GPO is applied but not working

jannebarckboat · 2017-01-19T12:50:51.000Z

Hi!

Have created GPO,hide “uninstall/change program”. GPO is applied when user login on the computer, but it still not working. User can uninstall program as usual.

Any ide ?

overdrive · 2017-01-19T12:51:41.000Z

Are you suffering from the missing Authenticated Users in the delegation tab of your new GPO? You’ve removed Authenticated Users from the scope tab (that’s fine) but then you have to add the Authenticated users group to your Delegation tab with READ permissions…

It has to do with a Windows Update released in June 2016 - MS16-072 - MS16-072: Security update for Group Policy: June 14, 2016 - Microsoft Support

Taken from Emin’s blog - Fix GPO permissions before applying MS16-072 | >_

To quickly display GPO names that don’t have the Authenticated Users group, you can do:

Powershell

Get-GPO -All | ForEach-Object {

Test if Authenticated Users group have at least read permission on the GPO

if (‘S-1-5-11’ -notin ($_ | Get-GPPermission -All).Trustee.Sid.Value) {
$_
}
} | Select DisplayName

To add back the Authenticated Users group with Read Permissions on the Group Policy Object (GPO), you can do:

Powershell

Get-GPO -All | ForEach-Object {
if (‘S-1-5-11’ -notin ($_ | Get-GPPermission -All).Trustee.Sid.Value) {
$_ | Set-GPPermission -PermissionLevel GpoRead -TargetName ‘Authenticated Users’ -TargetType Group -Verbose
}
}

Now, every GPO has a permission set for the ‘Authenticated Users’ group and to check what permission is set for this group, you can do:

Get-GPO -All | ForEach-Object {
[PsCustomObject]@{
DisplayName = $.DisplayName
Permission = ($ | Get-GPPermission -TargetName ‘Authenticated Users’ -TargetType Group).Permission
}
} | Out-GridView -Title ‘Authenticated Users permissions’

overdrive · 2017-01-19T12:52:55.000Z

Also, did you apply this at the user level or the computer level? If you applied it at the computer level, make sure you’re applying it to an OU that contains the computer objects you want to apply this to. If you applied it at the User level, make sure you’re applying it to an OU that contains the User objects you want to apply this to.

Little-Green-Man · 2017-01-19T12:53:41.000Z

OverDrive:

[unformatted PowerShell script]

Hey, code button the script please

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum! Programming & Development

Hi, and welcome to the PowerShell forum! Don’t apologize for being a “noob” or “newbie” or “n00b.” There’s just no need – nobody will think you’re stupid, and the forums are all about asking questions. Just ask! Use a descriptive subject. Don’t say “Need help” or “PowerShell Help”, actually summarize what the problem is. It helps the rest of us keep track of which problem is which. Don’t post massive scripts. We’re all volunteers and we don’t have time to read all that, nor will we copy…

@overdrive

overdrive · 2017-01-19T12:57:12.000Z

Little Green Man:

OverDrive:

[unformatted PowerShell script]

Hey, code button the script please

PLEASE READ BEFORE POSTING! Read if you're new to the PowerShell forum!

Only when SW adds functionality for BBCode tags or re-allows for pasting in specific html tags (previously were DIV before the update of the text editor near the end of 2015) as I use AutoHotKey to keep my guides and suggestions.

Did you really think I typed that whole thing out again?

@billkindle

jjoyner1985 · 2017-01-19T12:57:46.000Z

Could you give us the path of the GPO setting, it’s scope, and it’s security filter, please?

Otherwise, all we can provide is a best guess.

jannebarckboat · 2017-01-19T12:59:15.000Z

I have applied it at user level.

jannebarckboat · 2017-01-19T13:05:03.000Z

Sorry jjoyner1985, what do you mean ? Path of the GPO setting ? How can I get it ? Im a rookie when it comes to creating GPOs.

overdrive · 2017-01-19T13:06:45.000Z

Was the hide “uninstall/change program” in User Configuration or Computer Configuration?

jannebarckboat · 2017-01-19T13:09:08.000Z

“uninstall/change program” in user Configuration.

overdrive · 2017-01-19T13:13:26.000Z

Did you apply the GPO to an OU that contains the User accounts you want this to apply to?

jannebarckboat · 2017-01-19T13:17:03.000Z

Have created a test OU with one single user account in it.

overdrive · 2017-01-19T13:18:53.000Z

I take it you applied the GPO to this Test OU. I take it that you left the security filtering on the GPO as the default “Authenticated Users”.

Did you run gpupdate /force on the client machine or wait ~2 hours for the change to take effect on the client machine?

jannebarckboat · 2017-01-19T13:26:32.000Z

Yes everything is correct. I have run gpupdate /force, have reboot pc couple of time to. When I login on the user account I can see the GPO is recived and applied with rsop.msc

overdrive · 2017-01-19T13:34:56.000Z

You may be barking up the tree of mis-understanding on the GPO’s setting.

remkoweijnen.nl

Removing the Uninstall or change a program button from the Explorer Command...

Windows Vista introduced the Command Bar in Explorer which is sometimes also referred to as the Folder Band or the Task Band. The Command Bar is of course also present in Windows 7 and Server 2008 (R2). This Command Bar shows possible tasks or...

Est. reading time: 1 minute

It just removes it from the command bar (pretty useless in my opinion)

jannebarckboat · 2017-01-19T13:52:37.000Z

I tested this for fun:

DisableRemoveProgram

System/Ctrl+Alt+Del Optionshide

Policy Setting Comment Remove Change Password Enabled Remove Lock Computer Enabled Remove Logoff Enabled Remove Task Manager Enabled

And that is working correct! But not hide add/remove program…Whyyyyyyyyyyyyyyyy =((((((

overdrive · 2017-01-19T13:53:35.000Z

What is the exact location of the policy for hiding?

jannebarckboat · 2017-01-19T13:58:52.000Z

What do you mean ?

overdrive · 2017-01-19T14:02:45.000Z

Something like :

Computer Configuration > Policies > Administrative Templates > Network > Offline Files > Allow or Disallow use of the Offline Files feature > Disabled

jannebarckboat · 2017-01-19T14:04:53.000Z

You mean this ?

User config → Policies -->Administrative templets → Control panel → Add or remove programs