Outlook 2013 Programmatic Security Settings via Group Policy

I am in a domain environment and have deployed Office E3 via Shared Computer Activation on an RDS.
Outlook functions correctly in online mode.
When 3rd party software (such as ZetaDocs) attempts to access any Outlook feature (such as sending or address books) a prompt message is displayed - "A program is trying to access e-mail address information stored in Outlook...Allow access
for...".
I am able to change the Programmatic security settings to disable the prompt in Outlook by starting it as an Administrator.
I have tried to do this the 'correct' way using the Office 2013 ADMX GPO templates. The created policy is linked to the OU containing the RDS server.
gpresult and rsop shows no sign of the policy being implemented after a gpupdate /force.
Any ideas as to what is going wrong?

Make sure you have the correct adm:
http://support.microsoft.com/kb/2426686
The feature you probably want to disable is the
RPC/HTTP Connection Flags and set to None or 0. You'll have to test that out.
Twitter!: Please Note: My Posts are provided “AS IS” without warranty of any kind, either expressed or implied.

Similar Messages

How to control IE10's "Compatibility View settings" via Group Policy

First
of all thanks for taking the time to read this. I must let you know that I have limited experience with Group Policy so here it goes...
Domain Controllers are 2008 R2 Datacenter and client computers are Win7 Pro with IE10
I need to add several sites to the "Compatibility View settings" in IE10 and have these pushed out via Group Policy.
I followed this to enable the "Use Policy List of Internet Explorer 7 sites:"
Use
Policy List of Internet Explorer 7 sites
I even added the settings to both User Configuration as well as Computer Configuration. However the computers on the domain wouldn't show these sites in
IE even after forcing a GP update (gpupdate /force)
Yes I did use top level domain names.
Next I installed the Administrative Templates for Windows Internet Explorer 10 on the DC:
Administrative Templates for Windows Internet Explorer 10
this gave me an Inetres.adm file while I put in the same location as my other .adm files that Group Policy Manager sees (located at C:\Windows\SYSVOL\domain\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Adm)
I do see a bunch of .ADMX files located at C:\Windows\PolicyDefinitions
on the DC. I also see a lot of .ADML files located at C:\Windows\PolicyDefinitions\en-US.
Where is my Central Store located that my Group Policy references? How do I know what location GP is reading from?
Now I installed the Administrative Templates (ADMX) for Windows Server 2008 R2 and Windows 7 from here:
Administrative Templates (ADMX) for Windows Server 2008 R2 and
Windows 7
This gave me a "Win7-2008R2-admx.msi" package that I installed. I took the defaults and extracted contents to:
C:\Windows\PolicyDefinitions\Server 2008 Win7\PolicyDefinitions
Are all of these .ADMX files supposed to be placed into my Central Store?
If I mouse-over "Administrative Templates" in Group Policy Manager is says that the policy definitions are retrieved from the local machine.
I then right-clicked on top of "Administrative
Templates" in Group Policy Manager and highlighted Inetres and selected Delete.
While in Add/Remove Templates I click on Add and it defaults to looking for "Policy Templates" and will not let me select and .ADM/.ADML/.ADMX files.
What am I doing wrong here?
How do I know that I'm using the most recent Inetres file?
How do I know which file Group Policy Manager is using to manage the IE settings that are in:
User Configuration->Administrative Templates->Windows Components->Internet Explorer->Compatibility View->Use Policy List of Internet
Explorer 7 sites
or
Computer Configuration->Administrative Templates->Windows Components->Internet Explorer->Compatibility View->Use Policy List of
Internet Explorer 7 sites.
Is there anything else you can suggest?
Many, many thanks in advance for any response

Hi,
Regarding your question, usually we create a Central Store for Administrative Templates (Both .admx and .adml files), and create a folder that is named PolicyDefinitions in the following location:
\\FQDN\SYSVOL\FQDN\policies. The .adml files on the Windows computer
are stored in a language-specific folder. For example, English (United States) .adml files are stored in a folder that is named "en-US." When you have copied all .admx and .adml files, the PolicyDefinitions folder on the domain controller should contain the
.admx files and one or more folders that contain language-specific .adml files.
Please refer to the following articles. You will get more helpful details about the Central Store for Group Policy Administrative Template files.
How to create the Central Store for Group Policy Administrative Template files in Windows Vista
http://support.microsoft.com/kb/929841
Windows 7, Windows Server 2008 R2 and the Group Policy Central Store
http://blogs.technet.com/b/askds/archive/2009/12/09/windows-7-windows-server-2008-r2-and-the-group-policy-central-store.aspx
Based on your description, I understand you enable the setting “Use Policy List of Internet Explorer 7 sites”. However, didn’t show any sites in IE in client even after forcing a GP update
(gpupdate /force). Please use command “gpresult” in clients to collect the GPOs, and then check whether the GPO contain the setting “Use Policy List of Internet Explorer 7 sites” was applied to clients or wasn’t.
In addition, you also can change the related setting by using registry directly.
Follow the path of the registry:
HKEY_CURRENT_USER->Software->Policies->Microsoft->Internet Explorer->BrowserEmulation->PolicyList. (Create registry folders
manually if not present)
Right Click
PolicyList ->New->String Value->Enter the name of the website. (Both under ‘Name’ and ‘Data’. For example,
Value name: example.com Value data: example.com)
There is a similar question, please read as a reference.
Add manually URL on Compatibility View List in IE10
http://social.msdn.microsoft.com/Forums/ie/en-US/5a15e861-d106-471e-a968-fdea15e31c45/add-manually-url-on-compatibility-view-list-in-ie10
Hope this helps.
Best regards,
Justin Gu

Windows 8 and IE10 not accepting Proxy Settings via Group Policy

We have recently introduced a couple of Windows 8 computers in our network, and we are having issues applying the Internet Explorer Proxy Server settings.
We use a Microsoft TMG 2010 server as our proxy server for accessing the internet.
We have been using a GPO with the following settings to automatically configure our Windows 7 computers running IE9 with the appropriate Proxy settings:
User Configuration\Policies\Windows Settings\Internet Explorer Maintenance\Connection/Proxy Settings
“Enable Proxy Settings” : Checked
“Address of proxy” : server.domain.local
“Port” : 8080
“Use the same proxy server for all addresses” : Checked
“Exceptions” : Here we have a list of several internal or partner sites that should not be proxied.
This GPO has worked beautifully for our Windows XP and Windows 7 users with IE 7, 8 and 9.
Now with Windows 8 and IE10, this no longer works.
I’ve therefore added a Windows Server 2012 Domain Controller to the network, and using GPMC on that new DC, I created a new GPO with the following settings:
User Configuration\Preferences\Control Panel Settings\Internet Settings\Internet Explorer 10
Now, seeing as these are preferences, it’s a little different. But, I’ve “checked off” the option “Use a proxy server for your LAN” as well as “Bypass proxy server for local addresses”.
Then I click on “Advanced” and setup all my proxy settings the way I would like them, including the proxy server name, port and exceptions list.
When this new group policy gets applied to my Windows 8 PC, the only setting that gets applied is the “Use a proxy server for your LAN”.
It does not configure the name or port of the proxy server nor does it configure the exceptions list.
If I go back to the GPMC, and edit the new GPO, the settings are all there.
However, if I just view the settings from the main GPMC screen (without opening the GPO itself),
I don’t see all of those settings (again, only the one “Use a proxy server…”)
What am I missing???

Hi All, - (Revised Answer by myself)<o:p></o:p>
I banged my head against the keyboard on this one for some time trying to get this group policy to apply. I
did every thing that was suggested, learning about the F6 and F7 keys to Green underline and Red underline the options required and not required. I even gave in and used the registry settings and it still did not work. It turned out that I had
2 issues. The first one is obvious and the second not so obvious, this is how it is setup:
I have a 2012 R2 Standard DC with Windows 8.1 clients/workstations and IE 11. As you are aware you must make
sure that the following are underlined in green:
Automatically detect settings - (but not ticked)<o:p></o:p>
Use proxy server for your LAN<o:p></o:p>
Bypass Proxy for local address<o:p></o:p>
Next I made sure that the following had red dotted lines:
Address<o:p></o:p>
This still didn't work, so I went through my 'Do Not use proxy servers for addresses beginning with' removed all
of these and then re-added one by one until the problem materialized. The first issue was when using wildcards I had added an entry with the following:
http://domain.subdomain.com/*
Then caused my proxy fields not to be applied, I re-added this just with:<o:p></o:p>
http://domain.subdomain.com/
<o:p>This next one is IMPORTANT.</o:p>
I had these entries in a Word document of which I had copied and pasted from the entry box for 'Do
Not use proxy servers for addresses beginning with'. As shown in the screen shot above provided by SVEN_BURGER I had very similar entries:
http://domain.subdomain.com/;10.*.*.*;172.27.*.*;http://172.27.*.*
Each time I copied and pasted the line (+ more) above the proxy field on the Windows 8.1 client
be blank after using 'gpupdate /force' I then noticed that in my Word document the whole string was being seen as 1 URL due to the http part at the beginning, so I changed my entry to look like this:
10.*.*.*;172.27.*.*;http://172.27.*.*;http://domain.subdomain.com/
I again noticed that this section:
http://172.27.*.*;http://domain.subdomain.com/
Was being seen as one URL in my Word document. To resolve this I had to add the URL's individually and
apply and OK these before going back in and making the next entry. So I ended up adding them all individually after separating the
URL's in my Word document.
I hope this helps.

Windows 8 and IE10 and 11 not accepting Proxy Settings via Group Policy from windows server 2003

Hi
We are still running Windows Server 2003 with a Win7 and Win8 desktop environment. I can control Win7 IE9 settings,
But Win8 systems are running IE10. We have an internal proxy server.
Is there any way to force the proxy settings to the Win8/IE10 or 11 systems .
i have tried with The IE 10 .adm template and applied gpo,but does not have any proxy settings for ie10 and no changes were applies
please can anyone help me regarding this
i want to apply GPO from windows server 2003 to windows 8 ie10/11
Thanks
KNC

Hi,
I agree with Zanderol24, we can install RSAT on a windows8 client, and then we can use Group Policy Management to manage group policy from the client.
For more information about RSAT, we can refer to the following link:
Remote Server Administration Tools (RSAT) for Windows Client and Windows Server (dsforum2wiki)
http://social.technet.microsoft.com/wiki/contents/articles/2202.remote-server-administration-tools-rsat-for-windows-client-and-windows-server-dsforum2wiki.aspx
For more detailed information about how to use GPP to configure the proxy setting for ie10 and ie11, we can refer to the following link:
How to configure Group Policy Preference settings for Internet Explorer 11 in Windows 8.1 or Windows Server 2012 R2
http://support.microsoft.com/kb/2898604
When we use GPPs you need to be aware of the F5-F8 keys:
Red / Green: GP Preferences doesn’t work even though the policy applied and after gpupdate \force
http://blogs.technet.com/b/grouppolicy/archive/2008/10/13/red-green-gp-preferences-doesn-t-work-even-though-the-policy-applied-and-after-gpupdate-force.aspx
Besides, aside from using group policy to manage IE, IEAK can also be used to do this.
For IEAK, the following article can be referred to for more information.
Internet Explorer Administration Kit (IEAK) Information and Downloads
http://technet.microsoft.com/en-in/ie/bb219517.aspx
Best Regards,
Erin

Configuring Office 2013 Default Font Type via Group Policy / Office Customization Tool

Hello,
I'm trying to get a default font set for all word 2013 Users that access word via the Terminal Server. I have not been able to find any articles that shows how to get it done, though i found this technet link (http://technet.microsoft.com/en-us/library/cc179141.aspx)
which says to use the Office Customization Tool, but I see no options for font type/size change in the options when I use the OCT. Thanks a lot for your help.
Sola

Chris,
My question extends beyond Word. We have some older printers that do not have Calibri in them, so any office product that prints Calibri comes out garbage. Some things simply cannot be changed as needed (ex: outlook body messages can not be changed).
How can I change back to Arial for everything office produces. Thanks in advance, my users are ready to kill me.
Mark
a) I haven't seen printers which use "hard" fonts in over 15 years - are you sure about that?
b) this might help you:
http://blogs.technet.com/b/emeaoffice/archive/2012/12/12/office-2010-deploying-custom-fonts-across-all-applications.aspx
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

Deploying Printers with User Specific Settings via Group Policy

Good Morning All,
We are getting ready to switch our print server over and would like to find an easier way to update everyone's printer list. The issue we are running into is that we have a few large copiers that use a user id number to validate any print jobs. Is
there a way to set that up in GPO so that it will give the correct code directly? I cannot find anywhere that I can adjust the printer preferences.
Thanks,
Brent

Hi
So you just want to update the TCP port with the new IP instead of deploying new drivers from the server?
Hope this helps. Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Change settings to "Always Allow" via Group Policy

We upgraded our Flash Players from v6 to v8 (I know v9 is out
we haven't go there yet) a couple months ago, and we've just
noticed that we can not access some of our local stored Flash
content. Then error we get is "Macromedia Flash Player has stopped
a potentially unsafe operation. The following local application on
your computer your computer or network:
H:\some\network\file.swf: localhost"
I found on Adobe's website how I could add the site/file as a
trusted location via the Settings Manager Global Security Settings
panel. Problem is that I can't seem to figure how to accecss the
Security panel, unless I do it from a computer which has internet
access, which my network does not. Also once I make these changes I
don't know how I can push out this change to all the computers on
my network. I thought I could do it via windows group policy, but I
don't see any documentation from adobe showing what registry
keys/files need to be updated/changed to make these certain
settings via group policy. Can anyone help?

I found that if I copy the settings.sol to a users profile,
but I have over 1000+ users on our network......surely there's got
to be an easier way?!?!?!?

Disable Private Browsing via Group policy

We are a medium sized business using Firefox 27.0.1. I have been looking for a way to control private browsing via group policy for a while but there are no clear answers on how a system administrator can do this without a convoluted process of editing files that can't be found anywhere on a computer.
Our environment:
windows 2008 DC
using group policy
500 users, all windows
Do not use any proxy or L7 filtering
I've looked into using the adm file that is available from the link below. I've sifted through the code and followed instructions for the lockdown process for Computer and User configuration; however, nothing works.
http://4sysops.com/archives/group-policy-for-firefox-and-chrome/#download-the-adm-files
If someone can point me to a registry entry or a vbs file that can be used as a start up script, it would be greatly appreciated by myself and all the system administrators of the world that are trying to decrease private browsing in organizations.
Between the 3 major browsers we are using on our Windows platform (IE, Chrome Firefox); Firefox seems to be a challenge to control. I have been successful in controlling settings via group policy for the other two. I'm working on a cumulative step by step document for this and will share with the world when I am able to configure Firefox.

Thanks for those suggestions; however, they don't help sysadmins that already have the non-enterprise version in their environment. From what I gather, there really isn't a straightforward way of doing this via group policy in a Windows environment without first removing the app and then deploying it with customizations (using tools suggested).
I guess I'll go with the answer "No, there isn't a straighforward way of controlling Firefox through Group policy".

RDS 2012 R2 - How do I lockdown access to Local Computer Management and Windows Backup via Group Policy

Greetings all,
I am needing assistance in how to lockdown access to Local Computer Management and Windows Backup via Group Policy for users that access RDS service. I have followed this awesome guide - h t t p://w w w.it.ltsoy.com/windows/lock-down-remote-desktop-services-server-2012/
- but it is missing two important resources that I would like to lock down.Currently, I have successfully locked down Control Panel for users via Group Policy, but I cannot find any group policy or guide on how to restrict user access
to Computer Management (different to Server Manager). When using Win-X shortcut to open the 'Administrator's shortcuts' near the windows icon, I have locked down everything except Computer Management. Computer Management gives direct access to Disk Management,
Shares etc, which are locked down for users. But Windows Server Backup is still accessible. Can someone please guide me on how to restrict access to both Computer Management and Windows Server Backup.
Thanks in advance.
Terry.

Prevent running of Windows Server Backup
Computer Configuration\Policies\Windows Settings\Security Settings\File System
Right click on File System - Add File - Drill down to \System32\wbadmin.msc
On the Database Security ACL that pops up - Remove Creator Owner, Remove Users and check Adminstrators have Full Access.
On the Object window - choose Propagate inheritable permissions to all... (Default)

Force UAC on via Group Policy

I have looked all around but have not really found a solution to this problem. How do I lock UAC on via Group Policy so that no one can change it except via Group Policy and all the settings
are greyed out even for administrators? I just want it on the default settings and left alone. If I wanted to do something similar for Windows Firewall or Internet Explorer settings, it seems easy, but UAC seems to be different. Unfortunately I have situations
at clients where this setup is necessary and unavoidable.

Hi,
This can be done via Local Group Policy or via Active Directory-based GPO, which is much more suited for large networks where one would like to disable UAC for many computers at once.
If using Local Group Policy you'll need to open the Group Policy Editor (Start > Run > gpedit.msc) from your computer.
If using in AD-based GPO, open Group Policy Management Console (Start > Run > gpmc.msc) from a Vista computer that is a member of the domain. In the GPMC window, browse to the required GPO that is linked to the OU or domain where the Vista computers
are located, then edit it.
1.In the Group Policy Editor window, browse to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options.
2.In the right pane scroll to find the User Access Control policies (they're down at the bottom of the window). You need to configure the following policies:
User Account Control: Behavior of the elevation prompt for……
User Account Control: Detect application installations and……
User Account Control: Run all administrators in Admin App……
3.You'll need to reboot your computers.
There is a detial Microsoft official website on Configuring UAC via Group Policy：
UAC Group Policy Settings and Registry Key Settings
http://technet.microsoft.com/en-us/library/dd835564(WS.10).aspx
Hope it helps.
Regards,
Blair Deng
Blair Deng
TechNet Community Support

Disabling windows update via group policy

hi,
i would like to disable automatic windows upate via group policy on windows server 2008. is it possible?
thanks.
sundeep

hi,
disabling the automatic update is not a recommended practice, but here are the steps,
Click Start, and then click
Run.
Type gpedit.msc, and then click
OK.
Expand Computer Configuration.
Right-click Administrative Templates, and then click
Add/Remove Templates.
Click Add, click
Wuau.admin the Windows\Inf folder, and then click Open.
Click Close.
Under Computer Configuration, expand
Administrative Templates, expand Windows Components, and then expand Windows Update.
The Configure Automatic Updatespolicy appears. This policy specifies whether the computer receives security updates and other important downloads through the Windows Automatic Updates feature. The settings for this policy let you specify if
automatic updates are enabled on the computer. If the service is enabled, you must select one of the three configuration options.
To view the policy settings, double-click the
Configure Automatic Updatespolicy.
To turn on Automatic Updates, click
Enabled or to turn off select
Disabled
hope this helps
thanks

Automatic Windows Update via Group Policy in Windows 8

Hi,
I have created a new GPO to place some settings on the Automatic Update to all my client pcs. The settings applied as the image i uploaded below. The problem is that this GPO were successfully applied to all my Windows 7 machine but not Windows 8.1 machines.
Is there anything that i missed or i should know about Windows 8.1 automatic update configuration via Group Policy?. I've tried to google but cant find any guidance that relates. I'm not using WSUS. Appreciates any advise. Thanks.
Cheers, Sparcx [MCTS,MCITP-EA]

Hi Leon, yes i have read the blog that you gave, It says that Windows 8 requires a KB update to roll the changes that will solve this issue. However its also said that the update is included in Windows 8.1 and there's no need to update to solve the Automatic
Update behaviour via Group Policy as mentioned. Also tried to apply the KB update suggested, but failed. It is not for Windows 8.1 platform. Is there any other suggestion? I kinda stuck here..
Cheers, Sparcx [MCTS,MCITP-EA]

How to deploy a file on all users C drive via group policy

I'm trying to deploy a file on all users C drive via group policy but its not working. logon script is already kept in place but nothing is happening. If I run the same command from my pc it's working fine. Does any one have good script to copy & deploy
the file. Pls help

Hi,
You can use Group Policy Preferences to deploy this and Item-level-Targetting to filter by OUs/groups, wmi filters ,etc.
Computer Configuration / User Configuration - Preferences - Windows Settings - Files
More on this here.
http://technet.microsoft.com/en-us/library/cc772536.aspx
Hope this helps.
Regards,
Calin

How to disable via Group Policy - "Any user who has a password doesn't need to enter it when waking this PC"

The setting can be found in the following location:
From the “Charm” bar, Settings>Change PC Settings>Users>Sign-in Options> click the “Change” button next to “Any user who has a password must enter it when waking this PC”.
I am looking to disable this option via Group Policy on our domain, but am unable to find a default policy related to this setting. I am searching Group Policy on a Server 2012 machine, and in local Group Policy in Windows 8, but have found nothing.
Hoping I'm just missing the location of this and someone can point me to the right place.
Regards,
-BN

There is no specific policy for this item. Please set “Require a password on wakeup” policy instead.
Niki Han
TechNet Community Support
I'm using Windows Server 2012 R2, and I can't find the above quoted policy, and don't know where to anymore where to look. I searched for "Require a password when the computer wakes up", but it took me to the "Define Power Buttons and Turn On
Password Protection" page of System Settings, but there's NOTHING there except the "When I press the power button". I really want to stop having to enter a password every time I wake up the monitor screen.
Capt. Dinosaur

Updating Existing Install and adding extensions via Group Policy

We have recently installed StarOffice 8 due a full planned move away from Microsoft Office 2003, we have deployed the CD install via group policy to test the functionality of StarOffice in a school environment. Due to a problem cropping images in Writer (cropooo 0.2.1 extension needed) we are having to update to the latest patch ver10 (300+pc's). Is there a way to automate this via GPO? We only have the standard version of staroffice 8 and not the enterprise CD so we can not make a custom transform file. Also can extensions be deployed via Group Policy? We are runnning a Windows 2k3 server with XP clients.

Network Deployment of Adobe Flash Player
I found this link http://www.adobe.com/devnet/flashplayer/articles/flash_player_admin_guide.html
It is a good idea to extract the msi the deployment data point using msiexec /a {filename} (this creates an administrative installer)
Use the extracted MSI to deploy flash. (either assigned or published)
Please make sure that the user can read from the data point you place the files.

Outlook 2013 Programmatic Security Settings via Group Policy

Similar Messages

Maybe you are looking for