Loading ...

Category: Group Policy

File Server Audit Logging via Group Policy

Recently going through the HIPAA compliance standards and dealing with “accidentally” deleted items on a file share has lead to a need for a standard file server audit logging policy that can be deployed to all servers via Group Policy Object (GPO). Here is the summation of my research:

File Server Audit Logging Policy GPO

1. Create a GPO and name it File Server Audit Policy
2. Set the following settings to enable advanced features and disable shutdown:

[Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\]
Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings – Enabled
Audit: Shut down system immediately if unable to log security audits – Disabled

3. Move down the tree structure to the following and edit these various auditing settings:

[Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\]
Account Logon: Credential Validation – Success and Failure
Account Management: Computer Account Management – Success
Account Management: Other Account Management Events – Success and Failure
Account Management: Security Group Management – Success and Failure
Account Management: User Account Management – Success and Failure
Detailed Tracking: Process Creation – Success
Logon-Logoff: Logoff – Success
Logon-Logoff: Logon – Success and Failure
Logon-Logoff: Special Logon – Success
Object Access: File System – Success
Policy Change: Audit Policy Change – Success and Failure
Policy Change: Authentication Policy Change – Success
Privilege Use: Sensitive Privilege Use – Success and Failure
System: IPsec Driver – Success and Failure
System: Security State Change – Success and Failure
System: Security System Extension – Success and Failure
System: System Integrity – Success and Failure

4. Change the following Maximum Log Size (KB) settings according to http://support.microsoft.com/kb/957662:

[Computer Configuration\Administrative Templates\Windows Components\Event Log Service\Security\]

5. Open the Properties of the shared folder needing Auditing, click on Security tab and then on the Advanced button
Folder Security Properties Page
6. Click on the Auditing tab, if there is UAC prompt then click Continue and then click on the Add button

Folder Advanced Security Settings
7. Click on Select Principal, search for the Everyone security group and then click on the OK button
8. Change the Type to All, click on Show advanced permissions, check the boxes next to “Delete subfolders and files” and “Delete” and then click on the OK button
File Server Audit Logging Entry
9. Put a check next to “Replace all child object auditing with inheritable auditing from this object then click on the OK button
If your company is using a Windows Server for network file access and need help getting the File Server Audit Logging setup property for HIPAA compliance, then contact us for assistance.

Terminal Server Lockdown Group Policy

Recently have had to setup a couple terminal servers and wanted to create a list of standard lock downs that can be added via a Terminal Server lockdown Group Policy Object (GPO).

Terminal Server Lockdown Preparation

1. Open Active Directory Users & Computers
2. Create Organizational Unit (OU) for Terminal Server.
3. Move all terminal servers to this OU.
4. Create Security Group in this OU for users who will use Remote Desktop Host (i.e. Terminal Server Users).
5. Add all users who will use the terminal server as members of this security group. 6. Open Group Policy Management, right click the new Terminal Server OU and “Create a GPO in this domain, and Link it here” (i.e. Terminal Server Lock Down).
7. In Security Filtering delete Authenticated Users, add Terminal Server Users security group created in previous step.

Configure users who can connect to the server remotely:

1. Log into the terminal Server
2. Open Control Panel, open System, click on Remote Settings then click on the Remote tab.
3. Click on Select Users, Remove any groups/users and then Add the Terminal Server Users security group.

Disable Server Manager Pop Up at user log on:

1. On Terminal Server open Task Scheduler.
2. Navigate to Task Scheduler Library\Microsoft\Windows\Server Manager.
3. Disable task “ServerManager” which triggers at log on of any user.

Configure Group Policy for Terminal Server Lock Down:

Loopback Processing:

[Computer Configuration\Policies\Administrative Templates\System\Group Policy]

Configure user Group Policy loopback processing mode: Enable – Merge

Disable Control Panel Items:

[User Configuration\Policies\Administrative Templates\Control Panel]

Hide specified Control Panel items: Enable

Add following items to the disallowed Control Panel items:
Microsoft.AdministrativeTools
Microsoft.AutoPlay
Microsoft.ActionCenter
Microsoft.ColorManagement
Microsoft.DefaultPrograms
Microsoft.DeviceManager
Microsoft.EaseOfAccessCenter
Microsoft.FolderOptions
Microsoft.iSCSIInitiator
Microsoft.NetworkAndSharingCenter
Microsoft.NotificationAreaIcons
Microsoft.PhoneAndModem
Microsoft.PowerOptions
Microsoft.ProgramsAndFeatures
Microsoft.System
Microsoft.TextToSpeech
Microsoft.UserAccounts
Microsoft.WindowsFirewall
Microsoft.WindowsUpdate
Microsoft.DateAndTime
Microsoft.RegionAndLanguage
Microsoft.RemoteAppAndDesktopConnections
Install Application On Remote Desktop Server
Java
Flash Player

Remove Administrative Tools and Powershell:

Restrict access to Administrative tools:

1. Navigate to:

[Computer Configuration\Policies\Windows Settings\Security Settings]

2. Right click on File System, choose Add File… .
3. In the Add a file or folder window, type the following in the Folder field and click OK:

%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Administrative Tools

Terminal Server Lockdown - Folder Security Settings
4. On the next window, Database Security, remove Users and check that Administrators have Full Access.
Database Security for Server Manager.lnk
5. On the Add Object window choose Configure this file or folder then Propagate inheritable permissions to all subfolders and files then click OK.
Terminal Server Lockdown - Add Object
6. Repeat the above steps for the PowerShell shortcut (in addition delete Creator Owner in database security):

%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\System Tools\Windows PowerShell.lnk

7. Repeat the above steps for the Server Manager shortcut:

%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Server Manager.lnk

File Explorer Configuration:

[User Configuration\Policies\Administrative Templates\Windows Components\File Explorer]

Enable – Restrict A, B, C and D drives only: Hide these specified drives in My Computer

Enable – Remove Hardware tab

Enable – Hides the Manage item on the File Explorer context menu

Enable – Remove Security tab

Disable Registry Modification:

[User Configuration\Policies\Administrative Templates\System]

Enable – Prevent access to registry editing tools

Configure Windows Installer and Windows Updates:

[Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Installer]

Enable: Prevent users from using Windows Installer to install updates and upgrades

Enable Always: Turn off Windows Installer

[Computer Configuration\Administrative Templates\Windows Components\Windows Update]

Enable: Do not display ‘Install Updates and Shut Down’ option

[Computer Configuration\Administrative Templates\Windows Components\Windows Update]

Enable: Do not display ‘Install Updates and Shut Down’ option

Disable: Allow non-administrators to receive update notifications

Additional Policies:

[Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits]

Enable (i.e. 30 minutes): Set time limit for disconnected sessions

[Computer Configuration/Policies/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Connection/Remote Desktop Session Host/Session Time Limits]

Set time limit for logoff of RemoteApp sessions: Enable (i.e. logoff delay 1 hour)

[Computer Configuration/Policies/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Connection/Remote Desktop Session Host/Session Time Limits]

Set time limit for active but idle Remote Desktop Services sessions: Enable ( i.e. 1 hour)

[User Configuration/Policies/Administrative Templates/Start Menu and Taskbar]

Go to the desktop instead of Start when signing in or when all the apps on a screen are closed: Enable

[User Configuration/Policies/Administrative Templates/Start Menu and Taskbar]

Remove the Action Center icon: Enable

[User Configuration/Policies/Administrative Templates/Windows Components/Windows Update]

Remove access to use all Windows Update features: Enable (0 = Do not show any notifications)

[User Configuration/Policies/Administrative Templates/Windows Components/File Explorer]

Remove CD Burning features: Enable

[User Configuration/Policies/Administrative Templates/Windows Components/File Explorer]

Prevent access to drives from My Computer: Enable (choose the drives)

[User Configuration/Policies/Administrative Templates/Windows Components/Credentials User Interface]

Do not display the password reveal button: Enable

[User Configuration/Policies/Administrative Templates/Windows Components/AutoPlay Policies]

Turn off Autoplay: Enable (CD-ROM and removable media drives)

[User Configuration/Policies/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Connection]

Do not allow passwords to be saved: Enable

For detailed explanations of what each of these items does please see the notes in each individual Group Policy setting.

Group Policy Deployed Printer Preferences

This was an interesting find for me as I had not thought of changing Group Policy deployed printer preferences for a printer that was deployed via Group Policy. A client wanted to have the default for their multi-function printer to be set to black & white printing. As this is a printer deployed via Group Policy, changing the preferences in Devices & Printers did not do the trick. Instead it took the following:

Making changes to Group Policy deployed printer preferences

1. Open the Print Management Administrative Tool
2. Expand Print Servers and then expand the print server
3. Click on Printers, right-click on the printer to be changed and then choose “Set Printing Default…”
4. Make the needed changes to the preferences then click OK button.
If your company is using Group Policy to deploy printers or needs any help troubleshooting network printers, then contact us for assistance.

Deploying Adobe Acrobat DC Cloud Edition

Had a school that bought the cloud licensing for Adobe Acrobat DC and wanted help deploying Adobe Acrobat to the workstations on their network. Began the process by creating an MSI based package with the Adobe Cloud Packager for deployment via group policy, but the deployment failed. Found that this is a known issue with Adobe Acrobat DC and can only be solved by running a script instead:

Creating Script for Deploying Adobe Acrobat DC Cloud Edition

Open an administrative command prompt

Change directory to – [Package Location]\Exceptions\APRO15.0en_US\Adobe Acrobat\

Run the following – Setup.exe /sALL /extUI /sl “en_US” /msi INSTALLDIR=”” EULA_ACCEPT=”NO” SUITEMODE=1 OWNERSHIP_STATE=1 LANG_LIST=”en_US” INSTALLLEVEL=101 AS_DISABLE_LEGACY_COLOR=1 IGNOREAAM=1

Open the application then Sign In to Adobe Cloud

Paste Product Key into the prompt that opens

This was found after some deep research into the Adobe Support site. Once you have tested these line of code then a batch file can be created for deploying Adobe Acrobat DC via Group Policy.

If your company is using Adobe Acrobat DC and needs help deploying Adobe Acrobat DC to network workstations, then contact us for assistance.

DFS Folder Redirection Engineering

A huge thanks to Joseph Moody from DeployHappiness for these wonderful guides on how to deploy DFS Folder Redirection in an organization using Distributed File Services as a methodology for file sync between sites. I made some modifications to the DFS Replication to use site link costing and fail back for the remote sites to avoid the multiple data target issues seen in his notes.

Three Part DFS Folder Redirection Series

If your company is thinking about using DFS Folder Redirection or needs help planning out multi-site server network topology, then contact us for assistance.

Demote Windows Small Business Server

Since Microsoft is no longer making Small Business Server (SBS) as the complete package for the SMB client, it is time to migrate email to Office365 and put in a Windows Standard Server in its place. This will explain the details of how to demote Windows Small Business Server from the domain after email has been migrated, the new server should already be in place and it should be running the appropriate server service and Flexible Single Master Operation (FSMO) roles would already be migrated.

One Last Check

  • Open a Command Prompt

  • Type in – netdom query fsmo

  • Make sure that all roles are pointing to the new Domain Controller

Uninstall Exchange

  • Open Control Panel

  • Double Click on “Programs and Features” icon

  • Search the list and find the entry named something like “Microsoft Exchange Server…” right click on it and choose “Uninstall”

  • Click “Next >” button then uncheck all possible boxes then click “Next >” button

  • Once the prerequisites have cleared successfully, click “Uninstall” button

  • Finally click “Finish” button

Remove AD Certificate Services

  • Click Start button, click Administrative Tools, and then click Server Manager.

  • Click on Roles, then in the Roles Summary section, click Remove Roles.

  • In the Remove Roles Wizard, click “Next >” button

  • Clear the “Active Directory Certificate Services” check box, and then click “Next >” button

  • On the Confirm Removal Options page, review the information, and then click “Remove >” button

Demote Windows Small Business Server and Remove from Active Directory

  • On the Source Server, click Start button, click Run, type dcpromo, and then click “OK” button

  • Click “Next >” button twice. (WARNING: Do not select “Delete the domain because this server is the last domain controller in the domain.”)

  • In the Summary dialog box, you are told that Active Directory Domain Services (AD DS) will be removed from the computer and that the server will become a member of the domain. Click “Next >” button

  • Click “Finish” button and the Server will restart

  • After the Server restarts, it can then be removed from the domain into a workgroup and disconnected from the network.

To remove the Source Server from Active Directory Domain Services

  • On the new Domain Controller Server click Start button, click Administrative Tools, and then select Active Directory Users and Computers.

  • In the Active Directory Users and Computers navigation pane, expand the domain name, expand MyBusiness, expand Computers, and then expand SBSComputers.

  • Right-click the old Server name if it still exists in the list of servers, click Delete, and then click Yes.

  • Verify that the Source Server is not listed, and then close Active Directory Users and Computers.

To update the Software Updates Group Policy Object

  • On the Management Server, click Start, click Administrative Tools, and then click Group Policy Management.

  • On the User Account Control dialog box, click Continue.

  • In the Group Policy Management console, in the navigation pane, expand Forest:DomainName, expand Domains, expand DomainName, and then expand Group Policy Objects (GPO).

  • Click Update Services Server Computers Policy.

  • In the results pane, click the Scope tab.

  • In the Security Filtering section, click the object that begins with “S-1-5…” This is the old Server Security Identifier (SID).

  • Click Remove, and then click “OK” button

If your company is migrating to Office 365 and needs help to demote Windows Small Business Server, then contact us for assistance.

Group Policy Preferences Desktop Internet Shortcut

There are often times that shortcuts are needed on all users or a specific subset of user’s desktops, which is where Group Policy Preferences Desktop Shortcuts come in. Here is how to create a simple internet shortcut for a particular website:

Create a Group Policy Preferences Desktop Internet Shortcut

  1. Login as an administrator.
  2. Go the the start screen and type “Server Manager”.
  3. In the Tools menu select “Group Policy Management”
  4. Find / Create the Organizational Unit (OU) in the domain containing the target computers
  5. Right click on the OU and select “Create a GPO in this domain, and Link it here…” to create a policy and link in to that OU.
  6. Right click on the new policy and select “Edit..”
  7. Navigate through the tree structure as follows:

    Computer Configuration — > Preferences — > Windows Settings — > Shortcuts

  8. Highlight Shortcuts and on the right pane, right click and select New then select Shortcut
  9. In the ‘New Shortcut Properties’, make the following changes so the values look like below:

    Action: Update
    Target type: URL
    Location: All Users Desktop
    Target URL: [Full Website Address]

  10. Close the “Group Policy Editor”
  11. Restart the client and once logged in with a domain user, the desktop would have the new Internet shortcut

    12. If your company is needs help creating Group Policy Preferences Desktop Shortcuts or help with Group Policy in general, then contact us for assistance.

Archives

Categories

Plant a Seed @ 541-761-9549
233 Rogue River Hwy #873 Grants Pass, OR 97527
Mon-Fri: 9:00am-5:00pm
support@farmhousenetworking.com
© 2016-2023- Farmhouse Networking. All rights reserved
Terms and Conditions Privacy Policy

Evaluation Signup

[contact-form-7 id="452" title="Free Network Evaluation"]