Marcus Hall

User Tools

Site Tools

Trace: • activedirectory
software:microsoft:windows:activedirectory

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
software:microsoft:windows:activedirectory [2020/09/17 15:41] – superwizardsoftware:microsoft:windows:activedirectory [2026/08/13 18:59] (current) – [Active Directory] superwizard
Line 2: Line 2:
  
 -------------------------------------------------------------------------------------------------------------------------------------------------\\ -------------------------------------------------------------------------------------------------------------------------------------------------\\
 +
 +====== Active Directory Group policy ======
 +Active Directory Group policy, we created a group policy for the entire domain. We defined: Computer Configuration, Policies, Windows Settings, Security Settings, Local Policies, Security Options, interactive logon: Message Text for users attempting to log on and interactive logon: Message title for users attempting to log on
 +
 +The message should appear **before the user enters Windows credentials**, not after reaching the desktop. On a typical Windows 10/11 console:
 +
 +  - Start or restart the computer.
 +  - Dismiss the initial lock screen or press Ctrl+Alt+Delete, if required.
 +  - The legal-notice dialog appears.
 +  - The user must click **OK**.
 +  - Windows then presents the normal username/password/PIN sign-in screen.
 +
 +It generally does **not** appear when merely unlocking an already signed-in session. Test using a full restart or sign-out, preferably from the computer’s physical console. Microsoft describes it as a dialog displayed before users can sign in. ([[https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on|Microsoft policy documentation]])
 +
 +===== Test it on one affected computer =====
 +
 +Open **Command Prompt as Administrator** and run:
 +
 +<code cmd>
 +gpupdate /target:computer /force
 +</code>
 +
 +Confirm that it reports:
 +
 +<code>
 +Computer Policy update has completed successfully.
 +</code>
 +
 +Then restart—not merely lock—the computer:
 +
 +<code cmd>
 +shutdown /r /t 0
 +</code>
 +
 +Test the next sign-in from the local console.
 +
 +===== Verify the resulting registry values =====
 +
 +After the policy refresh, run this in an elevated Command Prompt:
 +
 +<code cmd>
 +reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v LegalNoticeCaption
 +reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v LegalNoticeText
 +</code>
 +
 +You should see your configured title and message. These are the effective Windows settings:
 +
 +^ Policy        ^ Registry value       ^
 +| Message title | ''LegalNoticeCaption'' |
 +| Message text  | ''LegalNoticeText''    |
 +
 +If both values contain the expected text, Windows has received the setting. Restart and test at the console.
 +
 +If they are missing, empty, or contain different text, the GPO is not applying as intended or another policy is overriding it.
 +
 +===== Confirm that the GPO applies to the computer =====
 +
 +Because these settings are under **Computer Configuration**, they apply according to the location and permissions of the **computer account**, not the user account.
 +
 +Create a Group Policy Results report:
 +
 +<code cmd>
 +mkdir C:\Temp
 +gpresult /scope computer /h C:\Temp\ComputerPolicy.html
 +start C:\Temp\ComputerPolicy.html
 +</code>
 +
 +In the report, examine:
 +
 +  * **Applied Group Policy Objects** — your legal-notice GPO should be listed.
 +  * **Denied Group Policy Objects** — look for security filtering, WMI filtering, or other denial reasons.
 +  * The resulting settings under:
 +  ''Computer Configuration → Windows Settings → Security Settings → Local Policies → Security Options''
 +
 +Microsoft recommends ''gpresult'' for viewing the full resulting policy set because ''rsop.msc'' does not necessarily display every setting. ([[https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult|Microsoft gpresult documentation]], [[https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/use-resultant-set-of-policy-logging|Microsoft RSoP guidance]])
 +
 +For a quick text-only check:
 +
 +<code cmd>
 +gpresult /r /scope computer
 +</code>
 +
 +===== Check the GPO itself =====
 +
 +In **Group Policy Management**, verify all of the following:
 +
 +  - The GPO is actually **linked** to the domain or an OU containing the affected computer accounts.
 +  - The link is enabled.
 +  - **Computer Configuration Settings** are not disabled.
 +  - Security filtering permits the computer to **Read** and **Apply Group Policy**.
 +  - A WMI filter is not excluding the computer.
 +  - The computer’s OU does not have **Block Inheritance** enabled.
 +  - Another GPO linked closer to the computer’s OU is not replacing the title or message with blank values.
 +
 +A common source of confusion is **GPO Status: Enabled**. That status only means the GPO’s Computer and User sections are available for processing. It does **not** prove that the GPO is linked, within scope, permitted by security filtering, or applied to a particular computer.
 +
 +===== If it still does not apply =====
 +
 +Check the client’s Group Policy operational log:
 +
 +<code>
 +Event Viewer
 +  Applications and Services Logs
 +    Microsoft
 +      Windows
 +        GroupPolicy
 +          Operational
 +</code>
 +
 +Look for errors at the time you ran ''gpupdate''.
 +
 +Since three weeks have passed, this is not an ordinary refresh-delay problem. Computer policy normally refreshes approximately every 90 minutes plus a randomized interval and is also processed at startup. The most likely causes are an incorrect link/scope, security filtering, blocked inheritance, or another higher-precedence GPO overriding the values. ([[https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-policy/group-policy-processing|Microsoft Group Policy processing documentation]])
 +
 +====== Configure Microsoft Entra hybrid join ======
 +
 +<WRAP center round box >
 +Bringing your devices to Microsoft Entra ID maximizes user productivity through single sign-on (SSO) across your cloud and on-premises resources. You can secure access to your resources with Conditional Access at the same time.
 +
 +https://learn.microsoft.com/en-us/entra/identity/devices/how-to-hybrid-join
 +
 +</WRAP>
 +
  
 ====== Viewing the active Directory with ADSIEDIT.MSC ====== ====== Viewing the active Directory with ADSIEDIT.MSC ======
Line 71: Line 193:
  
 ====== Computer login ====== ====== Computer login ======
 +<WRAP center round box >
 +
 +2022-04-05
 +
 +Deny User or Group to Sign in Locally in Windows 10
 +
 +From <https://winaero.com/deny-user-group-sign-in-locally-windows-10/> 
 +
  
 From: https://community.spiceworks.com/topic/216823-implications-of-removing-nt-authority-authenticated-users-user-from-users-list From: https://community.spiceworks.com/topic/216823-implications-of-removing-nt-authority-authenticated-users-user-from-users-list
Line 80: Line 210:
 A better way would be to do it in the security policy (secpol.msc) A better way would be to do it in the security policy (secpol.msc)
  
-Security Settings > Local Policies > User Rights Assignments > Allow log on locally. Remove the "Users" group from this policy and add those users you want to allow to log on.+Security Settings > Local Policies > User Rights Assignments > **Allow log on locally**.\\  
 +Remove the "Users" group from this policy and\\  
 +add those users you want to allow to log on.
  
 From: https://community.spiceworks.com/topic/199167-active-directory-2008-r2-control-user-login-to-computer From: https://community.spiceworks.com/topic/199167-active-directory-2008-r2-control-user-login-to-computer
Line 86: Line 218:
 ChristopherO ChristopherO
 Mace Mace
-ChristopherO Feb 15, 2012 at 6:54 AM  +ChristopherO Feb 15, 2012 at 6:54 AM \\  
-You could certainly do this in 2003.  If you want to be granular, you will need to update the Users group on each computer - remove Domain Users and add in the specific accounts/groups that can log into that computer.  If it's going to be the same for a large number of computers (ie, users in the Sales group can log into any computer in the Sales department) you can use Restricted Groups in Group Policy - just remember, with Restricted Groups it will remove ALL other users/groups from that local computer group and ONLY allow in what you set in the policy.+You could certainly do this in 2003.\\  
 +If you want to be granular, you will need to update the Users group on each computer\\  
 +- remove Domain Users and add in the specific accounts/groups that can log into that computer.\\  
 +If it's going to be the same for a large number of computers (ie, users in the Sales group can log into any computer in the Sales department) you can use Restricted Groups in Group Policy - just remember, with Restricted Groups it will remove ALL other users/groups from that local computer group and ONLY allow in what you set in the policy.
  
 From: https://community.spiceworks.com/topic/338040-how-to-stop-domain-users-from-logging-into-my-pc From: https://community.spiceworks.com/topic/338040-how-to-stop-domain-users-from-logging-into-my-pc
Line 94: Line 229:
  
 From: http://windowsitpro.com/security/restricting-interactive-user-logons From: http://windowsitpro.com/security/restricting-interactive-user-logons
 +
 +</WRAP>
  
 ====== Remote Login Active Directory ====== ====== Remote Login Active Directory ======
software/microsoft/windows/activedirectory.1600357267.txt.gz · Last modified: by superwizard