MSI Package Software Installations and uninstallations by group policy and sccm

Hi,
            I have a domain comprising approx. 30 ADCs, 5000 clients and 50 OUs. Our developers have created a c# Program for fetching some information from client machines and displaying them on their
screen on bootup (presence of 2 particular softwares, antivirus presence and its update date, OS patches updation etc... ). This program(.msi) and .net framework 4.0 is required to be pushed to all client machines. We have SCCM server through which we can
push software to be installed on clients. There are no. of ADCs for controlling different sites and OUs. Now I need to push this msi and .net framework to all clients. Dotnet framework I pushed from SCCM & it is successful.
Till today I have pushed this .MSI package using Group policy software installation settings using a local sharepath & sysvol.
In Local Share path , MSI source is availbale at only one ADC and all clients contact this adc only to install software and its taking very long time to boot.
Using Sysvol share path , MSI Source is available at All ADC and All Clients Contact their Site's ADC to install software.Only Win 7, win 8 machines are getting install and software is not able to install on XP and vista machine. What might be the
problem for xp machine getting it from sysvol path?
The error for XP machines is that Sysvol path is not accessible/ source is not available.
   Now I need to have some other fullproof method to apply it. How I need to push this .MSI packages to all sites (ADCs) in my child domain from my PDC.
   I want to know the steps & methods for installing & uninstalling this .MSI package using Group policy and SCCM as well.
   Thanks for replying...

Hi,
Based on your description, I want to confirm whether we have more than one domain. If we have more than domain, it is suggested that we can push the
MSI package from each domain.
Regarding how to use Group Policy to remotely install software, the following article can be referred to for more information.
How to use Group Policy to remotely install software in Windows Server 2008 and in Windows Server 2003
http://support.microsoft.com/kb/816102/en-us#method1
In addition, you also mentioned how to use SCCM to do this, in order to get better assistance, we can ask help in the following SCCM forum.
System Center Configuration Manager
http://social.technet.microsoft.com/Forums/systemcenter/en-US/home
Best regards,
Frank Shen

Similar Messages

ActiveX msi Flash Player 10.0.42.34 group policy deploy issue

I have been deploying the flash player to our workstations since version 9. We have a 2003 AD domain and XP SP3 workstations.
I know that it is recommended to use the flash uninstall program to remove flash when installing a new version but I haven’t taken the time to work on that type of scripting for any install. Any attempts to uninstall the previous versions of flash via group policy when deploying have never worked. I had the same experience with java 1.5 jres…they would never uninstall via policy.
I have had success so far with deploying the latest version to the workstations with a new policy while leaving the old policy applied until a few weeks have past when all the workstations have been updated.
I am in the process of deploying Flash Player 10.0.42.34 to replace Flash Player 10.0.32.18
My test deploy to my virtual XP test workstation worked with no problems. The flash test paged detected the newer version and the correct version was in add/remove programs.
I then did a test deploy to a production workstation and the software installed without errors (the group policy install went extremely fast so I knew something was wrong). No errors were reported in the workstation application log. However when you visited the flash test page no version of flash was detected. I also checked in add/remove programs and the program icon was the windows installer icon instead of the normal red flash box….this has been associated with other installation issues in the past.
I have tried this on 3 other production machines and experienced the same results. My virtual XP test workstation has only had version 10.0.32.18 on it so I am guessing that having had the older versions of 10 on the production workstations is causing the problem somehow.
I have had issues in the past, but nothing like this. Looks like I may have been owned by adobe on this one.
Any insight would be appreciated.
Thanks

Sure , here is the url :
http://www.forevermark.com/ja-jp/The-World-of-Forevermark-/Precious-Collection/
On some machines , the Japanese text in the centre section appears very large. ..( see attached snapshot)
We initially encountered this on the version prior to the 10.0.42.34 version.
However even after the upgrading to 10.0.42.34 , the problem still persists .
Thanks

Is there a way to deploy Adobe Air package via Group Policy or SCCM?

Is there a way to deploy Adobe Air package via Group Policy or SCCM?

hi,
I guess you can try the following options
Remove the all the entry from the TOC of your project or create a new blank TOC and select that while AIR file generation
Remove the all the entry from the index of your project or create a new blank index and select that while AIR file generation
Remove the all the entry from the glossary of your project or create a new blank glossary file and select that while AIR file generation
THis will ensure that TOC/Index/Glossary page is not shown,
There is no way to hide Favorite or RSS from the AIR Help. Again, you can try looking at the Unipane Template provided in the AIR SSL Dialog.
Hope this helps
-Praful Jain

Group Policy and GroupWise Attachments

My company uses the "Run only allowed Windows Applications" feature from Group Policy to lock down what can be run on our workstations. We have 2 main policies, a standard (lockdown) policy and an admin (open) policy.
Ever since a 7.0.2 GroupWise client/server upgrade, under my lockdown policy some of my users have complained that when they click the attachment button in GroupWise it no longer goes to the location of the last attached document, instead it goes to a default location. It might be the D drive, the GroupWise directory, it changes from computer to computer. I have confirmed that this is the behavior of the lockdown policy, and when I switch to the open policy the attachment button goes to the previous attachment location as is expected.
I've placed addrbook.exe, grpwise.exe, gwmailto.exe, gwreload.exe, gwsync.exe and notify.exe in my allowed list for executables and can't figure out what I might be missing. In the past I ahve found OCX and DLL files that have had to be specifically added to the policies as well to get certain functions to work, is it possible that this may be the case in my situation or could it be a completely different policy that I should be looking at?
I'm getting ready to push the 8.0.2 clients to my users and this is something that I'd like to try to resolve before I do that push. Thanks!

I just tore apart my group policy and found that using the Hide These Specific Drives and hiding the C: drive is what is causing this attachment behavior issue. Any ideas why it is causing this and any possible work arounds other than unhiding the C: drive?

EMET 5.x Configure EAF+ and ASR using Group Policy

I'm deploying EMET 5.2 in a test environment here at the office, and trying using Group Policy to configure the actual EMET mitigation policies. I'm aware of the new mitigations in 5.x, EAF+ and ASR, but I don't see any way to configure those using
Group Policy; they're not in the "available parameters" list in the GPO description, and nothing is mentioned about configuring them using GPO in the 5.2 config guide. Is there something I'm missing? I definitely updated the Group Policy
files with the latest from 5.2 in our domain's sysvol.
For example, to match the default configuration, I'd want a few GPO config lines like:
*\7-Zip\7zG.exe -EAF -EAF+ -ASR
*\Adobe\Acrobat*\Acrobat\Acrobat.exe -ASR

Hi.
Read this please:
Works well for the enterprise. Enterprise IT professionals can easily deploy EMET through Microsoft System Center Configuration Manager and apply Group Policies in Windows Active Directory to comply with enterprise account, user, and
role policies. Administrators can customize and configure EMET deployments and determine which applications they want to protect through which mitigation techniques.
I found it at the
Emet 5.2 Download website, in Details

How can I deploy EFS using Group Policy and automatically encrypt computers for ALL users who login?

How can I deploy EFS using Group Policy and Active Directory with a goal to automatically encrypt computers for ALL users who login? (NOT an option for me to use BitLocker)
I was asked to deploy EFS to encrypt the user my documents folder and profile on all of the users laptops. The laptops are in common areas (board meeting rooms, etc) and security of files is a must.
I successfully created a recovery certificate in AD. I created an OU and setup an EFS policy and users can now login and select to encrypt their own files. The issue is that management would like to have automaticy Encrypt ALL users my documents AUTOMATICALLY
when a user login.
Can this be done?
Please help

Hi,
Any update?
Just checking in to see if the suggestions were helpful. Please let us know if you would like further assistance.
Best Regards,
Andy Qi
TechNet Subscriber Support
If you are
TechNet Subscription user and have any feedback on our support quality, please send your feedback
here.
Andy Qi
TechNet Community Support

What is the differents between Policies and Preferences in Group policy Management Editor

What is the differents between Policies and Preferences in Group policy Management Editor?

Policies: If you delete a policy in GPO it deletes its registry files form the clients. Policies don't tattoo the registry. Policies Settings are permanent as long policy is in effect i.e. Desktop Backgrond. Policies are applied at Computer
Startup, User logon and Manual and automatic refresh. Takes Precedence over Preferences.
Preferences: Even if you delete a policy form Preferences tab the registry files will still available on the systems. Preferences tattooed the registry if you want to remove the registry entries you have to do it manually. Preferences exampl
is i.e. mapped drive. Settings applied with preferences are not grayed out. Not available in Local GPO.
Usefull for
Desktop Icons/Shortcuts
Url
Drive Map
File Copy, Update, delete
Thanks

Flash installer and uninstaller stays in processes and keeps laptop form going to standby

i have a fujitsu lifebook t-series 4020d and any time in i have to install flash player or inunstall it it stays in processes and makes it so it won't go into standby till you go to task manager and end the process. my brother has the same laptop and the same thing happens to his. just seeing if this bug was reported. hopefully this can be fixed because it is kinda anoying with all these updates that seem to happen.

oh sorry it is winxp tablet edition and firefox 3.6.18. this is not a browser issue though it is a flash installer/uninstaller issue. it should never stay in the processes after it is finished i got the installer and uninstaller from this web site and it does updates when the comptuer is restarted. after the update is done it stays in the processes and when you try and put comptuer to sleep, standby, even shutting down and restarting you have to go to task manager and en the flahs installer it used. if you try to standby,sleep,restart,shutdown it don't do it. as soon as you end the flash process it goes to standby,sleep,restart,shutdown if that bmakes sense. it hangs on the installer.

Software Center Application Uninstallation Button Greyed Out and Deploying an Application with Uninstall switch Fails

Hi,
I tried everything I could find on the internet but no luck so far. I can successfully deploy MS Visio 2013 to the clients. I also want to be able to uninstall it from the clients. On the client machine Uninstall button is greyed out. This deployment is
installed as "Available" and there is only one deployment type within that MS Visio 2013 Application.
I tried the following uninstall commands in my deployment:
setup.exe /uninstall
setup.exe /uninstall
VisPro
/config .\vispro.ww\uninstallvisio.xml
“\\SRVSCCM2012\Sources\MSApplications\MSVisioPro_2013_64Bit_ENG\setup.exe” /uninstall VisPro /config "\\SRVSCCM2012\Sources\MSApplications\MSVisioPro_2013_64Bit_ENG\vispro.ww\uninstallvisio.xml"
\\SRVSCCM2012\Sources\MSApplications\MSVisioPro_2013_64Bit_ENG\setup.exe /uninstall VisPro /config \\SRVSCCM2012\Sources\MSApplications\MSVisioPro_2013_64Bit_ENG\vispro.ww\uninstallvisio.xml
I checked Product ID from Setup.xml and I know it is correct. My uninstallvisio.xml' content is below:
<Configuration Product="VisPro">
<Display Level="basic" CompletionNotice="yes" SuppressModal="yes" AcceptEula="yes" />
<Setting Id="SETUP_REBOOT" Value="Never" />
</Configuration>
Last night, I downloaded and installed Cumulative Update 1 for SCCM 2012 R2 and I haven't tried the deployment after the update,yet. I will try it today but please let me know what else to check.
Yavuz Selim Atmaca

After I updated SCCM Server and test client pc with CU1 , I tried to deploy visio as Required. It installed successfully. Then I uninstalled visio by deploying the application with Uninstall Action.
After that I tried to deploy visio as "Available" to see if Software Center Uninstall button works. However visio deployment does not come to Software Center's Available Applications List. I check the status of the deployment under the Deployments monitoring
node and it says Success "Already Compliant". I dont know what it means. Does config manager thinks that visio already installed?
Yavuz Selim Atmaca
2 or 3 hours later that -Succes "Already Compliant"- status of the deployment under the Deployments monitoring node is vanished automatically and Software Center application list showed the new deployment. I installed it and uninstalled it succesfully.
So, you are right Solution is the CU1 but I am still wondering why my available deployment took so time to be visible in Software Center althought I didn't enter any schedule to be available.
Yavuz Selim Atmaca

Group Policy Guru? Group Policy and Windows 7 erratic and inconsistant.

(*If you don't feel like reading everything, skip to the bottom two paragraphs for my questions)
I've had a premier call open with MS since August. This week I had a Microsoft Technician in-house. Though we eliminated some possibilities, we're not really closer to a cause or solution.
Every time we work with an expert, I get a different explanation to describe the situation we are viewing.
Quick summery of the issue: We've been using Group Policy to manage most Windows XP and 7 settings for years, but starting the middle of last year, we began having clients with machines where some or all group policies would fail to apply.
These could be long assigned policies, new polices, or changes to policies. It would never affect everyone or even a majority at once, and the resolution is never the same. Sometimes a GPUDPATE /FORCE sometimes fixed automajically the next day,
sometimes (but very rarely) longer.
Troubleshooting History:
What we found in early troubleshooting, that these machines, had errors in Event Viewer for Netlogon, Time-Sync, and Group Policy. The other issue we noticed, was that our GPRESULT /H reports were missing security groups and the denied section was
nothing but SSID's. The first issue pointed me to:
Event ID 5719 and event ID 1129 may be logged when a non-Microsoft DHCP Relay Agent is used
I installed these Hot Fixes. No change to any of the errors in event viewer, or to our Group Policy problems.
Initial work with Premier Support found that Netlogon, Time-Sync, and Group Policy, were failing before loading of the network stack. The suggestion was to apply the group policy setting "Always wait for the network at computer startup and
logon". At the time, this seemed not to work. The policy was set on a test bed of laptops and desktops, and no changes in behavior were seen after 3 days.
Windows 7 Clients intermittently fail to apply group policy at startup
For some time after this, we were collecting GPSVC and NetTrace logs for Premeir Support, trying to document and troubleshoot the problem. Eventually we got fed up and asked our TAM to call in a pro to get this resolved. We were sent an engineer
for 3 days. For three days we banged away on this issue. We verified AD and replication health, we tried numerous fixes and workarounds. I learned 3 different desriptions of how Group Policy works, and in the end we thought we had a workaround
using the "Always wait for the network at computer startup and logon" because of a single success late in the day. On day 3 we tried replicating this fix, and quickly realized that the same issue we were having preventing other GPOs to apply,
were also preventing our "fix" GPO from applying. So we went the route of using a registry entry. I also had a problem that even though it was making the process more consistant, it was still taking 3 reboots for a Computer Policy, assigned
to a computer object via Security Group, to fully take affect on a computer.
I used the registry methods in the above article. It didn't work, no sign it was having the same affect the GPO had had.
Our support engineer claimed this was the proper method, but that path wasn't even close in a Windows 7 SP1 registry, and after creating all the keys that were not present, it still didn't work.
Always wait for the network at computer startup and logon - AzureWeb
We ran out of time, our engineer returned home.
I can understand how these errors indicate a problem applying Group Policy at boot. But to me it doesn't explain why it doesn't correct post boot, and after a GPUDPATE /FORCE and a reboot.
It also doesn't explain why we were working fine for years, then all of a sudden DHCP is being outrun by background services. (By the way logging showed DHCP wasn't significantly delayed, out boot process was actually excellent, health wise.)
Why all of a sudden is this not behaving optimly? No changes to network design or function. No changes to the domain since 2008 R2 was installed in 2011.
Today I'm reading through all these KB's and articles again, and took some time to read:
[Forum FAQ] Common steps to start troubleshooting Group Policy
application and it's links below.
We ran though all of that before and during the 3-day onsite. It's not getting us any closer to the cause or a solution.
I found and begin some deep reading in this link today. It has some additional information I will try to use next week:
Group Policy Basics - Part 3: How Clients Process GPOs
The one unanswered question I have is this. How is group policy supposed to apply to a computer, when that policy is applied to a AD Security Group, in which the computer object is a member?
Before we began having this problem, we would assign a computer GPO, then ask the user to reboot. If it were a user GPO, we'd ask the user to log off, or reboot. Either way, if we allowed a few minutes for AD and FRS replication, the user would
log back in with that new policy in affect. A new imaged machine would boot with all the GPO's linked to that domain and assigned to "Authenticated Users", already in affect. Admin groups would be present in administrators, proxy settings
would be set in Internet Explorer, etc.
Now I'm aked to beleive this was never the case from Premeier Support and Microsoft Engineers. That those policies require the equilent of a "GPUPDATE /FORCE" that was executed by the Local_System account. That 3 reboots may
be nessessary for a group policy to be applied. One for the AD Security Group to be applied. One for the Computer Policy to be applied. And a final one for the policy in the GPO to be applied to Windows.
Can someone confirm or correct this information please? It's imperitive to my troubleshootng.
There's no place like 127.0.0.1

That key is empty on all of my machines I have checked today. Working and problematic alike.
GPRESULT logs, when ran as me, historically would show the group polices applied, denied, and the AD group membership all by name. About 6 months ago I noticed this changed.
Now they show the applied GPO's by name, a few of the denied GPO's by name, most by SID, and only 2 to 3 AD groups, though PowerShell shows all the AD groups assigned. This happens after several AD security and distribution groups are added to the
machine (Radia software distribution uses Dist groups to assign software).
A check showed no groups with long legacy Kerberos keys.
When we make a change to AD Security Group membership, to assign or deny a Group Policy, is usually when we encounter this problem. It will usually fix itself in 24 hours of the machine being left up and running. But no amount of GPUPDATE /FORCE
and rebooting will cause the changes to take affect.
During this time, the Group Policies will show assigned to the computer in the GPRESULT log.
Yesterday I began looking into Spanning Tree configuration on our network being a possible cause for the boot up issues. I'm waiting on responses from our Network group to confirm our configuration.
There's no place like 127.0.0.1

Group-Policy and Inheritence

I have a Group-Policy created with all the attributes that my SVC clients should be using -- this GP is called GP-SVC. My client wants to add different access-levels for different sets of users. I would like to do this by having three new Group-Policies inherit attributes from GP-SVC, except for the VPN Filter ACL which will be different on each of these "child" GP.
So here is how I want inheritence to work:
DfltGrpPolicy
|
+-- GP-SVC
       |
       +--GP-SVC-Users
       +--GP-SVC-Devs
       +--GP-SVC-Admins
But for some reason, its not letting me choose a group to inherit attributes from for my child GPs:
asa5505#    show run group-policy GP-SVC
group-policy GP-SVC internal
group-policy GP-SVC attributes
dns-server value 172.17.96.181
vpn-tunnel-protocol svc
split-tunnel-policy tunnelspecified
split-tunnel-network-list value SPLIT-SVC
default-domain value something.local
split-dns value something.local
address-pools value SVC-POOL
asa5505(config)# group-policy GP-SVC-Users internal ?
configure mode commands/options:
from Specify group to initialize attributes from
asa5505(config)# group-policy GP-SVC-Users internal from GP-SVC
ERROR: source group GP-SVC does not exist
Anyone have any ideas as to what I'm doing wrong? My goal was for the "child" group-policies to only have one attribute assigned, the VPN Filter, and for the rest of their attributes to be inherited from GP-SVC.
My Device:
Cisco Adaptive Security Appliance Software Version 8.2(5)3
Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz

Hi jcarvaja
Looks like you're right. Strange that it errors out:
student10# show run group-policy
group-policy PARENT internal
group-policy PARENT attributes
dns-server value 1.1.1.1 1.1.1.2
vpn-access-hours none
vpn-idle-timeout 111
vpn-session-timeout 111
split-dns value one.com one.one.com one.one.one.com
student10#
student10# conf t
student10(config)# group-policy CHILDa internal from PARENT
ERROR: source group PARENT does not exist
student10(config)#
student10(config)# show run group-policy
group-policy PARENT internal
group-policy PARENT attributes
dns-server value 1.1.1.1 1.1.1.2
vpn-access-hours none
vpn-idle-timeout 111
vpn-session-timeout 111
split-dns value one.com one.one.com one.one.one.com
group-policy CHILDa internal
group-policy CHILDa attributes
dns-server value 1.1.1.1 1.1.1.2
vpn-access-hours none
vpn-idle-timeout 111
vpn-session-timeout 111
split-dns value one.com one.one.com one.one.one.com
student10(config)#
So it creates the CHILD GP, but it only copies the configurtion, doesn't truly inherit. Which is to say, if I make a change to the parent group, it is not replicated to the child:
student10(config)#
student10(config)# group-policy PARENT attributes
student10(config-group-policy)# dns-server value 3.3.3.3
student10(config-group-policy)# exit
student10(config)# exit
student10# show run group-policy
group-policy PARENT internal
group-policy PARENT attributes
dns-server value 3.3.3.3
vpn-access-hours none
vpn-idle-timeout 111
vpn-session-timeout 111
split-dns value one.com one.one.com one.one.one.com
group-policy CHILDa internal
group-policy CHILDa attributes
dns-server value 1.1.1.1 1.1.1.2
vpn-access-hours none
vpn-idle-timeout 111
vpn-session-timeout 111
split-dns value one.com one.one.com one.one.one.com
I guess I have my answer then, the "from" keyword is to simply copy the settings from another group-policy, not set up a parent-child relationship.
Thanks for your help, Jcarvaja. I'll mark your respone as the answer.

Group Policy and shortcuts

ok imagine there is a company "x" that has a group policy which allows certain softwares to be executed . In one department of this company , employs uses a certain program called "y" . One employ create a shortcut of this program
on the desktop and when he tries to open it , a error message comes out which tell him that a policy which allows certain softwares is in use . Can someone explain to me what happened ? I know the group policy which allows certain softwares is in use but if
he can use the program why he cant use the shortcut ? :/

Am 04.02.2014 11:47, schrieb KristAlbania:
> One employ create a shortcut of this program on the desktop and when he
> tries to open it , a error message comes out which tell him that a
> policy which allows certain softwares is in use .
AppLocker or SRP? AppLocker has an event log that will tell you what
exactly was blocked...
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Disable autorecovery in Word and Excel via group Policy fails

hello everybody,
I have to disable the autorecovery - and unsaved functions in the office 2010 suite on winXPsp3.
In the group policy console i set the function to "disabled" , so on the client side in the registry the values for:
software\policies\microsoft\office\14.0\excel\options\KeepUnsavedChanges =0
software\policies\microsoft\office\14.0\excel\options\AutoRecoverEnabled =0
software\policies\microsoft\office\14.0\word\options\KeepUnsavedChanges =0
software\policies\microsoft\office\14.0\word\options\AutoRecoverEnabled =0
appear. This works fine on Powerpoint, but in Excel and Word users still have the chance to enable autorecovery from the "file" menu on the client. Time settings are greyed out, but by activating autorecovery, settings are configurable again.
Any idea where else i could configure "autorecovery" and "KeepUnsavedChanges" to be unavailable for the customer ?
thank you in advance,
Hennes

Hi Everybody,
we finally found something close to our wishes together with MS Support ( the answer was just a few dollars away !) We had to configure exactly the opposite of what we want and combine it with a senseless time interval......tataaaaa We´re done !
If you want to deactivate autoRecovery, you have to set "AutoRecoverEnabled" to "activate" and select a time interval for "save AutoRecover info every X minutes" of "0" minutes. Then the option will be greyed out , although the customer might reactivate
it by checking the box. Anyhow, files will be deleted at logoff and there are no recoverable files left on the Client .
(although this function is very smart on your personal windows-client, we needed to get rid of it on some public Terminals where workers without personal account write their reports and other personalized dokuments)
It works! In my case (Word 2010 on Win2008 terminal server) I only had to enable the 'Save AutoRecover info' setting and put a value of 0.
Thank you

Group Policy and Windows 8.1 questions

I have a few group policy questions. Thanks in advance for taking a look.
I’ve downloaded the Win 8.1/Server 2012 ADMX files. They look to be the same file names as the Win 7 ADMX files. Can I copy them into the PolicyDefinitions folder and still be able create GPOs for either win 7 or Win 8?
If we use a windows 8.1 client with the GPO mmc to create the GPOs (instead of putting the ADMX files on the servers), will the GPO built from the win 8.1 client apply correctly even though its coming down from a DC that doesn’t have those ADMX files?
Does it make a difference if the win 8.1 client we use to create/edit the GPOs is x64 or x86?
We recently needed to add in an admx file for Lync 2013. I put the lync.admx file in the PolicyDefinitions folder on one DC. If we build the GPO from that server, when it replicates out to all the other DCs, does it matter that they don’t have that particular
ADMX file for lync?
How do we organize and structure our ADMX files wherever they end up so that we know which sets are for which operating system? Should we be thinking about deleting the Win 7 ADMX files when the point comes in the future that we are using only Windows 8
and Windows 9?
We are at AD functional level 2003. Do we need to go up in level for any of this to work?

> 1. I’ve downloaded the Win 8.1/Server 2012 ADMX files. They look to be
>    the same file names as the Win 7 ADMX files. Can I copy them into
>    the PolicyDefinitions folder and still be able create GPOs for
>    either win 7 or Win 8?
Yes. Simply overwrite and you'll be fine.
> 2. If we use a windows 8.1 client with the GPO mmc to create the GPOs
>    (instead of putting the ADMX files on the servers), will the GPO
>    built from the win 8.1 client apply correctly even though its coming
>    down from a DC that doesn’t have those ADMX files?
Yes. GPO processing doesn't need ADMX, only GPO editing needs them.
> 3. Does it make a difference if the win 8.1 client we use to
>    create/edit the GPOs is x64 or x86?
No.
> 4. We recently needed to add in an admx file for Lync 2013. I put the
>    lync.admx file in the PolicyDefinitions folder on one DC. If we
>    build the GPO from that server, when it replicates out to all the
>    other DCs, does it matter that they don’t have that particular ADMX
>    file for lync?
If you have a central store for your ADMX, it will automatically
replicate through all DCs. If not, "2." applies anyway.
> 5. How do we organize and structure our ADMX files wherever they end up
>    so that we know which sets are for which operating system? Should we
>    be thinking about deleting the Win 7 ADMX files when the point comes
>    in the future that we are using only Windows 8 and Windows 9?
If you use a central store, update it as required. If not, do nothing
and use a client with the OS version you want to target.
> 6. We are at AD functional level 2003. Do we need to go up in level for
>    any of this to work?
AD level doesn't matter in any aspect. Schema version matters (Bitlocker
and Wireless, eg...), but you can update the Schema easily to 2012 and
have your DCs still run Server 2003.
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Don't have proper privilege to change the date and time. Group Policy does not work

Hello All,
I have configure group policy to change date and time only administrator. The problem is Windows XP machine cannot view the calendar but windows 7 can. So i need to view the calender for windows XP machine.
Error: you do not have proper privilege to change the date and time.
Please suggest.
Thanks

Hi Parvez,
Before going further:
I applied a VM Windows XP pro. When I logged in as a local admin, I can view the calendar from the right corner of desktop or from control
panel. However, when I logged in as a normal user account, I received the same message as yours.
For now:
I know this is not what you want. However, for normal users to view calendar, we can consider to give
Change System Time permissions to these users.
In addition, regarding this topic, the following article and thread can be referred to for more information.
You cannot set the date, time, or time zone on your computer
http://support.microsoft.com/kb/300022/en-us
Check windows calendar in XP pro without admin rights
http://community.spiceworks.com/topic/100116-check-windows-calendar-in-xp-pro-without-admin-rights
Please Note: Since the second website is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
Best regards,
Frank Shen

MSI Package Software Installations and uninstallations by group policy and sccm

Similar Messages

Maybe you are looking for