Group Policy to Force Remote Desktop NLA Radio Button

Hey Guys:
I'm looking for a script or GPO to force the Network Level Authentication (NLA) for Remote Desktop.
I've searched and found a lot of info on how to disable the "less secure" remote desktop option but can't figure out how to force the "more secure" radio button. When I disable the "less secure" option Windows still defaults
at "Don't allow connections to this computer".
That's what I want to change. I want the GPO to force the "Allow connections only from computers running Remote Desktop with Network Level Authentication (more secure)" option.
Any ideas?
Thanks!

In order to do this you have to enable the two separate GPO settings below:
Windows Components/Remote Desktop Services/Remote Desktop Session Host/Security
Require user authentication for remote connections by using Network Level Authentication
Windows Components/Remote Desktop Services/Remote Desktop Session Host/Connections
Allow users to connect remotely using Remote Desktop Services

Similar Messages

Is there a group policy to force all workstations in an OU to logoff?

Hello,
Is there a group policy to force all workstations in an OU to logoff?
Thanks in advance.

I have not seen a policy related to log off users of specific OU's, but why not to give this a try:
import-module activedirectory
$Computers=Get-ADComputer -Filter * -SearchBase "ou=hadock,dc=hadock,dc=net"
foreach($PC in $Computers)
(Get-WmiObject win32_operatingsystem -ComputerName $PC.name).win32shutdown(4)
Above script uses WMI to send force logoff requests to clients in Hadock OU.
Hope it helps.
Mahdi Tehrani Loves Powershell
Please kindly click on Propose As Answer
or to mark this post as
and helpfull to other poeple.

Group Policy to block \ delete desktop.ini

Group Policy to block \ delete desktop.ini
Hi,
I need a GPO that can be used for some to have desktop.ini on their desktop and others not to have it.
How can I enable desktop.ini for some and disable \ delete for others ?
Thanks

Hi Bazap,
According to your description, you would like to delete the file desktop.ini for some users. Right?
You could create an OU which contains the users whcih you would like to delete the file, and then configure a GPO which is set to delete only apply to this OU. For your information, please refer to the following article to learn how to configure a GPO
which can delete a file:
Configure a File Item
http://technet.microsoft.com/en-us/library/cc772536.aspx
Regards,
Lany Zhang

Windows 8.1 Group Policy to Force Domain Logon as Default?

I recently purchased a new Windows 8.1 computer for use in our organization. The default logon option for the device is for a Microsoft Account (the default username field prompt is for an e-mail address, rather than for a username.) However,
I would prefer that the default logon option be for a Windows domain account logon, so that users don't have to click the "Sign-in options" link and select "Local or domain account password" each time they need to log onto the computer.
I have learned that setting the "Interactive logon: Do not display last user name"
policy (located under Computer Configuration / Policies / Windows Settings / Security Settings / Local Policies / Security Options) to
Disabled allows the domain logon option to be retained across sessions. However, I would prefer to keep this option set to Enabled so that the previous user name is not displayed.
Does anyone have any suggestions on how the default logon option can be forced to a domain logon, while still suppressing the display of the last username?

Hi Arowitv,
According to your description, we can use the following policy to check the result.
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options:
Accounts: Block Microsoft accounts
Click this option, and select" Users can't add or log on with Microsoft account"
Note: Selecting this option might make it impossible for an existing administrator on this computer to log on and manage the system.
Computer Configuration\Administrative Templates\System\Logon :Assign default domain for logon
Set the option to Enabled, and add the Default Logon domain.
Hope this helps.
Regards,
Kelvin Xu
TechNet Community Support

Trying to setup a group policy to force auto detect proxy setting on multiple machines on our network

We have the proxy configured on our computers to use a pac file, now we need to remove the pac and set it to auto detect proxy on our network. Do you have a adm file that works with 7.0.1 or another way to push this out on multiple pc's.

You can use a mozilla.cfg file in the Firefox program folder to lock prefs or specify new (default) values.
Place a file local-settings.js in the defaults\pref folder where you also find the file channel-prefs.js to specify using mozilla.cfg.
pref("general.config.filename", "mozilla.cfg");
pref("general.config.obscure_value", 0); // use this to disable the byte-shift
See:
*http://kb.mozillazine.org/Locking_preferences
You can use these functions in mozilla.cfg:
defaultPref(); // set new default value
pref(); // set pref, but allow changes in current session
lockPref(); // lock pref, disallow changes
*http://kb.mozillazine.org/network.proxy.type
*http://kb.mozillazine.org/network.proxy.%28protocol%29
*http://kb.mozillazine.org/network.proxy.%28protocol%29_port

Audio service hangs on Windows Server 2008R2 with Remote Desktop Services

Hello!
I have some terminal servers on Windows Server 2008R2. Users have the ability to use web browsers (IE, Firefox) with the included Flash Player, IM clients / Internet
telephony (Skype, ICQ), Windows Media Player, Office, and a specific internal software (works with MS SQL). I have the following problem: the Windows audio service hangs up that leads to hangup of all programs which use it, such as: any sites in Internet with
a flash content (in all browsers), ICQ, Skype.Even logging out the session hung when tried to lose a sound. It's impossible to stop or restart service from the services.msc the service just hang with status "restarting". To stop service I terminate svchost
process. As soon as the audio service is stopped - all programs start to work correctly (certainly without a sound). This problem appeared not suddenly - periodic hangups of programs on servers were marked long ago (more than half a year), but not directly
were connected to audio service, especially there were they rather rare (on the average once a week - two) and were corrected by server reset. The error message:
Error container , type 0
Event name: AppHangXProcB1
Reply: No data
Ident CAB: 0
Problem signature:
P1: iexplore.exe
P2: 9.0.8112.16446
P3: 4fb57c8f
P4: 77c1
P5: 131200
P6: svchost.exe:AudioClientRpc
P7: 0.0.0.0
P8:
P9:
P10:
shall suggest an idea about a sound service, but in Event Viewer has no Windows Audio events.
Recently I updated Skype to the last version 6.0.66.120. Before was 4.2.35.155 because versions 5хх on Windows2008R2 with the Remote Desctop Services actually don't
work, if users at the server more than one or two. We checked the sixth version by the test machine with the terminal environment and very were delighted to its normal working capacity. However after installation of this client on production servers it appeared
that hangups of programs on servers began to occur on the average time at an o'clock in case of an average daily load (about 20 users on one server). If you have worked one or two users, problems weren't watched. Internet search led me to the support page
Skype, where the Windows 7 x64 user faced a similar problem in the fifth version of the program. But the solutions proposed by the support team does not help me. In addition, I found the advice to disable enhancements in the properties of the playback device,
but it is impossible for the "Remote Audio" device.
At the moment, on servers where I updated the Skype, I disabled the audio service. If within a reasonable time, I do not find a solution, I will have to revert
to an older version of Skype, but I would like to solve the problem completely.

Enable the Allow audio and video playback redirection Group Policy setting
To allow audio and video playback when connecting to a computer running Windows Server 2008 R2, you must enable the Allow audio and video playback redirection Group Policy setting. The Allow audio and video playback redirection Group Policy setting is located
in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection and can be configured by using either Local Group Policy Editor or the Group Policy Management
Console (GPMC).
For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).
Is this policy applied? Refer:
http://technet.microsoft.com/en-us/library/dd759165.aspx
Also, have you tried update the audio device driver for this terminal server?

RDS 2012 - Session Collection Timeout vs Group Policy Timeout

Which policy applies?
The RD Session Collection timeout or the group policy?
My Remote desktop servers are in an OU at a top level with all of my other servers, so I have a administrative timeout group policy which is extremely strict to keep our administrators off server consoles. But for the RD farms I would like to have a less
strict policy so that users only get disconnected overnight and not if they go out to lunch (as an example)
I know one way to do this is to write individual group policies, but that removes the ease of control by configuring each session collection timeout via the Session Collection.

Hi Robin,
Thank you for posting in Windows Server Forum.
You can configure timeout and reconnection settings on a per user basis by using the Remote Desktop Services Extension to the Local Users and Groups snap-in or to the Active Directory Users and Computers snap-in.
Timeout and reconnection settings configured by using Remote Desktop Session Host Configuration will take precedence over timeout and reconnection settings that have been configured for a specific user account.
More information (for reference)
Configure Timeout and Reconnection Settings for Remote Desktop Services Sessions
http://technet.microsoft.com/en-us/library/cc754272.aspx
Hope it helps!
Thanks.
Dharmesh Solanki

Allow log on through Remote Desktop Services Group Policy for Domain Controllers

Hello,
We want to allow our Helpdesk Operators to be able to connect to Domain Controllers with the Remote Desktop Services. This is by default not allowed but according to many sites, it should be able to configure by using a Group Policy.
We made a new Group Policy with the setting 'Allow log on through Remote Desktop Services' and 'Allow log on locally' (as an extra for testing) and applied Security Filtering to only use it for a specific Security Group. Our test user is a member of this
security group and should be able to access the Domain Controllers now. However this isn't working.
The error message we receive upon trying to connect:
The connection was denied because the user account is not authorized for remote login.
For troubleshooting, we also applied the Security Group for that setting in the Default Domain Controllers Policy but that doesn't seem to work either. We want to avoid customization on our Default Domain Controllers Policy but this was just a test case
for solving our problem.
What should we do to solve our problem?
I hope to hear from you soon.
Thanks in advance.

Hi, I just found out what the problem was. This site helped me alot:
http://blogs.technet.com/b/askperf/archive/2011/09/09/allow-logon-through-terminal-services-group-policy-and-remote-desktop-users-group.aspx
In my case, I had the group added to the Allow Logon Through Remote Desktop Services but was not added to the Builtin\Remote Desktop Users group. After knowing this I made some changes to our situation and are now using the builtin\Remote Desktop Users group
rather than a new self made Security Group. I also added the Remote Desktop Users to the Allow Logon Through Remote Desktop Service in the Default Domain Controllers Policy as this is not done by default. By default only the Domain Administrators are able
to logon through remote desktop services.
You do not need the 'Log on Locally' permission within the Group Policies.
In short:
Add the desired users/groups to the 'Builtin\Remote Desktop Users' security group.
Add the 'Builtin\Remote Desktop Users' security group to the 'Allow Logon Through Remote Desktop Services' within the 'Default Domain Controllers Policy'.
Thank you anyway for the fast reply.
Have a nice day!

Novell login not available with remote desktop on windows 7

Installed Novell Client 2 SP3 for Windows Server 2012 on my terminal server. When I log in from Windows XP to that terminal server I am getting an option to login with Novell Client. On Windows 7 however I only can logon to the server. What am I missing here?

djaquays <[email protected]> wrote:
> Mostly, that MS RDP for Mac ignores the authentication level:i:0 option
> in an RDP file and there's no GUI equivalent to force legacy
> authentication.
Microsoft's Network Level Authentication (NLA) feature is supported in
Windows Server 2008 and later terminal servers, and supported by
Remote Desktop Connection (MSTSC) 6.x and later terminal clients.
Windows XP did not ship with a MSTSC 6.x terminal client, but it is
available optionally through Windows Update.
The NLA authentication is essentially requiring that valid Windows
user account credentials for the Windows Server machine must be
provided /before/ the RDP-level terminal session connection is even
attempted or permitted. If the Windows user credentials you're logged
in with on the client workstation do not already satisfy this
requirement, the NLA-aware MSTSC clients will prompt you for valid NLA
credentials before even attempting to open the terminal session.
In other words, NLA doesn't directly have anything to do with whom you
will become authenticated as within the terminal session, or whether
you'll reconnect to some other already-running terminal session; it's
a new default mechanism which requires Windows credentials for
authorizing you to create an RDP connection to the Windows Server
machine "at all."
Unfortunately Windows Server 2008 and later don't permit you to turn
NLA completely off. You can configure the Windows Server to always
require NLA, which means pre-MSTSC 6.x terminal clients will be unable
to connect. Or you can configure the Windows Server to "not require
NLA" ("Allow connections from computers running any version or Remote
Desktop"), but this still means Windows Server will use NLA if the
workstation's MSTSC client supports NLA.
The only option which has been available to "disable NLA" even when a
Windows Server 2008 or later terminal server and a MSTSC 6.x or later
terminal client are involved is to configure the
"enablecredsspsupport:i:0" setting in the MSTSC client's .RDP file
(e.g. default.rdp in the My Documents folder), in addition to
configuring the terminal server to "not require NLA."
Once you have "Allow connections from computers running any version or
Remote Desktop" set on the Windows Server, and
"enablecredsspsupport:i:0" set in the MSTSC client, now you're back to
the Windows XP & Windows Server 2003 behavior where an RDP terminal
connection can be established without first having to supply NLA
credentials, and the first thing the MSTSC client user will experience
is the full normal credential provider-based login experience just
like you see at the physical console of the terminal server.
Note that if you do leave NLA enabled and supply NLA credentials
during the MSTSC connection attempt, after successfully using those
credentials to authorize creation of the RDP connection, the MSTSC
client will /also/ default to using the NLA credentials as default
credentials to attempt logging on with within the terminal session
itself. In other words, if you successfully supply NLA credentials,
by default you also become logged in on the terminal session and go
straight to the desktop of the Windows user account specified in the
NLA credentials. So even though "NLA credentials" and "whom I will
logon as within the terminal session" are two separate things, by
default the MSTSC client tries to use the same credentials for both.
But it's not that the NLA credentials "must" be used for logging in on
the terminal session; that's simply the default behavior. If you
leave NLA enabled on the Server 2008 or later terminal server, after
NLA credentials are successfully used to authorize creation of an RDP
connection, if you wanted to instead be prompted within the terminal
session with the normal credential provider login experience, enable
the "Always prompt for password" on the Windows Server 2008 or later
terminal server.
(On the Server 2008 or later machine, under "Administrative Tools"
find the "Remote Desktop Services" group and launch the "Remote
Desktop Session Host Configuration" console. Highlight/select the
"RDP-Tcp" connection, right-click and select "Properties". On the "Log
On Settings" tab elect "Always prompt for password".)
That sounds like probably the scenario which fits best for the "I have
a Macintosh-based client which doesn't allow enablecredsspsupport:i:0
/ authentication level:i:0." You would leave NLA enabled on the
Server 2012 machine, but enable "Always prompt for password" in the
RPC-Tcp connection properties on the Server 2012 machine. Such that
after NLA authentication was performed and Windows allowed creation of
the terminal session, instead of immediately also attempting to login
within the terminal session as the Windows account specified in the
NLA credentials, Windows will instead present the normal interactive
credential provider login experience to allow the user to specify whom
they want to login as.
Finally, note that everything described above applies even to a
Windows Server and Windows client workstation that do /not/ have the
Novell Client for Windows installed. The same mechanisms remain in
effect even once the Novell Client is installed; the presence of the
Novell Client just changes what credential providers would be used or
presented within the terminal session once the terminal session was
allowed to be created. The fact that NLA is required by default and
requires valid Windows credentials in order to authorize an RDP
connection is still the same, regardless of whether the Novell Client
is present or not.
Alan Adams
Novell Client CPR Group
[email protected]
Novell
Making IT Work As One
www.novell.com
Upgrade to OES Community
http://www.novell.com/communities/co.../upgradetooes/

Group Policy Pref - Mapped Drives Not Applying to One User

Hi All,
I’m new to this list, so please excuse any etiquette slip ups. 
I have three users at a site. All their machines are running Windows XP Service Pack 3 and have client side extensions installed. I created a group policy to map their default drives using GP User Preferences.
Each of the drives is set to "update".
As an example of the policy created XML is as follows:
<Drive clsid="{935D1B74-9CB8-4e3c-9914-7DD559B7A417}" name="H:" status="H:"
image="2" changed="2009-11-25 05:13:58"
uid="{8A44D2F4-AAE5-4F43-AEEC-D36F08EA619C}" desc="Maps the users H drive to
ServerName\users$\%username%" bypassErrors="1"><Properties action="U"
thisDrive="NOCHANGE" allDrives="NOCHANGE" userName=""
path="\\ServerName\users$\%username%" label="Home (ServerName)"
persistent="1" useLetter="1" letter="H"/></Drive>
and
<Drive clsid="{935D1B74-9CB8-4e3c-9914-7DD559B7A417}" name="J:" status="J:"
image="0" changed="2009-11-30 03:52:58"
uid="{535CD462-A45D-4363-ADA1-2316D5ECC703}" desc="Maps J drive for users to
\\ServerName\apps" bypassErrors="1"><Properties action="C"
thisDrive="NOCHANGE" allDrives="NOCHANGE" userName=""
path="\\ServerName\Apps" label="Apps (ServerName)" persistent="1"
useLetter="1" letter="J"/></Drive>
The group policy is applied to an OU for that site.
All three users are in the same OU.
All three users are also in the same “xxsitecode Users” group.
2 of the users log into their pc and get the mapped drives with no issue, but one user doesn’t.
There are no other login scripts and the user has no manually mapped drives.
He does have a H drive mapped using the profile field in his AD object as a temp measure. But every 90 mins any other manually mapped drives are removed by the policy.
We don’t use roaming profiles
To trouble shoot I have tried
-    Reinstalling client side extensions
-    Re-joining the pc to the domain
-    Running gpupdate from the command prompt to see if any event logs are generated (none are)
-    Manually mapping the drives to make sure there is network access etc – I can manually map them/he can access them.
-    Creating the user a new account, when he logs in using that account he gets his mapped drives on all PC’s
-    Getting the user to log into a different pc, when he does this he doesn’t get his drives – so it’s not his machine or profile
-    Manually checking the security on the user object in AD against one of the users who gets their drives mapped
I'm sure the GP is fine because it works for two other users and the testing isolates his user account as the issue.
The Policy I’m having issues with is xxxx Mapped Drives/ Printers
I have posted this issue on the tech net GP discussion groups page, but haven’t had any replies.
Any suggestions would be appreciated.
Simone

What's interesting is that I applied a new GP to users - it has one policy setting and one preferences setting. He only gets the policy setting.. aka he gets the wallpaper but not the homepage.
Also, Jorke asked me to post the gpresult /z .
Microsoft (R) Windows (R) XP Operating System Group Policy Result tool v2.0
Copyright (C) Microsoft Corp. 1981-2001
Created On 10/02/2010 at 2:19:34 PM
RSOP results for DOMAIN\USER on MACHINENAME : Logging Mode
OS Type:                     Microsoft Windows XP Professional
OS Configuration:            Member Workstation
OS Version:                  5.1.2600
Domain Name:                 DOMAIN
Domain Type:                 Windows 2000
Site Name:                   SITECODE
Roaming Profile:
Local Profile:               C:\Documents and Settings\USER.DOMAIN
Connected over a slow link?: No
COMPUTER SETTINGS
    CN=MACHINENAME,OU=Laptops,OU=SITECODE,DC=DOMAIN,DC=com,DC=au
    Last time Group Policy was applied: 10/02/2010 at 1:06:38 PM
    Group Policy was applied from:      XXXXXADC.DOMAIN.com.au
    Group Policy slow link threshold:   500 kbps
    Applied Group Policy Objects
        Allow Remote Assistance
        au-mdwsus
        Default Domain Policy
        Legal Notice
        Proxy Settings
        Logon as service, operating system
        AU-WSUS
        Desktop Background & Home Page
        Reg Permissions for default desktop
        Local Admin & Local Power Users
    The following GPOs were not applied because they were filtered out
        SITECODE Mapped Drives/ Printers
            Filtering: Not Applied (Empty)
        Local Group Policy
            Filtering: Not Applied (Empty)
        AVD Rollout
            Filtering: Disabled (GPO)
    The computer is a part of the following security groups:
        BUILTIN\Administrators
        Everyone
        Debugger Users
        BUILTIN\Users
        NT AUTHORITY\NETWORK
        NT AUTHORITY\Authenticated Users
        MACHINENAME$
        Domain Computers
        CERTSVC_DCOM_ACCESS
    Resultant Set Of Policies for Computer:
        Software Installations
            N/A
        Startup Scripts
            GPO: Desktop Background & Home Page
                Name:         image.bat
                Parameters:
                LastExecuted: 7:55:34 PM
                Name:         swiftdesktop.vbs
                Parameters:
                LastExecuted: 7:55:35 PM
        Shutdown Scripts
            N/A
        Account Policies
        Audit Policy
        User Rights
        Security Options
        Event Log Settings
        Restricted Groups
        System Services
        Registry Settings
        File System Settings
        Public Key Policies
            N/A
        Administrative Templates
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\Windows NT\Terminal Services
                State:   Enabled
            GPO: AU-WSUS
                Setting: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\Windows NT\Terminal Services\RAUnsolicit
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\Windows NT\Terminal Services
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\Windows NT\Terminal Services\RAUnsolicit
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\WindowsFirewall\DomainProfile\GloballyOpenPorts
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\WindowsFirewall\DomainProfile\GloballyOpenPorts\List
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\WindowsFirewall\DomainProfile\AuthorizedApplications\List
                State:   Enabled
            GPO: AU-WSUS
                Setting: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\Windows NT\Terminal Services\RAUnsolicit
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\WindowsFirewall\DomainProfile\AuthorizedApplications\List
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\Windows NT\Terminal Services\RAUnsolicit
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\Windows NT\Terminal Services\RAUnsolicit
                State:   Enabled
            GPO: AU-WSUS
                Setting: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\Windows NT\Terminal Services
                State:   Enabled
            GPO: au-mdwsus
                Setting: Software\Policies\Microsoft\Windows\WindowsUpdate
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\Windows NT\Terminal Services\RAUnsolicit
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\Windows NT\Terminal Services\RAUnsolicit
                State:   Enabled
            GPO: au-mdwsus
                Setting: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\Windows NT\CurrentVersion\Winlogon
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\Windows NT\Terminal Services
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\WindowsFirewall\DomainProfile\AuthorizedApplications\List
                State:   Enabled
            GPO: AU-WSUS
                Setting: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\Windows NT\Terminal Services\RAUnsolicit
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\WindowsFirewall\DomainProfile\AuthorizedApplications
                State:   Enabled
            GPO: AU-WSUS
                Setting: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
                State:   Enabled
            GPO: au-mdwsus
                Setting: Software\Policies\Microsoft\Windows\WindowsUpdate
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\Windows NT\Terminal Services
                State:   Enabled
            GPO: Desktop Background & Home Page
                Setting: Software\Policies\Microsoft\Internet Explorer\Security
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\Windows NT\Terminal Services
                State:   Enabled
            GPO: AU-WSUS
                Setting: Software\Policies\Microsoft\Windows\WindowsUpdate
                State:   Enabled
            GPO: AU-WSUS
                Setting: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\Windows NT\Terminal Services\RAUnsolicit
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\WindowsFirewall\DomainProfile\AuthorizedApplications
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\WindowsFirewall\DomainProfile\RemoteAdminSettings
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\Windows NT\Terminal Services
                State:   Enabled
            GPO: AU-WSUS
                Setting: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
                State:   Enabled
            GPO: au-mdwsus
                Setting: Software\Policies\Microsoft\Windows\WindowsUpdate
                State:   Enabled
            GPO: AU-WSUS
                Setting: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\WindowsFirewall\DomainProfile\RemoteAdminSettings
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\Windows NT\Terminal Services\RAUnsolicit
                State:   Enabled
            GPO: au-mdwsus
                Setting: Software\Policies\Microsoft\Windows\WindowsUpdate
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\WindowsFirewall\DomainProfile\AuthorizedApplications\List
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\WindowsFirewall\DomainProfile\AuthorizedApplications\List
                State:   Enabled
            GPO: Allow Remote Assistance
                Setting: Software\policies\Microsoft\Windows NT\Terminal Services
                State:   Enabled
USER SETTINGS
    CN=Matthew Luhrs,OU=Users,OU=SITECODE,DC=DOMAIN,DC=com,DC=au
    Last time Group Policy was applied: 10/02/2010 at 1:54:53 PM
    Group Policy was applied from:      XXXXXADC.DOMAIN.com.au
    Group Policy slow link threshold:   500 kbps
    Applied Group Policy Objects
        Allow Remote Assistance
       **** SITECODE Mapped Drives/ Printers - has Gp Pref's that should apply
        Default Domain Policy
        Proxy Settings
        **** Desktop Background & Home Page - has Gp Pref's that should apply
        Local Admin & Local Power Users
    The following GPOs were not applied because they were filtered out
        AU-WSUS
            Filtering: Not Applied (Empty)
        Legal Notice
            Filtering: Disabled (GPO)
        Reg Permissions for default desktop
            Filtering: Not Applied (Empty)
        Logon as service, operating system
            Filtering: Not Applied (Empty)
        Local Group Policy
            Filtering: Not Applied (Empty)
        au-mdwsus
            Filtering: Not Applied (Empty)
        AVD Rollout
            Filtering: Disabled (GPO)
    The user is a part of the following security groups:
        Domain Users
        Everyone
        Offer Remote Assistance Helpers
        BUILTIN\Administrators
        BUILTIN\Users
        NT AUTHORITY\INTERACTIVE
        NT AUTHORITY\Authenticated Users
        LOCAL
        Computer Account Operators
        Internet Users
        SITECODE Users
        DOMAIN-Public Folders Administrators
        All Email Users
        DOMAINSWIFTEMAIL
        Domain Admins
        Offer Remote Assistance Helpers
        WSUS Administrators
        DHCP Administrators
        CERTSVC_DCOM_ACCESS
    Resultant Set Of Policies for User:
        Software Installations
            N/A
        Public Key Policies
            N/A
        Administrative Templates
            N/A
        Folder Redirection
            N/A
        Internet Explorer Browser User Interface
            GPO: Proxy Settings
                Large Animated Bitmap Name:      N/A
                Large Custom Logo Bitmap Name:   N/A
                Title BarText:                   N/A
                UserAgent Text:                  N/A
                Delete existing toolbar buttons: No
        Internet Explorer Connection
            HTTP Proxy Server:   Proxy:port
            Secure Proxy Server: Proxy:port
            FTP Proxy Server:    Proxy:port
            Gopher Proxy Server: Proxy:port
            Socks Proxy Server: Proxy:port
            Auto Config Enable: Yes
            Enable Proxy:        Yes
            Use same Proxy:      Yes
        Internet Explorer URLs
            GPO: Proxy Settings
                Home page URL:           N/A
                Search page URL:         N/A
                Online support page URL: N/A
        Internet Explorer Security
            Always Viewable Sites:     N/A
            Password Override Enabled: False
            GPO: Proxy Settings
                Import the current Content Ratings Settings:      No
                Import the current Security Zones Settings:       No
                Import current Authenticode Security Information: No
                Enable trusted publisher lockdown:                No
        Internet Explorer Programs
            GPO: Proxy Settings
                Import the current Program Settings: No

Windows 2008 R2 Standard Remote Desktop Users cannot Connect

I have a windows 2008 R2 Standard Terminal Server and some users aren't able to connect even though they are in groups that are in Remote Desktop Users on the local computer. I checked the local security policy setting "Allow log on through Remote
Desktop Services" and I see that Remote Desktop Users is a member of this group. Inside of Remote Desktop Users we have DOMAIN\Domain Users and DOMAIN\Terminal Users. Most of our users are in both groups, but there are still some people that
aren't able to connect via Remote Desktop to this computer. There are no users in "Deny logon through Terminal Services."
Thanks!

Hi,
Thank you for posting in Windows Server Forum.
Is it happens to all users or any particular group of users?
Please check by creating new user add them to “Remote Desktop Users” group and then see whether that test user can remote desktop to the server.
It also might happens that you may be limited in number of users or some connection issue or may be firewall setting issue. Please go through beneath article for information.
Remote Desktop disconnected or can’t connect to remote computer or to Remote Desktop server (Terminal Server) that is running Windows Server 2008 R2
http://support.microsoft.com/kb/2477176
Hope it helps!
Thanks.
Dharmesh Solanki

How to use Group Policy to remove the shutdown button on the logon screen

Environment: Shared use computers running Window 7 Professional and MS office Suite; Windows 2008 Standard server, Windows 7 EC Domain Policy and MS Office 2007 ADML Template downloaded from Microsoft. WIndows 7 Accounts OU.
I am in the process of developing a shared use computer lockdown policy for several Windows 7 computers that will made available in my client's computer lab. I need to use a group policy setting to remove the Shut Down button on
the logon screen of the Windows 7 client computers. I am editing the Windows 7 EC Domain Policy to user accounts in a Windows 7 Accounts OU that I created. I am using the Group Policy editor in the Group Policy Management Console.
Please let me know the best practice for accomplishing this using Group Policy editor.
Thanks.
P.S. I tried a setting recommended in the following link in the Windows 7 EC Domain Policy which did not seem to work.
http://www.windowsitpro.com/article/group-policy/can-i-use-group-policy-to-display-or-remove-the-shut-down-button-on-the-logon-screen-.aspx

Hi Vernon,
I tried the group policy you mentioned (Computer Configuration, Windows Settings, Security Settings, Local Policies, and select Security Options, "Shutdown: Allow system to be shut down without having to log on") and it worked on a Windows 7 client.
Thus you may need to check if the group policy you created is actually applied to clients.
A screenshot can be found here:
http://cid-b7ed40feb32ba29f.office.live.com/self.aspx/.Public/desktop/Capture.JPG

Disable Reply All button via Group Policy without disabling keyboard shortcut

At my organization, we've used Group Policy to disable the Reply to All button in Outlook 2007 and Outlook 2010. When you use the setting in the ADM files for the respective versions of Office to disable a Command bar ID, the Reply to All button is disabled,
however they keyboard shortcut (Ctrl + Shift + R) is still active. This forces our users to think a bit more before using the Reply All function.
The keyboard shortcut continues to work, because there's a separate setting to disable the keyboard shortcuts. The same is true for Office 2013's GP templates, however, it does not function as expected.
When I use the Office 2013 admin templates and disable command bar ID 355 (Reply All), it disables the button as expected, however it also disables the keyboard shortcut for Reply All without actually setting it as disabled in the disable shortcut keys.
Has anyone had success disabling a command bar ID without disabling the associated shortcut keys? If so, how did you do it?

Hi,
This issue has been fixed by this hotfix:
Hotfix 2881040 for Outlook 2013 June 10, 2014 (Outlook-x-none.msp)
http://support.microsoft.com/kb/2881040
Thanks,
Steve Fan
Forum Support
Come back and mark the replies as answers if they help and unmark them if they provide no help.
If you have any feedback on our support, please click
here

Group Policy for Lockscreen

Hi All,
My conundrum is as such:
We have set-up a Group Policy on the server for a default Lockscreen (Company Image) to be sent to all users on the network on their PC's. It's a new server running 2012 R2. It's fully up to date.
However the default lock screen is now causing everyone's Lockscreen screen to show a blank blue page. The image is located on a shared drive all PC's have access to. We have tried numerous solutions online but none seem to have worked.
Any help on this matter would be much appreciated so we can put this niggle to bed!
Thanks in advance.

Hi,
Before going further, what are the operating systems of our clients? The group policy setting
Force a specific default lock screen image should be supported on Windows 8 or above. Besides, for Windows 8, to apply this policy setting, please make sure that the following update has been installed.
Windows 8 and Windows Server 2012 update rollup: November 2012
http://support.microsoft.com/kb/2770917/EN-US
Regarding managing the lock screen image on Windows 8, the following article can be referred to for more information.
Win8: How to Manage the Lock Screen Image on Windows 8 and Windows Server 2012
http://support.microsoft.com/kb/2787100/en-us
Best regards,
Frank Shen

Feature request for Mac Remote Desktop client.

Wouldn't be great to have folders or groups in the Mac Remote Desktop Client.
I am finding that I have more and more Remote Desktop saved connections and storing them in collapsible groups or folders would be great.

Hi Bill,
Thanks for your feedback, will pass this request to product group for future research and releases.
Thanks for your understanding and Support!
Regards.
Dharmesh Solanki
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Group Policy to Force Remote Desktop NLA Radio Button

Similar Messages

Maybe you are looking for