Yaos posted:

As do we and it works exactly as it is supposed to work, however you can't pick and choose what you want to freeze or not freeze; the whole computer is frozen or nothing is frozen. SteadyState let's you log in as an administrator and make changes without turning off SteadyState. SteadyState only works on Windows XP though, while Deep Freeze works on 7.

Now somebody is going to tell me Deep Freeze can do that and it's done it since version 1.

Honey Im Homme posted:

The problem is if I run this script as a GPO login script the printers don't get mapped and every login provides the popup with "Debug, client name: %CLIENTNAME%". Does anyone have any ideas how I can get around this, or an alternative method of mapping printers like this?

Caged posted:

I think update only applies if there's already an existing file, replace will put it there if it doesn't already exist.

But I'd rather someone more competent answers

Honey Im Homme posted:

I'm trying to map printers on terminal services based on the users client.

code:

Dim LeftString, netPrinter
Set Sh = CreateObject("WScript.Shell")
sys = Sh.ExpandEnvironmentStrings("%CLIENTNAME%")
LeftString = Left(sys, 3)
if leftstring = "HP0" OR leftString = "IEC" then
	Set netPrinter = CreateObject("WScript.Network")
	netPrinter.AddWindowsPrinterConnection "\\printserver\printer"
	netPrinter.SetDefaultPrinter("\\printserver\printer")

else
	wscript.echo "Debug, client name: " & sys
end if

When I run this manually in an interactive session, either the printer is mapped correctly or it gives me a popup with the correct client i'm connecting from.

The problem is if I run this script as a GPO login script the printers don't get mapped and every login provides the popup with "Debug, client name: %CLIENTNAME%". Does anyone have any ideas how I can get around this, or an alternative method of mapping printers like this?

Terminal servers are both Server 2008.

BangersInMyKnickers posted:

Other way around. Replace will modify value data only if the specified registry value is already present, update will create the registry value if it isn't present and assign it the specified data.

E: I said that for registry keys, but the same concept applies for files.

quote:

Replace – Remove whatever drive mapping exists for this share, and create a new one with these settings. If there isn’t one, just create it. No matter what, you’re getting this drive mapping, whether something existed there or not. It’s very insistent, like the bully of the CRUD options, so it gets a Red icon.

Update – Yellow – If that drive mapping exists, it will be updated with the settings specified here. If there are other settings associated with the drive mapping that aren’t specified here, they will be maintained. If no drive mapping exists for this share, create it. Nothing gets blasted away like with the Replace setting, but there is still a chance that you’ll overwrite something, so it gets a Yellow icon (warning! make sure you know what you’re going to be over-writing!).

BangersInMyKnickers posted:

IT Guy posted:

I've decided to use UAC to control what a user can and cannot do on their machine. It works great as they can't touch anything on the computer that isn't per-user.

However, I've noticed I can open regedit on Windows XP still. I can't change anything in HKLM which is fine, but the user can still edit HKCU. Basically my question is, is this a problem, can they do any damage in the HKCU?

Second question, can you change the default home page for IE but still allow a user to change it? I hate having MSN as the default home page for a new user profile but any setting I've found in the GPOs seems to force the homepage and not allow it to be changed.

Gyshall posted:

I've been working for a firm that has been very old school in the way that they have set up networks in the past (using VB scripts, Logon scripts only) and I have just recently turned them onto the magic that is group policy.

I'm in charge of a brand new Server 2008 R2 deployment, and I'm already doing some cool things like -

- Removing the stupid Internet Explorer "Run Once" setup thing
- Deploying 7zip to each machine
- Installing the firewall single sign on client on every machine by default
- Deploying printers/shared drives

What else should I look at doing? I already have a blank slate as far the network goes, and I'm under no real pressure to get it up and running any time soon (the company deploys in January.)

I've got different levels of users set up with different permissions, but is there anything else sweet I could be doing?

Sounder posted:

Apologies if this has already been covered, but is there a way to prevent users from writing to the C drive except for places I want them to write to (My Docs, Desktop)? It looks like, by default, even unprivileged users can create folders in C:\, and that just won't fly in a company where everything MUST be backed up regularly from our file servers.

Sounder posted:

Apologies if this has already been covered, but is there a way to prevent users from writing to the C drive except for places I want them to write to (My Docs, Desktop)? It looks like, by default, even unprivileged users can create folders in C:\, and that just won't fly in a company where everything MUST be backed up regularly from our file servers.

Megiddo posted:

How can I set a script that requires elevated privileges to run on every user logoff on Windows 7, preferably without using domain-applied GPOs (since our central IT overlords control them)?

This needs to run after all users log off a machine, and nearly all users are limited users, so a simple logoff script via GP will not directly work. I've tried creating a Scheduled Task that is set to "run on local disconnect from user session" in the context of an admin account, but I can't get it to fire.

Any ideas?

BangersInMyKnickers posted:

I think you could accomplish it through a scheduled task the executes when it sees the logoff event in the event log, and then making the command execute with an alternative set of credentials that have administrative or system rights, depending on what works in your case.

StrikerJ posted:

- At next computer boot (if computer setting)?
- At next user login (if user setting)?

skipdogg posted:

So assuming you have permissions to edit those registry keys your GPO is affecting, these would be true.

Unless you did a gpupdate /force on the client machine, that would trigger a reprocessing of the GPO.

Naramyth posted:

I have had to reimage and deploy a few computers this week and have had some issues with my GPO software deployments not pushing to the new computers and when I install it by hand on the next reboot the policy triggers and removes the software that was deployed. No errors are being reported to the event viewer. Any idea of what is happening? Do I need to have some version of Firefox/flash/etc. baked into my images before GPO will deploy correctly?

madmaan posted:

Did you try gpupdate to the machines before manually installing the apps?

Naramyth posted:

Yeah. The machines display each software install for a second or so with verbose logins selected, it just doesn't actually deploy the software. The Event Viewer shows software install start and end for each one but they are events that show up are on the same second.

madmaan posted:

Have you changed your imaging process at all? Is the software deployment locations still fully available to the users who login?

Swink posted:

Which runs first, a User GPO login script, or a script in the startup directory?