Disable Autoruns And Group Policy

[6Foot2]

Hi,

 

We have an issue with slow station start-up and slow user logon. I have disabled some of the services that users are unlikely to be using at a test station and the performance has been improved significantly. I would like to find a way to disable these services [or make them manual start] network wide. I am sure that it can be done: I think that I am not finding the right syntax [?] in Group Policy.

 

I will post more detail shortly, I just have to connect to the school via VPN to paste the details into this post [can't do it now because when I use the VPN into school I lose my home Internet connection ]

 

Posting this here and now in case anyone has can point me in the right direction right off the bat?

[MatthewL]

What anti-virus software are you running?

 

Also are your DNS servers on your clients pointing to your own DNS servers?

[6Foot2]

What anti-virus software are you running?

 

Sophos. Should that matter?

 

Also are your DNS servers on your clients pointing to your own DNS servers?

 

Yes. The clients point to our DNS servers first and then to other DNS servers off site. Does this affect what I am trying to do in Group Policy/Registry Settings?

[DrPerceptron]

I suspect it's more of a question of is it something else...

 

As for disabling services... vbs/WMI is capable of disabling services, enabling services etc (probably batch files too thinking about it)

 

In Server 2003, you could control core services from Computer Templates > Security Settings > System Services

 

It'll exist in 2008, probably somewhere pretty obvious, but I've not tried it out yet.

 

 

Autorun has its own policy object in GPMC somewhere too

Edited June 12, 2009 by DrPerceptron

[mac_shinobi]

I suspect it's more of a question of is it something else...

 

As for disabling services... vbs/WMI is capable of disabling services, enabling services etc (probably batch files too thinking about it)

 

In Server 2003, you could control core services from Computer Templates > Security Settings > System Services

 

It'll exist in 2008, probably somewhere pretty obvious, but I've not tried it out yet.

 

 

Autorun has its own policy object in GPMC somewhere too

 

vbs and wmi can stop and pause and start services ( so has the same effect of restarting the services)

 

' ------ SCRIPT CONFIGURATION ------
strComputer = "" ' e.g. fs-rtp01 (use . for local system)
strSvcName = "" ' e.g. dnscache
' ------ END CONFIGURATION ---------
set objWMI = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
set objService = objWMI.Get("Win32_Service.Name='" & strSvcName & "'")

intRC = objService.StopService
if intRC > 0 then
WScript.Echo "Error stopping service: " & intRC
else
WScript.Echo "Successfully stopped service"
end if

intRC = objService.StartService
if intRC > 0 then
WScript.Echo "Error starting service: " & intRC
else
WScript.Echo "Successfully started service"
end if

 

Best piece of code I have found here

 

VBScript Scripting Techniques: Services

[MatthewL]

Sophos. Should that matter?

 

 

 

Yes. The clients point to our DNS servers first and then to other DNS servers off site. Does this affect what I am trying to do in Group Policy/Registry Settings?

 

I know there have been issues with McAfee so wanted to rule that out, also if they were not pointing to your DNS I know this can also cause problems.

 

Not sure on this one to be honest.

[srochford]

Yes. The clients point to our DNS servers first and then to other DNS servers off site. Does this affect what I am trying to do in Group Policy/Registry Settings?

 

Having the wrong DNS settings can make lots of things go wrong and slow processing of group policies is one of those.

 

The client machines should only point to your internal DNS; those DNS servers should then have forwarders configured to point to your ISPs DNS.

 

You can use group policy to configure services to manual startup - it's in the security bit of the machine settings if I remember rightly.