In a domain-joined networked environment, we always need to restrict users’ access to most PC settings and resources. It is necessary to do so for security and safety reasons. One crucial restriction that we always need to apply is to deny users access to PC Settings and Control Panel. And that is what this article is about. More specifically, this article covers the detailed steps to preventing users’ access to the Control Panel and PC Settings using Group Policy on Windows Server 2022.

In our example, our domain controller machine runs Windows Server 2022, on which we create the group policy. We create an Organization Unit (OU) level group policy directly on the (OU) that contains the users to which we apply the policy.

You may also like to read Install Active Directory On Windows Server 2022 Using PowerShell.

Steps to Deny Access to PC Settings and Control Panel

As we described in the scenario earlier, we create the policy that is linked to an OU, which contains the users to which we apply the restriction. We can create the group policy first and link that to the OU, or we can create the group policy directly on the OU. Either way ends up with the same result. However, we go with the second approach in our example. That being said, let’s go with the steps.

1. Press down the Windows key + R keys on your keyboard to open the Run dialogue box.
2. Type in gpmc.msc and press Enter to open the Group Policy Management console.

3. Right-click on the OU to which you want to associate the group policy. Then, select Create a GPO in this domain,… option.

4. Put a name for the Group Policy Object (GPO) in the relevant box, and click OK.

5. Once the GPO is created, right-click on it, and select Edit from the context menu.

6. On the Group Policy Management Editor window, expand Policies under User Configuration. Then, expand the Administrative Template and click on Control Panel. Finally, double-click on Prohibit access to Control Panel and PC settings.

7. On the configuration window, check the Enabled option. Then, click OK, and close the Group Policy Management Editor window.

To this end, we have created the group policy to prevent users’ access to the Control Panel and PC settings. We created it directly linked to the OU that contains user accounts that we want to restrict. So, it is all done. To verify it, go with the next section.

Verifying the Above Group Policy Configuration

To check the above restriction, we need to log in with a user account that is a member of the OU to which we linked the group policy. Then, we update the group policy and try to open the Control Panel and PC Settings. See the below steps.

1. Login to the client’s computer with a user account that is a member of the OU to which you linked the restriction.
2. Run gpupdate /force in the Run dialog box to perform group policy updates. Wait for a while until the group policy completes.

3. Once the group policy gets updated, try to open the Control Panel or PC Settings. It doesn’t open, and you will face the pop-up window shown in the below pic.

That is all we need to do to check how the restriction we configured works and if it is applied correctly.

Conclusion

It is a common setting in a domain environment to deny users access to the Control Panel and PC settings. It is essential for security and safety reasons. As the steps discussed above, we can apply this restriction simply by defining and configuring a group policy object to an OU that contains the target users.

In the end, I hope you found this article helpful. Do not hesitate to share your thoughts and queries in the comment section.

The post Deny Users Access to PC Settings and Control Panel using Group Policy appeared first on TECHNIG.

System admins have the ability to prevent/block users’ access to all removable storage media drives. Such restrictions play an important role in the security and safety of a networked environment. And they are very common and most often used inside almost all organizations. Additionally, the tool that helps us create such restrictions is the Group Policy Management Console (GPMC). It is a feature that we add along with the AD DS role installation. That all being said, this article covers a step-by-step guide to preventing domain-joined users’ access to removable storage media drives using group policy in Windows Server 2022.

In our example, the domain controller machine runs Windows Server 2022 Standard. Additionally, we define the group policy directly on an Organizational Unit (OU) that contains the target users. So, we have already created an OU and moved the target user(s) into it.

You may also like to read DNS Server Guides and DHCP Server Articles.

Steps to Prevent Access to Removable Media

With the above scenario in mind, it is a straightforward process to prevent users’ access to removable media.

1. Press down the Windows Key + R on your keyboard. It opens the Run dialogue box.
2. Type in gpmc.msc and press the enter. It opens the Group Policy Management (GPM) console.

3. On the group policy management console, right-click on the OU that contains the target users. Then, select Create a GPO… from the context menu.

4. Type a name for the new GPO. Then, click OK to continue.

5. Right-click on the GPO that you created. Then, select Edit from the context menu.

6. On the GPM Editor window, expand User Configuration -> Administrative Templates -> System. Then, select the Removable Storage Access folder as shown in the below picture. Finally, double-click on All Removable Storage classes: Deny all access.

7. On the GPO configuration window, check the Enabled option. Then, click OK and close the GPM Editor window.

8. The GPO configuration is all set throughout the previous steps. However, it will affect only after we perform a group policy update on the client machine or restart it. So, to perform a group policy update, use gpupdate /force the Command Prompt or Run dialogue box.

9. Now, if you insert a removable media like a USB drive and try to open it, you will face an error saying the media is not accessible.

That is all with the steps to deny users access to removable storage media using group policy.

Conclusion

To conclude this article, first, we talked about the importance of restricting users’ access and discussed the Group Policy Management tool. Then, we briefly introduced our scenario. Lastly, we covered detailed steps to prevent users’ access to removable storage media.

In the end, as always, I hope you find this article helpful. And feel free to share your thoughts and queries in the comment section.

The post How to Prevent Access to Removable Storage Media Using Group Policy? appeared first on TECHNIG.

Server Manager automatically launches by default on most of the Windows OS for servers including Windows Server 2022. The Server Manager is, of course, a very important management console, but it might be disturbing to pop up automatically at login. It is also present on the start menu by default and we can easily launch it anytime needed. This article discusses three simple methods to disable Server Manager auto-launch on a single server. These three methods are only for an individual server. Additionally, the article includes how to disable Server Manager auto-launch in Windows Server 2022 for a number of specified servers in an environment.

Method 1: Using Server Manager

The first and by far the easiest method to disable The Server Manager auto-launch on a single server is to use the server manager itself. Follow the below easy steps to do so.

• Open Server Manager console. To do so, open the start menu and click on Server Manager as shown in the below picture illustration. You can also open using the command servermanager in the Run dialogue box.

• On the Server Manager window, click on Manage and choose the Server Manager Properties option from the list. Then, check out the Do not start Server Manager automatically at logon checkbox and click on OK.

As simple as that! The next time you log in, the Server Manager will not automatically pop up.

Method 2: Group Policy Editor

The second method to disable Server Manager auto-launch at logon in Windows Server 2022 is by using the Local Group Policy Editor. The simple steps are listed below.

• Open Local Group Policy Editor. To do so, press down the Windows Key + R on your keyboard to open Run. Type in the command gpedit.msc and enter or click on OK as shown in the below picture. You can also searchedit group policyat the start, and click on it when appeared.

• On the Local Group Policy Editor window, expand the Administrative Templates folder under Computer Configuration. Then, expand the System folder, and go all the way down to find Server Manager. Now, select this folder and double click on Do not display Server Manager automatically at logon option.

• On the properties window for the abovementioned option, check out the Enabled option. Click on OK afterwards.

That is all with the second method. We disabled Server Manager auto-launch in Windows Server 2022 using the local group policy editor. Now, let’s see the third method.

Method 3: Task Scheduler

The third method to disable Server Manager auto-launch in Windows Server 2022 is by using Task Scheduler. Let’s straightly walk through the steps to do so.

• Open Task Scheduler. To do so, press down the Windows Key + R to open Run. Put in thetaskschd.msc command and press enter key or OK button as shown in the below picture. Another way to open the Task Scheduler is to right-click on Start, choose Computer Management, and select Task Scheduler. Both ways end up in the same window.

• Now, expand the Task Scheduler Library folder. Then, expand Microsoft and consequently the Windows folder. Scroll down and find the Server Manager folder. Select this folder. On the central pane, right-click on the ServerManager option and click on Disable as shown in the below picture.

When it is done successfully, close the Task Scheduler window. We are all done with disabling Server Manager auto-launch in Windows Server 2022 using Task Scheduler.

As mentioned at the beginning, these three methods are only for individual servers. That means, that when you want to disable Server Manager auto-launch for a single server, you make use of one of these methods. To disable Server Manager auto-launch at logon for a set of servers in an environment, read the next section of the article.

Disabling Server Manager Auto-Launch for a Group of Servers

To disable Server Manager auto-launch for multiple servers in an environment, we must have an Organizational Unit (OU) containing all those target servers. We can define a group policy to disable the Server Manager auto-launch for the whole objects (in this case, servers) residing in that OU. The below steps explain the whole process.

• Log in to the Domain Controller (DC).
• On the Server Manager console of the DC, click on Tools and select Group Policy Management.

• Now, we have an OU named Servers. This OU includes all the servers to which we apply the policy. Read How To Create Object In Active Directory if you do not know what it is and how to create one.

• Enter a name for your GPO and click on OK.

• Now, you can see that the new GPO pops up at the right pane. Right-click on it and select Edit.

• Expand the Policies under Computer Configuration. Expand the Administrative Templates, and System folder consequently. Find the Server Manager and select it. Open Do not display Server Manager automatically at logon at the right pane.

• Check out the Enabled option and click on OK to apply.

We have defined our OU-level policy to disable Server Manager auto-launch, and it applies to all the servers in that OU.

Summery

To summarize this article, we discussed various methods to disable Server Manager auto-launch in Windows Server 2022. These methods work on most of the Windows Os for Servers. We discussed three methods to disable Serven Manager auto-launch for an individual server. Then we went through discussing a way to accomplish this task for multiple Servers in a networked environment.

It is encouraging for me if this article is helpful to you. If there is any further question, make sure to share them in the comment section.

Relate Articles:

• How To Create And Configure Storage Pool On Windows Server 2022
• Install And Configure Active Directory In Windows Server 2016 Step By Step Guide
• Quick Installation Of Hyper-V On Windows 11 And Windows Server 2022

The post How to Disable Server Manager Auto-Launch in Windows Server 2022 appeared first on TECHNIG.

Here you just learn about backup and restore Group Policy Object in Windows Server 2016 and Windows Server 2019. This method works the same for other Windows server as well. Group policy objects backup will helps you protect GPOs configuration. It is easy to create and edit group policy object from Group Policy Management on Windows Server. But takes to much time to completely configure the settings of each GPOs. Having a backup save you time and effort to reconfigure settings of a new GPO.

Backup and Restore Group Policy Object

To back up the created GPO in Windows Server, navigate to Group Policy Management console from server dashboard or type ‘gpmc.msc‘ in windows run and then press enter to open the Group Policy Management Console.

1. Type “gpmc.msc” on run and press enter to open the group policy management console.
2. Expand the domain and your domain name.
3. Now, expand the Group Policy Objects to see all GPOs created by you.

4. In Group Policy Management expand the domain name and group policy objects in order to see all created objects.

5. To create a backup from all GOPs, right-click the Group Policy Objects and click Back up all. 

Remember, this will backup all modified and non-modified GPOs which you have created for the domain. The other configuration like linked objects, Enforced, and Block Inheritance to domain organizational units will not back up. The full configuration back up just done a full system back up with Windows backup services.

6. Now in Back Up Group Policy Object page, click Browse and choose wherever to want to save backups and type some description in the description box, then click Back Up button.

7. Good, the backup task was accomplished successfully. Let’s check how do we can restore the deleted GPO from backup data.

Restore Group Policy Object

To restore GPO, right-click the Group Policy Objects and click Manage Backups. In the Manage Backups page brows to the backup directory or location on the hard disk.

You see backup contents in GPO backup folder. But if you want to restore a policy object, select GPO and click Restore button.

Click OK, if ask you ‘Do you want to restore the selected backup? and selected backup will restore the Group Policy Objects.

Now you can link and apply it to your OUs in your domain.

Hope this helps you solve the backup and restore of group policy object on Windows server. If you have any issue, just write us in the comment box.

The post Backup & Restore Group Policy Objects in Windows Server 2016 appeared first on TECHNIG.

The articles is going to explain how to convert exe to msi format? There is no any specialized built-in tool in Windows to convert exe to msi for installing software with Group Policy. Software deployment through Group Policy in Windows Server required Microsoft Installer (msi) file format. Most application are exe file, but it’s not supported by group policy to deploy on clients machines on the network.

Here are some free and paid software that help you to convert exe to msi files easily and make deplorable through group policy. The free versions of these software are has limited features, but the premium versions are full features for enterprise software deployment.

How to Convert Exe to MSI Package?

The below software make your work easy when you need to change Exe to MSI format. Just download and install one of these tools and try to covert exe to msi package.

The MSI Wrapper tool let you how to convert exe to msi package of any exe software. Go to exemsi site and download the free version of MSI Wrapper. It specialize in converting executable setup programs to MSI packages.

System administrators often prefer MSI over a normal setup.exe. MSI packages are better suited for software distribution through Active Directory group policies.

The target audience for this web site and it’s tools is divided in two main groups:

• Software developers who have a setup.exe and want to offer an MSI that wraps their original setup.exe.
• System administrators with a setup.exe they want to distribute as an MSI to client computers in their organization.

The MSI Wrapper is the tool that makes it easy to convert an executable setup program to an MSI package.

1. Open the MSI Wrapper on Windows and click Next on the welcome page.

2. Select the exe software form Setup Executable input file name section. Select Windows Installer under Security context for launching the executable then specify the output location and click Next.

3. On the Application Ids page, look up for installed software on your computer. In this case I have testing on Internet Download Manager. Then click Create New to create an upgrade code and click Next.

The application id and upgrade code are needed to identify the installation packages when you upgrade and uninstall the software.

4. Click Next on Properties page.

5. You can specify a help link, update information link, about link, and contact information for this msi package. You can click Next without specifying any links.

6. On the Parameter page click Next. If you have pro version, you can do more with msi file.

7.  The summary page shows you what you have selected. Click Build to create the MSI file and click Exit to close the MSI Wrapper tool.

Finally, the exe file should converted to MSI file. Right click the output msi package and see the result.

That is all about how to convert exe to msi package to install software with Group Policy.

If this software is not help you to create msi package from an exe file. I recommend you to use Advanced  Installer.

This is a unified package containing the complete Advanced Installer application, which includes Freeware, Professional, For Java, Enterprise and Architect features. Freeware features can be accessed at any time by creating a project of type “Simple”.

Creating any other type of projects requires non-freeware features. These are fully enabled during the trial period, after which you must purchase a license to continue using them.

There more tools that help you to convert exe to msi. You might now better tools and let us know.

The post How to Convert Exe to MSI for Software Deployment? appeared first on TECHNIG.

Configure user account control behavior in Windows let you easily protect your system unknown behaviors. It helps prevent potentially harmful programs from making changes to your computer without any warring. If you don’t know about UAC and how it works, read the below short details from Technet.

What is User Account Control?

The User Account Control (UAC) is a security component that enables users to perform common tasks as non-administrators called standard users , and as administrators without having to switch users, log off, or use Run As Administrator. 

User accounts that are members of the local Administrators group run most applications as a standard user. By separating user and administrator functions, UAC helps users move toward using standard user rights by default.When an administrator logs on to a computer that is running Windows 10, the user is assigned two separate access tokens. Access tokens, which contain a user’s group membership and authorization and access control data, are used by the Windows operating system to control what resources and tasks the user can access. Read more about UAC.

Configure User Account Control behavior in Windows 10

Let’s do to configure user account control behavior in your Windows 10 and make sure your system is pretty enough secure.

1. On the Windows search type “UAC” and open the User Account Control. The default setting is on Notify me only when apps try to make changes to my computer. This level is not notify you when you bring any changes to your system. Because all Windows default programs are familiar apps to Windows.

If you need to bring changes to UAC settings, simply bring down or up the options and fix it for your system. Never put the option on Never notify me when system trying to install software and make changes on my system. It’s the worst option for any system. Versus the Never notify me, Always notify me is annoying you when normally work on Windows.

The below lists are the notifications window and icons colors or UAC.

• Blue background with a blue and gold shield icon: It notify when you run a Server administration tools to make any changes.
• Red background with a red shield icon: The app is blocked with Group Policy or is blocked the app publisher. It happens for unknown software publishers.
• Blue background with a blue shield icon: Notify for apps that trusted by local computer and signed by authenticated user.
• Yellow background with a yellow shield icon: Notifies for non-trusted by local computer and unsigned apps.

These settings and configurations are just for a single computer. But how to configure UAC on a large network with more than ten brunches.

Configure User Account Control with Group Policy

On a local computer or Windows server you can configure UAC settings through group policy. On single computer you only apply the settings for your own computer and users, but on Windows server you can apply to all users and computers of the network.

1. Type “gpedit.msc” on Windows run to open group policy editor on Windows 10 or other Windows client. But for Windows server type “gpmc.msc” to open group policy manager console and create a GPO then edit and make changes.

You can simply enable or disable the user account control. If you don’t know the basics of group policy manger or editor, read about group policy management.

Ask us, comment us and let us know your problems about User account control behavior on Windows server and Windows clients.

The post How to Configure User Account Control behavior? appeared first on TECHNIG.

Backup and restore Group Policy Objects in Windows Server will help you to protect GPOs configuration. It is easy to create and edit group policy object from Group Policy Management on Windows Server. But takes to much time to completely configure the settings of each GPOs.

How to Backup and Restore Group Policy Objects?

For backing up the created GPOs in Windows Server, go to Group Policy Management console from server dashboard or type ‘gpmc.msc‘ in windows run and then press enter to open the Group Policy Management Console.

In Group Policy Management expand the domain name and group policy objects in order to see all created objects.

To create a backup from all GOPs, right click the Group Policy Objects and click Back up all. 

Remember, this will backup all modified and non-modified GPOs which you have created for domain. The other configuration like linked objects, Enforced, and Block Inheritance to domain organizational units will not backing up. The full configuration back up just don by full system back up with Windows backup services.

Now in Back Up Group Policy Object page, click Brows and choose wherever to want to save backups and type some description in the description box, then click Back Up button.

So, the back up task has accomplished successfully. Lets check how do we can restore the deleted GPO from backup data.

How to Restore Group Policy Objects?

In order to restore GPO, right click the Group Policy Objects and click Manage Backups. In the Manage Backups page brows to the backup directory or location in the hard disk.

You see backup contents in GPO backup folder. But if you want to restore a policy object, select GPO and click Restore button.

Click OK, if ask you ‘Do you want to restore the selected backup? and selected backup will restore to the Group Policy Objects.

Now you can link and apply it to your OUs in your domain.

The post How to Backup and Restore Group Policy Objects? appeared first on TECHNIG.

It is better to have the same desktop background wallpaper on all users monitor. The ability of changing desktop background should be disabled the users will not be able to change his desktop background. Locally it is easy to change desktop background on Windows from desktop settings, but how to change desktop background with group policy management?

There are two ways to do this task in Windows Server. First one is using Group Policy, Administrative Template, Desktop Wallpaper, Setting and the next one is using Windows Registry within group policy Preferences Registry Key Wallpaper Configuration.

If you don’t know the basic of Group Policy Management, you must read this Step-by-Step Guide to Understanding the Group Policy Feature Set article.

Change Desktop Background with Group Policy

Note: Before applying this policy with group policy management, you must share the folder of wallpaper you want to set as desktop background. Assign changes for share permission and modify for security permission. Then apply the below step by step article to change desktop background using group policy. 

1. In Windows Server, just open the Group Policy Management from Dashboard of Server Manager, or type ‘Gpmc.msc’ in Windows Run and press enter.  Then create a GPO named Desktop Wallpaper or any name you want.

2. Right click the new created GPO and click Edit to open group policy editor.

3. Navigate to ‘User Configuration > Polices > Administrative Templates > Desktop > Desktop’ then double click the Desktop Wallpaper.

4. On the Desktop Wallpaper option, check the Enabled to enable the policy and set the universal naming convention (UNC) path of the shared picture you want to be display on as desktop background of clients computers then select Fill for Wallpaper Style.

5. Now apply the created GPO for your domain users and update the group policy with command ‘gpupdate /force /logoff’. 

Yes it works perfectly. You can see the Desktop background of Technig client on Windows 10. This wallpaper applied for all version of Windows and you can restrict users from bring changes to desktop background.

Change Desktop Background – Video Tutorial

Don’t you like to read more? Then see the short video tutorial about changing desktop background using Group Policy.

Finally, you can see the Windows registry for changes.

The policy apply this changes to desktop background through Windows Registry. You can see this changes on Registry like above screenshot.

The post How to Change Desktop Background with Group Policy? appeared first on TECHNIG.

This article shows you how simply you can redirect folder in Windows Server with group policy. The folder redirection is the way to keep a profile folders to a network location or other location in the local computer. Typically user profiles and settings are stored in local profile. By redirecting folders, you can  access to data regardless of which computers you are logs in.

So in this simple article, I’m going to do step by step process to redirect folder in Windows Server 2012 R2. It’s simple and easy, you can apply for all on Windows Servers with the same process.

Redirect Folder in Windows Server with Group Policy

This task will perform from Group Policy Management and will affect all computers on OU that applied the policy.

1. Open Group Policy Management from Dashboard  of Server Manager then click Tools > Group Policy Management.

You can open Group Policy Management by shortcut also. Type ‘gpmc.msc’ in the Run and press enter.

2. Now, expend the domain name in group policy management console and create a new group policy object.

3. To create  a new Group Policy Object (GPO) right click Group Policy Objects and click New.

Type a name for new GPO and click OK. The name must be related to Policy you want to create and use it.

4. To configure the policy, right click the newly created GPO and click Edit in order to open Group policy management Editor.

5. Now, go to Folder Redirection under User Configuration > Windows Settings > Folder Redirection. In this directory you see all redirect-able folders.

6. To redirect a folder, just right click the folder and go to Properties.

Here I’m trying to redirect Downloads folder to Redirected folder that is a shared folder in the Server DC1.

From the Setting of Downloads Properties select ‘Basic – Redirect everyone’s folder to the same Location. Select Redirect to the following location from Target folder location and set the shared folder location to the Root Path then click OK. 

Just click Yes the warning window and close the Group Policy Management Editor.

7. Now you can link this GPO to entire domain or just add it to a specific Organization Unit.

When you have accomplished all task successfully, update the Group Policy by typing ‘gpupdate /force’ in Run or Command Prompt.

8. Now check the Shared folder and see all redirected folders of a user.

Go to the client computer and check the properties of Download and Documents folders.

That’s all the redirect folder in Windows Server work perfect.

The post How to Redirect Folder in Windows Server 2012 R2? appeared first on TECHNIG.