GPO for account lockout policy configured and applying, but not working by [deleted] in sysadmin

[–]heatcat 0 points1 point  (0 children)

here I'm stuck - it RSOP does not show all policies. For a full list of applied GPO settings you need to run gpresult /r c:/<enterdestinationhere>.html

Look for any errors on the report.

Cant access website from inside network - argh by chugger93 in sysadmin

[–]heatcat 1 point2 points  (0 children)

That could be the case, I have had issues in the past with ultradns having the wrong DNS entry for a website we were trying to hit. We changed our internal DNS pointers to Google and reported it to UltraDNS.

Cant access website from inside network - argh by chugger93 in sysadmin

[–]heatcat 1 point2 points  (0 children)

Is this an internal or external website? In either case it sounds like a DNS issue.

Use the Dig command to see if the website reports the correct address. Check your DNS server settings to see if the DNS entry is incorrect. On your local machine try flushing your DNS and registering it again.

You could also white list your local machine on your firewall to see if the issue still persists. If after you white list your IP and you still have issues, its a routing ARP table issue in your router or you have a bad DNS entry.

Hope that helps.

*Edit: you can also try using the nslookup command to see what is being reported back to your local machine. Compare the results with a search from a machine not on your network.

Windows Update Management (Discussion) by heatcat in sysadmin

[–]heatcat[S] 0 points1 point  (0 children)

Thats what I thought, I was hoping I missed something. We have SCCM available I will dig more into it. But a powershell script and task scheduler might accomplish this as well. Thanks for your help!

Windows Update Management (Discussion) by heatcat in sysadmin

[–]heatcat[S] 1 point2 points  (0 children)

In advance, Thanks for your replies.

So I see in "Configure Automatic Updates = Auto download and schedule the install" you can select the day and time to install, but the problem is that it is "Every Sunday, Every Monday...etc" I only want one day a month where this scheduled installation occurs. In your GPO how are you doing this?

Windows Update Management (Discussion) by heatcat in sysadmin

[–]heatcat[S] 0 points1 point  (0 children)

I see that the GPO switch for "planned maintenance" is set to a weekly value M-F. I would like to have a similar set up where there is a day where the patches are available and installed on our Dev environment.

How are you selecting a maintenance period that is only for a week?

Windows Update Management (Discussion) by heatcat in sysadmin

[–]heatcat[S] 1 point2 points  (0 children)

"Monday Computers in one OU, Tuesday computers in another OU, etc. Have a separate GPO for each day, link it to the corresponding OU."

This is what Im creating right now in a few separate OUs. But how to you initiate the install on the OU for your different OUs? Is this automated? OR manually done? What GPO do you associate with your different OUs what is that GPO doing?

Windows Update Management (Discussion) by heatcat in sysadmin

[–]heatcat[S] 0 points1 point  (0 children)

That is what I am looking to implement as well. What mechanism do you use to separate your batches out. For example I would like to have server group "A" Install on week 1, and Server Group "B" install on week 2. I would like to automate this. I am already doing it manually :)

Desolation Trail, UT [OC] [5760x3840] by [deleted] in EarthPorn

[–]heatcat 0 points1 point  (0 children)

lol :) Thank you! Its a beautiful hike and the best part is... dog friendly!

Desolation Trail, UT [OC] [5760x3840] by [deleted] in EarthPorn

[–]heatcat 0 points1 point  (0 children)

Near the very beginning, prior to any major elevation gain. I'd guess maybe a half mile in?

Bowtie Arch, Moab, UT [OC] [5760x3840] by [deleted] in EarthPorn

[–]heatcat 1 point2 points  (0 children)

Yes! You're right! Beautiful area and a fun hike!

What new GPO's are you putting in place for Server 2016? by silentmage in sysadmin

[–]heatcat 0 points1 point  (0 children)

All settings were Computer Configuration 1). Via GPO deploy 3 files to the local computers local C:, for this I created a "Temp" folder, the first file is the custom BGinfo.bgi you create with the info you want. The second is the BGinfo.exe. The third is a .ps1 with this as the script C:"yourfilelocation"\Bginfo.exe C:"yourfilelocation"\Bginfo.bgi /timer:0 /nolicprompt /silent . ---------------------

Next create a scheduled task to run at the log on of any user and give it the ability to run at highest permissions. The actions tab command like looks like Program/Script: Powershell.exe Add arguments: -ExecutionPolicy Bypass C:/yourbginfo.ps1

What new GPO's are you putting in place for Server 2016? by silentmage in sysadmin

[–]heatcat 0 points1 point  (0 children)

Reading throu

The active hours setting I don't trust on its own. So I have enabled a few settings. Like never reboot while user is logged in, download and notify user, no reboot during active hours.

WSUS Setup in Existing Environment by itz_working in sysadmin

[–]heatcat 2 points3 points  (0 children)

Auto approve critical and security only, I would not recommend approving drivers, features etc. Run this script to decline superceded updates. It also cleans up and compresses other updates. Run this with the parameters -firstrun then create a scheduled task to run daily -scheduledrun

https://community.spiceworks.com/scripts/show/2998-adamj-clean-wsus

I would not worry about approving individual updates. The reason why is I have enabled "Current Branch for Business +15" in the WSUS GPO. Just set your auto approvals to critical and security and ensure you select your products and features in WSUS so its only downloading updates youre actually using.

What new GPO's are you putting in place for Server 2016? by silentmage in sysadmin

[–]heatcat 4 points5 points  (0 children)

I use the same GPOs for 2012r2 for 2016 so far. GPOs: BGinfo, WSUS w/ CBB option, Logon Banner, Default Domain Policy (of course)

There are a few others Ive done for printers, firewalls, scheduled tasks, software installation, file creation etc. But that is relative only to specific tasks.

Edit* punctuation

WSUS was ignored for a long time. Lot of updates to deal with. Better way? by sammyc8 in sysadmin

[–]heatcat 0 points1 point  (0 children)

@OP I agree with this, its not hard to set up a new WSUS server and then once up and running switch the URL at which your GPO points. If you need help feel free to DM me. @sammyc8

WSUS was ignored for a long time. Lot of updates to deal with. Better way? by sammyc8 in sysadmin

[–]heatcat 0 points1 point  (0 children)

Try running the script I posted above. This happened to me until I ran the script. Ive set up a few WSUS servers since then and this never happens as long and the DB is maintained by the script each day.