Group Policy - UAC Levels

LEVEL 1

 

Never notify me when:

Programs try to install software or make changes to my computer.

I make changes to Windows settings.

***

Admin Approval Mode for the Built-in Administrator account = Disabled

 

Allow UIAccess applications to prompt for elevation without using the secure desktop = Disabled

 

Behavior of the elevation prompt for administrators in Admin Approval Mode = Elevate without prompting

 

Behavior of the elevation prompt for standard users = Prompt for credentials

 

Detect application installations and prompt for elevation = Enabled

 

Only elevate executables that are signed and validated = Disabled

 

Only elevate UIAccess applications that are installed in secure locations = Enabled

 

Run all administrators in Admin Approval Mode = Disabled

 

Switch to the secure desktop when prompting for elevation = Disabled

 

Virtualize file and registry write failures to per-user locations = Enabled

---------------------------------------------

LEVEL 2

 

Notify me only when programs try to make changes to my computer (do not dim my desktop)

Don't notify me when I make changes to Windows settings

***

Admin Approval Mode for the Built-in Administrator account = Disabled

 

Allow UIAccess applications to prompt for elevation without using the secure desktop = Disabled

 

Behavior of the elevation prompt for administrators in Admin Approval Mode = Prompt for consent for non-Windows binaries

 

Behavior of the elevation prompt for standard users = Prompt for credentials

 

Detect application installations and prompt for elevation = Enabled

 

Only elevate executables that are signed and validated = Disabled

 

Only elevate UIAccess applications that are installed in secure locations = Enabled

 

Run all administrators in Admin Approval Mode = Enabled

 

Switch to the secure desktop when prompting for elevation = Disabled

 

Virtualize file and registry write failures to per-user locations = Enabled

 

-------------------------------------------

LEVEL 3

Default - Notify me only when programs try to make changes to my computer.

Don't notify me when I make changes to Windows Settings

***

Admin Approval Mode for the Built-in Administrator account = Disabled

 

Allow UIAccess applications to prompt for elevation without using the secure desktop = Disabled

 

Behavior of the elevation prompt for administrators in Admin Approval Mode = Prompt for consent for non-Windows binaries

 

Behavior of the elevation prompt for standard users = Prompt for credentials

 

Detect application installations and prompt for elevation = Enabled

 

Only elevate executables that are signed and validated = Disabled

 

Only elevate UIAccess applications that are installed in secure locations = Enabled

 

Run all administrators in Admin Approval Mode = Enabled

 

Switch to the secure desktop when prompting for elevation = Enabled

 

Virtualize file and registry write failures to per-user locations = Enabled

------------------------------------------------

LEVEL 4

 

Always notify me when:

Programs try to install software or make changes to my computer

I make changes to Windows settings

***

Admin Approval Mode for the Built-in Administrator account = Disabled

 

Allow UIAccess applications to prompt for elevation without using the secure desktop = Disabled

 

Behavior of the elevation prompt for administrators in Admin Approval Mode = Prompt for consent on the secure desktop

 

Behavior of the elevation prompt for standard users = Prompt for credentials

 

Detect application installations and prompt for elevation = Enabled

 

Only elevate executables that are signed and validated = Disabled

 

Only elevate UIAccess applications that are installed in secure locations = Enabled

 

Run all administrators in Admin Approval Mode = Enabled

 

Switch to the secure desktop when prompting for elevation = Enabled

 

Virtualize file and registry write failures to per-user locations = Enabled

Windows 8.1 KMS Activation

Problem: Nach dem Windows 8.1 Staging ist nicht der Company LockScreen ersichtlich. Es muss zuerst mit einem Benutzer angemeldet werden.  
Wichtig zu wissen: der LockScreen kann erst geändert werden, wenn sich Windows erfolgreich aktiviert hat.
Auf dem Proxy (TMG) müssen für All Users folgende URL zugelassen werden:

• http://go.microsoft.com/
• https://sls.microsoft.com/
• https://sls.microsoft.com:443
• http://crl.microsoft.com/pki/crl/products/MicrosoftRootAuthority.crl
• http://crl.microsoft.com/pki/crl/products/MicrosoftProductSecureCommunications.crl
• http://www.microsoft.com/pki/crl/products/MicrosoftProductSecureCommunications.crl
• http://crl.microsoft.com/pki/crl/products/MicrosoftProductSecureServer.crl
• http://www.microsoft.com/pki/crl/products/MicrosoftProductSecureServer.crl
• https://activation.sls.microsoft.com
• https://activation-v2.sls.microsoft.com:443
• https://validation-v2.sls.microsoft.com:443

 

Details:

http://support.microsoft.com/kb/921471/en-us

Windows 8.1 WLAN Wizard prompt ausschalten

Um bei Windows 8.1 OSD (zb. mit MDT) den WLAN Wizard von Windows zu verhindern, kann im Antwort-File muss folgender Schalter gesetzt werden:

oobeSystem\amd64_Microsoft-Windows-Shell-Setup_neutral\OOBE
HideWirelessSetupInOOBE ==> True

HP Driver Packages

Unter folgenden Links ist ersichtlich, für welche HP Geräteserien es Driver-Packages gibt:

http://ftp.hp.com/pub/caps-softpaq/cmit/HP_Driverpack_Matrix_x64.html

http://ftp.hp.com/pub/caps-softpaq/cmit/HP_Driverpack_Matrix_x86.html

Windows 8.1 - Set Default Programs

Im Businessbereich kommt es oft vor, dass Videos oder Bilder nicht mit der "Windows App" geöffnet werden soll.
Um per Default festzulegen, mit welcher App eine Dateiendung geöffnet werden soll, bietet sich die DISM Funktion DefaultAppAssociations an.

Die Associations können bei einem Referenz Client über die "Standardprogramme" definiert und anschliessend exportiert werden.

Export Associations:
Dism /Online /Export-DefaultAppAssociations:.\AppAssoc.XML



Das Konfigurationsfile kann anschliessend als Vorgabe verwendet werden, oder über Group Policy fest definiert werden.

Export Associations als Vorlage:
Dism /Online /Import-DefaultAppAssociations:.\AppAssoc.XML
Als Standard über Group Policy setzen:
Computer Configuration\Administrative Templates\Windows Components\File Explorer\Set a default associations configuration file


TechNet Dokumentation:
http://technet.microsoft.com/de-de/library/hh825038.aspx

Windows Default Wallpaper

Oft kommt es vor, dass man einem Benutzer ein Corporate Wallpaper als Default konfigurieren will. Der Benutzer soll jedoch anschliessend das persönliche Wallpaper selber wählen können.

Über Group Policy Basis Funktionen ist es lediglich möglich, ein "festes" Wallpaper zu setzen. Der Benutzer kann es nicht ändern.

Mit Nachfolgendem Script wird das Default Windows Wallpaper mit dem Corporate Wallpaper ersetzt und gilt somit als "Default" und für den Benutzer änderbar:

TakeOwn.exe /F %SystemRoot%\Web\Wallpaper\Windows\img0.jpg

icacls %SystemRoot%\Web\Wallpaper\Windows\img0.jpg /reset

rename %SystemRoot%\Web\Wallpaper\Windows\img0.jpg img0.jpg.bak

copy /y <Path>\CorporateBackground.jpg %SystemRoot%\Web\Wallpaper\Windows\img0.jpg

Logon Script Delay bei Windows 8.1 und Server 2012 R2

Gemäss Windows 8.1 und Server 2012 R2 Standard ist für LogonScripts ein Delay von 5 Minuten konfiguriert.

Diese Verzögerung kann über Group Policy geändert / deaktiviert werden.
Computer Configuration/Administrative Templates/System/Group Policy ==> "Configure Logon​ Script Delay"

Legende:
- Not Configured ==> 5 Minuten Delay
- Enabled ==> Default 5 Minuten Delay / Definierbar
- Disabled ==> Kein Delay