Any applicable\recommended Group Policy settings (Local & Domain) for configuring windows 8.1 "gold master image" for collection

Happy Friday everybody -
I'm working on implementing Microsoft RDS 2012\VDI for the folks here at work. I've read - online - a lot of articles on VDI and RDS 2012 - and have a working model that is working somewhat satisfactorily. I haven't seen much online about steps
I could take in Local Group Policy on my Windows 8.1 'gold image' - or for that matter Domain level group policy - that can assist in creating a better, more reliable/robust Windows 2012 VDI environment.
Anybody out there got any information or opinions or advice on Group Policy settings for VDI environments?
Thanks again, everyone!
Adrian
anr

Hi Adrian,
Thank you for posting in Windows Server Forum.
In regards to your issue you can refer beneath article for detail information.
1. Group Policy Best Practices for VDI Environments
2.Some Basic Group Policy Settings for VDI
Hope it helps!
Thanks.
Dharmesh Solanki

Similar Messages

User Group Policy Settings not applied to new user profiles at first logon

Good Afternoon,
We have an issue that occurs to a new user when they first log on to their machines. They log on and a new profile creates from the Default User Profile. We can see that a number of our Group Policy Settings applied as "User Configuration" are
not applying.A log off and back on is required before the policies apply.
Any thoughts to this behaviour please?
Regards
LeeB
Lee Bowman MCITP MCTS

Hi,
How about your problem now? How many system encounter this problem? Is all policy couldn't be applied? Is there any feedback when using gpresult to check policy applied status?
As Group Policy applies after user identity authentication, generally speaking, user logoff and back doesn't helpful with this problem.
When this problem occures, have you checked event log if it identify this problem?
Roger Lu
TechNet Community Support

Cases in which Domain Group Policy settings would be reverted to default settings on a Win7 client

Hi - I'm sure this info is out there somewhere, but I'm having a hard time finding it. Basically, I'm trying to identify the cases in which settings deployed via Domain Group Policy on 2008R2/Win7SP1 would get reverted back to "default settings"
on a Win7SP1 client that is still a member of the domain, and is in a proper OU, properly targeted, WMI filters should still evaluate true, etc...
For instance, it appears that if machine-level registry settings contained within a LocalGPO file on a client get corrupted (C:\Windows\System32\GroupPolicy\Machine\registry.pol), all of those settings, plus all machine level administrative template settings
defined in Domain Group Policy, get reverted to default settings (corresponds with Event ID 1096 in System Event Log where it references "LocalGPO"). I have not confirmed if this is the case for machine level settings defined outside of administrative
templates in Domain Group Policy, or for any user level settings though. (But I suspect not.)
When a workstation is unable to talk to a Domain Controller in order to identify applicable Domain Group Policy settings (for instance, this issue:
http://support.microsoft.com/kb/2421599/en-us), do administrative templates Domain Group Policy settings revert to defaults up until the next successful processing interval? I don't believe
so, but would like confirmation.
Are there any other cases in which Domain Group Policy settings for a client still joined to the Domain would be reverted to defaults?
And when a client is unjoined from the Domain, what Domain Group Policy settings would remain on the client? I understand that some Domain Group Policy settings outside of administrative templates are "tattooed" to the registry. Does
anyone know of a full list of these settings? I believe that most or all of the ones in Windows Settings\Security Settings are tattooed, and the only way to get these settings removed is to explicitly change them via registry edit or LocalGPO/Local Security
Policy, after unjoining the domain.
Any info/insight/links to other doc/etc would be much appreciated!

Hi Shaun,
>>If a client cannot talk to a domain controller at all, admin template settings still stay in-place on the client, correct?
As far as I know, it's not this case. If a client can't communicate with domain controllers, it means that the GPOs applied to the client are out of scope. As suggested by
the article I provided, for native policy, "when a Group Policy object (GPO) goes out of scope, the policy setting is removed allowing the original configuration value to be used."
>>What if a client looses network connectivity while reading Domain GPO?
Group policy will be get updated when computers start up and users log on. Besides, for workstations, group policy will get refreshed at background with by default an interval
of 90 minutes. As long as workstations can restore network connectivity, the group policy settings will get updated.
>>Are there any other failure cases like this where some or all Group Policy settings (admin template or other areas) would get reverted?
There are many reasons which can cause GP malfunction. However, Windows itself provides necessary tools for troubleshooting various issues. When GP malfunctions, we can check
Event Viewer, collect group policy result, or generate group policy log to troubleshoot.
TechNet Subscriber Support
If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.
Best regards,
Frank Shen

Backup & Restore non-administrators Group Policy Settings

Hi,
I'm trying to setup a few reference images of Windows 7 which will be deployed to our client computers. The baseline Group Policies are configured through Local Group Policies set in the image. I've setup a Master GPO machine on which to build the policies
and test them.
The Local Group Policies have been set for Local Computer Configuration, Local User Configuration and for Local Non-Administrators Configuration. The thinking is that members of the local Administrators group on the computer are unrestricted and still have
the ability to do most things. Users which log onto the computer abide by the more restrictive Non-Administrators Group Policy settings.
Using the "LocalGPO.wsf" script I'm able to backup and restore Computer and User Configuration which affects all users of the machine but it does not backup the Non-Administrators Policies. Is this possible?
After some digging around in the "GPOPack.wsf" files I've found that the Machine & All Users Policies are restored by the "LocalPol.exe" file. This utility has command line switches for '-m' machine and '-u' user. So I'm guessing
that it's not possible to restore the Non-Administrators Policies?
For what it was worth I've tried copying the "Registry.pol" file from "%windir%\System32\GroupPolicyUsers\S-1-5-32-545\User" folder on the GPO Master machine and placed the file in the same location on target computer. A test which had
one value set worked on the reference computer but when the policies were copied form the GPO Master machine, the target computer ignored all the settings.
Any ideas how to backup/restore Local Machine Non-Administrator Group Polices?
Thanks!

Not entirely sure of the specific policies you're dealing with, but you would typically use the Microsoft Security Compliance Manager to create GPO packs that you would then apply using the Apply Local GPO Package task sequence step in MDT.
I'd encourage you to look over the Applying Group Policy Object Packs section of the
Using the Microsoft Deployment Toolkit.docx file in the MDT 2013 documentation for more details.
MDT 2013 documentation can be downloaded here: LINK

How to restrict users working on Windows 7 clients from accessing Windows Explorer and other systems in the network through Group Policy with a domain controller running on Windows Server 2008 r2

Dear All,
We are having an infrastructure setup of around 500 client computers managed through group policy.
Recently the domain controllers have been migrated from Windows Server 2003 to Server 2008 R2.
Since this account requires extremely strict environment, we need to figure the solution for restricting the users from access anything locally.
It would be great if you can assist me with the following query.
How to restrict users logged on Windows 7 clients from accessing Windows Explorer and browsing other systems in the network through Group Policy with a domain controller running on Windows Server 2008 r2 ?
Can we disable Network Tab on the left hand pane ?
explorer.exe is blocked already, but users are able to enter the Windows Explorer by clicking on the name which is visible on the Start Menu.

>   * explorer.exe is blocked already, but users are able to enter the
>    Windows Explorer by clicking on the name which is visible on the
>    Start Menu.
You cannot block explorer.exe when you do not replace the shell - the
desktop you see effectively IS explorer.exe...
Your requirement sounds like you need a custom shell:
http://gpsearch.azurewebsites.net/#2812
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

EMET 5.0 Group Policy Settings Ignored (Probable race condition with Policy application)

In our deployment, EMET 5 seems to be ignoring group policy settings from immediately after the first group policy refresh post-boot.
Settings are being applied to the computer correctly, and are appearing in the registry correctly, and on boot, a set of Event ID 50 events are logged containing ConfigAppmitGPO (and similar for the other settings) elements with the correct settings.
Upon the first group policy refresh, further eventID 50 events are logged, with empty ConfigAppmitGPO elements.
Investigation with Process Monitor seems to indicate this is a race condition between Group Policy Registry settings being refreshed (which deletes the entries) and the EMET service reading out these settings from the registry (which appears to be triggered
by Group Policy application or by a notification on the registry keys themselves)
This is reproducible on Windows 7 and Windows 8.1.
Is there any way to arrange for settings to be applied correctly at all times, or is this a bug that will need to be fixed in a future update?

We're experiencing the exact same behavior currently. I was starting to think I was going crazy. Glad to know others are experiencing the same behavior.
I've found that using the method from pervious versions to read and update settings from Group Policy, using "emet_conf.exe --refresh" still works, and upon every execution, the event log shows the GPO settings being read and applied. While I welcome the
move to have EMET update from GPO settings without requiring running a separate task, as it stands now in its current condition, it is a step back.
Scott Ladewig http://www.ladewig.com

Can any one recommend a good mixer/control surface for Soundtrack pro?

Hey,
Can any one recommend a good mixer/control surface for Soundtrack pro? I was looking at the Mackie Universal Pro, does anyone have any experience with that or any others?
Many thanks in advance,
Gus

I have to put in another vote for OWC and against ANYTHING else. I bought a Western Digital MyBook Studio Mac Edition several years ago and it did not play well with my old G-series minitower nor the Intel iMac that replaced it last year. The drive was noisy, would cause sleep issues, lock up, overheat and, when allegedly working, dragged down performance.
I had to leave it turned off most of the time and do TM backups when I remembered--not good.
Recently I grew sufficiently browned off at the device to rip out the perfectly good WD SATA drive inside it and order an OWC Mercury Elite Pro enclosure with FireWire 800, USB 2 and eSATA ports. The old drive required only minutes to install in the OWC and has behaved perfectly since. No lockups, overheating, and the same drive is actually quieter in the new enclosure than the old.
WD makes fine hard drives but their enclosures are not very friendly, even those sold as "Mac Editions."
EDIT: forgot one point. If you have a desktop Mac, don't get a "mobile" or "portable" drive that has no source of power other than the computer. If you MUST use USB, it's possible to have dropouts if the USB bus gets overwhelmed while the drive is connected. Go with a desktop dirve with a separate power supply if you can. If you must go with a USB portable drive lacking its own power supply, also buy a powered USB hub. That usualy provides portable drives with enough power to stay with the program when used at home.

How to install Windows Updates on a 2012 Domain Controller w/Group Policy Settings

Hello All,
I'm having an issue installing Windows Updates on my Windows Server 2012 Standard with AD DS role, acting as a backup DC.
I have Group Policies setup for the Domain Controllers to download updates from my WSUS server but not to install them. When I go to my Windows Server 2003 R2 Domain Controller, I can install updates via the "Install Updates and Shutdown". That
option doesn't show up on the 2012 server. I can see from my WSUS server and the event viewer that the updates are being downloaded to the 2012 server........just no option for me to install the updates.
Am I just missing something or will I need to change the way my Group Policy is setup to allow installs and/or downloads? Any help would be greatly appreciated!
Tony

So I've totally removed the GPO settings for configuring updates on the Default Domain Controllers OU and I can get the Windows Server 2003 Server to get updates from Windows Updates, but the 2012 Server still won't show me how to download or install any
updates. It just states on the log-in screen that there are "Windows Updates Sign in and install important updates".
Well guess what Microsoft! I've signed in and still don't see where I can install updates!!!
I guess because you've set AU=3.
There doesn't seem to be much documented in depth about AU/WUAgent (not in the history of forever), but Lawrence and others in the WSUS forum do cover a lot of related question about the agent and also GP settings.
Lawrence has blogged a lot of detail about the registry settings which are available for AU/WU, and how some of those settings are not practically of any use since WinXP.
So, even though your question isn't about WSUS, the WSUS forum is a great place to visit for help for WUAgent etc.
Anyway, "where can I install updates?" :
on the Start screen, Search for "Windows Update"
or
Settings charm
Change PC Settings
Update and Recovery
Windows Update
or
Control Panel\System and Security\Windows Update
Some further (light) discussion on the "new" behaviour:
http://blogs.msdn.com/b/b8/archive/2011/11/14/minimizing-restarts-after-automatic-updating-in-windows-update.aspx
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

Windows 8.1 Group Policy to Force Domain Logon as Default?

I recently purchased a new Windows 8.1 computer for use in our organization. The default logon option for the device is for a Microsoft Account (the default username field prompt is for an e-mail address, rather than for a username.) However,
I would prefer that the default logon option be for a Windows domain account logon, so that users don't have to click the "Sign-in options" link and select "Local or domain account password" each time they need to log onto the computer.
I have learned that setting the "Interactive logon: Do not display last user name"
policy (located under Computer Configuration / Policies / Windows Settings / Security Settings / Local Policies / Security Options) to
Disabled allows the domain logon option to be retained across sessions. However, I would prefer to keep this option set to Enabled so that the previous user name is not displayed.
Does anyone have any suggestions on how the default logon option can be forced to a domain logon, while still suppressing the display of the last username?

Hi Arowitv,
According to your description, we can use the following policy to check the result.
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options:
Accounts: Block Microsoft accounts
Click this option, and select" Users can't add or log on with Microsoft account"
Note: Selecting this option might make it impossible for an existing administrator on this computer to log on and manage the system.
Computer Configuration\Administrative Templates\System\Logon :Assign default domain for logon
Set the option to Enabled, and add the Default Logon domain.
Hope this helps.
Regards,
Kelvin Xu
TechNet Community Support

Windows Update Group Policy Settings?

I browsed through SCCM 2012 documentation for an answer of what to set in a GPO when wanting to use SCCM 2012 SP1 to handle updates.
At the moment I have:
WSUS/Reporting pointing to wsus server and its appropriate ports
Allow Automatic Updates immediate installation: Enabled
All signed updates from intranet Microsoft Updates: Enabled
Configure Automatic Updates: Enabled
Configure automatic Updating - 4 Auto download and schedule the install
Scheduled install day: Every Friday
Scheduled install time: 21:00
Enabling Windows Update Power Management to auto wakeup the system to install Enabled
No auto-restart with logged on users for scheduled automatic updates installations: Enabled
Reschedule Automatic Updates scheduled installation: Disabled
I didn't see any hint, perhaps it is there and I missed it, on what might be the prescribed settings for a GPO.
What is happening is Windows 8ish is drawing a band across the screen and reporting that your computer needs to reboot; and then reboots. From what I could tell in the WindowsUpdate.log file is that round the time it was observed rebooting smsexec
requested a reboot. But oddly I also saw in the Windows Update log was a reboot was scheduled to expire on the 26th, two days after the observed behavior and I also saw that other reboot requests either expired or had been scheduled.
What I have recently done to various Windows Update deployments was to remove the check boxes for Deadline behavior to prevent Software Updates and System restarts outside the Maintenance Window and also checked Device restart behavior
Suppress system restart on the following devices Servers and Workstations.
At the moment I would like to figure out what the GPO settings should be and also how to determine what had requested reboot and when and if the reboot actually happened.
Thanks!

This blog series by Jason should help you with that (it's still applicable):
http://blog.configmgrftw.com/software-update-management-and-group-policy-for-configmgr-what-else/
http://blog.configmgrftw.com/software-updates-management-and-group-policy-for-configmgr-cont/
My Blog: http://www.petervanderwoude.nl/
Follow me on twitter: pvanderwoude

Specify Office 2013 kms host trough group policy settings

Hello.
Can someone please help me get the right registry key for Office 2013. I want to specify kms host for my clients in domain - trough group policy. Dont want to use dns or config.xml to specify the host.
For Windows i use this key, activation works greate.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\KeyManagementServiceName (REG_SZ)
Have found the key for Office 2010 but cant use this for 2013
HKLM\Software\Microsoft\OfficeSoftwareProtectionPlatform\KeyManagementServiceName (REG_SZ).
I have searched the web but cant find the key.
I realy need some help here.
Best regards
Nils S.

Have found the key for Office 2010 but cant use this for 2013
HKLM\Software\Microsoft\OfficeSoftwareProtectionPlatform\KeyManagementServiceName (REG_SZ).
I have searched the web but cant find the key.
Hi,
according to the documentation, it is the same registry key ?
http://technet.microsoft.com/en-us/library/ee624350(v=office.15).aspx#section1
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

Servers take an endless time at applying group policy settings

We have some Windows 2008R2 RDS servers that have been given a syspreped image. After a few day in production, and several nightly reboots, the servers start to hang at applying group policy setting. I have created a gpsvc.log file. What can be wrong with
these servers?
When i reboot the server without network connection, the reboot time is fine. The user login still takes forever.
GPSVC(fc.4ec) 08:38:21:227 MachinePolicyCallback: Setting status UI to Beleid Group Policy Services toepassen...
GPSVC(fc.4ec) 08:38:21:227 ProcessGPOList: No changes. CSE will not be passed in the IwbemServices intf ptr
GPSVC(fc.1a4) 08:38:21:227 Message Status = <Beleid Group Policy Services toepassen...>
GPSVC(fc.1a4) 08:38:21:227 Setting GPsession state = 1
GPSVC(fc.5b4) 08:38:21:820 ProcessGroupPolicyCompletedExInternal: Entering. Extension = {827D319E-6EAC-11D2-A4EA-00C04F79F83A}, dwStatus = 0x0
GPSVC(fc.5b4) 08:38:21:867 GetWbemServices: CoCreateInstance succeeded
GPSVC(fc.4ec) 08:38:22:475 ProcessGroupPolicyCompletedExInternal: Entering. Extension = {91FBB303-0CD5-4055-BF42-E512A681B325}, dwStatus = 0x0
GPSVC(fc.4ec) 08:38:22:491 GetWbemServices: CoCreateInstance succeeded
GPSVC(5dc.5e0) 08:38:24:285 CGPNotify::RegisterForNotification: Entering with target Machine and event 0x2a0
GPSVC(5dc.5e0) 08:38:24:285 Client_InitialRegisterForNotification: User = machine, changenumber = 0
GPSVC(fc.1b0) 08:38:24:285 Target = Machine
GPSVC(5dc.5e0) 08:38:24:285 Client_RegisterForNotification: User = machine, changenumber = 0
GPSVC(5dc.5e0) 08:38:24:285 CGPNotify::RegisterForNotification: Exiting with status = 0
GPSVC(fc.1b0) 08:38:24:285 Target = Machine, ChangeNumber 0
GPSVC(5dc.5e0) 08:38:24:285 CGPNotify::RegisterForNotification: Entering with target S-1-5-18 and event 0x3d4
GPSVC(5dc.5e0) 08:38:24:285 Client_InitialRegisterForNotification: User = S-1-5-18, changenumber = 0
GPSVC(fc.1b0) 08:38:24:285 Target = S-1-5-18
GPSVC(fc.1b0) 08:38:24:285 Could not find user by sid, finding user by session id
GPSVC(fc.1b0) 08:38:24:285 Caller requesting for user notification/lock is from session 0
GPSVC(5dc.5e0) 08:38:24:285 Client_RegisterForNotification: User = S-1-5-18, changenumber = 0
GPSVC(5dc.5e0) 08:38:24:285 CGPNotify::RegisterForNotification: Exiting with status = 0
GPSVC(fc.1b0) 08:38:24:285 Could not find user by sid, finding user by session id
GPSVC(fc.1b0) 08:38:24:285 Caller requesting for user notification/lock is from session 0
GPSVC(62c.64c) 08:38:25:330 CGPNotify::RegisterForNotification: Entering with target Machine and event 0x1d4
GPSVC(62c.64c) 08:38:25:330 Client_InitialRegisterForNotification: User = machine, changenumber = 0
GPSVC(fc.1b0) 08:38:25:330 Target = Machine
GPSVC(62c.64c) 08:38:25:330 Client_RegisterForNotification: User = machine, changenumber = 0
GPSVC(62c.64c) 08:38:25:330 CGPNotify::RegisterForNotification: Exiting with status = 0
GPSVC(298.2c0) 08:38:28:310 CGPNotify::RegisterForNotification: Entering with target Machine and event 0xab0
GPSVC(298.2c0) 08:38:28:310 Client_InitialRegisterForNotification: User = machine, changenumber = 0
GPSVC(fc.1b0) 08:38:28:310 Target = Machine
GPSVC(298.2c0) 08:38:28:310 Client_RegisterForNotification: User = machine, changenumber = 0
GPSVC(298.2c0) 08:38:28:310 CGPNotify::RegisterForNotification: Exiting with status = 0
GPSVC(fc.1b0) 08:38:28:310 Target = Machine, ChangeNumber 0
GPSVC(fc.7c0) 08:38:39:401 CGPNotify::RegisterForNotification: Entering with target Machine and event 0x93c
GPSVC(fc.7c0) 08:38:39:401 Client_InitialRegisterForNotification: User = machine, changenumber = 0
GPSVC(fc.95c) 08:38:39:401 Target = Machine
GPSVC(fc.7c0) 08:38:39:401 Client_RegisterForNotification: User = machine, changenumber = 0
GPSVC(fc.7c0) 08:38:39:401 CGPNotify::RegisterForNotification: Exiting with status = 0
GPSVC(fc.95c) 08:38:39:401 Target = Machine, ChangeNumber 0
GPSVC(53c.580) 08:40:20:755 CGPNotify::RegisterForNotification: Entering with target Machine and event 0x608
GPSVC(53c.580) 08:40:20:755 Client_InitialRegisterForNotification: User = machine, changenumber = 0
GPSVC(fc.1c4) 08:40:20:755 Target = Machine
GPSVC(53c.580) 08:40:20:755 Client_RegisterForNotification: User = machine, changenumber = 0
GPSVC(53c.580) 08:40:20:755 CGPNotify::RegisterForNotification: Exiting with status = 0
GPSVC(53c.580) 08:40:21:098 CGPNotify::RegisterForNotification: Entering with target Machine and event 0x64c
GPSVC(53c.580) 08:40:21:098 Client_InitialRegisterForNotification: User = machine, changenumber = 0
GPSVC(fc.1c4) 08:40:21:113 Target = Machine
GPSVC(53c.580) 08:40:21:113 Client_RegisterForNotification: User = machine, changenumber = 0
GPSVC(53c.580) 08:40:21:113 CGPNotify::RegisterForNotification: Exiting with status = 0
GPSVC(53c.564) 08:40:21:238 CGPNotify::RegisterForNotification: Entering with target Machine and event 0x67c
GPSVC(53c.564) 08:40:21:238 Client_InitialRegisterForNotification: User = machine, changenumber = 0
GPSVC(fc.1c4) 08:40:21:238 Target = Machine
GPSVC(53c.564) 08:40:21:238 Client_RegisterForNotification: User = machine, changenumber = 0
GPSVC(53c.564) 08:40:21:238 CGPNotify::RegisterForNotification: Exiting with status = 0
GPSVC(200.f6c) 08:41:11:501 CGPNotify::RegisterForNotification: Entering with target Machine and event 0x350
GPSVC(200.f6c) 08:41:11:501 Client_InitialRegisterForNotification: User = machine, changenumber = 0
GPSVC(fc.1c4) 08:41:11:501 Target = Machine
GPSVC(200.f6c) 08:41:11:501 Client_RegisterForNotification: User = machine, changenumber = 0
GPSVC(200.f6c) 08:41:11:501 CGPNotify::RegisterForNotification: Exiting with status = 0
GPSVC(fc.1c4) 08:41:11:891 Target = Machine
GPSVC(fc.1c4) 08:41:11:891 Target = Machine, ChangeNumber 0
GPSVC(fc.7d0) 08:41:11:985 Target = Machine
GPSVC(fc.7d0) 08:41:11:985 Target = Machine, ChangeNumber 0
GPSVC(fc.7d0) 08:41:11:985 Sid = (null), dwTimeout = 600000, dwFlags = 268435456
GPSVC(fc.7d0) 08:41:11:985 LockPolicySection called for user <Machine>
GPSVC(fc.7d0) 08:41:11:985 Async Lock called
GPSVC(fc.7d0) 08:41:11:985 Reader has to wait for lock. ReaderID : 1.
GPSVC(fc.7d0) 08:41:11:985 Registering wait for lock notification
GPSVC(fc.9d8) 08:41:13:015 CGPNotify::RegisterForNotification: Entering with target Machine and event 0xcbc
GPSVC(fc.9d8) 08:41:13:015 Client_InitialRegisterForNotification: User = machine, changenumber = 0
GPSVC(fc.7d0) 08:41:13:015 Target = Machine
GPSVC(fc.9d8) 08:41:13:015 Client_RegisterForNotification: User = machine, changenumber = 0
GPSVC(fc.9d8) 08:41:13:015 CGPNotify::RegisterForNotification: Exiting with status = 0
GPSVC(fc.9d8) 08:41:13:015 CGPNotify::RegisterForNotification: Entering with target Machine and event 0xd24
GPSVC(fc.9d8) 08:41:13:015 Client_InitialRegisterForNotification: User = machine, changenumber = 0
GPSVC(fc.7d0) 08:41:13:015 Target = Machine
GPSVC(fc.9d8) 08:41:13:015 Client_RegisterForNotification: User = machine, changenumber = 0
GPSVC(fc.9d8) 08:41:13:015 CGPNotify::RegisterForNotification: Exiting with status = 0
GPSVC(200.1060) 08:43:10:223 CGPNotify::UnregisterNotification: Entering with event 0x350
GPSVC(200.1060) 08:43:10:223 CGPNotify::AbortAsyncRegistration: No asyn registration is pending
GPSVC(200.1060) 08:43:10:223 CGPNotify::UnregisterNotification: Canceling pending calls
GPSVC(200.1060) 08:43:10:223 Client_CompleteNotificationCall: failed with 0x71a
GPSVC(200.1060) 08:43:10:223 CGPNotify::UnregisterNotification: Cancelled pending calls
GPSVC(200.1060) 08:43:10:223 CGPNotify::UnregisterNotification: Exiting with dwStatus = 0x0
GPSVC(fc.1054) 08:43:16:252 Target = Machine
GPSVC(fc.1054) 08:43:16:252 Target = Machine, ChangeNumber 0
GPSVC(fc.1138) 08:43:24:188 CGPNotify::RegisterForNotification: Entering with target Machine and event 0xeac
GPSVC(fc.1138) 08:43:24:188 Client_InitialRegisterForNotification: User = machine, changenumber = 0
GPSVC(fc.7d0) 08:43:24:188 Target = Machine
GPSVC(fc.1138) 08:43:24:188 Client_RegisterForNotification: User = machine, changenumber = 0
GPSVC(fc.1138) 08:43:24:188 CGPNotify::RegisterForNotification: Exiting with status = 0
GPSVC(fc.1054) 08:43:29:418 Target = Machine
GPSVC(fc.1054) 08:43:29:418 Target = Machine, ChangeNumber 0
GPSVC(fc.1054) 08:43:50:304 Target = Machine
GPSVC(fc.1054) 08:43:50:304 Target = Machine, ChangeNumber 0
GPSVC(fc.1374) 08:51:06:327 Found the Waiting Rpc Reader in the waiting list. Removing it...
GPSVC(fc.1374) 08:51:06:327 Lock timeout
Gert MCITP SA, EA & VA

Hi,
From the log you submit, I found the following error:
GPSVC(f0.13fc) 03:00:18:665 Client_CompleteNotificationCall: failed with 0x525
GPSVC(2f0.baf4) 03:00:18:665 CGPNotify::OnNotificationTriggered: Completenotification failed with 1317
GPSVC(518.e980) 03:00:18:665 Client_CompleteNotificationCall: failed with 0x6ba
GPSVC(f0.13fc) 03:00:18:665 CGPNotify::OnNotificationTriggered: Trying to recover from error 1722
GPSVC(518.e980) 03:00:18:665 CGPNotify::RegisterNotificationAsynchronously: Starting async registration
GPSVC(3b8.3e0) 03:04:19:034 Client_RegisterForNotification: CheckRegisterForNotification returned error 0x6d9
GPSVC(3b8.3e0) 03:04:19:034 CGPNotify::RegisterForNotification: Service not RUNNING. waiting
GPSVC(3b8.3e0) 03:04:19:034 CGPNotify::RegisterForNotification: Trying to recover from error 1753
GPSVC(3b8.3e0) 03:04:19:034 CGPNotify::RegisterNotificationAsynchronously: Starting async registration
GPSVC(100.4c8) 03:05:07:753 ProcessGPOs: OpenThreadToken failed with error 1008, assuming thread is not impersonating
GPSVC(100.13f4) 07:54:09:864 GetOldSidString: Failed to open profile profile guid key with error 2
GPSVC(658.2354) 09:52:41:726 Client_ProcessRefresh: ProcessRefresh returned error 0x5b4
GPSVC(658.2354) 09:52:41:726 GetGPOList: Client_ProcessRefresh failed with 0x5b4.
GPSVC(658.2354) 09:52:41:726 Exiting RefreshPolicyForPrincipal with status = 1460
GPSVC(100.1a7c) 10:48:26:711 CGPAdminEventInitFailure::Initialize(): FormatMessage failed to look up error code (0x4005) due to error 317. Can not log error description.
GPSVC(100.219c) 10:48:26:711 ProcessGPOList: Extension Internet Explorer Branding was not able to log data. Error = 0x80004005, dwRet = 1252,leaving the log dirty
GPSVC(100.19b4) 10:48:27:491 ProcessGPOList: Extension Internet Explorer Branding was not able to log data. Error = 0x80004005, dwRet = 1252,leaving the log dirty
1. Please try to renamed the files on the folder c:\windows\system32\GroupPolicy to .old and ran Gpupdate /force.
2. Please verify the DNS set correctly and DNS Client Service is enabled. Restart the DNS Client Service.
Hope this helps!
Best Regards
Elytis Cheng
TechNetSubscriber
Support
If
you are TechNetSubscription user
and have any feedback on our support quality, please send your feedback here.
Elytis Cheng
TechNet Community Support

Group Policy Administrative Templates not applying on Windows XP SP3 - Windows Server 2008 R2

I have a Windows 2008 R2 domain with windows 7, and Windows XP SP3 client workstations.
I have a group policy to deny all access to removable storage in policies/administrative templates/system in user configuration (actually its in the computer configuration as well)
The problem is the policy is having no effect on the Windows XP machines. It works perfectly on Windows 7 machines.
Group policy in general is working on the Windows XP machines, as I can successfully map drives, push out scheduled tasks, and push out printers. (All preferences I know and I have GP Preferences client side extensions installed).
Its almost like the windows XP machines can't "understand" the admin templates from Windows Server 2008 R2.
Do I need to install something on the windows XP machines? What could be the problem?

> Its almost like the windows XP machines can't "understand" the admin
> templates from Windows Server 2008 R2.
Simply read the "supported on" of these settings... Vista and above
required.
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

DNS best practice in local domain network of Windows 2012?

Hello.
We have a small local domain network in our office. Which one is the best practice for the DNS: to setup a DNS in our network forwarding to public DNSs or directly using public DNS in all computers including
server?
Thanks.
Selim

Hi Selim,
Definately the first option "setup a DNS in our network forwarding to public DNSs " and all computers including server has local DNS configured
Even better best practice would be, this local DNS points to a standalone DNS server in DMZone which queries the public DNS.
Using a centralized DNS utilizes the DNS cache to answer similar queries, resulting in faster response time, less internet usage for repeated queries.
Also an additional DNS layer helps protect your internal DNS data from attackers out in the internet.
Using internal DNS on all the computer will also help you host intranet websites and accessibility to them directly. Moreover when you are on a AD domain, you need to have the computers DNS configured properly for AD authentication to happen.
Regards,
Satyajit
Please “Vote As Helpful”
if you find my contribution useful or “Mark As Answer” if it does answer your question. That will encourage me - and others - to take time out to help you.

Help! How to migrate local account settings to domain account in Windows 8.1 Pro

All kinds of answers to this question come up for Windows 7 (even though I specify Windows 8.1 Pro)
Anyway, have a laptop originally with Win 8.1 and a local account created. Upgraded to Win 8.1 Pro and logged in as domain user. How can I copy all the settings I had as a local account to my domain account? Surely SOMEONE has found a way
to do this?

Hi,
You can use USMT to achive your goals. However, I doubt whether you would encounter some problem, as domain controller would set some restricted settings and some policy of your local account won't be applied.
To know more about USMT, please refer to the link below:
http://blogs.technet.com/b/nepapfe/archive/2013/04/15/using-usmt-v-5-to-migrate-your-profile-data-apps-amp-profile-settings.aspx
Roger Lu
TechNet Community Support

Any applicable\recommended Group Policy settings (Local & Domain) for configuring windows 8.1 "gold master image" for collection

Similar Messages

Maybe you are looking for