ZENworks 6.5 SP1b And Group Policy Editor Problems

I just installed ZENworks 6.5 SP1b on a brand new test server that I am
running. I have no users or strain on the server. After I installed the
service pack it started take about 20 to open the Group Policy Editor for
a user policy and about a minute 20 to close it. I was using it before the
upgrade and it only took like 10 seconds to close before. What's up? Can
any one help?

Yeah Sorry I clicked the wrong one
> I presume someone will help in the Desktops forum, since this is for
> server management...
>
> --
>
> Shaun Pond
>
>

Similar Messages

Group Policy Editor problem

Hi
I updated Windows 7 SP1 Enterprise 64 bit
with the Windows Update.
Now, when I open the Group Policy
Editor, this window is displayed with the
following error message:
How come?
Thanks
Bye
Balubeto

Hi,
Apologize for the late reply.
The error message seems to be related with some updates that didn't update the Admx related files. The error was aften caused by mis-matched ADMX and ADML files.
See this similiar thread:
Error when selecting administrative template in any GPO
https://social.technet.microsoft.com/Forums/windowsserver/en-US/bac54114-54d7-472b-969d-9b08f28dbba9/error-when-selecting-administrative-template-in-any-gpo?forum=winserverGP
For the inetres.admx, line 1495 column 249, please follow the suggestions mentioned in the above thread. Unzipping the download (THIS ONE
http://www.microsoft.com/en-us/download/details.aspx?id=40905), then copy the related language\inetres.adml file to the c:\Windows\PolicyDefinitions\language directory, overwriting
the existing one in the destination.
Best regards
Michael Shao
TechNet Community Support
When I try to execute the copy commands via the command prompt with elevated privileges, the "Access Denied" error is displayed. How come?
Thanks
Bye
Balubeto

How do I setup Active Directory and Group Policy on Windows Server 2012?

I work for a school district that uses a Windows 2012 server with about 400 Windows 7 PCs and 150 Mac PCs. We are set up with Roaming Profiles on the PCs and would like to be able to setup Active Directory, Group Policy, and Roaming Profiles on our macs. (We also have a mac server that they are using as a file server only) As we are a school, our funds are very low. Now for the questions...
Is there a software that allow us to accomplish this?
Is there a free solution or a very reduced price option to do this?
I heard that http://www.centrify.com/products/mac-edition.asp may accomplish this and I read something about it on here but didn't know if this is what I was really trying to do becuase it was marked as "The Golden Triangle" and did not mention Raoming Profiles. This is the link though: https://discussions.apple.com/message/17200059#17200059
Any help would be greatly appreciated.

The above reply does not take into account that I am trying to use GROUP POLICY EDITOR to make it the default browser.

How do I set firefox as the default browser in Windows Server 2012 Group Policy Editor?

Hello, I am unable to set firefox as the default browser despite multiple different attempts to do so using group policy.
I have:
- Set a registry command (targeted at 32/64 via a WMI query) to reset the opening command as shown below:
HKEY_CURRENT_USER\Software\Classes\http\shell\open\command
"C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -osint -url "%1"
- Set a powershell logon script to run (that does run):
firefox.exe -silent -setDefaultBrowser
Despite setting the above it seems the client computers browsers are not affected by the settings above. When the script runs or if I run the command above a UAC window pops up and requests that I accept the command (for the setDefaultBrowser) but even if I click yes as an administrator it does nothing.
Since GPO in 2012 has changed perhaps there is something that I am missing? Do I need to somehow disable Windows Internet Explorer from achieving default browser status?
Please do not reply if you will suggest that I use Internet Explorer Maintenance (since this function in GPO has been disabled since IE10)
My DC is Server 2012, my client computers are Win7 32/64.

The above reply does not take into account that I am trying to use GROUP POLICY EDITOR to make it the default browser.

Can't see ADMX files in Group Policy Editor

I have a problem with ADMX files on my Server 2008 r2 group policy. I start by going to group policy editor. Then I browse to Computer Policy and then Administrative Templates. There is nothing in there... Which is weird... There has always been stuff there...
So, then I go in to add templates back in... I find the ADMX files in C:\Windows\Policy Definitions and also \\domain\SYSVOL\domain\Policies\PolicyDefinitions and go to Add/Remove Templates. I click add and then browse to either directory (which has ADMX files
in them!) and see nothing. ADM files I can see fine. But ADMX I can't see. So, I see these links:
2008 R2 Server GP can't see admx files
I can't see admx files
Looking at them, they both say I should be able to see ADMX files in the central store...So I manually copy the ones in C:\Windows\Policy Definitions to the SYSVOL central store. Restart group policy editor... Nothing there when I browse the settings...
Still not able to add templates.
It looks like group policy editor doesn't know about ADMX files at all... Is there a registry setting or something that "enables" the ADMX files?
Thanks,
Scott

In gpedit / gpmc, the menu item : "Action -> Add/Remove Templates", is only applicable/useful for the older/legacy ADM files - the menu item isn't relevant for ADMX/ADML files at all.
The most common reason for an "empty" list of Administrative Templates settings, is an incorrect configuration of the Central Store.
The usual guidance tells us to place ADMX files here, to setup a CS:
\\domain\SYSVOL\domain\Policies\PolicyDefinitions\
This folder/file structure has to mimic what you would see at: C:\Windows\PolicyDefinitions\
If your domain is named contoso.com, you would need this:
contoso.com\SYSVOL\contoso.com\Policies\PolicyDefinitions\
In that folder, reside your ADMX files.
You also need the relevant locale subfolder, and in there, you need the matching ADML files.
The best way to establish that, is to go to C:\Windows\PolicyDefinitions\ on your RSAT PC, or DC, and copy all the contents including subfolders and files, into the equivalent folder of your CS.
Then exit GPMC (if you had it opened), and re-launch GPMC. No need to to anything else in GPMC, it will automatically, by default, look for a CS first, and, if no CS is found, will revert to the local policydefinitions folder structure.
But, if the CS folder structure exists *AND* is incomplete or incorrect, you will get your symptom.
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

No standard templates in Group Policy Editor on SBS 2008

Hi, we have a SBS 2008. Problem is that we don't have any standard templates in Group Policy Editor anymore, just Office templates. If I do "Add/Remove Templates" the list is empty (please see Image below).
Any ideas?
Thanks in advance for your help
Best regards, Thomas

Hi Thomas,
Would you please let me confirm whether change anything before this issue occurred? Did this issue just occurred
recently?
Would you please let me know if Administrative Templates files still store in the default location C:\Windows\PolicyDefinitions
folder? Or have created the Central Store for Group Policy Administrative Template files? Please navigate to
PolicyDefinitions folder and check if it is empty.
If any update, please feel free to let me know.
Hope this helps.
Best regards,
Justin Gu

Is there a way to give a local user permission to add a local user using the local group policy editor?

I need to find a way to have the local administrator of a Windows Server 2012 system grant a local user (non-administrator) the ability to add a user for the machine using the local group policy editor. The machine is not part of any Active Directory environment,
this is strictly on the one machine. In my situation it is not an option to just make the user an administrator. The idea is to give someone the right to add a user and have no other such administrative rights. I need to accomplish this using the
Local Group Policy editor or the Group Policy Management Console if it is possible to do this outside of an active directory environment. This is not an assignment to learn how to use these tools and I am not even sure if it would even be possible though I
need to either find a way or find proof that it is not possible using these applications.

Hi,
Sorry for the delay reply.
So did you want to non-admin user have the ability to add another user?
As far as i know, we cannot add the user if we have no local admin permission, we will receive the error"Access denied".
Regards.
Vivian Wang

Windows 7 DNS and Group Policy Issues

Hi,
We have several suites of Windows 7 domain connected PC's.
In one of the suites I have been called into look at 3 different PC's where the users have not got mapped drives, desktop backgrounds, internet connectivity - because their group policies have not applied.
When I look at the error logs I find DNS 1014 errors, and Group Policy 1054 errors.
I have looked at the logs on the switches, and there is nothing on them - Could a pupil pulling the network cable out cause these errors?... Possibly they could have put it back in before I got back in the room.
The user logs off of the PC and back on again and are fine, as are the users that logon after them.
We have 2 DC's/DNS servers, which I would have thought would be able to cope with the load here.
Please let me know what you think the likely cause could be.

Hello John555444,
What is your current situation?
Is this issue resolved?
Best regards,
Fangzhou CHEN
Fangzhou CHEN
TechNet Community Support

Error when trying to open group policy editor

When I try to open the Local Group Policy Editor I get error message:
"Found duplicate definition of element string with name 'AppxRuntimeBlockFileElavationExplanation'.
File c:\Windows\PolicyDefinitions\en-US\AppXRuntime.adml, line43, column 15"
I'm running Win 10 Pro build 10041.
Has anyone seen this?

When I try to open the Local Group Policy Editor I get error message:
"Found duplicate definition of element string with name 'AppxRuntimeBlockFileElavationExplanation'.
File c:\Windows\PolicyDefinitions\en-US\AppXRuntime.adml, line43, column 15"
Same here.
Dave

Unknown Error when starting the Group Policy Editor

On Windows 8.1 Professional, I opened the "Edit group policy" from the control panel and also tried to start gpedit.msc from an elevated CMD prompt. In both cases I get the following error message:
In English: Failed to open GPO. You may not have appropriate rights. Details: Unknown Error
There it is again - this dreaded "Unknown Error" message - telling me absolutely nothing about the cause of the problem.
In the past I have been able to launch the GPE on that machine without problems. I can absolutely not remember having messed around with the system files or registry settings. So there is no suspicious thing I could have done to break something. I had a
look at all copies of the GPEDIT.MSC in an editor but none of them looked broken in any way.
I startet C:\WINDOWS\SYSTEM32\MMC.EXE C:\WINDOWS\SYSTEM32\GPEDIT.MSC using the debugger of Visual Studio and paused execution after the error dialog had poped up. I got this call stack:
gpedit.dll!ReportError(struct HWND__ *,unsigned long,unsigned int,...)   Unknown
gpedit.dll!CComponentData::Load(struct IStream *)   Unknown
mfc42u.dll!CWinApp::ProcessShellCommand(class CCommandLineInfo &)   Unknown
I had configured the debugger to break on all exceptions but as you see yourself, MMC is an MFC 4.2 app that doesn't use exceptions.
Since I get no access to the symbols of gpedit.dll, can anybody please tell me which conditions - i.e. problems - in Load() are handled by simply returning E_FAIL? What could be wrong with my machine?

Hi,
Consider the corrupted local policy files and system files, please try these steps:
Step 1: clear local GP by running these commands:
RD /S /Q "%WinDir%\System32\GroupPolicyUsers"
RD /S /Q "%WinDir%\System32\GroupPolicy"
gpupdate /force
Step 2: To scan system files by running this command as admin:
SFC /SCANNOW
Andy error, please post back the CBS.log
Then, restart the computer to check the results.
Also, the event log (Open local event viewer) will show something related to this issue, please check event under
Windows log\Application and Applications and services log\Microsoft\Windows\Grouppolicy, post back if you find any error about this issue.
Kate Li
TechNet Community Support

Access Connections and Group Policy generated network profiles

Hello,
We are in the middle of rolling out 3500 T400 machines and are having fits with Access Connections 5.02. We have a default in-house Preferred Wireless Network Profile that is created on each machine via Group Policy. This works fine with AC and everything does what is supposed to do when our users are in our buildings. When our users go offsite, we have nothing but fits with AC and trying to set up any other WAN connections.
If users set up a new network connection, we are asking them to set it up thru AC. We have had them try using both the "Use Windows to Configure Wireless Network" as well as "IEEE 802.1X Authentication". Once the network connection is set up, for some, the wireless will work for a short period (a week or so) and then will no longer detect network connections. The user nor the client site has made any changes to the wireless configuration.
Others will have a stable connection wirelessly until they connect over VPN – VPN will drop in a few minutes after connection. They can then sometimes reconnect after a reboot; but the instability is a constant problem.
It seems to me that the problem could all be traced back to GP enforcement, which occurs every 8 hours when connected to our network. If a user is offline for several days, then connects up to check email or transfer time or whatever, then they are kicked off. If a user connects via VPN, they are kicked off within minutes - again potentially traceable to GP enforcement.
Has anyone else dealt with this scenario of Preferred Wireless Network policies and Access Connections?
Thanks!

Try going back to AC 4.52, which solved the problems i was having with AC5.02 (freezes, BSOD, loss of wireless connections when coming out of standby, GUI problems) on Vista Home Premium. Scroll down for prevous versions of AC5.02 here:
http://www-307.ibm.com/pc/support/site.wss/document.do?lndocid=MIGR-67283
I do not use a VPN system so AC4.52 may not help your 3500 Thinkpads.
Lenovo (Mark_Lenovo) knows there are problems with AC5.02 for the last three (or more ) months and have stated that AC 5.1 will solve the problems, but it has not been released as far as I know. There are many threads on AC5.02 on this forum and also on thinkpads.com
the Lenovo Blog site also has an update on AC5.02 ;under "Design Matters" on how they selected the graphics for wireless connections - the responses there offer some suggestions to fix the problems.
T60: 6371-CTO, VISTA Home Premium+SP1, 2GB....R51: 1836-Q4U,XP,1GB...600...755CD

Anyconnect tunnel-group and group-policy from LDAP

Recently we've changed from LOCAL to LDAP authentication and added additional group-policies for different users to increase security.
To prevent users from selecting an incorrect group-policy, the LDAP server provides a IETF-Radius-Class value which matches the different group-policy names.
It is my understanding that the authentication method is provided by the tunnel-group.
tunnel-group DefaultWEBVPNGroup general-attributes
authentication-server-group LDAP_AD
This all works, but for _one_ of the group policies i'd like to enable (external) two factor authentication. Two enable two factor auth a 'secondary-authentication-server-group' needs to be set in the tunnel-group.
Creating a tunnel-group which maches the name of the group-policy doesn't seem to have any effect. When listing the connected users via "show vpn-sessiondb anyconnect", it always states the correct Group Policy but also always DefaultWEBVPNGroup.
When enabling the listing of tunnel-groups for webvpn, thus allowing users to select their own tunnel-group, the two factor auth does work.
To summarize, is it possible to let LDAP decide which tunnel-group is used or is there another way to have different group policies without users being able to choose ?

Fabian,
Your connection lands on a tunnel group and picks a group policy.
A typical way to overcome the problem you're indicating is by using group-url.
a URL is bound to a specific tunnel-group and allows you to land directly on the one you desire.
vide:
http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/98580-enable-group-dropdown.html
M.

Difference between domain controllers and group policy objects in GPMC

Hello,
Am in confusion, someone can tel me the difference between
1.Domain controllers>default domain controller policy and
2.Group policy object>default domain controller policy
In Group policy management console and also i would like know where to define these categories. I normally use second option.
I have attached screenshot for your information.
regards,
Dharanesh,

This first/upper item is a link to the GPO, the second/lower item is the actual GPO.
(notice the link, has a shortcut arrow showing)
by default, when you double-click on a link, a message will display which says "you have clicked on a link....." and the messagbox offers a checkbox for "do not display this message again..."
Effectively they are equivalent to a shortcut-to-a-file vs. the actual file.
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

Demoting a DC and Group policy, help needed.

Hi all,
so we have 3 domain controllers, lets say dc1,dc2 and dc3. We have the 3rd line assistance from another company, they have advised the following....
SO the stages will be
1) Can you please go through all the GPO's in DC3 and consolidate what you need and what you do not need, you need to extensively cross reference this with DC1 and DC2, this is something you have to do. As I will not know what you need and what you do
not. You can do this by logging into each domain controller and opening up the settings of each GPO and cross referencing.
2) Once the above is done, we will consolidate the GPO's to a central repository in your domain
3) Backup Sysvol directory and Netlogon folder in DC3
3) Proceed to dcpromo DC3 out of the domain
4) Test connectivity if clients to the AD
5) Add the additional Server options
6) All of the above can be done during office hours.
it was my understanding (perhaps wrongly) that the group policies were not on the individual Domain Controllers but in Sysvol and as such replicated anyway?
any advice would be very much appreciated.

> I am being told that our Group policies are different across different
> Domain Controllers and to my knowledge that's impossible as we have
> discussed it should be in the replicated Sysvol.
Ok, that's a common problem. Fix it and you will be fine:
http//support.microsoft.com/kb/2218556 (for DFS-R Replication of Sysvol)
http://support.microsoft.com/kb/315457 (for NTFRS replication)
> I'm a bit lost on the central repository aspect but prior to saying it
> makes no sense I just wanted to check my understanding, especially with
> an MVP!
I agree. Talking of a "central repository" fro group policy doesn't make
sense, because group policy from the very beginning lives in AD and
sysvol, which both are kind of "central repository". Seems they don't
really know what they're talking about :)
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

IE 8 Trusted sites list and Group Policy

Hi all
I have a problem deploying some IE trusted sites to all our users.
I have previously been able to do this by editing the Local Group Policy, but am finding that what ZCM is telling me now, doesn't make sense. Here's what I'm doing when I edit the policy:
GP Helper in the ZCM console brings up the Group Policy window, then I proceed as follows:
Local Computer Policy / User Configuration / Internet Explorer Maintenance / Security / Security Zones and Content Ratings, click Continue to the prompt about Enhanced Security Configuration, then click Modify Settings.
When I go to the Security tab and open Trusted Sites, the sites I entered are no longer listed (the list is empty), BUT if I try to add the sites back in, I am told that "This Site is already in the Trusted Sites Zone".
If I log on as a user that has this policy applied, the sites are not in the Trusted Sites list.
I really don't want to be in position where I have to do this through a bundle, I figure that's what policy is for! I'm also concerned that if this part of policy is showing some weirdness, maybe other parts of my policy are no longer being applied properly too.
Just a bit stumped at the moment. Has anyone else seen this issue, or has any suggestions for me?

Spearse,
I just tried this with IE7, and it worked as advertised... I would
suggest you look at the logs to see if there are any errors
Shaun Pond

ZENworks 6.5 SP1b And Group Policy Editor Problems

Similar Messages

Maybe you are looking for