Group Policy on gal.vin

Better Windows Updates For Everyone

Tue, 14 Dec 2021 01:49:09 +0000

In this post I’m going to show how to quickly configure Windows Updates so that you only receive important security updates. We’ll cover Home and Pro/Enterprise users of both Windows 10 and Windows 11.

These are also the settings I use myself and recommend for most users.

These settings may also be helpful for IT admins.

Set Active Hours - Windows 10

By default Active Hours are configured to be automatic but personally I think it’s better to set them manually.

Go to Settings using WIN + I, then Update & Security > Change active hours.

Turn off the setting Automatically adjust active hours... and click on Change next to Current active hours

Set the Active hours to the maximum allowed amount of 18 hours. I use 8am - 2am: This means Windows Update won’t restart my computer during this time period.

Set Active Hours - Windows 11

By default Active Hours are configured to be automatic but personally I think it’s better to set them manually.

Go to Settings using WIN + I, then go to Windows Update > Advanced Options > Active Hours

Change the Adjust active hours setting from Automatically to Manually.

Set the Active hours to the maximum allowed amount of 18 hours. I use 8am - 2am: This means Windows Update won’t restart my computer during this time period.

Registry Settings - Windows 10 Home

If you are running Windows 10 Home Edition, you’ll need to make these edits to the registry as Home edition does not have access to Group Policy.

Open an elevated PowerShell prompt and run this line to configure Windows Updates as noted in this article:

`1`	`Invoke-Expression ((New-Object System.Net.WebClient).DownloadString('https://git.io/JDRIh'))`

Use the Registry Editor and make the changes manually:

Open regedit with WIN + R and then type regedit
Go to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings
Right-click New > DWORD (32-bit) Value
Name the new Value BranchReadinessLevel and set it to Base: Decimal, Value data: 20
Repeat steps 3 and 4 with the Value of DeferFeatureUpdatesPeriodInDays Value data: 365
Repeat steps 3 and 4 with the Value of DeferQualityUpdatesPeriodInDays Value data: 5

Group Policy Settings - Windows 10 Pro/Enterprise

With Windows 10 Pro or Enterprise we can use the Local Group Policy, or the Domain Group Policy for the IT admins out there.

Open the local group policy with WIN + R and then type gpedit.msc
Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows update for Business
Select Manage preview builds and set it to Enabled and change the drop down menu to Disable preview builds
Select Select when Preview Builds and Feature Updates are received and set it to Enabled
Change the drop down menu to Semi-Annual Channel and then for After a Preview Build or Feature Update is released, defer receiving it for this many days enter 365.
Select Select when Quality Updates are received and set it to Enabled
For After a Quality updates is released, defer receiving it for this many days enter 5.

Registry Settings - Windows 11 Home

If you are running Windows 11 Home Edition, you’ll need to make these edits to the registry as Home edition does not have access to Group Policy.

Open an elevated PowerShell prompt and run this line to configure Windows Updates as noted in this article:

`1`	`Invoke-Expression ((New-Object System.Net.WebClient).DownloadString('https://git.io/JDRIh'))`

Use the Registry Editor and make the changes manually:

Open regedit with WIN + R and then type regedit
Go to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings
Right-click New > DWORD (32-bit) Value
Name the new Value BranchReadinessLevel and set it to Base: Decimal, Value data: 20
Repeat steps 3 and 4 with the Value of DeferFeatureUpdatesPeriodInDays Value data: 365
Repeat steps 3 and 4 with the Value of DeferQualityUpdatesPeriodInDays Value data: 5

Group Policy Settings - Windows 11 Pro/Enterprise

With Windows 11 Pro or Enterprise we can use the Local Group Policy, or the Domain Group Policy for the IT admins out there.

Open the local group policy with WIN + R and then type gpedit.msc
Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Update
Select Select when Preview Builds and Feature Updates are received and set it to Enabled and then for How many days after a Feature Update is released... enter 365.
Next, select Select when Quality Updates are received and set it to Enabled and then for After a quality update is released.. enter 5.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Disable The News and Interests Bar in Windows 10

Thu, 10 Jun 2021 15:26:20 +0100

The New News and Interests Bar for Windows 10

In the June updates for Windows 10 the News and interests bar has been rolled out to Windows 10 and is enabled by default. If you want to disable it as a user, it’s easily done by right-clicking on the Taskbar > News and Interests > Turn off. Job done. 👍

Registry

The registry entry for the setting is per-user and is located here:

`1`	`HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Feeds`

The key is a DWORD (32-bit) Value name ShellFeedsTaskbarViewMode and it has 3 states:

0 (Show icon and text)
1 (Show only icon)
2 (Hide everything)

Group Policy

To disable this feature for all users using Group Policy, the setting can be found here:

`1`	`Computer Configuration > Administrative Templates > Windows Components > News and interests`

Enable news and interests on the taskbar

Set this item to Disabled to remove it for all users on the PC by default.

Central Store

You may not see this setting in your Group Policy if you have created a Central Store for your Group Policy Objects. You’ll need to update the Central Store with the following files from a Windows 10 system with the June update:

1
2

C:\Windows\PolicyDefinitions\Feeds.admx
C:\Windows\PolicyDefinitions\en-US [or your language]\Feeds.adml

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Disable Network Discovery in Windows 10/11

Tue, 20 Apr 2021 23:18:59 +0100

Fully disabling Network Discovery in Windows 10 using Group Policy

To properly disable Network Discovery in Windows 10 in a way that the user cannot easily re-enable we must create some firewall rules and prevent some services from running on start-up. We can do both things using Group Policy.

Firewall Rules

Create a new Group Policy or use an existing one that takes effect on computer objects.

Go to Computer Configuration > Policies > Windows Settings > Security Settings > Windows Firewall with Advanced Security.
Inside the Inbound Rules node, right click and choose New Rule.
On Rule Type, select Predefined and choose Network Discovery then click Next.
You will be presented with a long list of rules, many of which are duplicates because of the Profile they belong to; Public, Domain, Private.
Select only the following rules, it does not matter which profile as we will change it later.
- Network Discovery (LLMNR-UDP-In)
- Network Discovery (NB-Datagram-In)
- Network Discovery (NB-Name-In)
- Network Discovery (Pub-WSD-In)
- Network Discovery (SSDP-In)
Next, choose Block the connection and click Finish.
We will now make some changes to those rules.
First, select Network Discovery (NB-Datagram-In) and go to its properties.
On the General tab, select the Allow the connection radio button.
Next on the Scope tab, under Remote IP address, select the These IP addresses: radio button and then click Add…
In the new window, select the Predefined set of computers: radio button and choose Local subnet from the drop-down list.
Next on the Advanced tab, make sure that the check boxes next to Domain, Private and Public are all checked.
Click on Apply, and close the properties window.
On the other 4 inbound rules repeat steps 10 - 13.

Your inbound firewall rules should look like this:

We are now going to repeat the steps above for the outbound rules.

Inside the Outbound Rules node, right click and choose New Rule.
On Rule Type, select Predefined and choose Network Discovery then click Next.
You will be presented with a long list of rules, many of which are duplicates because some the Profile they belong to e.g. Public, Domain, Private.
Select only the following rules, it does not matter which profile as we will change it later.
- Network Discovery (LLMNR-UDP-Out)
- Network Discovery (NB-Datagram-Out)
- Network Discovery (NB-Name-Out)
- Network Discovery (Pub-WSD-Out)
- Network Discovery (SSDP-Out)
Next, choose Block the connection and click Finish.
We will now make some changes to those rules.
First, select Network Discovery (NB-Datagram-Out) and go to its properties.
On the General tab, select the Allow the connection radio button.
Next on the Scope tab, under Remote IP address, select the These IP addresses: radio button and then click Add…
In the new window, select the Predefined set of computers: radio button and choose Local subnet from the drop-down list.
Next on the Advanced tab, make sure that the check boxes next to Domain, Private and Public are all checked.
Click on Apply, and close the properties window.
On the other 4 inbound rules repeat steps 9 - 12.

Your outbound firewall rules should look like this:

System Services

Now we are going to configure the Group Policy to disable some system services.

Go to Computer Configuration > Policies > Windows Settings > Security Settings > System Services.
Select the Function Discovery Provider Host service and go to it properties page.
Select Define this policy setting, choose Disabled and then click on Apply and close the properties window.
Repeat the above steps for the following services:

Function Discovery Resource Publication
Link-Layer Topology Discovery Mapper
SSDP Discovery
UPnP Device Host

The Group Policy is now configured. Link it to an OU or OU’s that contain computer objects and run gpupdate or restart the computers. Network Discovery will now be disabled and even if a user enabled it in the Network and Sharing Center it will remain disabled.

Support My Work

If you would like to support me, please check out the link below.

PayPal

If you have any questions or comments, please leave them below.

-Mike

Get Started with Windows Update for Business (WUfB)

Tue, 24 Dec 2019 01:48:36 +0000

You may have seen the option to use Windows Update for Business and wondering what it brings to the table when compared to WSUS and SCCM. Windows Update for Business (WUfB) is a good way of simplifying and automating the deployment of Windows Updates without using any on-premises infrastructure. The downside is that you do loose some control, but the benefits outweigh the drawbacks. As I always say, it does depend on your infrastructure and environment though. The biggest aspect of control that you lose is the ability to completely block an update. In WSUS you can just decline it and it will never deploy, but with Windows Update for Business you can only defer (delay) updates. The benefits of using Windows Update for Business are:

No need to manage the approval of individual updates.
You don’t need to dedicate infrastructure to running Windows Server Update Services (WSUS).
You can receive driver and other updates, without dedicating infrastructure to it – managing driver updates with WSUS is difficult and usually not recommended.
It simplifies configuration of client devices receiving updates.

Creating a Group Policy Object

To get started using Windows Update for Business, we’re going to create a Group Policy to test it out and use an Active Directory group to limit the devices we move over to WUfB.

Create a new GPO called: WUfB_Test Below I’ll list the settings to configure in the GPO and what effect they have.

Computer Configuration/Policies/Administrative Templates/Windows Components/Delivery Optimization

Download Mode - Enabled

Download Mode: LAN (1)

Explanation: This will enable your clients to provide updates to other clients on the local area network. This will help prevent all client devices from going to the internet to retrieve updates and saving on bandwidth usage.

Computer Configuration/Policies/Administrative Templates/Windows Components/Windows Update

Configure Automatic Updates - Enabled

Configure automatic updating: 4 - Auto download and schedule the install

Install during automatic maintenance: Un-checked

Scheduled install day: 0 - Every day

Scheduled install time: 03:00

Every week: Checked

Install updates for other Microsoft products: Un-checked

Turn off auto-restart for updates during active hours - Enabled

Active Hours Start: 8am Active Hours End: 5pm

Explanation: With the settings above Windows will download and install updates automatically without user intervention. If an update requires a restart Windows will not do so during the active hours set.

Computer Configuration/Policies/Administrative Templates/Windows Components/Windows Update/Windows Update for Business

Manage preview builds - Enabled

Set the behaviour for receiving preview builds: Disable preview builds

Explanation: These settings prevent the preview builds of Windows 10 from installing.

If you do want a collection of devices that install the Insider preview builds of Windows 10 for testing in your organisation, then you should create another GPO for that.

Select when Preview Builds and Feature Updates are received - Enabled

Select the Windows readiness level for the updates you want to receive: Semi-Annual Channel

After a Preview Build or Feature Update is released, defer receiving it for this many days: 365

Pause Preview Builds or Feature Updates starting: leave blank

Explanation: This is where you select the update channel, which at this point in time only really matters if you are deploying preview Insider builds of Windows 10. There does appear to be a bug in the Group Policy Management console where it reports the channel as always being ‘Semi-Annual Channel (Targeted) for 1809 and below (Deprecated)’. The settings above will prevent Windows 10 from downloading and installing any of the major feature updates for one year. For example, when running Windows 10 v1903, it will not download the update to Windows 10 v1909 for one year (365 days).

Select when Quality Updates are received - Enabled

After a quality update is released, defer receiving it for this many days: 7

Pause Quality Updates starting: leave blank

Explanation: These settings control when the quality updates can be installed. The quality updates are the monthly updates released for Windows 10. You may want to defer these for a week or two just in case there are any issues with them.

Now we’re going to use an Active Directory group ensure that this GPO only applies to the clients we want it to.

Create a group in Active Directory called: WUfB_Test.
Add in the computer accounts you want to use to test Windows Update for Business.
Using Group Policy Management, go to Group Policy Objects > WUfB_Test.
Click on the GPO and select the Scope tab in the larger right-hand pane
Under the Security Filtering section, remove the Authenticated Users group and add the WUfB_Test group.

All we need to do now is link the GPO to an OU that contains the devices we want to test WUfB with.

Final Thoughts and Recommendations

Something I haven’t covered in this post is how to get telemetry on the status of updates across the devices in your organisation and that’s because to be honest, I haven’t been able to get it working yet. According to Microsoft’s documentation, it is available via a free service in Azure, but I haven’t been able to find it yet let alone enable it. I’ll keep you posted. There are two Group Policy settings that don’t appear to have any effect on Windows 10 or Windows Server 2016+ devices. If your experience if different, please let me and others know in the comments.

Install updates for other Microsoft products - This used to effect Windows 7 and possibly Windows 8, but these days it doesn’t appear to do anything. It may take some effect on older or slightly obscure pieces of software, however.

Install during automatic maintenance - This setting only appears to take effect on Windows Server 2012 R2 devices. As I mentioned earlier in the post, I would suggest that depending on your environment you might want to set up a couple of different GPOs so you could have a testing group and then a production group for updates. You could also configure a GPO to enable the deployment of Windows Insider builds within your organisation to test software as well as deployment. You could also use WUfB for servers as well. WSUS was first released during the Windows XP and Windows Server 2003 timeframe and back then it was a godsend. Over the years as Windows has changed, WSUS has had more and more added to it and these days it feels very much like part of the legacy and on-prem suite of products that aren’t going to get any updates in future. We can debate on whether this is a good thing or not in the comments section and on Twitter, but hopefully this post helps bring awareness to Windows Update for Business and how you might be able to use it.

I hope you found this post useful in some way, please consider supporting my future work by checking out my PayPal. If you are unable or prefer not to use either of those methods, no problem - sharing my work and following me on social media is a huge help. Thanks!

If you have any questions or comments, please leave them below.

-Mike

Managing Windows Updates with Group Policy

Thu, 26 Sep 2019 11:54:52 +0000

In this post I’ll walk through how I manage and test the delivery of Windows Updates to all my clients and servers. I’ll also go through how I manage essential servers like Domain Controllers, Hyper-V hosts and I’ll touch on getting started with Cluster-Aware Updating. We’re going to group our machines into Clients and Servers, and then group each of those groups into Ring 1 and Ring 2. If you want, you can create more rings for more control, but generally I find two rings are sufficient.

Ring 1 Testing

Updates are initially approved here and installed on specially selected machines that you have chosen. For clients I’d suggest a cross section of users, preferably who are communicative and easy to work with. I find it helps if they have volunteered to begin your victims beta testers. For servers, you’ll want a selection of non-critical servers running a variety of services.

Ring 2 General Availability

When updates have passed testing, they can be approved for general availability and installed on all clients and servers.

Special Note

I know that a lot of people have the viewpoint that they “shouldn’t have to be testing Microsoft’s updates for them” and I can understand this frustration, but the reality is that currently the updates coming out have issues that aren’t being picked up by internal testing. So to look at it from a slightly different perspective; you’re not testing for Microsoft, you’re doing your due diligence, testing for your systems to maximise up time and also reduce the stress and extra work that you and/or your team have to cope with.

Getting Started

To put this all in place we need to create some Group Policy Objects, Active Directory groups and make some changes to WSUS. To Install and configure Active Directory Domain Controllers, click here. To install and configure WSUS, click here.

Create the following Group Policy Objects:

WSUS_General
WSUS_Clients_Ring1
WSUS_Servers_Ring1

Create the following Active Directory groups:

WSUS_Clients_Ring1
WSUS_Clients_Ring2
WSUS_Servers_Ring1
WSUS_Servers_Ring2

Create the follow computer groups in WSUS:

Clients - Ring 1
Clients - Ring 2
Servers - Ring 1
Servers - Ring 2

You’ll also need to change some options in WSUS: Under the Options node, go to Computers and select Use Group Policy or registry settings on computers.

Group Policy Object Settings

The WSUS_General GPO is where we will configure core settings that we want to apply to all computers regardless of which ring they will be in. Configure the following settings:

Computer Configuration/Policies/Administrative Templates/Windows Components/Delivery Optimization

Download Mode > Enabled - Lan (1)

Explanation: Enable the above setting to allow your clients and servers to download updates from each other. They will still only download and install updates that have been approved for their group, but it will lighten the load on your WSUS server.

Computer Configuration/Policies/Administrative Templates/Windows Components/Windows Update

Specify intranet Microsoft update service location > Enabled

Set the intranet update service for detecting updates > http://wsus.contoso.com:8530

Set the intranet statistics server > http://wsus.contoso.com:8530

Set the alternate download server > http://wsus.contoso.com:8530

Download files with no Url in the metadata if alternate download server is set > Disabled

Client Group Policy Object Settings

We’re now going to configure the WSUS_Clients_Ring1 GPO. We’re going to use this GPO as a template for the other client ring GPOs too. The reason we’re not putting all these common settings in the general GPO above, is because these settings control the installation of updates and if we need to tweak them in future, we can test the settings first using the ring system.

Configure the settings in the WSUS_Clients_Ring1 GPO as below:

Computer Configuration/Policies/Administrative Templates/Windows Components/Windows Update

Automatic Updates detection frequency > Enabled

Check for updates at the following interval (hours) > 4

Configure Automatic Updates > Enabled

Configure automatic updating > 4 - Auto download and schedule the install

Install during automatic maintenance > Disabled

Scheduled install day > 0 - Every day

Scheduled install time > 17:00

Every week > Enabled

Install updates for other Microsoft products > Disabled

Configure auto-restart reminder notifications for updates > Enabled

Specify the period for auto-restart reminder notifications > 60

Enable client-side targeting > Enabled

Target group name for this computer > Clients - Ring 1

No auto-restart with logged on users for scheduled automatic updates installations > Disabled

Specify deadline before auto-restart for update installation > Enabled

Specify the number of days before a pending restart will automatically be executed outside of active hours:

Quality Updates (days) > 7

Feature Updates (days) > 7

Turn off auto-restart for updates during active hours > Enabled

Active Hours Start > 8 AM

Active Hours End > 5 PM

Explanation: With the settings above, this should provide a good balance of getting updates installed without interrupting users. The active hours ensure that automatic reboots will not happen during these hours. Now we’re going to ensure that this GPO only applies to the clients we want it to by using Active Directory groups and Security Filtering on the GPO.

Using Group Policy Management, go to Group Policy Objects > WSUS_Clients_Ring1 and click on the GPO.

Select the Scope tab in the larger right hand pane, and under the Security Filtering section, remove the Authenticated Users group and add the WSUS_Clients_Ring1 group we created earlier.

You might be wondering why we didn’t create the WSUS_Clients_Ring2 GPO above. We’re going to copy the WSUS_Clients_Ring1 and use it as a template.

To copy the Group Policy, right-click on the WSUS_Clients_Ring1 and select Copy, then right-click on the Group Policy Objects node in the left hand side of the Group Policy Management console and select Paste.

Specify the permissions for the new GPO and then click on OK.

You will now have a GPO called Copy of WSUS_Clients_Ring1. Rename the GPO to WSUS_Clients_Ring2 and then edit it and change the setting below:

Target group name for this computer > Clients - Ring 2

Server Group Policy Object Settings

We’re now going to setup the WSUS_Servers_Ring1. Like the client GPO this as a template for the other server ring GPOs too. The reason we’re not putting all these common settings in the general GPO, is because these settings control the installation of updates and if we need to tweak them in future, we can test the settings first.

Configure the settings in the WSUS_Servers_Ring1 GPO as below.

Allow Automatic Updates immediate installation > Enabled

Automatic Updates detection frequency > Enabled

Check for updates at the following interval (hours) > 4

Configure Automatic Updates > Enabled

Configure automatic updating > 4 - Auto download and schedule the install

Install during automatic maintenance > Disabled

Scheduled install day > 0 - Every day

Scheduled install time > 06:00

Every week > Enabled

Install updates for other Microsoft products > Disabled

Enable client-side targeting > Enabled

Target group name for this computer > Servers - Ring 1

No auto-restart with logged on users for scheduled automatic updates installations > Disabled

Turn off auto-restart for updates during active hours > Enabled

Active Hours Start > 6AM

Active Hours End > 11PM

Explanation: With the settings above, the servers should reboot only when an update requires it and only outside of the active hours configured. It’s important to note that the Active Hours can only have a maximum range of 18 hours.

Now just like the clients GPO we’re going to set up this GPO so it only applies to the servers we want it to by using Active Directory groups and Security Filtering on the GPO.

Using Group Policy Management, go to Group Policy Objects > WSUS_Servers_Ring1 and click on the GPO. Select the Scope tab in the larger right hand pane, and under the Security Filtering section, remove the Authenticated Users group and add the WSUS_Servers_Ring1 group we created earlier.

We’re now going to copy the WSUS_Servers_Ring1 and use it as a template for the ring 2 GPO. To copy the Group Policy, right-click on the WSUS_Servers_Ring1 and select Copy, then right-click on the Group Policy Objects node in the left hand side of the Group Policy Management console and select Paste.

Specify the permissions for the new GPO and then click on OK. You will now have a GPO called Copy of WSUS_Servers_Ring1. Rename the GPO to WSUS_Servers_Ring2 and then edit it and change the setting below:

Target group name for this computer > Servers - Ring 2

Putting It All Together

In Active Directory, find the computer accounts you want to use for testing updates and add them to the group WSUS_Clients_Ring1. Add all the other computer accounts to the WSUS_Clients_Ring2 group.

Next add the servers that you are going top test updates on to the WSUS_Servers_Ring1 group, and the other servers to the WSUS_Servers_Ring2 group.

Do not add Domain Controllers, Hyper-V hosts or servers that are in clusters, we’ll cover how to manage updates for these later on.

Link the WSUS_General GPO to the most top level Organisational Unit(s) you can that contains the computer accounts you want to receive the settings.

Now link the WSUS_Clients_Ring1 GPO to the OU(s). Only the computer accounts that are in the WSUS_Clients_Ring1 group will receive the settings.

Repeat these steps for the WSUS_Clients_Ring2 GPO and the WSUS_Servers_Ring_1 & 2 GPOs.

Over time (a reboot may be required for the settings to fully take effect) the clients and servers should begin to appear in the WSUS console under the Computers node in the configured groups.

Domain Controllers

I separate domain controllers from the other servers because they need to have a staggered reboot from each other. If they reboot at the same time the whole domain goes down, and this is a bad thing not desirable. To do this I create GPOs for each DC, with different install times and I put the DCs in ring 2, so they only install updates which have been tested.

Here are the settings for the WSUS_DC01_Ring2 GPO:

Allow Automatic Updates immediate installation > Enabled

Automatic Updates detection frequency > Enabled

Check for updates at the following interval (hours) > 4

Configure Automatic Updates > Enabled

Configure automatic updating > 4 - Auto download and schedule the install

Install during automatic maintenance > Disabled

Scheduled install day > 0 - Every day

Scheduled install time > 01:00

Every week > Enabled

Install updates for other Microsoft products > Disabled

Enable client-side targeting > Enabled

Target group name for this computer > Servers - Ring 2

No auto-restart with logged on users for scheduled automatic updates installations > Disabled

Turn off auto-restart for updates during active hours > Enabled

Active Hours Start > 6 AM

Active Hours End > 11 PM

The GPO settings for WSUS_DC02_Ring2 are the same, except I set a different install time:

Scheduled install time > 02:00

This gives DC01 an hour to install, restart and stabilize before DC02 installs its updates and restarts. We now need to link the GPOs to the DCs. One way we can accomplish this is by linking the GPOs to the Domain Controllers OU and set security filtering on the GPOs for each DC.

So WSUS_DC01_Ring2 would have Authenticated Users removed from security filtering and the DC01$ computer account would be in its place.

However, I’ve had trouble getting this to work recently. So, I’ve taken to creating an OU for each DC, and then linking the GPO to the OU and leaving Authenticated Users in the security filtering. See below:

[

This may not be the best way to do it, but for a small number of DCs, I think it’s good enough. For larger numbers of DCs (more than four I’d say), I’d recommend creating groups, and grouping up the DCs, as with running more than four DCs rebooting a couple at the same time shouldn’t be an issue.

Hyper-V Hosts

Like with Domain Controllers, I separate the Hyper-V hosts if they are not in a cluster. For the Hyper-V hosts I copy the WSUS_Servers_Ring2 GPO and set the install time setting to something that doesn’t conflict with the DCs or the other servers.

Since Windows Server 2012 R2 there’s been a setting for updates to Install during automatic maintenance. This sounds like a good idea as it installs updates and restarts at a random point within a period of time that you can set. Unfortunately, I’ve never been able to get it to work reliably on Windows Server 2016 and 2019, so I don’t use it.

Here are the settings for my WSUS_VS01_Ring2 GPO:

Allow Automatic Updates immediate installation > Enabled

Automatic Updates detection frequency > Enabled

Check for updates at the following interval (hours) > 4

Configure Automatic Updates > Enabled

Configure automatic updating > 4 - Auto download and schedule the install

Install during automatic maintenance > Disabled

Scheduled install day > 0 - Every day

Scheduled install time > 03:00

Every week > Enabled

Install updates for other Microsoft products > Disabled

Enable client-side targeting > Enabled

Target group name for this computer > Servers - Ring 2

No auto-restart with logged on users for scheduled automatic updates installations > Disabled

Turn off auto-restart for updates during active hours > Enabled

Active Hours Start > 6 AM

Active Hours End > 11 PM

I don’t configure security filtering on this GPO, leaving Authenticated Users in place.

Cluster-Aware Updating (CAU)

Cluster-Aware Updating is entirely different and doesn’t use Group Policy at all, except to disable Windows managing updates itself. To use Cluster-Aware Updating, open the application named Cluster-Aware Updating in the Windows Administration Tools and connect to the failover cluster you wish to manage.

Once connected you can configure how you want updates to be installed and when just like with Group Policy, except CAU manages the installs and reboots for each node in a cluster, making sure the cluster stays up. One change you have to make when setting up Cluster-Aware Updating is disabling Windows from managing updates using GPO. To achieve this, it’s best if you have an Organisation Unit setup for each cluster, and all the AD objects for that cluster inside the OU. We’ll create a GPO named WSUS_Disabled_CAU and disable Automatic Updates entirely.

Computer Configuration/Policies/Administrative Templates/Windows Components/Windows Update

Configure Automatic Updates > Disable

Link this GPO to the OU containing the cluster objects and now the cluster should install updates as configured in the Cluster-Aware Updating tool.

If you have any questions or comments, please leave them below.

-Mike

Delving Into Disabling OneDrive

Wed, 17 May 2017 13:57:58 +0000

UPDATE 2017-11-07

After testing the method below on Windows 10 1703, I found that it wasn’t working as it did with 1607. To disable One Drive and remove the One Drive folder from the Navigation Pane of Windows Explorer, enable the group policy item: Computer Configuration/Policies/Administrative Templates/Windows Components/OneDrive/Prevent Usage of OneDrive for file storage and also set the following registry key from 1 to 0:

1
2

HKEY\_CLASSES\_ROOT\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}
"System.IsPinnedToNameSpaceTree"=dword:00000000

Please note that the registry key must be set on a per user basis. You can set it via a log in script. For my environment, I customise the Default Profile, so I edit the registry in the Task Sequence which sets the option for all future profiles created after deployment.

Original post

Disabling OneDrive for Windows 10 (and previous versions for that matter) is a relatively easy task to accomplish, but if you’re doing some profile customisation and setting the “CopyProfile” option in the Unattend.xml then you’ll need to do some extra work to make sure that it’s disabled, and hidden as expected. The first thing to do is to set the Group Policy option to disable OneDrive. It’s a computer only option which you’ll find under Computer Configuration/Policies/Administrative Templates/Windows Components/OneDrive/Prevent Usage of OneDrive for file storage you’ll need to set the option to enabled.

If your Windows 10 user profiles are created from the standard default profile then OneDrive should be disabled. When you logon you may see the OneDrive entry in the Navigation pane of Windows Explorer for a short time, but it should disappear eventually. If you are employing a different method creating profiles, either from a custom default profile being created and then copied via the CopyProfile setting in the Unattend.xml or another way, then you will need to make sure that the OneDrive first run setup is being run on login as the Group Policy setting only takes effect properly (removing the OneDrive entry from the Navigation bar) when this is done. For my environment I chose to do this during the deploy Task Sequence in MDT, after the Application Installs. I added the lines below into a batch script which I use to do a few small final tasks.

1
2
3

REG LOAD "hku\Default" "C:\Users\Default\NTUSER.DAT"
REG ADD HKU\Default\Software\Microsoft\Windows\CurrentVersion\Run /v OneDriveSetup /t REG\_SZ /d "C:\Windows\SysWOW64\OneDriveSetup.exe /thfirstsetup"
REG UNLOAD "hku\\Default"

The reason I’ve chosen to do this like is because during my build task sequence, options are set for the Administrator user, which when the image is captured and then deployed, the CopyProfile option copies the Administrator users profile and uses it for as the template for user profiles afterwards. The OneDrive setup first run doesn’t carry over because it’s already run as the Administrator, so you have to restore it. I attempted to just enter the reg key during the very end of the build Task Sequence but it didn’t work. Only after setting it as in the batch file above, during the final steps or the deploy sequence did it work as intended. This is an oddly specific problem that I faced, hopefully my sharing it will help others.

If you have any questions or comments, please leave them below.

-Mike

Customising the Start Menu and Taskbar with Windows 10 all versions incl. 1903/1909

Mon, 06 Feb 2017 23:57:52 +0000

This week I’ve gone pretty deep down the rabbit hole of automating the Start Menu and Taskbar layouts during an MDT Task Sequence.

Update 2017-05-02

This also works with Windows 10 1703 (Creators Update) As every device I’m deploying will have the same customisation I wanted to automate it during the build or deploy Task Sequence, rather than applying it via domain Group Policy to reduce limited network bandwidth, keep Group Policy as light as possible and reduce login times as much as possible.

Update to this post:How to partially lock down the Start Menu.

A new and extremely welcome feature of Windows 10 1607 is the ability to customise the Taskbar layout, there’s a very good post about it here. With this post in mind, I used one of my reference images and customised the Start Menu layout and exported it via everyone’s favourite PowerShell command:

`1`	`Export-StartLayout C:\StartLayout.xml`

As the TechNet post says, you can add the extra xml data necessary to configure the Taskbar layout, although in the end I did just write my own xml file from scratch.

When deploying the customisation you may have missing icons, for example the Internet Explorer icon may be missing. This is most likely due to the location of the Internet Explorer.lnk file being a part of the users profile - customisation is applied before the file exists, so it’s removed. To work around this I recommend copying the Internet Explorer.lnk file to the %alluserprofile% Start Menu as part of your deployment and (as above) editing the StartLayout.xml file to reference the new location of the file. I recommend doing this for any .lnk files that aren’t in a public/all users location.

If you intend on deploying this Start Menu/Taskbar layout customisation during the image build process via the Import-StartMenu PowerShell commandlet, then you may, as I did, encounter a problem. One of the final things my image build task sequence does is apply customisation to the Administrator users profile, which is then copied for use as the Default profile during the deploy Task Sequence, using the CopyProfile unattend.xml option. The problem is that by using the Import-StartLayout command, this only sets the layout for the Start Menu and Taskbar for new profiles created from that point on wards.

The CopyProfile option does not set the Start Menu/Taskbar layout, as it’s not a part of the Administrators profile. So what do we do? Well, you can just set it via GPO and call it a day, but I absolutely wanted it to be a part of the image, so I looked into setting it as a local group policy option during the image build task sequence. This also failed to take effect when deploying the image. I’m led to believe (as silly as this might sound) that the reason for this is that the StartMenuLayout.xml that the group policy was configured to use needs to be newer than the OS deployment, as in the date stamp needs to be after. So what I finally did was copy the StartMenuLayout.xml file and set the local group policy option late during the deployment Task Sequence, thus the .xml file is “newer” than the OS install and the local group policy option ensures that the setting it applied for every user than logs on, without hitting domain Group Policy.

If you have any questions or comments, please leave them below.

-Mike

Windows 10 1607 (Anniversary Update) opens msn.com at login and how to stop it.

Thu, 12 Jan 2017 22:01:34 +0000

I thought about trying to find a better name for this post and this issue, but this is all I could come up with.

Update 2017-10-16: A few people have contacted me and made me aware that doing the reg hack below can prevent users from using Microsoft Office Clipart, so you should be aware of that before proceeding. Additionally, I’ve found that with Windows 10 1703 (Creators Update), allowing access to http://www.msftconnecttest.com/redirect through your firewall/proxy will achieve the same thing without the reg hack and without preventing access to Microsoft Office Clipart. Please note though, it does not work with 1607.

Original Post ANYWAY, I finally tracked down how to stop Windows 10 1607 (Anniversary Update) from opening the default browser with msn.com. There are no startup or login registry entries, Group Policy settings, Scheduled Tasks, or even programs in the Start Menu startup folder. This is *something* that Windows is doing itself. I’ve only encountered this issue on corporate networks, not on my home network, so I knew that some sort of authentication/proxy/filtering/firewall thing. I’ve also only had this issue with Windows 10 1607 (Anniversary Update), not 1511 (November Update) or 1507 (RTM).

It seems that Windows 10 is probing the network to get out to the internet, hitting some sort of issue (I’m guessing that it’s authentication in my case) and then opening up the default browser and browsing to a Microsoft owned address that results in a redirect to http://www.msn.com. In my case no authentication dialogue box pops up, it just browses to the site and appears to be happy with that. Weird. If it were only happening to “Admin” users I wouldn’t worry about it, but it happens to everyone! So, although not a cause for major concern or enough to halt my roll out of Windows 10 1607, I still wanted to fix it, if possible.

After some research it appears a similar issue to this occurred with Windows 8. I never had this issue during my roll out of Windows 8 but the resolution appears to work for Windows 10 1607 as well. At this stage I don’t know if making this change causes any unforeseen problems, but I’ll add to this post if I see anything. Here’s how to prevent it. Using the registry editor, navigate to the location below, and change the “1” (enabled) to a “0” (disabled).

`1`	`HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet\EnableActiveProbing`

This should stop the browser from opening at login but Internet access should still be available. I hope this helps. If you’ve already done this and it’s caused another issue, please let me know in the comments or tweet me! You’ll probably want to roll this out to your Windows 10 clients, of course you can do it via Group Policy but as it’s a one time setting I would suggest adding it to the Task Sequence that builds your reference image.

Adding the registry change to Group Policy

Open Group Policy Management
Navigate to Group Policy Objects
Right click and Create or edit your Group Policy for your Windows 10 Clients
Navigate to Computer Configuration > Preferences > Windows Settings > Registry
Right click and go to New > Registry Item
Under Key Path enter SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet
Under Value name enter EnableActiveProbing
The Value type should be REG_DWORD
The Value data should be set to 00000000 - that’s six zeros for a Hexadecimal Base or you can just enter one zero for Decimal Base.
Click OK to save the changes.
If you created a new Group Policy Object, you will need to link it to an OU that contains the clients you want the GPO to affect. To do this right click the OU and select Link an existing Group Policy… and then select the Group Policy you created earlier.

Adding the registry change to a Task Sequence

Open Notepad and paste the following into it:

Windows Registry Editor Version 5.00
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet]
"EnableActiveProbing"=dword:00000000

Save the file with any name you like, but it must have the extension .reg
Copy the .reg file to your Deployment server. It needs to be accessible by the Task Sequence, so I put mine in E:\DeploymentShare\Applications\
In the Task Sequence, you’ll want to add it before the Windows Update (Pre-Application Installation) item, so select that item first.
Click the Add button at the top of the sequence, and go to General > Run Command Line.
Select the new Run Command Line item and click the Up button at the top of the sequence to move it above the Windows Update (Pre-Application Installation) item.
On the right hand side of the window, under Name, enter whatever you want, I called mine cmd - disable active probing
Under Command Line enter REG IMPORT Z:\Applications\ActiveProbing.reg
Click OK to save and close the Task Sequence and you’re done!

When you run the Task Sequence to create a reference image, the registry will be edited and during your build phase you won’t get any browser windows opening on login.

If you have any questions or comments, please leave them below.

-Mike