Fazza Posted December 18, 2013 Posted December 18, 2013 Finally got time to tinker with 8.1 on a 'Student' desktop PC. What Group Policy settings have you configured to get it running smoothly on your school network? Any GPO tips/advice are greatly appreciated - especially ones that can help speed up log on times etc!
robjduk Posted December 18, 2013 Posted December 18, 2013 Have you got a 2012 R2 domain controller? I tried to copy the ADMX files over and it spat them out. On your main subject I have dabbled with a test network at home and the xml desktop control is a wonderful addition.
Fazza Posted December 19, 2013 Author Posted December 19, 2013 No we haven't got a 2012 R2 DC, I do have a couple of 2012 R2 member servers though. I've updated the Schema but not added any ADMX files yet. I've got Windows 8.1 installed on one of our Student PCs and I plan to tinker with it in the new year, I thought I pop on to Edugeek to find out what others have done and have found useful so I'm up-to-speed ready for January.
sted Posted December 19, 2013 Posted December 19, 2013 just been altering gpos from a technician pc running 8.1 and settings seem fine. Basically its windows7 settings (with a slightly different software deploy to not install flash), redirecting profiles so that windows 7 and 8.1 profiles are kept separate and user policys is basically the same but with a start screen layout specified. Same redirection policies for docs/start menu etc
3s-gtech Posted December 19, 2013 Posted December 19, 2013 Grab the ADMXs from the PolicyDefinitions folder on the 8.1 PC and whack them into your sysvol PolicyDefinitions. I use a 2008 R2 DC to manage my 8.1 clients, works just fine (the ADMXs work on any DCs newer than Server 2008) - you'll just need to play about if you're using certain GPPs. The policies we're using are mostly to do with customisation - Start Screen icons, scaling options, etc. Other than that, our Windows 7 policies work happily for the most part.
chazzy2501 Posted December 19, 2013 Posted December 19, 2013 I've been looking at the custom start screen for 8.1 so you can specify what icons are on the metro interface. This also works with Side loaded apps. It unfortunately requires the Enterprise edition. Customize Windows 8.1 Start Screens by Using Group Policy Although I hear you can boot straight to desktop. I don't know if that means you can deny metro access.
robjduk Posted December 20, 2013 Posted December 20, 2013 bah my 2008R2 just did not like the admx files. Looking forward to Jan when I get my new DC's up and running.
Fazza Posted December 21, 2013 Author Posted December 21, 2013 bah my 2008R2 just did not like the admx files. Looking forward to Jan when I get my new DC's up and running. Did you upgrade the Schema first?
robjduk Posted December 21, 2013 Posted December 21, 2013 oooooohhhh..... so I upgrade the domain level I can do it then without messing with DC upgrades?
Fazza Posted January 4, 2014 Author Posted January 4, 2014 oooooohhhh..... so I upgrade the domain level I can do it then without messing with DC upgrades? Yes, after updating the schema to 2012 R2 (from an 2012 R2 disk or mounted ISO image) you then install the .admx files (AKA Group Policy Files) and you can then set Group Policies for 8.1. You configure Group Policies for 8.1 in this scenario by installing the RSAT tools on an 8.1 installation, you cant configure them on anything less than 2012 R2 or 8.1. Hope that makes sense.
mattpant Posted January 14, 2014 Posted January 14, 2014 Going back to this post, If anybody does have any GPO's that they've used with Windows 8 / 8.1 that they wouldn't mind pulling out a GPO Report (Pupils / Staff) and sharing them with us I'd appreciate it too... I'm about to setup a new Server 2012R2 with Windows 8.1 Enterprise clients, so if anybody can share recommended GPO settings as a starting block rather then re-inventing the wheel it would be useful. Thanks Matt
eshaq786 Posted January 15, 2014 Posted January 15, 2014 (edited) Computer Configuration (Enabled) Policies Administrative Templates Windows Components/Family Safety [TABLE=class: info3, width: 1885] [TR] [TH]Policy[/TH] [TH]Setting[/TH] [TH]Comment[/TH] [/TR] [TR] [TD]Make Family Safety control panel visible on a Domain[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [/TABLE] User Configuration (Enabled) Policies Windows Settings Folder Redirection Documents Setting: Basic (Redirect everyone's folder to the same location) Path: %HOMESHARE%%HOMEPATH% Options [TABLE=class: info, width: 1885] [TR] [TD]Grant user exclusive rights to Documents[/TD] [TD]Enabled[/TD] [/TR] [TR] [TD]Move the contents of Documents to the new location[/TD] [TD]Enabled[/TD] [/TR] [TR] [TD][/TD] [TD]Disabled[/TD] [/TR] [/TABLE] [TABLE=class: info, width: 1885] [TR] [TD]Policy Removal Behavior[/TD] [TD]Leave contents[/TD] [/TR] [/TABLE] Downloads Setting: Basic (Redirect everyone's folder to the same location) Path: H:\Downloads Options Same as above. Pictures Setting: Follow the Documents folder Videos Setting: Follow the Documents folder Administrative Templates Control Panel [TABLE=class: info3, width: 1885] [TR] [TH]Policy[/TH] [TH]Setting[/TH] [TH]Comment[/TH] [/TR] [TR] [TD]Prohibit access to Control Panel and PC settings[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [/TABLE] Control Panel/Add or Remove Programs [TABLE=class: info3, width: 1885] [TR] [TH]Policy[/TH] [TH]Setting[/TH] [TH]Comment[/TH] [/TR] [TR] [TD]Hide Add New Programs page[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Hide Add/Remove Windows Components page[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Hide Change or Remove Programs page[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Hide the "Add a program from CD-ROM or floppy disk" option[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Hide the "Add programs from Microsoft" option[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Hide the "Add programs from your network" option[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Hide the Set Program Access and Defaults page[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Remove Add or Remove Programs[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [/TABLE] Control Panel/Display [TABLE=class: info3, width: 1885] [TR] [TH]Policy[/TH] [TH]Setting[/TH] [TH]Comment[/TH] [/TR] [TR] [TD]Disable the Display Control Panel[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [/TABLE] Control Panel/Personalization [TABLE=class: info3, width: 1885] [TR] [TH]Policy[/TH] [TH]Setting[/TH] [TH]Comment[/TH] [/TR] [TR] [TD]Prevent changing visual style for windows and buttons[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [/TABLE] Control Panel/Printers [TABLE=class: info3, width: 1885] [TR] [TH]Policy[/TH] [TH]Setting[/TH] [TH]Comment[/TH] [/TR] [TR] [TD]Point and Print Restrictions[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD=colspan: 3][TABLE=class: subtable_frame, width: 1873] [TR] [TD]Users can only point and print to these servers:[/TD] [TD]Disabled[/TD] [/TR] [TR] [TD]Enter fully qualified server names separated by semicolons[/TD] [TD][/TD] [/TR] [TR] [TD]Users can only point and print to machines in their forest[/TD] [TD]Disabled[/TD] [/TR] [TR] [TD=colspan: 2][/TD] [/TR] [TR] [TD=colspan: 2]Security Prompts:[/TD] [/TR] [TR] [TD]When installing drivers for a new connection:[/TD] [TD]Do not show warning or elevation prompt[/TD] [/TR] [TR] [TD]When updating drivers for an existing connection:[/TD] [TD]Do not show warning or elevation prompt[/TD] [/TR] [TR] [TD=colspan: 2]This setting only applies to:[/TD] [/TR] [TR] [TD=colspan: 2]Windows Vista and later[/TD] [/TR] [/TABLE] [/TD] [/TR] [/TABLE] Control Panel/Programs [TABLE=class: info3, width: 1885] [TR] [TH]Policy[/TH] [TH]Setting[/TH] [TH]Comment[/TH] [/TR] [TR] [TD]Hide "Get Programs" page[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Hide "Installed Updates" page[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Hide "Programs and Features" page[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Hide "Set Program Access and Computer Defaults" page[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Hide "Windows Features"[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Hide "Windows Marketplace"[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Hide the Programs Control Panel[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [/TABLE] Control Panel/Regional and Language Options [TABLE=class: info3, width: 1885] [TR] [TH]Policy[/TH] [TH]Setting[/TH] [TH]Comment[/TH] [/TR] [TR] [TD]Restricts the UI languages Windows should use for the selected user[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD=colspan: 3][TABLE=class: subtable_frame, width: 1873] [TR] [TD]Restrict users to the following language:[/TD] [TD]English[/TD] [/TR] [/TABLE] [/TD] [/TR] [/TABLE] Desktop [TABLE=class: info3, width: 1885] [TR] [TH]Policy[/TH] [TH]Setting[/TH] [TH]Comment[/TH] [/TR] [TR] [TD]Do not add shares of recently opened documents to Network Locations[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Don't save settings at exit[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Hide Internet Explorer icon on desktop[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Hide Network Locations icon on desktop[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Prohibit User from manually redirecting Profile Folders[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Remove Properties from the Computer icon context menu[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Remove Properties from the Documents icon context menu[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Remove Properties from the Recycle Bin context menu[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Remove the Desktop Cleanup Wizard[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [/TABLE] Network/Network Connections [TABLE=class: info3, width: 1885] [TR] [TH]Policy[/TH] [TH]Setting[/TH] [TH]Comment[/TH] [/TR] [TR] [TD]Prohibit access to properties of a LAN connection[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Prohibit access to properties of components of a LAN connection[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Prohibit access to the Remote Access Preferences item on the Advanced menu[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [/TABLE] Start Menu and Taskbar [TABLE=class: info3, width: 1885] [TR] [TH]Policy[/TH] [TH]Setting[/TH] [TH]Comment[/TH] [/TR] [TR] [TD]Lock the Taskbar[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Prevent changes to Taskbar and Start Menu Settings[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Prevent users from rearranging toolbars[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Prevent users from resizing the taskbar[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Prevent users from uninstalling applications from Start[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Remove Default Programs link from the Start menu.[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Remove links and access to Windows Update[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Remove Run menu from Start Menu[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Remove the "Undock PC" button from the Start Menu[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Remove the Action Center icon[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Turn off feature advertisement balloon notifications[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Turn off notification area cleanup[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [/TABLE] System [TABLE=class: info3, width: 1885] [TR] [TH]Policy[/TH] [TH]Setting[/TH] [TH]Comment[/TH] [/TR] [TR] [TD]Prevent access to the command prompt[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD=colspan: 3][TABLE=class: subtable_frame, width: 1873] [TR] [TD]Disable the command prompt script processing also?[/TD] [TD]No[/TD] [/TR] [/TABLE] [/TD] [/TR] [/TABLE] Windows Components/Add features to Windows 8.1 [TABLE=class: info3, width: 1885] [TR] [TH]Policy[/TH] [TH]Setting[/TH] [TH]Comment[/TH] [/TR] [TR] [TD]Prevent the wizard from running.[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [/TABLE] Windows Components/App runtime [TABLE=class: info3, width: 1885] [TR] [TH]Policy[/TH] [TH]Setting[/TH] [TH]Comment[/TH] [/TR] [TR] [TD]Allow Microsoft accounts to be optional[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [/TABLE] Windows Components/Credential User Interface [TABLE=class: info3, width: 1885] [TR] [TH]Policy[/TH] [TH]Setting[/TH] [TH]Comment[/TH] [/TR] [TR] [TD]Do not display the password reveal button[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [/TABLE] Windows Components/File Explorer [TABLE=class: info3, width: 1885] [TR] [TH]Policy[/TH] [TH]Setting[/TH] [TH]Comment[/TH] [/TR] [TR] [TD]Display the menu bar in File Explorer[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Hide these specified drives in My Computer[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD=colspan: 3][TABLE=class: subtable_frame, width: 1873] [TR] [TD]Pick one of the following combinations[/TD] [TD]Restrict C drive only[/TD] [/TR] [/TABLE] [/TD] [/TR] [TR] [TH]Policy[/TH] [TH]Setting[/TH] [TH]Comment[/TH] [/TR] [TR] [TD]Prevent access to drives from My Computer[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD=colspan: 3][TABLE=class: subtable_frame, width: 1873] [TR] [TD]Pick one of the following combinations[/TD] [TD]Restrict C drive only[/TD] [/TR] [/TABLE] [/TD] [/TR] [/TABLE] Windows Components/Microsoft Management Console [TABLE=class: info3, width: 1885] [TR] [TH]Policy[/TH] [TH]Setting[/TH] [TH]Comment[/TH] [/TR] [TR] [TD]Restrict the user from entering author mode[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [/TABLE] Windows Components/Network Sharing [TABLE=class: info3, width: 1885] [TR] [TH]Policy[/TH] [TH]Setting[/TH] [TH]Comment[/TH] [/TR] [TR] [TD]Prevent users from sharing files within their profile.[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [/TABLE] Windows Components/Windows Mail [TABLE=class: info3, width: 1885] [TR] [TH]Policy[/TH] [TH]Setting[/TH] [TH]Comment[/TH] [/TR] [TR] [TD]Turn off the communities features[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Turn off Windows Mail application[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [/TABLE] Windows Components/Windows Messenger [TABLE=class: info3, width: 1885] [TR] [TH]Policy[/TH] [TH]Setting[/TH] [TH]Comment[/TH] [/TR] [TR] [TD]Do not allow Windows Messenger to be run[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [TR] [TD]Do not automatically start Windows Messenger initially[/TD] [TD]Enabled[/TD] [TD][/TD] [/TR] [/TABLE] Edited March 29, 2014 by ZeroHour 4
mattpant Posted January 16, 2014 Posted January 16, 2014 Thanks eshaq786 for sharing your settings - much appreciated!
chazzy2501 Posted March 27, 2014 Posted March 27, 2014 I don't suppose anyone has a user gpo export they're happy with, I'd like to use /modify one. I can't find the enthusiasm to trawl through all the new settings.
Sanfoor007 Posted May 5, 2014 Posted May 5, 2014 Hi I want to thank you for the big help of your info about recomended school gpo, what i want to ask you is if you have an ide about a recomended gpo for student exam settings to close all programs and all internet and make only wordpad working. best regards Sanfoor
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now