and improving your management of Group Policy or just have some solid best practices of your own already let me know, I would love to hear about what you are doing and how to incorporate more techniques into my own management style.
Offline files in Windows are a set of features that essentially give users the ability to work with files off of or outside of the network. So for example if a user had a laptop that had a mapped drive or network share and were to take their computer outside of the network, the features offered by offline files would allow this user to continue working with these files. I will not cover the details of how all of this magic works in this post, I just want to show people the best way I found to disable this feature with the least amount of problems. If you want to go straight from the source, here is the original article the gave me about 95% of the information necessary for accomplishing this task.
The remainder of this post will detail my findings and experience from the link above. This feature (offline files) is enabled by default in Windows 7. Here is a good overview of the benefits of offline files. However, for me personally as an admin, this feature so far has caused much confusion in the work environment for users that are not accustomed to having such a feature in our move towards Windows 7.
These settings can of course be controlled on a per user basis by changing the settings and configuration of the “Sync Center” tool in Windows. But when you are involved in a larger environment and need this sort of process automated for many users, Group Policy becomes the most effective way to handle this problem. There are a few steps to get offline folders disabled correctly so I thought I would share all the pieces in case somebody runs across a similar need as I did. The first step to disable the offline file features is to adjust the following settings in Group Policy:
Allow or Disallow use of the Offline Files feature: Disabled
Prohibit user configuration of Offline Files: Enabled
Sync all offline files when logging on: Disabled
Sync all offline files before logging off: Disabled
Sync offline files before suspend: Disabled
Remove “Make available offline” command: Enabled
Prevent use of Offline Files folder: Enabled
Next, we need to tell Group Policy to shut off the offline file service and disable it on all Windows machines that have the service installed (Windows XP, 7, 8 machines). To do this you will need to modify your Group Policy settings on a machine that has the service installed it already, through RSAT. This is an important step, you will not be able to find this service if you are adjusting the GP settings from a server. This service is located in the following location:
Computer Configuration -> Windows Settings -> Security Settings -> System Services
The specific service we are looking for is the “cscservice“, which corresponds to the service labeled “Offline Files” in the Windows services list.
The last step to get this policy working correctly is to add in a registry key that will fix machines that have already been used to cache certain network resources. Essentially adding this registry key tell the machine to blow up its database of offline files and tells the machine to remove the cached files as well. To configure this settings we need to add in a custom reg entry:
Computer Configuration -> Preferences -> Windows Settings -> Registry
Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\CSC\Parameters Value name: FormatDatabase Value type: DWORD Value data: 1
Here is a good article with instructions on how change the registry settings by hand and a screenshot of my own GP environment with how the settings should look via the GP Management Console.
That should be all the necessary changes that need to be made. If I missed anything let me know, hopefully this will save people time in the future.
Lately I have been building a Windows Hyper-V v3 clustered lab environment with all the bells and whistles. It has been a great learning experience thus far and I can honestly say that I am enjoying Hyper-V overall thus far. Recently I decided to take the plunge and begin experimenting with System Center Virtual Machine Manager (SCVMM), and managed to run across a bizarre issue last Friday. The reason I am posting is because there were basically no real clues for this problem, so I would like to go over some of the various things that I looked and ultimately how this issue was resolved. I feel this post may be useful to others because a lot of this stuff is relatively new and there wasn’t a ton of material out there on this specific problem to use as reference.
The installation process is relatively straight forward. The environment I am using is Server 2012, so as a prerequisite you must use SCVMM 2012 w/SP1 in order for this to work. If you are using 2008R2 you can use SCVMM 2012. I used this guide as a reference for the installation instructions, which more or less go like this:
Create your SCVMM accounts in AD. scvmmadmin (admin account), scvmmsvc (service account), scvmmadmins (admin group).
Install/point the SCVMM server to SQL 2012. I won’t go over SQL installation because it is beyond the scope of this post.
Install the prerequisites on your SCVMM server. ADK for Windows 8, SQL 2012 native client, SQL 2012 command line utilities.
This is easy enough to follow but I was getting suck on step 4 when I was attempting to install the Management Server and the Console. The installation would choke about half way through with the following error:
A Hardware Management error has occurred trying to contact server GMVM-TEST-04.gmrcnet.local .
Check that WinRM is installed and running on server GMVM-TEST-04.gmrcnet.local. For more information use the command “winrm helpmsg hresult”.
Okay… WTF? I knew that I already had WinRM installed and was on, but if you are not sure the quickest way to find out is to type winrm quickconfig from a command prompt. You should get something similar to the following:
So we know WinRM is on and should be working. Next, I checked the installation logs for clues. They are located in C:\ProgramData\VMMLogs\SetupWizard.log. I found the portion of the logs that indicated there were issues:
12:44:54:VMMPostinstallProcessor threw an exception: Threw Exception.Type: Microsoft.Carmine.WSManWrappers.WSManProviderException, Exception.Message: A Hardware Management error has occurred trying to contact server GMVM-TEST-04.gmrcnet.local .
WinRM: URL: [http://gmvm-test-04.gmrcnet.local:5985], Verb: [INVOKE], Method: [AssociateLibrary], Resource: [http://schemas.microsoft.com/wbem/wsman/1/wmi/root/scvmm/AgentManagement]
Check that WinRM is installed and running on server GMVM-TEST-04.gmrcnet.local. For more information use the command "winrm helpmsg hresult".
12:44:54:StackTrace: at Microsoft.Carmine.WSManWrappers.ErrorContextParameterHelper.ThrowTranslatedCarmineException(WsmanSoapFault fault, COMException ce)
at Microsoft.Carmine.WSManWrappers.WsmanAPIWrapper.RetrieveUnderlyingWMIErrorAndThrow(SessionCacheElement sessionElement, COMException ce)
at Microsoft.Carmine.WSManWrappers.WsmanAPIWrapper.Invoke(String actionUri, WSManUri targetUri, Hashtable parameters, Type returnType, Boolean isCarmineMethod, Boolean forceResponseCast)
at Microsoft.Carmine.WSManWrappers.WsmanAPIWrapper.Invoke(String actionUri, String url, Hashtable parameters, Type returnType, Boolean isCarmineMethod)
at Microsoft.Carmine.WSManWrappers.AgentManagement.AssociateLibrary(WsmanAPIWrapper wsmanObject, String CertificateSubjectName, String& ExportedCertificate, ErrorInfo& ErrorInfo)
at Microsoft.VirtualManager.Setup.VirtualMachineManagerHelpers.AssociateDefaultLibraryServer()
at Microsoft.VirtualManager.Setup.VirtualMachineManagerHelpers.SetupLibraryShare()
at Microsoft.VirtualManager.Setup.InstallItemCustomDelegates.PangaeaServerPostinstallProcessor()
12:44:54:InnerException.Type: System.Runtime.InteropServices.COMException, InnerException.Message: The WinRM client sent a request to an HTTP server and got a response saying the requested HTTP URL was not available. This is usually returned by a HTTP server that does not support the WS-Management protocol.
12:44:54:InnerException.StackTrace: at WSManAutomation.IWSManSession.Invoke(String actionUri, Object resourceUri, String parameters, Int32 flags)
at Microsoft.Carmine.WSManWrappers.MyIWSManSession.Invoke(String actionUri, Object resourceUri, String parameters, Int32 flags)
at Microsoft.Carmine.WSManWrappers.WsmanAPIWrapper.Invoke(String actionUri, WSManUri targetUri, Hashtable parameters, Type returnType, Boolean isCarmineMethod, Boolean forceResponseCast)
12:44:54:ProcessInstalls: Running the PostProcessDelegate returned false.
12:44:54:ProcessInstalls: Running the PostProcessDelegate for PangaeaServer failed.... This is a fatal item. Setting rollback.
12:44:54:SetProgressScreen: FinishMinorStep.
12:44:55:ProcessInstalls: Rollback is set and we are not doing an uninstall so we will stop processing installs
12:44:55:****************************************************************
12:44:55:****Starting*RollBack*******************************************
12:44:55:****************************************************************
Incredibly useful, I know. It is good to know where this stuff is located though just in case other issues arise that require troubleshooting like this. So at this point I was dumbfounded and most of the stuff I found on Google was not helpful for my situation (I tried many different suggestions).
Finally I came across a post that mentioned disabling WinRM from Group Policy. It just so happens that there is a policy in our test environment for enabling Powershell and remoting and all that jazz. So I completely disabled the policy and was finally able to get SCVMM to install! Here are the two policy settings you should take a look at first.
Computer Configuration > Administrative Templates > Windows Components > Windows Remote Management (WinRM) > WinRM Service
and
Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell
I need to go back and verify that the root issue was caused by the WinRM portion of the policy, which I’m suspecting it is. But if you run across this error look at your Group Policy settings!
The moral of the story: Windows Management Framework 3.0 and more specifically the WinRM components of WMF 3.0 are delicate, even on Server 2012 (there have been major compatibility issues with earlier versions of Windows). In my scenario Group Policy was somehow getting in the way (if you can understand and decipher those logs and how they relate to Group Policy let me know) of allowing SCVMM to install.
So I recently had a specific request at work from a user, which, unless I note somewhere I am sure I will forget. Basically, the requester does not want to grant the ability for users to be able to change the default UI ribbon settings within Outlook 2010 or any other Office 2010 program. The easiest way to explain it is, the user wants to disable the “Customize Ribbon” option as pictured below.
While I don’t know of an exact way to accomplish to “grey out” this option I did find a way to wipe the ability out to adjust these settings within Group Policy. The setting is located in the following location within Group Policy Manager. The setting we are looking for is labeledTurn off user customization via UI.
User Configuration -> Administrative Templates -> Microsoft Office 2010 -> Global Options -> Customize -> Turn off user customization via UI
NOTE that you need to have the Office 2010 Group Policy templates installed on the machine you are attempting to set the policy from (if you have questions just let me know and I can follow up with instructions on how to do this). Here is what the setting looks like:
And here is what the updated Outlook “Customize Ribbon” option looks like:
