MDM & GP Tips Blog

Guest post from Chris Jaramillo (a GPanswers.com regular friend!) with a little help from Jeremy Moskowitz, Enterprise Mobility MVP.

Well, another OS release from Microsoft, and you “workin’ it” Group Policy Admins know what that means: Time to update the central store with the latest definitions.

GPO Definitions: Latest and Greatest

GPO’s definitions start out life on each operating system type. The newest (as of this writing is 2012 R2 and Windows 8.1.)

You would EXPECT them to ship with the same Group Policy definitions, right?

Think again.

Well, I (Chris) did a quick WinDiff of the PolicyDefinitions folders on fresh 2012R2 and Win8.1 builds:

Default on clean install of both Windows 8.1 and 2012R2 systems

• 167 common ADMX files (and their corresponding AMDL)

ADMX files which are only on a clean install of 8.1:

• deviceredirection
• enhancedstorage (Available on 2012R2 via a Feature)
• sdiagschd
• search (Available on 2012R2 via a Feature)
• shapecollector (Available on 2012R2 via a Feature)
• winstoreui (Available on 2012R2 via a Feature)

ADMX files which are only on a clean install of 2012 R2:

• grouppolicy-server
• grouppolicypreferences
• mmcsnapins2
• napxpqec
• pswdsync
• servermanager (Available on Win8.1 via RSAT)
• snis
• terminalserver-server
• windowsserver

ADMX files which you can get only on 2012 R2 Only, when you install a Role:

• fileservervssagent

ADMX files which you can get on either 2012 R2 and Win 8.1, when you install a Feature

• searchocr

So in short, you get the issue as last time. That is, you have to grab some of them from the workstation OS and others from the Server OS. And/or you need to turn on specific features or Roles to get these ADMX files to actually appear at all !

If you had to manually do this, this would make Central Store management almost unbearable.

It would require installing all Roles/Features on each of a Vista, Windows 7, Windows 8, Windows 8.1, 2008R1, 2008R2, 2012R1, and 2012R2 nodes, each with the latest Service Pack.

Then starting with Vista, copy the PolicyDefinitions folder, overwriting with 20018R1, then Windows 7, 2008R2, Windows 8, 2012R1, Windows 8.1, and finally 2012R2. Even then, I have seen instances where MS has removed certain older policy settings from certain newer versions of the same ADMX !

Jeremy’s 2¢

So, here’s my (Jeremy’s) 2¢: Chris is right, but there’s some good news. You DON’T have to go through ALL those gyrations to get the “latest pack” of ADMX files.

Traditionally, Microsoft makes available a download of all the latest ADMX files all in one shot.

The basic rule of thumb would be to simply always just overwrite what’s already in the Central Store *WITH* what Microsoft provides.

So if you had any “extras”.. that’s cool, they just stay there and you can use them. But you’re always overwriting the old ADMX files with the LATEST ADMX files.

As of this MOMENT, Microsoft doesn’t yet have the “latest” ADMX files from Win 8.1 and 2012R2 yet available. I’m pretty sure they’re coming soon. When they do, I’ll post about it.

If it were me, I’d just limp along a little while longer until MS produces them as a full download.

So, that’s the story: Standby for when it drops from MS.

Chris Final 2¢

Special notes: In the 2008R2 version of AppCompat.ADMX, “Prevent access to 16-bit applications” was a user AND computer option. In the 2012R2 version of the same ADMX, the user option is gone. I’m pretty sure I’ve seen IE settings disappear in a newer ADMX as well.) Add on the fact that certain applications (such as IE) have their ADMX/adml files updated when the application is released (sometimes out of band from the OS release), or that certain hotfixes (such as the 2012R1 WSUS patch that I forwarded you a week or two ago) will update ADMX/adml files, and it’s enough to make your head spin.

So, even with populating the latest versions of all of the possible ADMX files, that may not populate the admin templates with all available settings for all client/server/apps (which was kind of the point of a Central Store). However, doing so probably the closest thing to an all-encompassing Central Store that is possible.

Chris extra notes: My recommendation is to keep a copy of the PolicyDefinitions folder from each OS version (including Service Packs) handy, just in case you temporarily need a previous version of the ADMX.

The Question: To pre-install or NOT to Pre-Install

On linked in, someone asked the following question: If you pre-install “big / universal drivers” on your target machine, will you will save login time when GPPreferences is used to deploy shared printers?

The idea is that the driver is “already there” and GPPrefs would just “do nothing.”

So.. SOMEONE had to figure it out. It might as well be me. ?

Tests and Methodology

Results: Here’s the result of my testing using the HP PCL 6 64-bit universal  printer driver. It’s a 17MB download. Then installing it on the server and doing a roundup of HP*.* I find 48MB of HP files within c:\windows\system32\spool\drivers\x64\3 after sharing a universal printer.

(Note: It doesn’t actually matter if the raw byte count is TRUE count or not, as the times I get on MY machine are RELATIVE to what you’ll see.)

I turned on the setting which enables me to SEE *WHEN* and *HOW LONG* each GP CSE takes to process. I also put a stopwatch next to it, then COUNTED HOW LONG these words appeared (http://screencast.com/t/YWDfqIwu).

Here are the test cases / results.

Again, WARNING: I am on a ludicrously fast testlab / laptop. The point is NOT for me to report exact seconds or even total time to log on.  The point is the FINAL RATIO of how long each test case takes VERSUS another test case.

The FINAL RATIO should be the same for just about anyone based upon these numbers.

Scenario 1: No GPPrefs Printers linked anywhere.

Result: ZERO seconds / “Applying Group Policy Printers policy” never appear.

Scenario 2: Universal Printer Driver shared on server in \\DC\HPPRINT1. GPPreferences item is linked to West Sales Users OU. Mr. WestSalesUser 1 logs on.

Result: 29 seconds for the CLIENT to show “Applying Group Policy Printers policy”… then MOVE ON.

Scenario 3: Same as scenario 2. BUT.. Mr. WestSalesUser1 has already logged on and downloaded the driver. NOW Mr. WestSalesUser2 logs on.

Result: 3 seconds for the CLIENT to show “Applying Group Policy Printers policy”… then MOVE ON.

*INTERESTING RIGHT?!* – More insights and thoughts below. Let’s continue onward.

Scenario 4: Universal Print Driver is pre-installed on target machine. GPPreferences item is linked to West Sales Users OU. Mr. WestSalesUser 1 logs on.

Result: 6 seconds for the client to show “Applying Group Policy Printers policy”… then MOVE ON.

Scenario 5: Same as 4. Mr. WestSalesUser1 has already logged on and used the driver. NOW Mr. WestSalesUser2 logs on.

Result: 3 seconds for the client to show “Applying Group Policy Printers policy”… then MOVE ON.

So.. how do we interpret these results?

Answer: Pre-installing the “big / universal” printer driver BEFORE using GPPreferences yields an 80% time improvement for the first user and a 90% time improvement for user #2.

However, if the FIRST user “suffers” and downloads the print driver via GPPreferences / the network, the improvement for user #2 is the same for over the network AND local installs of the driver.

Counter-intuitive thinking (so stick with me)

You might think my final advice would be “Yes, of course pre-stage universal drivers.. you get an 80%- 90% improvement in first-user login time!”

But that is NOT what I would suggest.

My belief is and has always been “The First Login Time For Any User Doesn’t Matter.”

Even if it takes, say, 3 times longer than the NEXT login (for the same user, or for the second user on the same machine)… my feeling has always been… “SO WHAT?”

Before you throw things at me, think about it: The first login time is “forgettable”. Its not an every day occurrence.

Sure.. If there’s some delay that can be eliminated at EVERY login (from login 2 onward) you should do it. (Crappy login scripts which copy big files EVERY time, or things that CRAWL the file system, etc etc.) OF COURSE — dump that crap — and make EVERY login time faster.

But that’s not what we’re talking about HERE.

HERE, in the case of “Do we” or “Don’t we” pre-install big universal print drivers, we DONT gain speed at EVERY login.

So, my final thought is: Generally *DONT* pre-install big univeral print drivers. You don’t get benefit at EVERY login.

Is there an exception?

Sure. Here goes: If you use non-persistent VDI where EVERY login feels like the FIRST login, then I could likely get behind pre-baking in items like this which make EVEN THE FIRST LOGIN go faster.

Again: That’s only because every login ACTS like its the FIRST login.

There are possibly other time-critical logins (Nurse’s stations, Stock Floor Trader) where maybe, again, would I agree that baking them in feels like the right thing to do to save X number of seconds (because you don’t know who has NEVER logged into that machine before.)

There’s my wrapup on this topic. I hope it helps you out. Please make your insightful (but kind) comments below. Thanks !

Tip o’ the hat to Chris Jaramillo who first pointed this problem out to me -and- the solution.

Here’s the lashup:

• You’ve got Windows 8 and/or
• Windows Server 2012
• You’ve got WSUS and
• You’re using the existing GP settings to manage WSUS

And, darnit.. Win8 and/or WS2012 are simply not playing ball with the WSUS GP settings.

So Win8 and WS2012 machines are getting updates (but not WHEN you want) THEN they’re rebooting (also NOT when you want.)

Why?

Those systems (Win8 / WS2012) weren’t coded to read those policy settings.

But hark !!

A hotfix has been made available to make Win8 and WS2012 act like Win7 and WS08 with regards to “doing what’s in the WSUS GP” settings.

Here’s the Microsoft blog entry on the subject.

Here’s the hotfix download to get you there.

Thanks again to Chris Jaramillo for this tip !

Ow.

I hurt myself, so I went to the doctor’s office.

And, it was one of these places which sees celebrity clients. Specifically, local sports stars in the Philadelphia area.

You know the routine: Take your shirt off, freeze half to death, then wait twenty minutes for the doctor to finally come in and tell you to take two Advil.

Gee, thanks.

But just before he came in, I took a picture of this computer.

(The red stuff, is obviously mine. And I blurred out a lot as I’ll describe below).

Let’s take a look at what a huge, mega error it was to leave me alone with this computer:

• Item 1: That’s me highlighted in the blue bar in section 1. Then ALSO the FULL NAMES, BIRTHDATES and PATIENT IDs of 10 more clients. Full. Freekin’. Names. Hello HIPPA COMPLIANCE !? Also pointed to in item 1 is MY healthcare plan, so the doctor can determine if he should spring for various tests. The crappier the plan I guess, the less they try to perform tests.
• Item 2: It’s XP. Great. So my medical records are protected by an operating system which will get no patching at all starting in April 2014. Grrrrrrreeeat !
• Item 3: Thanks for the attack vector and giving me the computer name. When I call the nurse’s station pretending to work for IT, it’ll make me look more credible that I have this information in hand. (No no.. I wouldn’t do that.. right?)
• Item #4: This is custom application. And, you can see the menu system: there’s a zillion settings for the Nurse, Doctor, or others.. (like me if I was being naughty) to misconfigure in this application. If they were using PolicyPak to deliver application settings, they could be guaranteed that those settings would be set and maintained. (What am I talking about? Attend my next webinar on application settings management at www.policypak.com) .
• Finally.. The main item is.. the damn keyboard and mouse are just fully unlocked. I had 20 full minutes to poke around here. I didn’t just snap this picture when the Nurse left the room. I took it 20 minutes AFTER she left.

Did I *ACTUALLY* touch the keyboard and move the mouse around?

Look, I’m not 12 years old anymore, so.. no I didn’t.

But I could.

And if this was, instead, an APPOINTMENT for a 12 year old, you KNOW his or hands would be on that keyboard.

Are you doing everything you can at YOUR organization to be more secure? Learn how to ENSURE that the RIGHT settings are delivered so naughty people cannot do things they shouldn’t do.

In my training class, I show you exactly how to use the Group Policy infrastructure you already have to do it.

Next class: Las Vegas, Dec 2 – 6.

Sign up at www.GPanswers.com/training .. And ensure your computers aren’t “totally exposed.”

One of the things I get asked about a lot is Group Policy Object “design.”

Design could mean a lot of things. Group Policy Design to me means:

• What you name your GPOs.
• What you put inside your GPOs.
• What GPOs are linked where.
• OU design.
• Use of Blocked Inheritance and Enforced properties.

When I perform my (paid) Group Policy Health Check consulting service… these are the kinds of things I look at overall.

To be honest, and I’m just callin’ it like it is here… I don’t usually see ALL of these elements designed well.

Usually ONE, sometimes ALL of these elements are near impossible to discern what’s going on.

Here’s one big overriding tip I can suggest if you decide you want to think about design (or, more likely a redesign.)

Good: Could someone from the outside look at your design and be able to basically figure out what is going on?

Better: Could someone from the outside look at your design and be able to figure out WHY you did it?

Best: Could someone from the outside look at your design and figure out what you did and why you did it, and NOT need any extra documentation?

To be clear: I’m not saying “don’t document your naming conventions” or “don’t make careful notes about what you’re doing and why.”

I *AM* saying that a good design should “jump off the screen” at you. If you got a new boss TOMORROW and you needed to spend 10 minutes explaining WHAT was done and WHY it was done that way… would it make sense based on what you have, in Active Directory (OUs) and the GPMC (GPOs)… TODAY?

Here’s the best (two) parts about GP design:

• Your design doesn’t have to look like anyone else. It just needs to make sense. 
• If you screwed it up the first time, it’s not heinous to get it repaired. You do need some direction and a trusted guide though.

If “Cleanliness is next to Godliness” is a real thing, then maybe you should think about getting cleaned up.

If you’re feeling dirty all over right now, here’s your two options: take either my Group Policy training class (Live or Online) or have me perform my (paid) Group Policy Health Check consulting service … you and your company can get cleaned up .. fast.

If you’re serious about either one (training or consulting) then give Laura a call at 215-391-0096 for a quote.

You can also reserve a seat in the next live class (Denver Aug 12 -16, 2013) or get the Online University at www.GPanswers.com/training.

We have limited seats left in the Denver class, and I only take ONE Group Policy Health Check client per month. First come, first served.

See you soon.

I got this fun email from Mads Lomholt from the Oslo Norway Norwegian Fanclub of GPanswers.com. (I didn’t know we had a Norwegian fanclub branch of GPanswers.com, but I’m super happy to learn it’s alive and doing well!)  Here’s his question (and my answer!)

—

Mr Moskowitz! ? Do you take requests?

Is there any situation where blocking inheritance of GPOs (often followed by enforcing GPOs which are higher) is a good and lasting solution?

I am not an expert on this, but so far I have seen only bad things happen when people dive into blocking and enforcing GPOs.

To a certain extent I believe I understand the principles, but why not craft the OU structure to account for this instead of blocking/enforcing?

I’ve read that Microsoft states: “It is recommended that Enforced and Block Inheritance be used sparingly”, Okay. Sure.

Excited to hear the expert judgment of my question!

Mads Lomholt
Norwegian fanclub, Oslo ?

Jeremy’s answer:

Mads:
Great question. Let’s clarify some items.
First: You don’t / can’t block inheritance of ONE GPO. People sometimes think that blocking is about a particular GPO. It’s not. Its about saying “From this point onward, we’re starting fresh and ignoring GPOs before this point.”
So, said another way, when you Block Inheritance upon an OU you’re starting fresh and saying that you don’t want policy setting (higher than here) from affecting your users or computers.
However, what’s also true is that you cannot block any GPOs where their links have the Enforced property. This means any GPO’s links that are enforced will always “make it through” any Block Inheritance.
So, when is Blocking Inheritance on an OU good? Well, anytime you want to “break free” from GPOs set higher up. I usually recommend Block Inheritance as a GOOD THING when OU administrators are really totally in charge of their own Group Policy desires.
For instance, in the domain, lets say Company X has:

• North Sales OU
• East Sales OU
• All of Marketing OU
• All of Research OU
• Other OUs…

Let’s assume that the administrators in the company are:

• Fred: OU admin, manages North Sales OU (and nothing else).
• Mary: OU admin manages East Sales OU (and nothing else).
• Gary: Domain admin, manages the domain AND “All of Marketing OU” and “All of Research OU” and some other OUs.

Gary might make some decisions at the domain which would affect Fred and Mary.

If Fred and Mary basically are allowed to “do their own thing” and don’t really answer to Gary, then they should Block Inheritance to create a clean slate for their OUs.
But, if there’s something REALLY important (like a security setting which should affect everyone) then Gary is able to link it to the domain and Enforce it, which will definitely affect everyone.

So, that’s a GOOD reason to use Block Inheritance.

However, going back to your original question: I often see Block Inheritance used way, way too much. And, as such, I see the Enforced property used way, way too much.

I would agree: designing first to try to avoid a lot of blocking and enforcing is ideal whenever possible. But in my case above there are perfectly fine times to use it.
Additionally, it should be noted that if administrators are well versed in Group Policy Preferences, then Item Level Targeting feature can be used to usually avoid Block Inheritances and subsequent enforces.

That’s because you’re specifically targeting WHICH users or computers should get whatever setting you want. (Note that PolicyPak ALSO hooks into the Group PolicyPreferences Item Level Targeting as seen in this demo https://www.policypak.com/videos/sn6j7q1clmq.html. So in this way you don’t have to have lots of weird design just to manage applications’ settings via Group Policy).

So, Mads, I think basically you answered your own question. You saw that having lots of blocking and enforcing cannot be good. But you also saw (I think) that there would be some times where you couldn’t architect around it.

I hope this article helps you and others out.

Thanks !

I created a video this morning, because I got a request from fellow GPanswers.com team member like you — Thomas P from Massachusetts.

He wanted to know the answer to a common question, which I demonstrate in my ONLINE and LIVE Group Policy classes (www.GPanswers.com/training.)

Next one: Denver, CO – Aug 12 – 16th !

He wanted to learn how to deliver IE Favorites using Group Policy. Well, Thomas P (and all the Thomas P’s out there who wanted to know) .. Here’s the video (sends you to YouTube):

http://www.youtube.com/watch?v=wzfqEKaF9Gw

Next: To see some other amazing stuff you COULD be doing with IE, here’s a second video:
https://www.policypak.com/products/manage-internet-explorer-using-group-policy.html

Final thoughts for the day: It’s not too late to sign up for Denver for August. We DONT have unlimited seats (duh).

And you’ll be able to FINALLY learn the RIGHT WAY to transition from XP to Win7 or 8 without blowing up the network or looking like a dufus (or is it doofus?)

Regardless: You don’t want to look like one.

So, get your act together, get the training you need, and see you in Devner. (For Pete’s sake, or, really, for your own sake.)

www.GPanswers.com/training.

(Course outline and pricing and stuff is right there.)

Team,

Here’s an email I got in my inbox yesterday *AND* it was asked in my live Chicago class (25 awesome administrators, pumping their brains full of GP goodness.)

When two people ask the same question in the same day .. here’s the question and the answer.

”

Hey Dr. M. – have a good one for you.
When I try to rename a Policy in GPM, the ‘t’ on my keyboard does not type, the arrow keys do not function, & the Backspace key does not function..
I have no special program running with regards to the keyboard. I run a MS keyboard/mouse hardware.
This ONLY happens when I’m in GPMC… it does not happen when in AD Users & Computers.
Any idea? Have you see this before?
Just asking.
Thanks
Regards,
[Name Redacted Because I forgot to ask permission]
”

Answer:
First, thank you for referring to me as my proper name, “Dr. M.” ?

Next, yes, I do know the answer. I’ve got a Doctorate in Group Policy-ology now for 10 years.

Your pain is caused by a bug in the MMC code. There’s been a hotfix pill you can swallow.

It’s for Server 2008 R2 SP1 and also Windows 7 SP1.

I posted about it when it happened, but, I’m guessing maybe not everyone got the memo.

Take one of these and call me in the morning: http://support.microsoft.com/kb/2466373

PS: It works like a champ for me and I instantly put it on every Windows Server 2008 R2 SP1 and Windows 7 SP1 machine I build.

I hope it helps you out !

Your GP Doc..

-Jeremy Moskowitz, Enterprise Mobility MVP
Founder PolicyPak Software
www.PolicyPak.com

Microsoft has released its “Latest, Greatest” ADMX files which work on all GPMCs (from Windows 7 and later).

They’re downloadable here: http://www.microsoft.com/en-us/download/details.aspx?id=36991

I’ve put together a video to help you check it out and understand it. It’s here: 

PS: PolicyPak also uses the Group Policy Central Store. So, if you’d like to see a video for how we do that, here ’tis: https://www.policypak.com/videos/sph1irhpgdm

Troubleshooting Group Policy often makes you feel like you’re forced to “go at it alone.” You can feel a little helpless when customers are being nasty toward you, and you’re confused about where to start.

So it’s no surprise that when people come to my live Group Policy Master classes, one BIG THING they want is strategies on how to best troubleshoot Group Policy.

(Next live class: Chicago, Monday March 25 – March 29th) – www.GPanswers.com/training

Answer: There is no silver bullet toward Group Policy troubleshooting. There is a “holistic approach” to Group Policy troubleshooting, but that takes more hands-on time (which you’d get with me if you come to class. ? ) But for now, here are some base-hit  things which you can do if you’re stuck and in a rut.

Check for disabled GPOs: If the GPO is disabled or half the GPO is disabled, you need to hunt it down. Maybe someone decided to disable a GPO link and didn’t tell you?

Understand Inheritance: Between local, site, domain, and multiple nested OUs, it can be a challenge to locate the GPO you need to fix.

WMI Filters getting in the way?: Introducing WMI filters can make troubleshooting even harder. Don’t know what WMI filters are? Maybe you have ’em and don’t even know it.

Permissions problems: Ensuring that users and computers are in the correct site, domain, and OU is one battle; however, ensuring that they have the correct permissions to access GPOs is quite another.

Different processing between different OS (XP / 7/ 8 / WS 08 / WS12): Need I say more?  You HAVE to learn the differences here, or you will be bit on the ass when you needed to have this knowledge at your fingertips (but didn’t have it.)

Replication problems: The health of the GPO itself on Domain Controllers is important when hunting down policy settings that aren’t applying.

Infrastructure problems: Group Policy processing requires that all pieces of your infrastructure are healthy, including such seemingly unrelated pieces as DNS, the services running on the client, and the ability to pass network protocols between clients and domain controllers. Good Active Directory design equals good (consistent) Group Policy processing. The first place to look when Active Directory (or replication) behaves strangely is DNS. As my good friend Mark Minasi likes to say, “The second place to look for replication problems is DNS, too.” That’s because problems with Active Directory almost always result from the DNS misconfiguration.

Loopback policy processing: Sometimes, by mistake, an administrator has enabled loopback policy processing for a computer (or multiple computers). When this happens, the user sees unexpected behavior because the GPOs that would normally apply to him are suddenly out of the ordinary. Getting a full grasp on how loopback policy processing works is very, very tricky. Not only do we have two different modes (Replace or Merge), on top of that you can have complex permission settings on the GPOs themselves, making it hard to calculate which settings a given user will take on.

Slow links: You’ve got a VPN for your Windows users or you’ve rolled out DirectAccess for a seamless VPN experience. Now how and when are your clients going to process GPOs? Well, it depends. If you’re seeing inconsistent behavior, this could be why.

Hopefully, this gives you a little shortcut if you’re stuck. So, again, the best way to get smarter in this stuff is to NOT go at it alone.

Take the class, for the love of Pete and get the secret weapons you need to solve the serious Group Policy problems you already have. With hands on labs, you’ll be pre-prepared before your next problem actually bubbles up.

Again: Next live class: Chicago, Monday March 25 – March 29th.  https://www.gpanswers.com/training

This will be my last one for some time – I guarantee it. If you miss this one, you literally won’t be able to take a class from me for a long, long time.

Sign up online or call 302-351-4903 and talk with Jackie and you can use a PO. Discounts for 4+ students in the same class.

See you there.

Jeremy Moskowitz

GPanswers.com (Group Policy Community)

PolicyPak.com    (PolicyPak Software)