Had an interesting question from a reader in response to setting a default printer with Group Policy Preferences that I thought I would share.

Question was:
If you set a user general default printer like the main office copier but also set a location printer preference like the library copier using the loop back policy will it over ride the general default printer preference?

Do I merge or replace?

I decided to test this out as I have not come across this. Here is what I found, if you have a User Policy that is creating a printer connection and setting it as the default and you also have, using Loopback Policy Processing in Merge Mode, another User Policy being applied, this will override the first User Policy Settings. Both printers will be installed, but the default printer will be set to the one specified in the policy that has the loopback.

Note: I tested this on a client that has no printers installed

If Loopback Processing is in Replace Mode then the User Settings in that policy will “Replace” the settings in the other policy. Therefore only one printer will be installed and it will be set as default.

Hope that helps.

Simple scenario, we have a group of Media students that need a drive mapped to a different “Media Backup Server”, so what I have done is put these students into and Active Directory Group called “Media Students”.

So in my Students GPO I simply went to User Configuration > Preferences > Windows Settings > Drive Maps

Right Click Drive Maps and select New > Mapped Drive Select Create from the drop down menu, enter the path to the share (eg. \\server\share ), I have created folders that relate to the students username therefore I used the %username% variable, select the Drive Letter.

Then from the Common tab up the top tick Item Level Targeting, from the New Item Menu select Security Group, make sure User In Group is selected in the bottom window and browse for the Security Group that the user must be a member of.

All Done, now all students that are a member of the Media Security Group will get an M Drive Mapped.

Cheers

Daniel Anderson
Loving Group Policy Preferences

Use Group Policy Preferences !!!

In the past I have used the Print Management Console to deploy the printers via Group Policy, now that did work very well, but there was still the “overlooked” problem of being able to set the default printer. To get around this what I used to do was to name the computers in a certain way and then have a vbs script that would get the name of the printer and then set the default based on the computer name.

I was reading an article by GPO Guru Derek Melber about the new Group Policy Preferences that come with Windows Server 2008 and Windows Vista and thought I would explore this option.

To start off your client will need the Group Policy Preference Client Side Extensions both XP and Vista Clients need these. Now you can manually download these and install via a computer startup script via Group Policy or if you have a WSUS Server then you can make this “Feature Pack” available via Windows Updates (this is the option I took, less work!).

Now that you have the Group Policy Preference Client Side Extensions installed on the clients, you can go ahead and play with the GPO’s. If you open up the Group Policy Management snap in and edit a GPO object you will see “Preferences”

After expanding “Preferences” you will notice an options there that says PRINTERS. If you right click on Printers and select New > Shared Printer, the New Shared Printer Dialog Box will appear.

From here we can enter in the path to the shared printer and from the Action drop down menu select “Create”, but the best part is that you can place a tick in the “Set this printer as the default printer” box and it will make that printer the default. Interesting thing to note here though is that this check box is only available under a User Configuration and not the Computer Configuration. This is not what I wanted, I need to set a default printer for computers in a specific room.

So what I have done in enable User Group Policy Loop Back Processing under the Computer Configuration > Policies > Admin Templates > System > Group Policy, you can either set that to Merge or Replace. Now what that does is enable you to apply User Configurations to users that log onto those computers that this policy applies to.

This is the Good Part

Once you have created a shared printer to deploy there is a tab on the properties of that called “Common” , if you click on that and place a tick in the “Item Level Targeting” and click on the Targeting Button a whole new world opens up!

Click on the New Item and just have a look at the possibilities there. The one I was interested in was the Organisational Units option. Because what I want to happen is if a computer is in a specific OU install and make printer X the default.

With this option I was able to achieve just that. Just select the OU that the Computer should belong to by using the Browse Button and select the Computer in OU radio box.

Job Done……

For More Tips on how you can use Group Policy Preferences make sure you SUBSCRIBE to my RSS Feed so you don’t miss out on making your life as a Network Administrator an easier one !!!

To kick things off you first of all need a PKI Infrustructure and enable autoenrollment so that all your wireless clients obtain the correct certificates for the authentication process.

1. Install the Active Directory Certificate Services (ADCS) Role to the server and just use the default settings here.

2. Next Open up the Group Policy Management Console and either edit a policy or create a new one to apply the wireless settings to your clients. The section we want is Computer Configuration\Policies\Windows Settings\Security Settings\Public Key Policies. In the details pane now you need to right click the Certificate Services Client – Autoenrollment and then select properties. In the Properties dialog box select enabled from the rop down box and then place a tick in the other boxes, which is optional.

Let’s now install and configure the Radius Server to handle the authentication. Install the Network Policy and Access Services Role. Once install you need to then navigate to the NPS Node in Server Manager, under Roles\Network Policy and Access Services.

1. In the Details Pane, from the drop down list under Standard Configuration select RADIUS server for 802.1x Wireless or Wired Connections and click Configure 802.1X Hyperlink.

2. Select the top radio button “Secure Wireless Connections” click next

3. On the Specify 802.1X Swtiches Page Add your Wireless Access Points and Radius Clients. You need to do this for each Access Point you have. When you click the add button fill out the Friendly Name, IP Address. For the Shared Seceret you can either enter one in manually or have one generated (which will then need to be entered into the AP’s), once all AP’s have been entered click next.

4. Next up Configure an authentication method. From the Drop Down list select the method you want to use. We were currently using Smart Card or Other Certificate and I wanted to change to Microsoft: Protected EAP (PEAP).

NOTE: This method requires a Computer Certificate and the Radius Server and either a computer or user certificate on the client machine. The best way to do this is to use a Domain PKI see above.

5. Select the groups you would like to give wireless access to.

6. Next configure VLAN Settings. You can use this to restrict Wireless users to specific network resources. Then click Finish.

7. You then need to Reegister the server with Active Directory. Right Click the NPS Node and select Register Server.

Configure Wirelss Clients to Connect Automatically……

1. There are a couple of Group Policy settings that you will need to adjust here to get your wireless clients to automatically connect to your network. Open up your Group Policy Management Console and navigate and right click Computer Configuration\Policies\Windows Settings\Security Settings\Wireless Network (IEEE 802.11) and select Create A New XP Policy. If you have both XP and Vista Clients then you will need to select this option as if there is no Vista Policy, Vista Clients will use the XP one.

2. Give the Policy a Name and Description and then click the Preferred Networks Tab. Click the Add Button and select Infrastructure.

3. Enter the SSID of your Wireless Network, then from the Authentication drop down box select WPA2 and from the enryption drop down box select TKIP.

4. Then click on the IEEE 802.1X Tab leave the EAP Type and PEAP and under Authentication Mode selct Computer Only. This means that the authentication will take place prior to the Computer getting to the Login Screen. This is what I wanted.

Auto Enrolling Computer Certificates Via Group Policy

The process above regarding the PKI Infrastrucure will auto enroll the Root Cert. But we also need to auto enroll a computer certificate which can be done like this.

1. Open up your Group Policy Management Console and navigate to Computer Configuration\Policies\Windows Settings\Security Settings\Public Key Policies\Automatic Certificate Request Settings.

2. Right Click in the details pane and select New > Automatic Certificate Request.

3. This will open up a wizard and you can select a Computer Certificate.

Now do a policy update on your client machines and they SHOULD automatically connect to your newly secured wireless network.

Hope this helps you out. Cheers

Daniel
Securing My Wireless Network

Here was the command I used:

dsquery user -inactive 40 -limit 0 | dsmod user -disabled yes

I know, I know pretty simple but something that is good to have in the tool kit. I then went on and did it using the computer accounts. Then from Active Directory Users and Computers snap in I could then create a query to lookup all the disabled user and computer account and eother delete them or move them to a temp OU before deleting.

Daniel Anderson
Cleaning up my Active Directory.