Security Filter: Computer works, Computer Group doesnt works

Hi @all,
Server W2K12R2 ... Name Computer1
When i make a FPO with security filtering on
1.) Computer ... works
2.) Security Group, Global, Security with Member Computer1 ... doesnt works
Read, Apply Group Policy are set
Why?
Help

> When i make a FPO with security filtering on
I suppose this shoud read "GPO" and not "FPO"?
> 1.) Computer ... works
> 2.) Security Group, Global, Security with Member Computer1 ... doesnt works
How do you determine that it works/doesn't work? Do you filter on the
GPO at all or on a specific setting (Group Policy Preference) within the
GPO?
Greetings/Grüße,
Martin
Mal ein
gutes Buch über GPOs lesen?
Good or bad GPOs? - my blog…
And if IT bothers me -
coke bottle design refreshment (-:

Similar Messages

Issue with write Security filter in ASO 9.3.1

Hello All -
I'm having a strange security filter issue in system 9.3.1 ASO cube. We've the native users for the ASO cube and created several write security filters based on cost centers in that cube.
For example, the below security filter sometime works, and sometime not:
Write "Adjustments", @RELATIVE ("S532179", 0), @RELATIVE ("S587724", 0), @RELATIVE ("S525701", 0)
There are total 8 standard dimensions in the cube. I tried all possible combinations to make it work constantly, but it doesn't. Even modified the filter like below so that it has all dimensions (using LEVMBBRS, IDESCENDANTS, RELATIVE) , still users can't load data at level 0 members.
Write @LEVMBRS ("Chart of Accounts",0),@LEVMBRS ("Full Year",0),@LEVMBRS ("Business Unit",0),@LEVMBRS ("Fixed/Variable",0),@LEVMBRS ("Source",0),@LEVMBRS ("Products",0),@LEVMBRS ("Scenario",0),@LEVMBRS ("Cost Center",0)
It looks like the user and filter association is not working. If I give the user direct write access to the cube (bypassing filter totally), the users can write fine. Please help!

I didn't know that the logs didn't work; I tested it and they are not generated for ASO updates in 9.3.1. I didn't see any other setting that would cause them to be created; my guess is that the logs are created based on block manipulations that Essbase does internally using BSO. As there are no blocks in ASO then the same algorithm doesn't apply.
We log Essbase changes in our Dodeca product but we use a different algorithm. We evaluate the update in our server before committing the changes and generate a relational log that has the datapoint information plus the old value, new value and standard 'who' information for the person making the update.
Tim Tow
Applied OLAP, Inc

Trying to install the newest version of itunes on my pc and am getting "program cant start because msvcr80.dll is missing from your computer" reinstalling doesnt work. and then it says error 7 (windows error 126)

trying to install the newest version of itunes on my pc and am getting "program cant start because msvcr80.dll is missing from your computer" reinstalling doesnt work. and then it says error 7 (windows error 126). Any help would be appreciated. Using Windows 7 enterprise on an hp Z600

Go to Control Panel > Add or Remove Programs (Win XP) or Programs and Features (later)
Remove all of these items in the following order:
iTunes
Apple Software Update
Apple Mobile Device Support (if this won't uninstall move on to the next item)
Bonjour
Apple Application Support
Reboot, download iTunes, then reinstall, either using an account with administrative rights, or right-clicking the downloaded installer and selecting Run as Administrator.
The uninstall and reinstall process will preserve your iTunes library and settings, but ideally you would back up the library and your other important personal documents and data on a regular basis. See this user tip for a suggested technique.
Please note:
Some users may need to follow all the steps in whichever of the following support documents applies to their system. These include some additional manual file and folder deletions not mentioned above.
HT1925: Removing and Reinstalling iTunes for Windows XP
HT1923: Removing and reinstalling iTunes for Windows Vista, Windows 7, or Windows 8
tt2

Security filter against AD groups. When you add a computer, does it need to reboot to fall into scope.

This should be an easy one. I have a 2008r2 domain. When I add a computer to an AD security group, so it will get targeted from a GPO that has that same group in its security filter, does the computer need to reboot to start processing any part
of that policy? It has always seemed that computers need a reboot to pick up their group memberships, but I wanted to double-check.
Dave

Hi Dave,
Normally for a computer account to become aware of the group membership change a reboot is required.
Also some group policy can be applied after a comouter reboot. So I'd suggest to reboot your compputer.
Best Regards,
Elaine
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

HT1373 how do i deautorize a computer that doesnt work anymore

i want to deauthorize a computer that doesnt work. i would also like to change my main device to my new computer.

Hi,
If you can't start iTunes on a computer, you can't deauthorize. But really, don't worry for the reason that, once you will reach the 5 authorizations you are allowed to, you will be able to use the "deauthorize all computer" option to reset all of them (this can be done once per year).
i would also like to change my main device to my new computer.
I don't understand this one. As of computer authorization, there isn't any "main" device.

How can i deauhorize a computer that doesnt work anymore?

How can i deauthorize a computer that doesnt work anymore?

Hi,
If you can't start iTunes on a computer, you can't deauthorize. But really, don't worry for the reason that, once you will reach the 5 authorizations you are allowed to, you will be able to use the "deauthorize all computer" option to reset all of them (this can be done once per year).
i would also like to change my main device to my new computer.
I don't understand this one. As of computer authorization, there isn't any "main" device.

I just downloaded the newest itunes on my acer lap top and I also did a software update on my ipod, but everytime I try to plug my ipod in my computer itunes doesnt work and sync. Help!!

I just downloaded the newest itunes software on my Acer Lap top, and also did a software update IOS 6.0.1 on my ipod thats 4th generation. Everytime I try to hook my ipod to the computer it doesnt work and I'm not sure why. Help!!

What do you mean by "it doesnt work"?

Managed (mcx) preferences ONLY works for Computer Groups (Lists)

AD Server 2008 R2 with extended schema.
Macs (ML 10.8.5) bound to AD, mcx settings were created for Computer Groups , User Groups (AD security groups), Users
but ONLY Computer Lists settings apply on the local machine (ANY, not just one)
I can see it with mcxquery
Anybody has an idea why that could be & how to sort it, so it DOES apply to user, user groups as well?
Seb

Turned out that my user existed as LOCAL user (same name/pass as AD)
In that way ONLY Machine MCX applies
Renaming local user & login with AD user applies Preferences correctly
Seb

Security filter with variable does not work correctly

Helo,
I have one table with this columns (called BI_USERS):
USERBI | REGIONS
XXXX 10,5 -> In this case the user XXX can access the region 10 and 5
AAA 9,7
I use this table to apply the security filters. Fisrt I did a initialization block with the select: SELECT USERBI, REGIONS FROM BI_USERS WHERE USER = :USER
This select populate two variables: variable USER (system variable) and UserRegion (Non-system variable)
After I use the UserRegion variable in the securty filter of the one group of users. For exemple:
Name | Status | Business Model Filter
"Claro"."Historico Saldo Pre-Pago" Enabled "Claro"."Historico Saldo Pre-Pago"."DW_UN_NEG" In(VALUEOF(NQ_SESSION.*UserRegional)* )
But the issue is that the query is not working, because the query created for BIServer no use the IN operator. Seems the IN operator is changed for equal (=).
And the query returs error because the value 10,5 (for example) is not a numeric value.
Anybody could help me, please? I am using the version 10.1.3
Mauricio

|||\/||| wrote:
Helo,
I have one table with this columns (called BI_USERS):
USERBI | REGIONS
XXXX 10,5 -> In this case the user XXX can access the region 10 and 5
AAA 9,7
I use this table to apply the security filters. Fisrt I did a initialization block with the select: SELECT USERBI, REGIONS FROM BI_USERS WHERE USER = :USER
This select populate two variables: variable USER (system variable) and UserRegion (Non-system variable)
After I use the UserRegion variable in the securty filter of the one group of users. For exemple:
Name | Status | Business Model Filter
"Claro"."Historico Saldo Pre-Pago" Enabled "Claro"."Historico Saldo Pre-Pago"."DW_UN_NEG" In(VALUEOF(NQ_SESSION.*UserRegional)* )
But the issue is that the query is not working, because the query created for BIServer no use the IN operator. Seems the IN operator is changed for equal (=).
And the query returs error because the value 10,5 (for example) is not a numeric value.
Anybody could help me, please? I am using the version 10.1.3
MauricioHi Mauricio,
First of all you have some syntax errors with your init block:
select USERBI, REGIONS from BI_USERS WHERE upper(USER)=upper(':USER');
Couple things to consider here:
1) Why are you selecting Userbi column from the table? Is USER system session variable not getting populated through other souces like LDAP or default security?
Ans: If your user session variable is getting populated from a different init block, then you dont need to select that column. Then your init block would look something like this:
select 'USERREGIONAL', REGIONS from BI_USERS WHERE upper(USER)=upper(':USER'); - Data Source
Row Wise Initialization - Data Target
Initblock that is populating the user session variable as the order of precedence.
2) If you dont have USER session variable populating from any other source, then your init block would look something like below:
select 'USER', USERBI, "USERREGIONAL', REGIONS from BI_USERS; - Data source
Row Wise Initialization - Data target
After following one of the above two steps, you need to apply the filters on the table.
"Claro"."Historico Saldo Pre-Pago"."DW_UN_NEG" IN(VALUEOF(NQ_SESSION.USERREGIONAL))
Note: Make sure you understand that variables are case sensitive.
Please award points as this is correct answer.
Thanks,
-Amith.
Edited by: Amith on May 10, 2011 3:18 PM

New computer, ipod doesnt like him...

Hi everyone,
Im Timo and i have my ipod touch for a while now (2nd gen) and ever since i bought a new computer my ipod is not recognized by neither windows (7) or Itunes...
I have tried many things but nothing seems to work, there is a little hope because when i connect it to my dads computer it is instantly recognized by itunes and windows (xp).
When i connect it to my computer it doesnt charge, it does when connected to my dads computer... please help,
Timo
(Sorry for my bad english, im dutch :P)

Unfortunately it doesn't work thanks for your effort,
Drat.
If Christine's suggestion doesn't help (it's certainly worth following up), I'd like to check the details of your motherboard a bit more closely, Timo.
Try downloading and installing a copy of Belarc Advisor:
http://www.belarc.com/free_download.html
Run an audit of the PC with belarc Advisor. Under "Main Circuit Board" what do you see next to "Board:"?
For example, on my Lenovo I see:
*Board: LENOVO 889703U*

My computer wont recognize my iphone 4. when i plug it into any computer it doesnt charge. i followed the procedure on the website but the device manager still says unknown device. any ideas how to fix this???

My computer wont recognize my iphone 4. when i plug it into any computer it doesnt charge. i followed the procedure on the website but the device manager still says unknown device. any ideas how to fix this??? the weird thing is it use to work until yesterday. thanks

Will it charge when connected to a wall outlet? The USB port on your computer must be 2.0
Powering Apple and third party peripherals through USB

Export and Import Computer Groups

Two Monday mornings in a row the Open Directory on our Intel-based Xserve's Mac OS X 10.5.7 Server had failed. This would mean that users who were supposed to have specific access right to folders and share points on other Xserve file servers couldn't get their files or had full access instead of restricted access. The first Monday a restart resolved the issue. The second Monday a restart did not resolve the issue and we opened a case with AppleCare Enterprise Support. We got it up and running again but it failed on Friday during the day. Another call the AppleCare Enterprise Support had me export all my users, user groups, computers and computer groups as a backup.
In the end, I had to do an erase and install of Mac OS X 10.5 server and I updated right to 10.5.8. AppleCare pointed me to the (now Snow Leopard) documentation and told me that now that the server was running and nothing was "broken" and they could not continue to support me. It was up to me to figure out how to restore everything from the documentation. Unfortunately, that document has NOTHING in it about restoring computers or computer groups. It only documents users and user groups. Our user groups were restored with the import of the previously exported list. However, all of the computers in our computer groups appear in the membership list as "Not Found". The preferences/settings for the group were restored but are not being applied to any computers. This means that portable users probably no longer have "mobile" accounts so they can log in off the network and now the Software Update is wide open (although most users are not administrators).
Is there some trick I'm missing to get the computers back into their groups automatically? I can add them manually but I have 400 and can't tell from the list of workstation numbers which are laptops and which are desktops.
-Doug

Hi Tapojyoti,
>>1. Is it correct that "WSUS 3.0 API Samples and Tools" is not supported in WSUS 4.0?
Yes, WSUS 3.0 API Samples and Tools is not supported in Windows Server 2012R2 by default. We may try to rebuild it in Windows Server 2012R2. For detailed information about how the rebuiled, please refer to the readme document of the WSUS 3.0 API Samples
and Tools.
>>2. Is "WSUS 4.0 API Samples and Tools" available?
No, I can't find the WSUS API Samples and Tools for 2012R2.
>>3. Is there any alternative way in WSUS 4.0 to export and import XML file consisting "Computer Groups" and "Patch Approvals" configurations?
As I have mentioned above, due to WSUS 3.0 API Samples and Tools is released with source code, we can try to rebuild it in the Windows Server 2012R2.
If it doesn't work, as a workaround, we can configure the new WSUS server as the replica server of the existing WSUS server. After the synchronization, change the server mode to stand alone.
Best Regards.
Steven Lee
TechNet Community Support

SCOM 2012 - Custom disk space report - Computer Groups

Hello,
I've created custom disk report with sql query to pull the disk space for all servers. The report has parameters start data,End date and computer name but now my requirement would be to get the disk reports based on custom created computer group, Is it possible
to feed computer group name instead of computer name in the custom reports?
Regards,
Vijay

Hi,
For SCOM 2007, you can’t select a group of servers and run a free disk space report on them. And for 2012 I think it also like that.
But based on my research, someone said that when you create group with Logical Disk targets, it may work. Here are two similar threads for your reference:
Report on Logical Disk Free Space % for a group of servers
http://social.technet.microsoft.com/Forums/en-US/fbec6fce-8f65-461b-8730-98a0d493c375/report-on-logical-disk-free-space-for-a-group-of-servers?forum=operationsmanagerreporting
Can't target free disk space report at Custom Group
http://social.technet.microsoft.com/Forums/en-US/8555fc3e-eed2-4523-a307-589eb6ff72fc/cant-target-free-disk-space-report-at-custom-group?forum=operationsmanagerreporting
Regards,
Yan Li
Regards, Yan Li

Approving WSUS updates for one computer group at a time

We have a WSUS server, and four computer groups (Alpha, Beta, Production, Workstations). Our patching process has us approve all "Not Approved" patches for the Alpha group, right after they're released by Microsoft. One week later, we approve all
of the updates from the previous week, for the Beta group. One week later, we do the same for Production.
I'm writing a script (which I can't test until next week), and wonder if there's a better way to get the list of updates that are approved for Alpha. Here is the code:
$updateScope = New-Object Microsoft.UpdateServices.Administration.UpdateScope
$updateScope.ApprovedStates = [Microsoft.UpdateServices.Administration.ApprovedStates]::LatestRevisionApproved
$updateScope.FromArrivalDAte = (Get-Date).AddMonths(-1)
$wsusGroup = $wsus.GetComputerTargetGroups() | Where {$_.Name -eq "$PatchingGroup"}
$updateScope
$updateScope.getType()
$updateScope.count
$updateScope.ApprovedComputerTargetGroups.add($wsusGroup)
$wsus.GetUpdates($updateScope)
$Updates = $wsus.GetUpdates($updateScope)
I assume I can take the $Updates variable and do the following for the Beta and Production groups:
Foreach ($update in $updates) {
$update.Approve(“Install”,$PatchingGroup)
Is this going to work, and is there a better way?

For WSUS Scripts see this: http://poshwsus.codeplex.com/
¯\_(ツ)_/¯

How to export and import "Computer Groups" and "Patch approvals" in WSUS 4.0 ?

Hi,
I have a query regarding the export and import options for "Computer Groups" and "Patch Approvals" in WSUS 4.0.
In WSUS 3.2 once we install WSUS 3.0 API Samples and Tools, we get "WSUSMigrationExport" and "WSUSMigrationImport" tools under
C:\Program Files\Update Services 3.0 API Samples and Tools\WsusMigrate\ folder.
Using the 'WSUSMigrationExport' tool we can export the Computer Groups and the Patch Approvals in a XML file. And using the 'WSUSMigrationImport' tool we can import the 'Computer Groups' and the 'Patch Approvals' from that XML file into a different WSUS
3.2 server. We can run the import tool as below:
a. Run command prompt as administrator.
b. In the command prompt, go to C:\Program Files (x86)\Update Services 3.0 API Samples ans Tools\ WsusMigrate\WsusMigrationImport
c. Type WsusMigrationImport filename.xml TargetGroups None. Press enter; this will import Computer Groups to the WSUS 3.2 server.
Type WsusMigrationImport filename.xml Approvals None. Press enter; this will import "Patch Approvals" to the WSUS 3.2 server.
This is easy and useful.
Now, for WSUS 4.0 I did not find "WSUS
4.0 API Samples and Tools". So I installed "WSUS 3.0 API Samples and Tools" in my WSUS 4.0 server. And tried to import a valid XML file in the above mentioned process. But the command returned an error.
The error says the "Microsoft.UpdateService.Administration.dll" file was not found.
I further searched in the internet about this issue and I found that the "WSUS 3.0 API Samples and Tools" is not supported in WSUS 4.0 as the .net framework used in "WSUS 3.0 API Samples and Tools" is 2.0 and WSUS 4.0 uses .net Framework
4.5.
So, Here are my questions.
1. Is it correct that "WSUS 3.0 API Samples and Tools" is not supported in WSUS 4.0?
2. Is "WSUS 4.0 API Samples and Tools" available?
3. Is there any alternative way in WSUS 4.0 to export and import XML file consisting "Computer Groups" and "Patch Approvals" configurations?
I need an urgent reply. Thank you in advance.

Hi Tapojyoti,
>>1. Is it correct that "WSUS 3.0 API Samples and Tools" is not supported in WSUS 4.0?
Yes, WSUS 3.0 API Samples and Tools is not supported in Windows Server 2012R2 by default. We may try to rebuild it in Windows Server 2012R2. For detailed information about how the rebuiled, please refer to the readme document of the WSUS 3.0 API Samples
and Tools.
>>2. Is "WSUS 4.0 API Samples and Tools" available?
No, I can't find the WSUS API Samples and Tools for 2012R2.
>>3. Is there any alternative way in WSUS 4.0 to export and import XML file consisting "Computer Groups" and "Patch Approvals" configurations?
As I have mentioned above, due to WSUS 3.0 API Samples and Tools is released with source code, we can try to rebuild it in the Windows Server 2012R2.
If it doesn't work, as a workaround, we can configure the new WSUS server as the replica server of the existing WSUS server. After the synchronization, change the server mode to stand alone.
Best Regards.
Steven Lee
TechNet Community Support

Security Filter: Computer works, Computer Group doesnt works

Similar Messages

Maybe you are looking for