Skip to main content

Posts

Showing posts with the label GPO

Who broke my GPO's? User GPOs no longer applying.

I stumbled on this gem today. Basically, if you use Security Filtering on a User GPO, it may not work any more due to Microsoft Patch  MS 16-072 , which was released on June 14, 2016. See https://blogs.technet.microsoft.com/askpfeplat/2016/07/05/who-broke-my-user-gpos/ This is an excellent article and explains it very well. Basically, this Microsoft patch changes the way that GPO's are processed. In summary: After applying the appropriate patch to your systems, User group policies are retrieved from SYSVOL differently than before. Prior to the update, domain joined computers used the user’s security context to make the connection and retrieve the policies. After the update is applied, domain joined computers will now retrieve all policies using the computer security context. What this means is that if you have used Security Filtering on a GPO with User scope, and you do not have "Authenticated Users" in the list of delegates with Read permissions, you need to add "...
Post a Comment
Read more

Examining GPO Health

I was recently asked to evaluate an Active Directory environment to determine it's health, specifically relating to GPO's and how they were being used. I discovered that the number and configuration of the OU's, GPO's, and contents, were a clear indication that the administration of GPO's was not well understood by the committee of people who were managing them, and that there were clearly problems being self-inflicted due to these issues. The question, however, was how can we quickly assess whether the management of GPO's was in trouble, and also how can we quantify the issue? The first thing to understand is that there are Recommended Best Practices from Microsoft for how to manage GPO's.  See https://technet.microsoft.com/en-us/library/cc785903(v=ws.10).aspx But how to quantify these subjective suggestions? First,  "Minimize the Use of the Block Policy Inheritance Feature".   You can determine the number of OU's that have Blocked Policy Inhe...
Post a Comment
Read more