Group Policy causes novell client to never show up windows XP

Hello,
I've been having a problem for the last couple of months that I have no
idea how to fix. I'm using Windows XP SP1, Novell Client 4.91, and
Zenworks 3.2 (included in Novell Client 4.90 SP2). This is a Netware 6
server. I am running E-trust Antivirus 7.1.192. I am having a problem
where the novell client will not show up after restarting the workstation.
An hourglass comes up for a couple of seconds, disappears, and then I'm
left with a blank screen and a mouse curser. The only thing I can do is
power the machine down manually, no keystrokes work at that point. It
doesn't happen all the time, it's completely random, but it occurs often
enough for the users to complain.
The source of the problem seems to be the group policy that is in effect
for students (this is a K-12 school district). If I disable the group
policy for students, the problem appears to go away (this is not an
option). If the login screen shows up, then everything else on the
computer functions perfectly (including policy after login). Are there are
group policy updates available that may solve this problem? Please let me
know if I've left out any important information. I appreciate any help
provided as I've been at this for the past couple months!
Thanks,
Patrick

Pat,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Do a search of our knowledgebase at http://support.novell.com/search/kb_index.jsp
- Check all of the other support tools and options available at
http://support.novell.com.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://support.novell.com/forums)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://support.novell.com/forums/faq_general.html
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://support.novell.com/forums/

Similar Messages

Drive restriction group policy causes error message when accessing Open and Save As Dialog Boxes on Windows 8.1

We are running Windows 8.1 Pro x86
I am really curious as to why the drive restriction group policy causes the error message to pop up:
"This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator."
It does not prevent from actual saving so functionality is not lost but it really annoys our end users and we're getting a lot of complaints. We cannot use the workaround of hiding drives instead of restricting as this still presents security issues. This
is happens when saving (or clicking on a button like "Browse" that opens the 'Open' dialogue box) in all Office 2013 applications, Internet Explorer, Paint, Notepad, and probably most others. I've looked at many forums and no suggestions for workarounds
have succeeded for us to get rid of this error message and in fact, I read a post that stated that someone contacted Microsoft and they said this was by design and there is no workaround. I find this very unfortunate that we either have the choice of compromising
security or annoying our end users. It seems to me like the new dialogue box in Windows 8.1 (and maybe 8?) attempts to access the local drive under the logged in user's account before it actually opens up the dialogue box which conflicts with the group policy
that restricts access to the drive.
Has anyone at all had any luck getting this to go away without removing the restrictions? It seems like the answer is either buried in the Windows code or somewhere in the registry.
Thank you in advance for your time!

Thank you for your time and response! Unfortunately, we have the machine locked down pretty tight (they are public use computers that require heavy restriction) and it is set to restrict all drives so access is limited to the local profile. We did try
testing your method, however, by adding the Desktop as an allowed location in the Office policy (which would not solve the issue for the other applications but was good for a test) using the path %userprofile%\desktop. When choosing that location, it does
not throw the error but unfortunately, it does not remember like it did for your with the E: drive so it still always throws the error when first loading the dialogue box no matter what I do. If you're able to confirm that this is simply by design and we're
just expected to inform our users to click through the errors, then I guess that's the accepted answer. Although, do you think that there might be a registry key value that is set after you save to the E: drive for the first time? Maybe we could set that value
to %userprofile%\desktop if it's doing the redirection after the first save through registry. Thanks again!

Group Policy for Desktop background applied but showing black desktop in the client end

Trying to set wallpaper in group policy but it's coming up blank.We have windows 2008 and 2012 server.most of the computer is windows 7.

Hi,
Does this issue occur to all computers?
Besides, can the users access the wallpaper?
If this issue just happens to Windows 7, we can try applying the hotfix in the following article.
The "Desktop Wallpaper" Group Policy setting is not applied in Windows 7 or in Windows Server 2008 R2
http://support.microsoft.com/kb/977944/en-us
If the issue persists, we can refer to the following thread to troubleshoot the problem.
Black Desktop wall paper after implementing group policy
http://social.technet.microsoft.com/Forums/windowsserver/en-US/0c36d7bf-4694-46e1-b408-d644111c0264/black-desktop-wall-paper-after-implementing-group-policy?forum=winserverGP
Best regards,
Frank Shen

Apply Group Policy to external clients

Is it possible to apply GPO's to clients on external networks such as their own personal networks. I'm looking at solutions such as authenticating them through a proxy on the perimeter network and are pushed to the Domain Controller to force these policies.
As it stands, the clients use a VPN client to gain access to the corporate network, and I know that group policy will use the Network Location Service to detect the Domain Controller, but the VPN connection is not mandatory and most be established by the client,
if this connection is not required for their job, the may never connect and not get updated GPO's.

Hi,
I agree with Joseph. Unlike many traditional VPN connections, which must be initiated and terminated by explicit user action, DirectAccess connections are designed to connect automatically as soon as the computer connects to the Internet.
Regarding DirectAcces, the following articles can be referred to for more information.
Using DirectAccess
http://technet.microsoft.com/en-in/windows/dn168168.aspx
Windows Server 2012 Direct Access – Part 1 What’s New
http://blogs.technet.com/b/meamcs/archive/2012/05/03/windows-server-2012-direct-access-part-1-what-s-new.aspx
In addition, for this question mainly focuses on network, in order to get more and better help, we can also ask for suggestions in the following forum.
Network Access Protection
https://social.technet.microsoft.com/Forums/windowsserver/en-US/home?forum=winserverNAP
Best regards,
Frank Shen

Windows Server 2008 - Group policy for domain client to start/stop services installed on it

Hello Experts
I am a newbie to windows server administration , though did a Google , but ended up with these question with my requirements
I have created a new domain and 2 client/computer (A & B namely) to domain . Now A & B has tomcat server running with port 8080 , 9090 which i have installed
domain ADMIN account .
&& now i am want to start/stop/restart services enabled for domain users !! How do i achieve this !!
basic question : How can i access A & B tomcat services on DOMAIN CONTROLLER server to create a GPO and that are on (A & B)
what is the easiest way to achieve the same , (if not using GPO)???
similarly I am looking for many features : where I want to control the permission to user on (A & B ) like : If the binaries of tomcat is available on machine say : A , if the user can install (now
it ask for ADMIN credentials)
Thanks
Mike~Ed

Controlling services with Group Policy is done under Computer Configuration\Policies\Windows Settings\Security Settings\System Services.
The limitation is that system services can only see the services the computer running the Group Policy management console. To access other services, you will either need to create the services on your computer (install the software the adds the service)
or install the remote server administration toolkit (RSAT) on the computer with the service already on it.
If my answer helped you, check out my blog:
Deploy Happiness

Windows Server 2008 Standard: Multiple Concerns: Inconsistent group policy update on client PC's, frequent disconnections of map drives and remote connection

Hi this is my first time to ask a question here in this community.
I am a system administrator here at my work and we are having some issues on some servers that we handle. Network in our office is stable and we have determined it is not a problem on the connection.
First issue - One of our domain controller consistently drops out on our Directory Server and saying it's unavailable.
Second issue - Unable to ping hostname but IP address works fine. (Sometimes hostname is ok but very intermittent)
Third issue - Since connection is unstable map drives causes to disconnect
If someone can provide any assistance on this matter it would be a great help. If screenshots needed for proper assistance would be appreciative.
Just to add that this only happen after a power failure last April of this month and a few weeks bluescreen started to show. It is a hazy version wasn't able to get any code that may lead to a hardware failure.
Now our main RDC.local is also affected so we are trying to isolate this issue and exhauted my brain since we cannot determine what causes it. Need external assistance just to give us a lead on where we can get this resolved.

Hi Ryan,
Before going further, would you please let me confirm something more? Thanks for your understanding.
1. For first issue, would you please let me know OS edition information of the problematic DC? Was it Windows Server 2008 R2 or Windows Server 2012 or any other?
à
One of our domain controller consistently drops out on our Directory Server and saying it's unavailable.
Would you please let me know the complete error message or provide a screenshot of it?
(Please hide all protected or private information.) Meanwhile, please log on the problematic DC and check if find relevant events or errors in Event Viewer.
2. For the second issue, it seems to be a DNS issue. Did you run
ipconfig /flushdns and ipconfig /registerdns command? Any find? Meanwhile, please use
ipconfig /all to display full TCP/IP configuration and check. Or you can post the
ipconfig result here. It may help us to go further analyze. By the way, would you please let me know error message that you can get when be unable to ping via hostname?
3.
àSince connection is unstable map drives causes to disconnect
May be a cause.
If any update, please feel free to let me know.
Hope this helps.
Best regards,
Justin Gu

Group policy preventing write access to hard drive for Windows Service

I recently stood up several SharePoint Servers which use various domain user accounts as service accounts. Everything was going fine until the servers were moved from the staging OU to the production OU which has a server hardening GPO applied to it. Once
this occurred, all of SharePoint's logging via the Tracing service broke--because this account doesn't run as Local Service, but rather one of the domain user accounts.
After examining the Application event log, I saw it filled with errors indicating the E:\Logs\ULS and E:\Logs\Usage were not accessible due to error 0x5 -- access denied.
I explicitly granted permissions to the service account to these folders, and gave Full Control perms. I then restarted the service, but the Access Denied errors persisted. I granted Full Control to the entire E: drive -- the root folder -- with inheritance,
and made sure the permissions were inherited. And yet the problem persisted.
I installed a different application which can log to different drives, and it writes to the E: drive just fine when run as Local System. If I change it to one of the domain service accounts, it too produces Access Denied errors trying to write to the E:
drive, regardless of the NTFS perms.
The E: drive is a hard drive, not a USB or removable drive.
I found several posts here that explain how to disable write access to USB and DVD media, but I cannot find anything how to block writing to a hard drive. The server hardening GPO contains thousands of different settings and it'll take days to comb through
them all. Does anyone know of a GPO setting that can block writing to a hard drive, regardless of NTFS perms?
The servers in question are running Windows Server 2012 standard (not R2).
UPDATE: If I grant the service account the ability to log on locally (i.e. add it to the local Users group), and open a command prompt with "Run as User," I can write to the E: drive just fine. But the access denied
persists when running as a service. This leads me to believe a GPO is blocking the write access to a
service user but allowing the same account when logging in as an interactive
user.

I created a test Windows service that does nothing more than open two StreamWriter objects -- one to write into E:\Logs\ULS and the other into C:\ProgramData\Logs. The former writes dummy text once per second, while the latter writes errors. So error messages
will get written into C:\ProgramData\Logs.
I set up this test Windows Service and set it up to use my SharePoint app pool account, and this was written to the error log - the first line indicates the account being used.
[8/22/2014 12:01:25 PM] - Error writer is initialized and ready. Execution context svc_SPSvcApp_J
[8/22/2014 12:01:25 PM] - Directory E:\Logs\ULS does not exist.
[8/22/2014 12:01:25 PM] - Failed to set up the log writer. Access to the path 'E:\Logs\ULS' is denied.
System.UnauthorizedAccessException: Access to the path 'E:\Logs\ULS' is denied.
at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
at System.IO.Directory.InternalCreateDirectory(String fullPath, String path, Object dirSecurityObj, Boolean checkHost)
at System.IO.Directory.InternalCreateDirectoryHelper(String path, Boolean checkHost)
at ServiceLogWriter.Service1.Compose()
I then tried this with my Farm account. For TEST purposes, I TEMPORARILY put this account in the local Administrators group (I removed it after the test). And
STILL does not see the E: drive or any folders it contains.
[8/22/2014 12:05:08 PM] - Error writer is initialized and ready. Execution context svc_SPFarm_J
[8/22/2014 12:05:08 PM] - Quick test to look for things we KNOW exist on the Server. We know there is an E: drive, and we know there's a folder named E:\Logs\ULS.
[8/22/2014 12:05:08 PM] - Windows reports E:\ does not exist. This is bad.
[8/22/2014 12:05:08 PM] - Windows reports E:\Logs does not exist. This is very bad.
[8/22/2014 12:05:08 PM] - Windows reports E:\Logs\ULS does not exist. In the words of the late Captain Phil Harris, "This is bad. This is bad bad."
[8/22/2014 12:05:08 PM] - Directory E:\Logs\ULS does not exist (we'll try to create it).
[8/22/2014 12:05:08 PM] - Failed to set up the log writer. Access to the path 'E:\Logs\ULS' is denied.
System.UnauthorizedAccessException: Access to the path 'E:\Logs\ULS' is denied.
at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
at System.IO.Directory.InternalCreateDirectory(String fullPath, String path, Object dirSecurityObj, Boolean checkHost)
at System.IO.Directory.InternalCreateDirectoryHelper(String path, Boolean checkHost)
at ServiceLogWriter.Service1.Compose()
Next I tried my own ID to run the same service. I'm a Domain Admin so I should have ruler of the roost perms
[8/22/2014 12:12:35 PM] - Error writer is initialized and ready. Execution context sawyemat
[8/22/2014 12:12:35 PM] - Quick test to look for things we KNOW exist on the Server. We know there is an E: drive, and we know there's a folder named E:\Logs\ULS.
[8/22/2014 12:12:35 PM] - Windows reports E:\ does not exist. This is bad.
[8/22/2014 12:12:35 PM] - Windows reports E:\Logs does not exist. This is very bad.
[8/22/2014 12:12:35 PM] - Windows reports E:\Logs\ULS does not exist. In the words of the late Captain Phil Harris, "This is bad. This is bad bad."
[8/22/2014 12:12:35 PM] - Directory E:\Logs\ULS does not exist (we'll try to create it).
[8/22/2014 12:12:35 PM] - Failed to set up the log writer. Access to the path 'E:\Logs\ULS' is denied.
System.UnauthorizedAccessException: Access to the path 'E:\Logs\ULS' is denied.
at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
at System.IO.Directory.InternalCreateDirectory(String fullPath, String path, Object dirSecurityObj, Boolean checkHost)
at System.IO.Directory.InternalCreateDirectoryHelper(String path, Boolean checkHost)
at ServiceLogWriter.Service1.Compose()
Mind you I'm starting and stopping the service while logged in interactively -- I can CLEARLY SEE there's an E: drive and E:\Logs\ULS folder!
It is quite evident to me that there is a policy blocking Windows services from seeing the E:
drive.
Run this under the LocalSystem (SYSTEM) account, and all is well.
[8/22/2014 12:15:18 PM] - Error writer is initialized and ready. Execution context SYSTEM
[8/22/2014 12:15:18 PM] - Quick test to look for things we KNOW exist on the Server. We know there is an E: drive, and we know there's a folder named E:\Logs\ULS.
[8/22/2014 12:15:18 PM] - So far so good - Windows reports E:\ exists.
[8/22/2014 12:15:18 PM] - Windows reports E:\Logs exists.
[8/22/2014 12:15:18 PM] - Awesome - Windows reports E:\Logs\ULS exists.
[8/22/2014 12:15:18 PM] - Log writer is set up successfully.
[8/22/2014 12:15:25 PM] - Shutdown in progress.

Windows 2012 Group Policy Option missing for Windows 7 Client

Hi there,
We have a deployment with a windows 2012 DC and various Windows 7 clients.
I am trying to set up a group policy on the 2012 DC to configure the Windows 7 clients and basically disable the Aero feature.
The "Do not allow desktop composition" is the one I need to enable and this would sit under Admin Templates > Windows Components > Desktop Windows Manager.
In Windows 2012 Group Policy editor this does not show...does anyone know how I can do this to a remote Windows 7 machine from 2012 DC?
Note if it helps on a windows 7 machine you can also disable the service "Desktop Window Manager Session Manager”
to achieve the same thing BUT when looking through the Group Policy again I can’t seem to find this!!
Thanks for any help,
Steve

> In Windows 2012 Group Policy editor this does not show...does anyone
> know how i can do this to a remote Windows 7 machine from 2012 DC?
Install RSAT and edit on W7. Or copy all W7 admx/adml templates to the
central store.
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Set "always show all icons and notifications on the taskbar" via Group policy

Any ideas on how to set "always show all icons and notifications on the taskbar" on a set of users?
I thought it would be under User Configuration\Administrative Templates\Start Menu and Taskbar, but I cannot find it.
Anyone know if this can be enforced via policy?

Hello,
Thank you for your post here.
Unfortunately, there is not any group policy settings which can set "always show all icons and notifications on the
taskbar".
To distribute the setting, you can create a default domain user profile and copy it to the following network share.
When the domain user account is first logged onto the domain, the default profile will be applied.
\\<Server_name>\NETLOGON\Default User.v2
How to customize default user profiles in Windows 7 and in Windows Server 2008 R2
http://support.microsoft.com/kb/973289
This would only apply if a new profile is created, not for existing ones.

Power Manager - no new profiles, group policy not applying

Hi there!
Having an issue with power manager (latest version, downloaded today) on Vista on a T61. The first problem is that I cannot create a power profile. If I hit New on the advanced page and fill all the stuff out, the named power plan does not show up. It's like I never did it.
The second issue is that group policy doesn't seem to apply, either. I tried to create a new power policy through AD using the GPO available for download. All the settings are filled out, it's named, and it doesn't show up.
For those concerned that the group policy is mucking up the ability to create a new one through the UI, that was the behavior before the group policy was set up.
rsop.msc shows definitively that the policy is applying to this machine.
Does anyone have any hints?
Thank you!

rscurr,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Visit http://support.novell.com and search the knowledgebase and/or check all
the other self support options and support programs available.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://forums.novell.com)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://forums.novell.com/faq.php
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://support.novell.com/forums/

I get a Group Policy Disk Quota failure at every system start

This is very long, my apologies
I asked this question about a month ago and then had some medical problems so I'm starting over again.
Whenever I start my system I get a message on the screen that the system is trying to run Group Policy for Disk Quotas. To my knowledge I've never set a disk quota policy and I can't find any indication that one is currently set. I freely admit
that I could be responsible for this. I might have done something in the early days of the system because it wasn't happening for the first month or two.
This time I did more reading and found a procedure on TechNet at:
"http://technet.microsoft.com/en-us/library/cc749336(WS.10).aspx" which led me step by step through the procedure, although I still can't make sense of the results.
So far I've verified that there are no policies set and that all the hard drives (3) have the Disk Quota bit 'disabled'. I did this as 'Administrator'.
The results from the TechNet procedure turned out to be quite long but I'm listing it here in hope that someone in the community will be familiar with this problem and be able to use the information to figure out the problem.
Here are the results:
From: TechNet Group Policy Testing
( "http://technet.microsoft.com/en-us/library/cc749336(WS.10).aspx" )
1 - Troubleshooting using the Group Policy operational log
   a - Determine the instance of Group Policy processing
   (Before you view the Group Policy operational log, you must first determine
   the instance of Group Policy processing that failed.)
My ActivityID from the Group Policy operational log = C87E5BC2-FD21-4794-B678-787AB587D8D5
2 - Create a custom view, via a query, of the Group Policy instance
My resultant query:
<QueryList><Query Id="0" Path="Application"><Select Path="Microsoft-Windows-GroupPolicy/Operational">*[System/Correlation/@ActivityID='{C87E5BC2-FD21-4794-B678-787AB587D8D5}']</Select></Query></QueryList>
3 - Results of running the query from step 2 are listed below, in chronological order, including the complete 'detail' sections from each event.
event 4000
Event Description(s) = Computer startup
BEGIN DETAIL SECTION-----------------------------------------------------------------------------
- System
  - Provider
   [ Name] Microsoft-Windows-GroupPolicy
   [ Guid] {AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}
   EventID 4000
   Version 1
   Level 4
   Task 0
   Opcode 1
   Keywords 0x4000000000000000
   - TimeCreated
   [ SystemTime] 2010-05-15T13:29:33.598400000Z
   EventRecordID 22707
   - Correlation
   [ ActivityID] {C87E5BC2-FD21-4794-B678-787AB587D8D5}
   - Execution
   [ ProcessID] 1280
   [ ThreadID] 1784
   Channel Microsoft-Windows-GroupPolicy/Operational
   Computer GROK
   - Security
   [ UserID] S-1-5-18
- EventData
  PolicyActivityId {C87E5BC2-FD21-4794-B678-787AB587D8D5}
  PrincipalSamName WORKGROUP\GROK$
  IsMachine 1
  IsDomainJoined false
  IsBackgroundProcessing false
  IsAsyncProcessing false
  IsServiceRestart false
  ReasonForSyncProcessing 2
END DETAIL SECTION-------------------------------------------------------------------------------
event 5320
Event Description(s) = Checking for Group Policy client extensions that are not part of the system.
Event Description(s) = Service configuration update to standalone is not required and will be skipped.
BEGIN DETAIL SECTION------------------------------------------------------------------------------
- System
  - Provider
   [ Name] Microsoft-Windows-GroupPolicy
   [ Guid] {AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}
   EventID 5320
   Version 0
   Level 4
   Task 0
   Opcode 0
   Keywords 0x4000000000000000
   - TimeCreated
   [ SystemTime] 2010-05-15T13:29:33.614000000Z
   EventRecordID 22711
   - Correlation
   [ ActivityID] {C87E5BC2-FD21-4794-B678-787AB587D8D5}
   - Execution
   [ ProcessID] 1280
   [ ThreadID] 1784
   Channel Microsoft-Windows-GroupPolicy/Operational
   Computer GROK
   - Security
   [ UserID] S-1-5-18
- EventData
  InfoDescription %%4161
END DETAIL SECTION-------------------------------------------------------------------------------
event 5313
Event Description(s) = The following Group Policy objects were not applicable because they were filtered out :
BEGIN DETAIL SECTION------------------------------------------------------------------------------
- System
  - Provider
   [ Name] Microsoft-Windows-GroupPolicy
   [ Guid] {AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}
   EventID 5313
   Version 0
   Level 4
   Task 0
   Opcode 0
   Keywords 0x4000000000000000
   - TimeCreated
   [ SystemTime] 2010-05-15T13:29:33.614000000Z
   EventRecordID 22710
   - Correlation
   [ ActivityID] {C87E5BC2-FD21-4794-B678-787AB587D8D5}
   - Execution
   [ ProcessID] 1280
   [ ThreadID] 1784
   Channel Microsoft-Windows-GroupPolicy/Operational
   Computer GROK
   - Security
   [ UserID] S-1-5-18
- EventData
  DescriptionString None
  GPOInfoList
END DETAIL SECTION-------------------------------------------------------------------------------
event 5311
Event Description(s) = The loopback policy processing mode is "No loopback mode".
BEGIN DETAIL SECTION------------------------------------------------------------------------------
- System
  - Provider
   [ Name] Microsoft-Windows-GroupPolicy
   [ Guid] {AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}
   EventID 5311
   Version 0
   Level 4
   Task 0
   Opcode 0
   Keywords 0x4000000000000000
   - TimeCreated
   [ SystemTime] 2010-05-15T13:29:33.614000000Z
   EventRecordID 22708
   - Correlation
   [ ActivityID] {C87E5BC2-FD21-4794-B678-787AB587D8D5}
   - Execution
   [ ProcessID] 1280
   [ ThreadID] 1784
   Channel Microsoft-Windows-GroupPolicy/Operational
   Computer GROK
   - Security
   [ UserID] S-1-5-18
- EventData
  PolicyProcessingMode 0
END DETAIL SECTION-------------------------------------------------------------------------------
event 5312
Event Description(s) = List of applicable Group Policy objects:
Event Description(s) = Local Group Policy
BEGIN DETAIL SECTION------------------------------------------------------------------------------
- System
  - Provider
   [ Name] Microsoft-Windows-GroupPolicy
   [ Guid] {AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}
   EventID 5312
   Version 0
   Level 4
   Task 0
   Opcode 0
   Keywords 0x4000000000000000
   - TimeCreated
   [ SystemTime] 2010-05-15T13:29:33.614000000Z
   EventRecordID 22709
   - Correlation
   [ ActivityID] {C87E5BC2-FD21-4794-B678-787AB587D8D5}
   - Execution
   [ ProcessID] 1280
   [ ThreadID] 1784
   Channel Microsoft-Windows-GroupPolicy/Operational
   Computer GROK
   - Security
   [ UserID] S-1-5-18
- EventData
  DescriptionString Local Group Policy
  GPOInfoList <GPO ID="Local Group Policy"><Name>Local Group Policy</Name><Version>524296</Version><SOM>Local</SOM><FSPath>C:\Windows\System32\GroupPolicy\Machine</FSPath><Extensions>[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{D02B1F72-3407-48AE-BA88-E8213C6761F1}][{3610EDA5-77EF-11D2-8DC5-00C04FA31A66}{D02B1F72-3407-48AE-BA88-E8213C6761F1}][{F3CCC681-B74C-4060-9F26-CD84525DCA2A}{0F3F3735-573D-9804-99E4-AB2A69BA5FD4}]</Extensions></GPO>
END DETAIL SECTION-------------------------------------------------------------------------------
event 4016
Event Description(s) = Starting Microsoft Disk Quota Extension Processing.
Event Description(s) = List of applicable Group Policy objects: (Changes were detected.)
Event Description(s) = Local Group Policy
BEGIN DETAIL SECTION------------------------------------------------------------------------------
- System
  - Provider
   [ Name] Microsoft-Windows-GroupPolicy
   [ Guid] {AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}
   EventID 4016
   Version 0
   Level 4
   Task 0
   Opcode 1
   Keywords 0x4000000000000000
   - TimeCreated
   [ SystemTime] 2010-05-15T13:29:33.614000000Z
   EventRecordID 22714
   - Correlation
   [ ActivityID] {C87E5BC2-FD21-4794-B678-787AB587D8D5}
   - Execution
   [ ProcessID] 1280
   [ ThreadID] 1784
   Channel Microsoft-Windows-GroupPolicy/Operational
   Computer GROK
   - Security
   [ UserID] S-1-5-18
- EventData
  CSEExtensionId {3610EDA5-77EF-11D2-8DC5-00C04FA31A66}
  CSEExtensionName Microsoft Disk Quota
  IsExtensionAsyncProcessing false
  IsGPOListChanged true
  GPOListStatusString %%4102
  DescriptionString Local Group Policy
  ApplicableGPOList <GPO ID="Local Group Policy"><Name>Local Group Policy</Name></GPO>
END DETAIL SECTION-------------------------------------------------------------------------------
event 5320
Event Description(s) = Finished checking for non-system extensions.
BEGIN DETAIL SECTION------------------------------------------------------------------------------
- System
  - Provider
   [ Name] Microsoft-Windows-GroupPolicy
   [ Guid] {AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}
   EventID 5320
   Version 0
   Level 4
   Task 0
   Opcode 0
   Keywords 0x4000000000000000
   - TimeCreated
   [ SystemTime] 2010-05-15T13:29:33.614000000Z
   EventRecordID 22713
   - Correlation
   [ ActivityID] {C87E5BC2-FD21-4794-B678-787AB587D8D5}
   - Execution
   [ ProcessID] 1280
   [ ThreadID] 1784
   Channel Microsoft-Windows-GroupPolicy/Operational
   Computer GROK
  - Security
   [ UserID] S-1-5-18
- EventData
  InfoDescription %%4165
END DETAIL SECTION-------------------------------------------------------------------------------
event 4016
Event Description(s) = Starting Audit Policy Configuration Extension Processing.
Event Description(s) = List of applicable Group Policy objects: (No changes were detected.)
Event Description(s) = Local Group Policy
BEGIN DETAIL SECTION------------------------------------------------------------------------------
- System
  - Provider
   [ Name] Microsoft-Windows-GroupPolicy
   [ Guid] {AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}
   EventID 4016
   Version 0
   Level 4
   Task 0
   Opcode 1
   Keywords 0x4000000000000000
   - TimeCreated
   [ SystemTime] 2010-05-15T13:31:21.987200000Z
   EventRecordID 22718
   - Correlation
   [ ActivityID] {C87E5BC2-FD21-4794-B678-787AB587D8D5}
   - Execution
   [ ProcessID] 1280
   [ ThreadID] 1784
   Channel Microsoft-Windows-GroupPolicy/Operational
   Computer GROK
   - Security
   [ UserID] S-1-5-18
- EventData
  CSEExtensionId {F3CCC681-B74C-4060-9F26-CD84525DCA2A}
  CSEExtensionName Audit Policy Configuration
  IsExtensionAsyncProcessing true
  IsGPOListChanged false
  GPOListStatusString %%4101
  DescriptionString Local Group Policy
  ApplicableGPOList <GPO ID="Local Group Policy"><Name>Local Group Policy</Name></GPO>
END DETAIL SECTION-------------------------------------------------------------------------------
event 7016
Event Description(s) = Completed Microsoft Disk Quota Extension Processing in 108374 milliseconds.
BEGIN DETAIL SECTION-------------------------------------------------------------------------------------
- System
  - Provider
   [ Name] Microsoft-Windows-GroupPolicy
   [ Guid] {AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}
   EventID 7016
   Version 0
   Level 2
   Task 0
   Opcode 2
   Keywords 0x4000000000000000
   - TimeCreated
   [ SystemTime] 2010-05-15T13:31:21.987200000Z
   EventRecordID 22717
   - Correlation
   [ ActivityID] {C87E5BC2-FD21-4794-B678-787AB587D8D5}
   - Execution
   [ ProcessID] 1280
   [ ThreadID] 1784
   Channel Microsoft-Windows-GroupPolicy/Operational
   Computer GROK
   - Security
   [ UserID] S-1-5-18
- EventData
  CSEElaspedTimeInMilliSeconds 108374
  ErrorCode 2147942402
  CSEExtensionName Microsoft Disk Quota
  CSEExtensionId {3610EDA5-77EF-11D2-8DC5-00C04FA31A66}
END DETAIL SECTION-----------------------------------------------------------------------------------------
event 5016
Event Description(s) = Completed Microsoft Disk Quota Extension Processing in 108374 milliseconds.
BEGIN DETAIL SECTION----------------------------------------------------------------------------------------
- System
  - Provider
   [ Name] Microsoft-Windows-GroupPolicy
   [ Guid] {AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}
   EventID 5016
   Version 0
   Level 4
   Task 0
   Opcode 2
   Keywords 0x4000000000000000
   - TimeCreated
   [ SystemTime] 2010-05-15T13:31:22.314800000Z
   EventRecordID 22720
   - Correlation
   [ ActivityID] {C87E5BC2-FD21-4794-B678-787AB587D8D5}
   - Execution
   [ ProcessID] 1280
   [ ThreadID] 1784
   Channel Microsoft-Windows-GroupPolicy/Operational
   Computer GROK
   - Security
   [ UserID] S-1-5-18
- EventData
  CSEElaspedTimeInMilliSeconds 312
  ErrorCode 2147483658
  CSEExtensionName Audit Policy Configuration
  CSEExtensionId {F3CCC681-B74C-4060-9F26-CD84525DCA2A}
END DETAIL SECTION-----------------------------------------------------------------------------------------
Event 8000
Event Description(s) = Completed computer boot policy processing for WORKGROUP\GROK$ in 108 seconds.
BEGIN DETAIL SECTION----------------------------------------------------------------------------------------
- System
  - Provider
   [ Name] Microsoft-Windows-GroupPolicy
   [ Guid] {AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}
   EventID 8000
   Version 1
   Level 4
   Task 0
   Opcode 2
   Keywords 0x4000000000000000
   - TimeCreated
   [ SystemTime] 2010-05-15T13:31:22.330400000Z
   EventRecordID 22721
   - Correlation
   [ ActivityID] {C87E5BC2-FD21-4794-B678-787AB587D8D5}
   - Execution
   [ ProcessID] 1280
   [ ThreadID] 1784
   Channel Microsoft-Windows-GroupPolicy/Operational
   Computer GROK
   - Security
   [ UserID] S-1-5-18
- EventData
  PolicyElaspedTimeInSeconds 108
  ErrorCode 0
  PrincipalSamName WORKGROUP\GROK$
  IsMachine 1
  IsConnectivityFailure false
END DETAIL SECTION-----------------------------------------------------------------------------------------
End of results.
Thanks to all,
wegrok
Win7 Ultimate x64, 8 GB ram, AMD Phenom 9950 Quad-proc @2.6Ghz, HD = 1TB ASUS M4N72-E mobo, Video = NVIDIA GeForce 8800 GT w/ Dell 2407 Digital Monitor -------------------------------------------------------------------------------------------------------

Did you ever have luck tracking this down? Im getting this error and have no clue where it is coming from. I have not enabled gp disk quotas, but I do have a network share on a domain member server that has quotas attached to each users folder.
I removed the quotas and still get this error when I manually perform a gpupdate.

Group-Policy and Inheritence

I have a Group-Policy created with all the attributes that my SVC clients should be using -- this GP is called GP-SVC. My client wants to add different access-levels for different sets of users. I would like to do this by having three new Group-Policies inherit attributes from GP-SVC, except for the VPN Filter ACL which will be different on each of these "child" GP.
So here is how I want inheritence to work:
DfltGrpPolicy
|
+-- GP-SVC
       |
       +--GP-SVC-Users
       +--GP-SVC-Devs
       +--GP-SVC-Admins
But for some reason, its not letting me choose a group to inherit attributes from for my child GPs:
asa5505#    show run group-policy GP-SVC
group-policy GP-SVC internal
group-policy GP-SVC attributes
dns-server value 172.17.96.181
vpn-tunnel-protocol svc
split-tunnel-policy tunnelspecified
split-tunnel-network-list value SPLIT-SVC
default-domain value something.local
split-dns value something.local
address-pools value SVC-POOL
asa5505(config)# group-policy GP-SVC-Users internal ?
configure mode commands/options:
from Specify group to initialize attributes from
asa5505(config)# group-policy GP-SVC-Users internal from GP-SVC
ERROR: source group GP-SVC does not exist
Anyone have any ideas as to what I'm doing wrong? My goal was for the "child" group-policies to only have one attribute assigned, the VPN Filter, and for the rest of their attributes to be inherited from GP-SVC.
My Device:
Cisco Adaptive Security Appliance Software Version 8.2(5)3
Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz

Hi jcarvaja
Looks like you're right. Strange that it errors out:
student10# show run group-policy
group-policy PARENT internal
group-policy PARENT attributes
dns-server value 1.1.1.1 1.1.1.2
vpn-access-hours none
vpn-idle-timeout 111
vpn-session-timeout 111
split-dns value one.com one.one.com one.one.one.com
student10#
student10# conf t
student10(config)# group-policy CHILDa internal from PARENT
ERROR: source group PARENT does not exist
student10(config)#
student10(config)# show run group-policy
group-policy PARENT internal
group-policy PARENT attributes
dns-server value 1.1.1.1 1.1.1.2
vpn-access-hours none
vpn-idle-timeout 111
vpn-session-timeout 111
split-dns value one.com one.one.com one.one.one.com
group-policy CHILDa internal
group-policy CHILDa attributes
dns-server value 1.1.1.1 1.1.1.2
vpn-access-hours none
vpn-idle-timeout 111
vpn-session-timeout 111
split-dns value one.com one.one.com one.one.one.com
student10(config)#
So it creates the CHILD GP, but it only copies the configurtion, doesn't truly inherit. Which is to say, if I make a change to the parent group, it is not replicated to the child:
student10(config)#
student10(config)# group-policy PARENT attributes
student10(config-group-policy)# dns-server value 3.3.3.3
student10(config-group-policy)# exit
student10(config)# exit
student10# show run group-policy
group-policy PARENT internal
group-policy PARENT attributes
dns-server value 3.3.3.3
vpn-access-hours none
vpn-idle-timeout 111
vpn-session-timeout 111
split-dns value one.com one.one.com one.one.one.com
group-policy CHILDa internal
group-policy CHILDa attributes
dns-server value 1.1.1.1 1.1.1.2
vpn-access-hours none
vpn-idle-timeout 111
vpn-session-timeout 111
split-dns value one.com one.one.com one.one.one.com
I guess I have my answer then, the "from" keyword is to simply copy the settings from another group-policy, not set up a parent-child relationship.
Thanks for your help, Jcarvaja. I'll mark your respone as the answer.

Installing Novell Client fails due to 'untrusted signer'

I am trying to update Novell Client on our Windows 7 workstations, using a Zenworks bundle. This method has worked in the past: copy the installation files to c:\temp\zeninstall\clnt2sp3ir5 (including appropriately modified NovellClientProperties.txt and install.ini) and then just launch "setup.exe /ncpf" as secure system user.
This time I noticed that the new client was only partially installed. When viewing Novell Client properties it shows the new version, however, some files are definitely from the previous client version (for example C:\Windows\System32\lgnwnt32.dll).
I dug up c:\windows\inf\setupapi.dev.log and it seems that installation was aborted due to "unsigned driver package":
Code:
sto: Validating driver package files against catalog 'netnvcli.cat'.
!!! sto: Driver package signer is unknown. Assuming untrusted signer. Error = 0x800F0242
!!! ndv: Driver package failed signature validation. Error = 0xE0000242
sto: {DRIVERSTORE_IMPORT_NOTIFY_VALIDATE exit(0xe0000242)} 12:37:47.960
!!! sto: Driver package failed signature verification. Error = 0xE0000242
!!! sto: Failed to import driver package into Driver Store. Error = 0xE0000242
sto: {Stage Driver Package: exit(0xe0000242)} 12:37:48.225
!!! sto: Failed to stage driver package to Driver Store. Error = 0xE0000242, Time = 6521 ms
sto: {Import Driver Package: exit(0xe0000242)} 12:37:49.973
inf: Opened INF: 'c:\temp\zeninstall\novell_client\c2sp3ir5\netnvcli.inf' ([strings])
! inf: Add to Driver Store unsuccessful
! inf: Error 0xe0000242: The publisher of an Authenticode(tm) signed catalog has not yet been established as trusted.
!!! inf: returning failure to SetupCopyOEMInf
<<< Section end 2014/02/11 12:37:51.439
<<< [Exit status: FAILURE(0xe0000242)]
If I run the installation manually, I am prompted at one point about unsigned driver and whether I want to install it. If I answer "yes", the installation is successful.
Looking at Windows' certificate store on our computers, I see under "Trusted Publishers" a certificate issued to Novell, Inc by "Verisign Class 3 Code Signing 2009-2 CA", but that certificate expired on 27.04.2013.
How can I obtain and deploy the certificate that would allow the silent installation of Novell Client 2 SP3 IR5 to proceed? Or am I going about this in an entirely wrong way?

Originally Posted by vatson
I am trying to update Novell Client on our Windows 7 workstations, using a Zenworks bundle. This method has worked in the past: copy the installation files to c:\temp\zeninstall\clnt2sp3ir5 (including appropriately modified NovellClientProperties.txt and install.ini) and then just launch "setup.exe /ncpf" as secure system user.
This time I noticed that the new client was only partially installed. When viewing Novell Client properties it shows the new version, however, some files are definitely from the previous client version (for example C:\Windows\System32\lgnwnt32.dll).
I dug up c:\windows\inf\setupapi.dev.log and it seems that installation was aborted due to "unsigned driver package":
Code:
sto: Validating driver package files against catalog 'netnvcli.cat'.
!!! sto: Driver package signer is unknown. Assuming untrusted signer. Error = 0x800F0242
!!! ndv: Driver package failed signature validation. Error = 0xE0000242
sto: {DRIVERSTORE_IMPORT_NOTIFY_VALIDATE exit(0xe0000242)} 12:37:47.960
!!! sto: Driver package failed signature verification. Error = 0xE0000242
!!! sto: Failed to import driver package into Driver Store. Error = 0xE0000242
sto: {Stage Driver Package: exit(0xe0000242)} 12:37:48.225
!!! sto: Failed to stage driver package to Driver Store. Error = 0xE0000242, Time = 6521 ms
sto: {Import Driver Package: exit(0xe0000242)} 12:37:49.973
inf: Opened INF: 'c:\temp\zeninstall\novell_client\c2sp3ir5\netnvcli.inf' ([strings])
! inf: Add to Driver Store unsuccessful
! inf: Error 0xe0000242: The publisher of an Authenticode(tm) signed catalog has not yet been established as trusted.
!!! inf: returning failure to SetupCopyOEMInf
<<< Section end 2014/02/11 12:37:51.439
<<< [Exit status: FAILURE(0xe0000242)]
If I run the installation manually, I am prompted at one point about unsigned driver and whether I want to install it. If I answer "yes", the installation is successful.
Looking at Windows' certificate store on our computers, I see under "Trusted Publishers" a certificate issued to Novell, Inc by "Verisign Class 3 Code Signing 2009-2 CA", but that certificate expired on 27.04.2013.
How can I obtain and deploy the certificate that would allow the silent installation of Novell Client 2 SP3 IR5 to proceed? Or am I going about this in an entirely wrong way?
You need to install the newest client (that have a never certificate) on a device and then export it from that machine, after that you import it on the devices you want to install the client before running setup.exe.
Thomas

Windows 8 and IE10 and 11 not accepting Proxy Settings via Group Policy from windows server 2003

Hi
We are still running Windows Server 2003 with a Win7 and Win8 desktop environment. I can control Win7 IE9 settings,
But Win8 systems are running IE10. We have an internal proxy server.
Is there any way to force the proxy settings to the Win8/IE10 or 11 systems .
i have tried with The IE 10 .adm template and applied gpo,but does not have any proxy settings for ie10 and no changes were applies
please can anyone help me regarding this
i want to apply GPO from windows server 2003 to windows 8 ie10/11
Thanks
KNC

Hi,
I agree with Zanderol24, we can install RSAT on a windows8 client, and then we can use Group Policy Management to manage group policy from the client.
For more information about RSAT, we can refer to the following link:
Remote Server Administration Tools (RSAT) for Windows Client and Windows Server (dsforum2wiki)
http://social.technet.microsoft.com/wiki/contents/articles/2202.remote-server-administration-tools-rsat-for-windows-client-and-windows-server-dsforum2wiki.aspx
For more detailed information about how to use GPP to configure the proxy setting for ie10 and ie11, we can refer to the following link:
How to configure Group Policy Preference settings for Internet Explorer 11 in Windows 8.1 or Windows Server 2012 R2
http://support.microsoft.com/kb/2898604
When we use GPPs you need to be aware of the F5-F8 keys:
Red / Green: GP Preferences doesn’t work even though the policy applied and after gpupdate \force
http://blogs.technet.com/b/grouppolicy/archive/2008/10/13/red-green-gp-preferences-doesn-t-work-even-though-the-policy-applied-and-after-gpupdate-force.aspx
Besides, aside from using group policy to manage IE, IEAK can also be used to do this.
For IEAK, the following article can be referred to for more information.
Internet Explorer Administration Kit (IEAK) Information and Downloads
http://technet.microsoft.com/en-in/ie/bb219517.aspx
Best Regards,
Erin

Using multiple LISTBOX in single Policy of Microsoft Group Policy .adm file?

OK, I am writing a .adm file and here is code for a policy within a category
CATEGORY !!A_CATEGORY
POLICY !!A_POLICY
KEYNAME "Software\Policies\ABC\ListBoxes"
PART !!PART_1_Text LISTBOX
ALUEPREFIX "FirstListBox"
END PART
PART !!DestPort_Label LISTBOX
VALUEPREFIX "SecondListBox"
END PART
END POLICY
END CATEGORY
The .adm file is successfully loaded in group policy editor without any problem and shows two list boxes too. I can give input for both list boxes and apply/ok without any problem. The real problem is that on registry location "Software\Policies\ABC\ListBoxes",
there comes only registry values as SecondListBox1, SecondListBox2, SecondListBox3 .... and no values for FirstListBox. Ideally, there should also be FirstListBox1, FirstListBox2, FirstListBox3 ...
I did some experiments and found that only the registry values with last PART (i.e. SecondListBox) are shown in registry and all other PART values before that are ignored. Lastly, the problem is only with multiple LISTBOX in a single policy. I can use multiple
CHECKBOX, COMBOBOX, DROPDOWNLIST, EDITTEXT, TEXT and NUMERIC within a single policy without any problem both in Windows 2003 Server and Windows 2008R2 Server
Baig

> and no values for FirstListBox. Ideally, there should also be
> FirstListBox1, FirstListBox2, FirstListBox3 ...
Since you do not use "ADDITIVE" it seems the whole key is cleaned out
before processing the second list. Give it a try :)
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Group Policy causes novell client to never show up windows XP

Similar Messages

Maybe you are looking for