Restricted Group setting in GPO is not configured after domain join

Hi all,
I'm configuring a GPO as part of a test environment in which I create a custom GPO for within an OU, it configures fine and I can RDP (using the settings in the GPO) to the domain controller. However, when I add a computer to the AD domain, I cannot RDP
using the user, I can log on locally though. After looking into it further I've found that the setting I have applied to my Restricted Group is not being brought across properly. The group I need is in the restricted group but it is not appearing as a member
of Administrators (in the "Member of") column. I have an 'X' in red next to the group giving the usual check win logon log file. The content of which is:
Make a local copy of \\shire6.vce\sysvol\shire6.vce\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf.
GPLinkDomain
Make a local copy of \\shire6.vce\SysVol\shire6.vce\Policies\{6D41C716-CDD9-457E-AB89-02C4192226FF}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf.
GPLinkOrganizationUnit
Process GP template gpt00000.dom.
This is not the last GPO.
Monday, April 27, 2015 3:36:03 PM
Copy undo values to the merged policy.
----Un-initialize configuration engine...
Process GP template gpt00001.inf.
Monday, April 27, 2015 3:36:03 PM
----Configuration engine was initialized successfully.----
----Reading Configuration Template info...
----Configure User Rights...
Configure S-1-5-32-545.
remove SeInteractiveLogonRight.
Configure S-1-5-32-551.
remove SeInteractiveLogonRight.
Configure S-1-5-32-555.
remove SeRemoteInteractiveLogonRight.
Configure S-1-5-21-330840483-2018858548-1314766947-1104.
add SeInteractiveLogonRight.
add SeRemoteInteractiveLogonRight.
Configure S-1-5-32-544.
User Rights configuration was completed successfully.
----Configure Group Membership...
Configure SHIRE6\System_Admins.
successfully added object to Administrators.
new memberof tattoo list: *S-1-5-32-544,
Group Membership configuration was completed successfully.
----Configure Security Policy...
0
Undo value for group policy setting <MinimumPasswordLength> was saved.
0
Undo value for group policy setting <PasswordHistorySize> was saved.
42
Undo value for group policy setting <MaximumPasswordAge> was saved.
0
Undo value for group policy setting <MinimumPasswordAge> was saved.
1
Undo value for group policy setting <PasswordComplexity> was saved.
0
Undo value for group policy setting <RequireLogonToChangePassword> was saved.
0
Undo value for group policy setting <ClearTextPassword> was saved.
Configure password information.
0
Undo value for group policy setting <LockoutBadCount> was saved.
0
Undo value for group policy setting <ForceLogoffWhenHourExpire> was saved.
Configure account force logoff information.
System Access configuration was completed successfully.
LSA anonymous lookup names setting : existing SD = D:(D;;0x800;;;AN)(A;;0xf1fff;;;BA)(A;;0x20801;;;WD)(A;;0x801;;;AN)(A;;0x1000;;;LS)(A;;0x1000;;;NS)(A;;0x1000;;;S-1-5-17)(A;;0x801;;;AC).
0
Undo value for group policy setting <LSAAnonymousNameLookup> was saved.
Configure LSA anonymous lookup setting.
Configure machine\system\currentcontrolset\control\lsa\nolmhash.
Mismatch - machine\system\currentcontrolset\control\lsa\nolmhash.
Undo value for group policy setting <machine\system\currentcontrolset\control\lsa\nolmhash> was saved.
Configuration of Registry Values was completed successfully.
Configure event audit settings.
0
Undo value for group policy setting <AuditPrivilegeUse> was saved.
0
Undo value for group policy setting <AuditAccountLogon> was saved.
Audit/Log configuration was completed successfully.
----Configure available attachment engines...
Configuration of attachment engines was completed successfully.
----Un-initialize configuration engine...
this is the last GPO.
Make a local copy of \\shire6.vce\sysvol\shire6.vce\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf.
GPLinkDomain GPO_INFO_FLAG_BACKGROUND )
Make a local copy of \\shire6.vce\SysVol\shire6.vce\Policies\{6D41C716-CDD9-457E-AB89-02C4192226FF}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf.
GPLinkOrganizationUnit GPO_INFO_FLAG_BACKGROUND )
Process GP template gpt00000.dom.
This is not the last GPO.
Monday, April 27, 2015 3:42:06 PM
Copy undo values to the merged policy.
----Un-initialize configuration engine...
Process GP template gpt00001.inf.
Monday, April 27, 2015 3:42:06 PM
----Configuration engine was initialized successfully.----
----Reading Configuration Template info...
----Configure User Rights...
Configure S-1-5-21-330840483-2018858548-1314766947-1104.
Configure S-1-5-32-544.
User Rights configuration was completed successfully.
----Configure Group Membership...
Configure SHIRE6\System_Admins.
old memberof tattoo list: *S-1-5-32-544,
object already member of Administrators.
new memberof tattoo list: *S-1-5-32-544,
Group Membership configuration was completed successfully.
----Configure Security Policy...
Configure password information.
Configure account force logoff information.
System Access configuration was completed successfully.
LSA anonymous lookup names setting : existing SD = D:(D;;0x800;;;AN)(A;;0xf1fff;;;BA)(A;;0x20801;;;WD)(A;;0x801;;;AN)(A;;0x1000;;;LS)(A;;0x1000;;;NS)(A;;0x1000;;;S-1-5-17)(A;;0x801;;;AC).
Configure LSA anonymous lookup setting.
Configure machine\system\currentcontrolset\control\lsa\nolmhash.
Configuration of Registry Values was completed successfully.
Audit/Log configuration was completed successfully.
----Configure available attachment engines...
Configuration of attachment engines was completed successfully.
----Un-initialize configuration engine...
this is the last GPO.
Any help would be much appreciated.
Thanks,
Adrian

> I cannot RDP using the user
Any error message?
Greetings/Grüße,
Martin
Mal ein
gutes Buch über GPOs lesen?
Good or bad GPOs? - my blog…
And if IT bothers me -
coke bottle design refreshment (-:

Similar Messages

Windows 8.1 modern shortcut icons are not displayed in taskbar after domain join

Hello,
Like the title says: modern (metro) shortcut icons in taskbar are not displayed after domain join. There's just blank space where the icon should be for Store, OneDrive etc. Shortcuts work for classic and 3rd part applications.
Shortcut icons work properly if I log in with local account. The applications work properly whether the icons are displayed or not for every user (local and domain).

Hi,
Since this issue only happened for domain account, I suggest you check whether there're some GPOs\logon scripts applied to the domain accounts which controls the taskbar icons.
Have you tried to unpin the modern taskbar icons and re-pin the icons to the taskbar? What is the result?
Yolanda Zhu
TechNet Community Support

How do I fix "Domain not configured This domain points to a Wikimedia Foundation server, but is not configured on this server."

The message
Domain not configured
This domain points to a Wikimedia Foundation server, but is not configured on this server.
That’s all we know.
Keeps appearing for different sites I use. First it was Facebook then Fanfiction.net and others.
It's driving me nuts. I'm fine and going about my business on either site and then I go to a new page and boom I get slapped with that "Domain not configured" message and can not access the page or any other page under that domain name.
I've cleared my cookies, history and other private data on all three of the Internet applications I use (Safari, Chome, Firefox) and I still can not access those pages on any Internet app.
I don't understand it and I'm really starting to hate wikipedia.
Any help is much appreciated. I'm running out of hair to pull.
10.8.2 on a Macbook Pro Retina.

Please read this whole message and be sure you understand all of it before doing anything. Back up all data before making changes to your settings.
Write down the server addresses.
Click Cancel to close the Advanced sheet. Unlock the preference pane, if necessary, by clicking the lock icon in the lower left corner and entering your password. Open the DNS tab again and change the server addresses to the following:
8.8.8.8
8.8.4.4
That's Google DNS. Click OK, then Apply.
In Safari, select
Safari ▹ Preferences... ▹ Privacy ▹ Remove All Website Data
and confirm. If you’re using another browser, empty the cache. Test. Any difference?
Notes:
1. If you lose Internet access after making the above change to your network settings, delete the Google servers in the Network preference pane, then select the TCP/IP tab and click Renew DHCP Lease. That should restore the original DNS settings; otherwise restore them yourself.
2. I’m not advocating Google or anything else as a DNS provider; the server addresses are offerred merely for testing purposes. There may be privacy and technical issues involved in using that service, which you should investigate personally before you decide whether to keep the settings. Other public DNS services exist.

OSDResults does not show unsuccessful domain join

Hi,
is it possible to have unsuccessful domain join info (as it is on MDT lite touch deployments on Final Summary window), when using MDT 2012 integrated SCCM 2012 task sequence with UDI?

The question was not why the domain join was failing. It's about that Deployment summary window generated by MDT component OSDresults.exe does not show any warning/error message when it fails. In pure MDT deployments a warrning message is displayed
(in deployment summary window), but it's not, when using MDT integrated SCCM task sequence.

Airport: Not Configured after 10.4.7 update

I just bought a new macbook 2.0Ghz, proceeded through the first-time installation wizard setup my wifi settings, and everything worked fine.
At first boot in macosx i had my wifi working and i was able to browse and download things.
I installed the 10.4.7 macosx update, restarted, then lost my wifi connection.
The signal indicator reads
Airport: Not Configured
and in the network settings under 'Network Port Configuration' I see a greyed out 'AirPort' configuration. I can"t enable it. I can't add a new one either since the only choices are Bluetooth, Builtin firewire/ethernet, 6 to 4
I found a knowledge base article describing a similar problem:
http://docs.info.apple.com/article.html?artnum=303437
But the described workaround doesn't seem to work.
I also tried to reinstall the 10.4.7 update using the combo installer, the issues remain.
I ran also the permission repair utility at various stages in the process, it never detected any errors.
In the System Profiler under network/Airport section, i see:
Airport Card Information:
Type: AirPort Extreme [..]
Locale: Worldwide
Firwmare: 0.1.24
Current Wireless Network: AirPort is currently turned off
I know the card is there and working, since linux happily uses it when i boot in linux.
Has anyone any clue about what's happening ?
Is there a simple 'enable' button somewhere, or is that a known isse with 10.4.7 updater, how can i revert to 10.4.6 then ?
Thanks a lot!
Macbook Mac OS X (10.4.7)

It's actually a bit more weird:
When stepping through the first-time boot wizard, it asks to select the wifi essid from a list, the scan is ok and shows my network, and i type the WEP key in the box, click next. The 'Configuring your computer' blinks then the setup goes on and asks for my .Mac account and so on.
After the wizard completes i'm able to surf the web and connected BUT !
The signal meter is always empty and clicking on it states 'Airport: Not Configured'. When i open the network preferences it says under 'current status' that i'm using the builtin ethernet device ??!!
The IP and dhcp re-lease stuff work in the UI even if it's clearly not the builtin ethernet card that i'm using since the IP is from the wifi router, and there is no cable plugged in, and i can access the internet.
No mention of Airport port in the setup, so i can't configure it.
As soon as i restart the connection is gone, and the setup created by the first-time wizard is gone.
So the situation is now i have a 10.4.6 os with no airport..

Page item value set in app process not maintained after page submit

Hi -- I have a sequence of events that goes like this:
1) Page 0 region REG_1 is rendered before footer
- Region REG_1 uses javascript / AJAX to call App process PROC_1
- PROC_1 sets Page1 item PAGE1_MESSAGE to X
- After PROC_1 executes successfully, REG_1 does doSubmit()
2) Page 0 region REG_2 is rendered before footer; this happens
after the page submit done by REG_1. (Conditions ensure that
REG_1 is not rendered again)
- Region REG_2 displays PAGE1_MESSAGE (=X) in an alert.
- Region REG_2 uses javascript / AJAX to call App process PROC_2
- PROC_2 sets Page1 item PAGE1_MESSAGE to Y
- PROC_2 sets Application item DEBUG to PAGE1_MESSAGE (this is for debugging)
- PROC_2 sets Application item APP_MESSAGE to Y (this is also for debugging)
- After PROC_2 executes successfully, REG_2 does doSubmit()
3) After REG_2 submits the page, here's what I have:
- Application item APP_MESSAGE = Y. Good. This is what it was set to in PROC_2.
- Page 1 item PAGE1_MESSAGE = X. Bad. This is what it was set to in PROC_1.
- Application item DEBUG = Y. Good. This at least shows that PAGE1_MESSAGE was
set to Y within PROC_2... but for some reason that value is not being preserved
after the app process is done executing.
- There are several other application items set in PROC_2, and they're all correct.
Any ideas as to why this is happening? It seems like this should be
pretty straightforward: set the value, submit the page, the value should be what
I set it to.
Thanks,
Carol

Hi -- Thanks for the suggestions. First and 3rd (default value, or being overwritten by process or computation) aren't happening. The source for PAGE1_MESSAGE having is Always, Using app item PAGE1_MESSAGE... but I don't see what else could work here. Not sure if that's the problem.
I've put an example on apex.oracle.com. Workspace is dew_mir_tor. Username is [email protected]. Password is Mir97Dew77!Tor. Application is 22679, RefreshAllTest.
To reiterate the description in my original posting, but using the real application item/region/process names:
0) Press Button REFRESH_ALL on Page 1. This branches back to Page 1.
1) Page 0 region Refresh_All is rendered before footer
- Region sends up an alert to show you it's working
- Region Refresh_All uses javascript / AJAX to call App process REFRESH_CZAR (You'll see a "wait" window flash up briefly while the app process is running)
- REFRESH_CZAR sets Page1 item P1_MESSAGE_1 to X (The text here indicates where
the value is being set and when it should be displayed)
- After REFRESH_CZAR executes successfully, region Refresh_All does doSubmit()
2) Page 0 region Refresh_Non_Czar is rendered before footer; this happens
after the page submit done by Refresh_Czar. (Conditions ensure that
Refresh_Czar is not rendered again)
- Region sends up an alert to show you it's working
- Region Refresh_Non_Czar displays P1_MESSAGE_1 in an alert.
- Region Refresh_Non_Czar uses javascript / AJAX to call App process REFRESH_NON_CZAR (You'll see a "wait" window flash up briefly while the app process is running)
- REFRESH_NON_CZAR sets Page1 item P1_MESSAGE_1 to Y (The text here indicates where
the value is being set and when it should be displayed
- REFRESH_NON_CZAR sets Application item TEST_VALUE2 to P1_MESSAGE_1 (this just shows that P1_MESSAGE_1 was indeed set to Y in this process...)
- After process REFRESH_NON_CZAR executes successfully, region Refresh_Non_Czar does doSubmit()
3) After Refresh_Non_Czar submits the page, Page 0 region Display_Messages is rendered.
It sends up an alert so you can see it's working, and then it displays the value in P1_MESSAGE_1.
The value is still the one that was set in REFRESH_CZAR, not the one set in REFRESH_NON_CZAR.
Note that Display_Messages sets P1_MESSAGE_1 back to null, so you won't see it in session state after it's displayed in the alert. But you can see that TEST_VALUE2 is set to the message from REFRESH_NON_CZAR.
Hope this helps solve the problem!
Thanks,
Carol

"Time machine not configured" after yosemite clean install

I'm on a MBP early 2011, 16gb Ram, Seagate 500gb used to back up with Time Machine. I was doing manual backups once a month. Having wifi problems like everyone else and general slowdowns on the machine even before the regular install of Yosemite (on top of Mountain Lion, on top of Snow Leopard) I decided to do a clean install. Start fresh. Followed all the directions. But,little did I know that by changing my user name (not deliberately) on my brand new OS, I don't have access to TM. At least that's what I think is up with this "TM not configured"
How should I proceed?
Can I configure the drive now with my new username and still have access to my files? I wanted to bring over some of them, not all of them. If it's possible to do this, and I do, will I have all kinds of permissions or other problems? Will I lose my old backups if I configure it?
Or should I just start over with another kind of clean install? It's only been a couple of days.If I restored from the backup or whatever options there are, am I actually reinstalling the problems I was trying to eliminate? The upgrade to 16gb ram was part of my initial troubleshooting.
Other options?
Thanks!

My family upgraded to Yosemite on our 3 Macs four days ago: on an iMac, a MacBook Pro, and a MacBook Air, all three Macs from early 2014.
In Mavericks there was never any trouble with the Time Machine. But now on all three Macs, the TM doesn’t function properly.
1) on entering TM, the Restore and the two Arrow buttons for selecting the date are dimmed out 90% of the time; nothing can be done, for example, clicking on the Finder folders or files and so on is impossible.
2) sometimes, however, only the Restore button is dimmed out, or vice versa, only the two Arrow buttons.
3) on two occasions, no buttons were dimmed out, but on the very first click, all the buttons were again dimmed out
4) on the iMac and the Mac Book Pro, thank God, the backups still seem to be working; however, on the MacBook Air, a „preparing backup“ message just keeps on running and running.
The TM is a major feature of OS X that Apple pushes hard in its ads. Hopefully this means we’ll soon have an update. As a normal Mac user, I would find it difficult to apply any more exotic workaround solutions that some Mac experts might offer. My patience and ability to troubleshoot doesn’t go much beyond David Pogue’s latest OS X manual.
Anyway, a last more point: the previous TM was a thing of beauty, and I really enjoyed being sort of shot into space with the stars, like Dante on his way to the Empyrean; but now, on entering the TM in Yosemite, it looks like the Finder has fallen into an ugly pool of mud.
Thanks for any help or feedback you can offer.

Sideloading not working on domain joined enterprise devices

Hi,
I wanted to know if sideloading has any limitations that an OMA DM agent that it won't be able to install an app through sideloading if the tablet is domain joined?
We are seeing this on enterprise edition tablets which are domain joined and enrolled to the an MDM (mobile device management) server that the OMA DM agent cannot install a sideloaded app.
We'd highly appreciate some pointers.
Thanks,
D

Hi,
Sorry for my dilatory reply. According to the following description:
Windows 8.1 supports three types of user accounts on a device: Local Accounts, Microsoft Accounts and
Domain Joined Accounts. The OMA-DM agent is disabled when a device is domain joined which means
the management service cannot set password policy for a domain joined account. Windows 8.1 RT and
Windows 8.1 Home SKUs cannot be domain joined.
It seems like OMA-DM agent doesn't support domain joined of Windows 8.1 device.
You can access to the link below to download the document for more details:
http://download.microsoft.com/download/8/6/B/86BAC59D-0DA3-4B9C-AF15-C077DC0D46CF/Windows%208.1%20Enterprise%20Device%20Management%20Protocol.pdf
Roger Lu
TechNet Community Support

To disable group policy when the machine not connected to domain controller

hi all
i have alot of users joined to the domain and i enabled prevent user to to add/ remove sites on the trusted sites option through group policy, is there any script file that allow user to add and remove sites from the trusted sites when he/she out
of LAN without interaction by user, or script to disable all group policy settings that applied by the active directory administrator when there is no connectivity between domain machine and the active directory.
regards

Duplicate post...
http://social.technet.microsoft.com/Forums/en-US/winserverGP/thread/617a7ddb-592e-481f-b360-23d871eb26be#617a7ddb-592e-481f-b360-23d871eb26be
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Slideshow set to autoplay does not work after loading a pdf file

Hi,
While developing our app we encountered a problem whereby on an article page, we added in a slideshow function set to autoplay to show various images and also we created a button linking to a PDF file which we added into the app to allow users to get more information about the slideshow images.
We noticed that while the slideshow is being played and when we launched the pdf file and closing it again, the slideshow stops playing. It doesn't reset itself either. The slideshow just stops at the image on when we launch the pdf.
Any solutions?
Regards

That's how they work. Slideshows pause when you open up an in-app browser window. There's no setting to change/configure this behaviour.
Neil

Security exceptions not configurable after release 31 (bug number 1042889 is not fixed)

We are running Firefox 31 32 and 33 on different machines on windows/XP (updated until end of support).
Our router has an expired certificate. On the machines updated to Firefox 32 or above the security popup screen does not show. Instead we just get the corresponding error message, when trying to access the router's homepage.
I looked at the support thread "Secure Connection Failed- can not confirm security exception (since update to 31)" .
The posted solutions do NOT work!
Chrome and even IE work fine.
Please take a look at what was changed and reverse it.
Or add a possibility to configure exceptions to the always accessible options tab "security", Having only 262 users with the same problem, means all others having the problem just moved to other browsers.
For someone using Firefox since the beginning and liking it this will be a hard step, so I raise the issue again.
No, buying a new router is NOT an option, because it manages our network storage and printers and the rule is "never fix a running system".

hello, the fix of the bug number you have referred to has already landed in firefox 31.2.0 esr and will land in the regular firefox release channel in case there is an update to firefox 33 or else in version 34.

Email Router Not Configured after IFD Installation on CRM2013 Server

After implementation of IFD on CRM2013 Server when we configure the Email Router the token service error will show during load the data in Email Router.
Kindly help me to resolve this issue
Thanks & Regards,
Mohit Sharma
email: [email protected]

Hi Upen,
Thanks for your response. It is a 64 bit machine and the setup is also 64 bit.
I would like to mention some points related to my deployment scenario:
We have a Windows server 2008 R2 Standard edition on Server machine.
I have a .net website appliaction deployed and running on this.
One of our third party vendor is developing Cold fusion application.
This Cold fusion application will be integrated in our .net website.
Deployment and configuration of Cold Fusion application and server wil be done by Third Party vendor.
I need to install Cold fusion and give access to Third party.
Issue when I install cold Fusion using default settings, my .net Website does not get loaded.
In Mozila and Chrome Browser I get blank Page with only Background image given in Body tab of page is getting displayed.
In IE Browser Page with background image given in Body tab of plus this text ' <script> src="" 'is getting displayed.
Regards,
Sarfaraj Shaikh

Group setting height to size of content, after having it set explicitly

Hi
I have a group like:
<Group id="test" height="100">
<button height="200" />
</Group>
Can I get the group, to have the size of the content, after having set the height explicitly?
Regards
Martin Andersen

It seems that the default is actually 0 as demonstrated in this sample:
<s:Application xmlns:fx="http://ns.adobe.com/mxml/2009"
               xmlns:s="library://ns.adobe.com/flex/spark"
               creationComplete="init()">
    <fx:Script>
        <![CDATA[
            import mx.core.UIComponent;
            import spark.components.Group;
            private function init():void {
                trace((new UIComponent()).height); // prints 0
                trace((new Group()).height); // prints 0
        ]]>
    </fx:Script>
</s:Application>

Tap to click setting in system preferences not persisting after reboot!

Hi,
This is the 2nd time this has happened.. I shut down my system, and boot it up later, and when I go to tap, nothing happens. I go into to system prefs > trackpad, and see that my tap to click & dragging options are unchecked......
Why is it not remembering those settings?
-patrick

I also have this behavior. It seems all trackpad preferences fail to persist after reboot and logout/login. I also disable Pinch Open & Close and Rotate settings and those also revert.

Inventory DB will not Configure after 6.5sp4a

I've recently installed NetWare 6.5sp4a on my zen server and it's broken
my inventory. When I attempt to configure the DB ConsoleOne hangs (both
on admin workstations and the server itself).
There are no errors on the ZEN Inventory screen - however, the logging
isn't very verbose. (Does anyone know the command to enable verbose
logging on the Inventory screen?)
I have the SP4 backed up and can rev back - However, I would rather see
if the problem can be resolved and use backing out of the service pack as
a last resort.
Has anyone seen this or had similar problems?
Thanks.
Matt.

On Mon, 12 Dec 2005 15:49:14 GMT, [email protected] wrote:
> There are no errors on the ZEN Inventory screen - however, the logging
> isn't very verbose. (Does anyone know the command to enable verbose
> logging on the Inventory screen?)
you wont get anything on the screen but in the log file..
but wonder if anything would show up..
Try enable debugging....
http://www.novell.com/documentation/...rts/zdprts.pdf
Marcus Breiden
If you are asked to email me information please change -- to - in my e-mail
address.
The content of this mail is my private and personal opinion.
http://www.edu-magic.net

Restricted Group setting in GPO is not configured after domain join

Similar Messages

Maybe you are looking for