Default AV policy behavior in email C360 -odd !?

I have Default message scanning policy "Scan for viruses only" selected. Still end users gets messages, where virus (attachment) has been removed and message is repaired (!) and delivered. I don't have "Scan and repair viruses" selected, but still it seems to do the job. And there is no option where to set "Drop Message" in the Repaired Messages field.
I must have something configured in the repair -policy that is upper (in the order) than Virus infected mesasge policy. Virus infected message policy says that Drop Message, if virus is in the message or atatchment.
Can this behavior be changed or is this a bug ? I updated recently to 6.5.3-007, and since end users haven't reported this behavior me before, could this be the new release bug..?
I put a content filter policy, which will drop all this kind of messages to keep the end users calm, but there should be better way to do this. This problem occured while christmas and these are christmast cards send by: [email protected] and they all contans a virus/rojan. I also managed to make an upgrade from previous release to 6.5.3-007 before christmas.
Pauli

The GUI is not logical for me and that was the problem. Thanks for the tip.
If I unselect "Drop infected attachments if a virus is found ", and click anywhere in the background, ONLY then the "repaired message" -action is greyed out (cannot not be configured, and seems to be disabled). But if I unselect it and I don't just click to then background, the "repaired message" stays in place (selected and configured). So, clicking the background "refreshes" the page. Another thing: those two Message scannig and Repair message sections should be grouped together, since they affect to each other.
Pauli

Similar Messages

[Forum FAQ] How to disable Microsoft account default sign-in behavior when accessing Microsoft website on Windows 8.1

Scenario
By default it will sign in with current Microsoft account, if a user accesses Microsoft website (www.live.com, www.bing.com, etc.) with Microsoft account on Windows 8.1. This article describes how to disable this default sigh-in behavior if you want to use
different Microsoft accounts every time.
Method
To disable this default sign-in behavior, we can deny current Microsoft Account read permission of MicrosoftAccountTokenProvider.dll, please follow the following steps:
Run Command Prompt with elevated permissions.
Run the following command to take ownership of MicrosoftAccountTokenProvider.dll:
  takeown /f C:\Windows\SysWOW64\MicrosoftAccountTokenProvider.dll
Run the following command to deny the read permission of the Microsoft:
icacls C:\Windows\SysWOW64\MicrosoftAccountTokenProvider.dll /deny
[email protected]:r
Note: Please replace your current Microsoft Account with the example
[email protected]
Change the owner of this file back to TrustedInstaller:
Right-click MicrosoftAccountTokenProvider.dll under
C:\Windows\SysWOW64\, choose Properties. Under
Security tab, click Advanced.
Click Change, in the box Enter the object name to select, type
NT Service\TrustedInstaller.
Click OK.
Note: This operation would take some hours to work.
Apply to:
Windows 8.1
Please click to vote if the post helps you. This can be beneficial to other community members reading the thread.

Error: System cannot find the specified path
I am getting this eroor
Parashuram Singade www.distinctnotion.com

How do I move the policy from Default domain policy to a custom policy.

I want to implement a new password policy. In the past we had a fairly loose policy, now I want to implement minimum length and complexity. I know how to set this up in Computer Config Policies windows settings security settings and account policies
password policy. However after I set it up I notice that it is not being applied. I have run gpupdate, and even waited several days but still it's not taking effect. I have created what im calling a custom gpo calling it "password policy".
It is situated under domains/mydomain.com . There are a number of other policies here.
When I run gpresult /h c:\temp\gpreport.html its all a bit confusing. It looks like it being applied but then further down it says under Group policies Applied GPOs Denied GPOs Pssword Policy mydomain.com empty. ??
But let me ask this first off .
The previous administrator I think has the password policy set up in the "default domain policy"
Is it possible that the default domain policy which IS indeed set differently is overriding my custom "password policy"
If this is so how can I make it so my custom password policy is applied over the default domain policy.
Or what other answers could it be.

Hi,
Based on your requirement you can create Fine Grained Password Policies.
This feature introduced in Windows Server 2008 allows you to override password policy set at the Default Domain Policy for specific users or groups.
Checkout the below link for creating Fine Grained Password Policies from GUI in Windows Server 2012,
http://blogs.technet.com/b/reference_point/archive/2013/04/12/fine-grained-password-policies-gui-in-windows-server-2012-adac.aspx
Regards,
Gopi
JiJi
Technologies

Windows 8 and Default Domain Policy modification issue

Hi,
I'm unable to edit the default domain policy from my new Windows 8 desktop. It's the only Win8 in the environment so I'm not able to easily test another one unfortunately. The error I receive is:
Group Policy Error
Failed to open the Group Policy Object. You might not have the appropriate rights.
Details: The volume for a file has been externally altered so that the opened file is no longer valid.
I have checked from a Win7 and a 2003 machine and can access and edit the GPO without issue using the same account. The Win8 desktop is a fresh install with the RSAT tools installed, Exchange 2010 tools and a few basic applicaitons (non of which stick
out as having anything to do with AD management).
It only occurs if I click edit on the GPO. I'm able to successfully view the policy and edit the permissions etc. Have rebooted and the machine is current with patches as of now.
thanks
Andy
Cheers Andy

Hi,
According to your description, the issue only occurred when you click to edit the GPO. And only occurred on Windows 8. I would like suggest you to follow below suggestions to narrow down the issue:
1. Check out whether the issue only occurred to Default domain policy object.
2. Test on another new installed Windows 8 client with only RSAT installed.
3. Create another new account and add it to domain admin group to test again.
4. Run dcdiag on DCs to check out whether the replications work fine.
Hope this helps.
Regards,
Yan Li
If you have any feedback on our support, please click
here
Cataleya Li
TechNet Community Support

I'm trying to update my apps but itunes is defaulting to an old deleted email address, how can I change it?

I'm trying to update my apps on my ipad, but when I go to updates itunes has suddenly defaulted to an old deleted email address, how can I fix this? When I go into settings on my ipad the email address is correct, it's just itunes thats causing a problem. Can someone please help, I cant access the deleted email address and when I try to answer the security questions Apple is telling me that I have entered the incorrect date of birth.....I haven't forgotten my date of birth.... this is so frustrating. What can I do?????

Is it a different account e.g. did you update your account with a new email address or did you create a new account ? If you updated your existing account then try logging out of the account by tapping on the id at the bottom of the Featured tab in the App Store app and then log back in and see if the updated id then shows in the Purchased tab.
If you created a new account then all apps (and any other content) downloaded by the old account will remain tied to the old account, and only that old account can download updates to its apps (and/or redownload its purchases). If you can't remember its password, and can't get the security questions reset (you don't have a rescue email address on the account ?), then you have need to contact Support in your country to get the questions and password reset.
Contacting Apple about account security : http://support.apple.com/kb/HT5699

Gpupdate wont update because of Default Domain Policy

Hi Technet Community
I have just tried to do a gpupdate /force in the Command Prompt, but it has thrown an error up at me. Screenshot below :
I have gone into Group Policy Management and tracked the UID (which is displayed above starting with 31B2F340...) to be the same as the Default Domain Policy. Usually, I would do whatever I need to with Group Policy to get it working again, but I don't know
how to change this policy about, or whether I can delete the current one and recreate it?
Could anyone let me know what I can do to resolve this.
A restart does not resolve this issue, and if I leave the domain and re-join it, it still doesn't resolve it.
I'll try installing SP1 and see if it works, but no other Windows 7, 8 or 8.1 client computers seem to work either, with exactly the same error.
All users can still log in.
Thanks
Ed

Hi Technet Community
I have just tried to do a gpupdate /force in the Command Prompt, but it has thrown an error up at me. Screenshot below :
I have gone into Group Policy Management and tracked the UID (which is displayed above starting with 31B2F340...) to be the same as the Default Domain Policy. Usually, I would do whatever I need to with Group Policy to get it working again, but I don't know
how to change this policy about, or whether I can delete the current one and recreate it?
Could anyone let me know what I can do to resolve this.
A restart does not resolve this issue, and if I leave the domain and re-join it, it still doesn't resolve it.
I'll try installing SP1 and see if it works, but no other Windows 7, 8 or 8.1 client computers seem to work either, with exactly the same error.
All users can still log in.
Thanks
Ed

How do i default my PC to open email photo or pdf attachments in Elements? It currently opens in my olf Adone photoshop starter edition 3.2

how do i default my PC to open email photo or pdf attachments in Elements? It currently opens in my olf Adone photoshop starter edition 3.2

You can install PSE on the XP machine.Convert the catalog on of starter edition to PSE.Take the backup of the catalog on XP machine and then restore it on the windows 7 machine. This way you will have all the data of the catalog on your XP machine.

Default domain policy got corrupted and can't reverse to old system state?

Initially we had two servers which was 2003 and 2008, after adding additional two more servers (server 2012) in the network and then demoted the old servers. and that was quite while ago. after carefully looking a the default policy I have noticed that there
so many policies was applied on default policy object which led me to disable them and created a backup for both domain controller and the domain policy.
now the problem is stupidly run
dcgpofix thought it will restore the domain policy to it's original state but it did not instead it came up with an empty default policy template and inside there is no security policy which i can edit. However i did tried to restore the old policy which
i backed up but i get an access denied error.
Now i realise that the original default policy was from server 2003 and the current schema domain functional level is 2012. Currently
I can not login to any newly added computers to the domain via domain administrator account.
Please help! Is there any way to create a new default domain policy?

Hi thanks for your input,
but that doesn't resolves my issue. However I have managed to fix it by modifying the Default policy systemflags and then run the command gpfixup.exe /ignoreschema /target :domain.com.
and after that I was able to restore my old gp from earlier backup.

Broken Default Domain Policy! GPOFIX Doesn't work

Justin1250 wrote:
So I noticed that command prompt is open in the users directory.
Did you right click on the command window and run as administrator?
It should run from the system directory as an admin.Yes I did. I just made sure again to run it as admin. Same result.

I've spent hours and hours trying to fix this but can't. I seem to have located the problem where the default domain policy has lost is child associated with the GUID in AD/Registry. None of the tools seem to work, and I can't delete and recreate it because it thinks it doesn't exist and because Microsoft has engineered it to not be removable. This would be fine if it wasn't corrupted. I've read on some forums that the in-ability to delete a policy object is due to permissions issues. However, that isn't the issue in my case.I've tried THISwhich didn't work.I recently did a test migration to 2012 from 2003, and was hoping when I migrated the data that the GPO wouldn't transfer it's corrupted data, but I was wrong :-/The pictures below should illustrate more detail than I could describe.GPOFIX ToolActive Directory showing that the GUID...
This topic first appeared in the Spiceworks Community

NIS+ default passwd policy, such as aging, length

How to set NIS+ default passwd policy, such as aging, length?
/etc/default/passwd only affect the local account. Where is the config file for NIS+? Is there a NIS+ table for the passwd policy?
If there is no config file or NIS+ table for such setting, where is the default value when a new user is added?
Message was edited by:
kdust

-- Second Update --
After policy installation I got several problems with PeopleSoft configuration. Which finally were solved.
1. Some URL's has to be defined as not enforced.
com.sun.am.policy.amFilter.notenforcedList[1]=/ps/images/*
com.sun.am.policy.amFilter.notenforcedList[2]=*.css
com.sun.am.policy.amFilter.notenforcedList[3]=*.ico
2. In versions older than PeopleSoft 8.4.2 the policy agent modified the file
/opt/fs/webserv/peoplesoft/applications/peoplesoft/PORTAL/WEB-INF/psftdocs/ps/configuration.properties to add the properties:
byPassSignon=TRUE
defaultUserid="DEFAULT_USER"
defaultPWD="your password"
signon_page=amsignin.html
signonError_page=amsignin.html
logout_page=amsignin.html
expire_page=amsignin.html
However, in the newer versions of PeopleSoft this properties are controled from the online Peoplesoft console. Which are set on:
PeopleTools --> WebProfile ---> WebProfileConfiguration --> [PROFILE] --> Security --> In section "Public Users" the parameters that has to be changed are:
Allow Public Access (cheked)
User ID : DEFAULT_USER
Password : your password
HTTP Session Inactivity : (SSO TIMEOUT)
and:
PeopleTools --> WebProfile ---> WebProfileConfiguration --> [PROFILE] --> Look and Feel -->
In section "SignOn/Logout" set the following values:
Signon Page : amsignin.html
Signon Error Page : amerror.html
Logout Page : amsignout.html
Note: After making any changes on the console; restart PIA (weblogic instance).
With this the SSO with PeopleSoft is working Ok.
Message was edited by:
LpzYlnd

Discrepancy in Default Domain Policy

Hello,
About 6 months ago we migrated from DC's running Windows 2003 R2 to Windows 2012 R2. At that time we raised our domain functional level to "Windows Server 2008 R2"
I am trying to audit my Group Policy and have found a problem I am unable to explain. I have installed RSAT tools on my local workstation, and I have been using it to view group policy to perform my audit. Everything was going fine until I came across:
"Default Domain Policy"
Computer Configuration\Policies\Windows Settings\Security Settings\Public Key Policies\Trusted Root Certification Authorities
However when I attempted to edit the policy to look at the settings, nothing is there, the certificate is just missing.
Furthermore, when I look in the Group Policy Management on the DC, It does not even show "Computer Configuration\Policies\Windows Settings\Security Settings\Public Key Policies\TrustedRoot Certification Authorities"
Can anyone explain to me the following:
1. Why does my local workstations RSAT tools show settings that are not reflected on the DC?
2. Why is my RSAT tools showing settings on a certificate the does not exist? Is it because there used to be a cert there when we were using 2k3 domain controllers, and the cert wasn't migrated?
3. How can I fix this so that my RSAT Group Policy Manager on my Workstations is synched with my Domain Controllers?
Thank You in advance for any assistance.
P.S. I had several pictures setup that made the explanation of all this much easier, but I was not allowed to add them because "Body text cannot contain images or links until we are able to verify your account."

I have made some interesting discoveries that I think may help future individuals, if they find this posting.
When looking at the picture in my original posting you see that the group policy points to:
"Computer Configuration\Policies\Windows Settings\Security Settings\Public Key Policies\Trusted
Root Certification Authorities"
So you would expect that you would navigate to the same path in the GPME (Group Policy Management Editor)
but it turns out, that is not the case, to edit these settings you must navigate to the following:
"Computer Configuration\Policies\Windows Settings\Security Settings\Public Key Policies" and
double-click on "Certificate Path Validation Settings"
I discovered this information using this technet article:
http://technet.microsoft.com/en-us/library/cc754841.aspx
Under "Managing Trusted Root Certificates for a Domain"
However this does not resolve my original issue, in that it does not explain the discrepancy between RSAT tools and the DC.
Well I have a friend who has almost an identical setup to mine at his company (he is using Server 2012 R1), he checked, and he saw the exact same scenario as I have.
I am unsure if this is by design or a bug in GPO. I would assume that if it was a bug that others would have discovered it by now and written about it, can anyone provide any insight?

Default Domain Policy Not Applying Settings to Servers or Clients

I have 2008 R2 DC's with a functioning level of 2003. Our domain servers are a mix of 2003, 2008, 2008 R2, and 2012 and our clients are a mix of Windows 7 Pro and Windows 8.1 Pro.
I recently made a change to the Default Domain Policy located at Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> Security Options
For the Security Policy setting called: Network security: Configure encryption types allowed for Kerberos
The change was to enable DES because of a specific need that I have with an application that I work with but enabling DES and leaving the other options such AES unselected caused other applications to not work right. I decided to revert the changes
back to "Not Defined" but those changes did not reflect on the servers even after running the gpupdate /force command.
In order to keep the application working that broke, we enabled all of the encryption levels such as DES, AES, etc. on the server that's running the application via it's Local Security Policy as a temporary fix.
Now, I want to make sure all servers receive the settings from the Default Domain Policy and have their Local Security Policies reflect the "Not Defined" setting but it's not applying. It seems like they worked when I first applied them but
when I try to remove them it does not work.
If I change the setting directly on the Local Security Policy on the server or clients it shows "No minimum" instead of "Not Defined" which I've heard can be fixed by identifying the registry entry for that setting and deleting it...so
help with the location and how to identify that key would also be helpful.
My goal is not to manually have to change servers and clients to revert back to their default settings...I want the Domain policy to apply and override the servers and client's Local Security Policy.
Any help with this would be greatly appreciated and thank you in advance.

I have 2008 R2 DC's with a functioning level of 2003. Our domain servers are a mix of 2003, 2008, 2008 R2, and 2012 and our clients are a mix of Windows 7 Pro and Windows 8.1 Pro.
I recently made a change to the Default Domain Policy located at Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> Security Options
For the Security Policy setting called: Network security: Configure encryption types allowed for Kerberos
refer:
http://technet.microsoft.com/en-us/library/jj852180(v=ws.10).aspx
We needed to implement a similar scenario a few years ago (when we introduced Windows7 into our estate).
We had an SAP/NetWeaver implementation which always worked on WinXP, but failed on Win7.
We had to enable the DES ciphers, since those were disabled by default in Win7. We discovered that we also needed to enable all the other ciphers (those which are enabled by default[not configured]).
i.e., when we changed the setting from "Not Configured", enabled DES, and left the RC4/AES stuff untouched by us, the RC4/AES stuff attracted a status of disabled.
So, we had to set the DES ciphers to Enabled, and, also set the RC4/AES ciphers to Enabled - this gave us the "resultant" enablement of the default stuff and the needed change/addition of DES.
When you set a GP setting "back to Not Configured", depending upon the setting *AND* the individual Windows feature itself - one of two things will happen:
a) the feature will "revert" to default behaviour
b) the feature will retain the current configured behaviour but becomes un-managed
In classic Group Policy terms, condition (b) above is often referred to as "tattooing", i.e., the last GP setting remains in effect even though GPMC/RSOP/etc does not reveal that to be the case.
(This is also a really good example of not doing this sort of stuff in the DDP. It could have borked your whole domain :)
What I'd suggest, is that you re-enable your ciphers for KRB settings again - this time, enable all the ciphers that would normally be "default", let that replicate around, and allow time for domain members to action it.
Then, set the setting back to Not Configured. This way, the "last" settings issued by GP will be those you want to remain as the "legacy".
Note: the GP settings reference s/sheet, has this to say:
Network security: Configure encryption types allowed for Kerberos
This policy setting allows you to set the encryption types that Kerberos is allowed to use.
If not selected, the encryption type will not be allowed. This setting may affect compatibility with client computers or services and applications. Multiple selections are permitted.
This policy is supported on at least Windows 7 or Windows Server 2008 R2.
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

Default Folders Policy/Items retention period not respected ?

Hello,
We have Exchange Server 2007 SP3 and we've set up a default folders policy to erase all mailbox content older than 31 days.
However in three mailboxes we've sampled this policy isn't properly applied : the mailboxes had mails newer than 31 days deleted ( some 20 days, some 28 days, mine had only 14 days old mails !
Can you please explain to me why this is happening?

Thank you sir Allen
I ran the commands you mentioned
[PS] C:\Documents and Settings\Administrateur>Get-Mailbox "alias" | FL Identit
y, ManagedFolderMailboxPolicy
Identity : domain.com/Users/alias
ManagedFolderMailboxPolicy : TestPolicy
[PS] C:\Documents and Settings\Administrateur>Get-ManagedFolderMailboxPolicy "TestPolicy" | FL Identity,ManagedFolderLinks
Identity : TestPolicy
ManagedFolderLinks : {Entire Mailbox, Tasks, Notes, Journal, Contacts, Calendar
[PS] C:\Documents and Settings\Administrateur>Get-ManagedContentSettings -FolderName "Entire Mailbox"
Name MessageClass ManagedFolderName
testrem * Entire Mailbox
[PS] C:\Documents and Settings\Administrateur>Get-ManagedContentSettings -FolderName "Tasks"
Name MessageClass ManagedFolderName
Preventing Del IPM.Task* Tasks
I set the entire Mailbox to be deleted after 31 days, then creating managed content settings on tasks, agenda and contacts and uncheked the item retention period so that these items do not get deleted.
tried to go with only deleting items from the inbox but it didn't delete those in custom folders(each user creates his own)... the other method worked though

How to avoid applying Default domain policy?

Hello! Hope to get some ideas on the following:
I have one PC that I DO NOT want to apply default domain policy to. I have created a separate OU in AD with one security group, that contains only that one PC.
I made sure that pc is a member of only that group and not domain computers or any other groups.
I have created a separate GPO for this PC and linked in to the domain.
I am seeing in the gpresult /r that both the new GPO is applied to the workstation and the default domain gp as well.
Default domain policy is designed to be applied to all authenticated users.
I have create a separate user for that workstation that is not a member of authenticated users.It is only a member of domain users.
Ultimately I want default domain policy to be filtered out and the gpo specific to this pc to be applied.
Any ideas?

> Default domain policy is designed to be applied to all authenticated users.
>
> I have create a separate user for that workstation that is not a member
> of authenticated users.It is only a member of domain users.
You cannot exclude any computer or user from being an authenticated user...
> Ultimately I want default domain policy to be filtered out and the gpo
> specific to this pc to be applied.
Then simply block inheritance on the OU this computer lives in, and link
the specific GPO to that OU.
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Windows 2003 Password Policy Ignored in Default Domain Policy

Hi there I've a problem on my DC.
i set in the "default domain policy" the settings form the policy password lenght complexity etc etc..
When i RUN Group policy modelling simulation i cannot view the settings of Windows Settings\Security Settings\account policy\password policy
the scope of the GPO is Authenticated
the GPO seems to be ignored for the security settings but not for the other parameters like kerberos security.
Any Idea to solve this issue?

Hi Federico,
>>i cannot view the settings of Windows Settings\Security Settings\account policy\password policy
What do this mean? Does this mean that we can’t see the password policy in the modeling, or that we can’t see the change we made to the password policy? Besides, were there
error messages displayed in the modeling?
In addition, we can try running the Group Policy Modeling Wizard again to see if the issue persist.
Best regards,
Frank Shen

Default AV policy behavior in email C360 -odd !?

Similar Messages

Maybe you are looking for