EMCO Remote Shutdown and Setting Windows 8(.1) Remote Registry by Group Policy Object (GPO)

As I have mentioned in a previous blog post, several clients who have been using this software for several years with their fleets of Windows 7 desktops with great success. This however changed when testing during the Windows 8.1 deployment we found that it does not work for 8/8.1 this is due to the Remote Registry service no longer being enabled by default.

2014-08-11-RemoteRegistry-00-DisabledRegistry

Now rather than wanting to update the machines manually or to change the service status in the image, I wanted to start this service as this will ensure that all devices turn it on and when I or someone else creates a new image in future, it is one less thing to do. It turns out this is easier to do than I thought it would be.

First you need to open up “Group Policy Management“, find the policy you want to edit by expanding the appropriate trees (or create a new policy within the right scope), right click on it and select “Edit“. This is a computer policy so if like me you limit your GPO’s to work on only users OR computers (Best Practice), then make sure you select a computer enabled policy.

2014-08-11-RemoteRegistry-01-GPEDIT

 

Once you have opened the “Group Policy Management Editor” then you will need to navigate the tree (in the left hand column) to “Computer Configuration” > “Policies” > “Windows Settings” > “Security Settings” > “System Services” and then in the right hand column search out “Remote Registry“, double click on this to open the “Remote Registry Properties” box.

2014-08-11-RemoteRegistry-03-EditPolicy

In this box, select the “Define this policy setting” checkbox, which will then in turn enable the options below it, and you simply want to change the “Select service startup mode” radio buttons system to “Automatic

Now after a group policy update (which can be forced on individual machines via “gpupdate /force“, without the quotes) and a reboot, the machines will have the “Remote Registry” started and running

2014-08-11-RemoteRegistry-04-RegistryEnabled

 

Justin

Internet Explorer & Other Multi-Tab Group Policy Settings

So visiting a client today and I noticed that the group policy settings for Internet Explorer were not applying correctly, some settings were aplying, some not. After looking at the settings and the RSoP, I decided to take a look at the XML generated for the GPO, and that’s when I saw it… disabled=1, hello. Now the question is where did it come from, I know the GPO is working in other respects, and checking the XML confirms this, so I re-generate the settings, 5 minutes work but still no resolution, its still stating that it is disabled.

What is a IT professional to do, woe is me… Looking further into the situation I came across something I had long forgotten, and filed under “I will never need that”. What was happening or rather not happening was  I was not enabling the fields, specifically in a multi-tabbed setting you will see a red dashed line or a red “No” symbol (the same red border and line that you see everywhere something is prohibited, no smoking sign for example). As shown below

stopped symbol   Dashed Line

To enable the settings you need to hit one or more keys depending on how you want to do it, these keys are as outlined below

F5 – Enable all items on the Page/Tab
F6 – Enable Currently Selected item on Page/Tab
F7 – Disable Currently Selected item on Page/Tab
F8 – Disable all items on the Page/Tab

Once you have enabled the items you will get either a solid green line or a green OK symbol as shown below

green line  go symbol

 Once this was done, I simply forced an update of group policy, and viola, everything worked as it should once more

Moral of this story, its the things you think you don’t need, that ultimately you will need

Language Management GPO

Recently (Well a few months ago) a client asked me to install multiple extra keyboards, on multiple (300+) PC’s through the organization, needless to say I was not to exited to do that manually, looking for options I discovered that there is no GPO available for it, and although it can be done through registry modifications, that whilst useful is not overly effective, so I wrote a GPO, at the time as it was a 2003 domain I wrote it as an ADM file, however as I was then asked for a similar thing (different languages) at a client with a 2008 domain the ADM files were useless (and so is ADMX Migrator from Microsoft/Full Armor, I recommend and use PolMan and its ADM Template Editor from SysPro [http://sysprosoft.com/products.shtml]) I re-wrote it for ADMX, and implemented it at a few client sites.

Forward to yesterday, a fellow tech at another client site had been asked the same thing, and came to me for advice on making their job easier, recalling these templates I promised I would forward it to them, which I did just moments ago (after making a minor modification and re-generating the ADMX to include a little joke for them, yet the inclusion is still useful for others, great how that works out hey) anyway I had always planned to release it to the public however I never had done, getting this request has prompted me to do it, currently there are 10 languages in there, I plan to add support for a bunch more in future and at the same time give Administrators and easy way to set the default keyboard layout but that will not happen till I have some spare time as at this point no clients require that functionality, if they do I will add it sooner

In the mean time download the file here, please note however, that the system contains no warranty whatsoever and although has been tested to work on Windows XP it is by far from guaranteed it is designed to work on Windows Vista and Windows 7

To install it just place it in the C:\Windows\PolicyDefinitions folder on your domain controller and restart Group Policy Editor, the settings show up under User Preferences > Administrative Templates > Keyboards

You can pass this on to others, so long as the work is still attributed to me, although I suggest you just point others here as it will allow them to get the latest version as it is updated

 

 

 

%d bloggers like this: