badders Posted January 26, 2011 Posted January 26, 2011 We will hopefully be moving to Windows 7 workstations in the summer, has anybody got any tips on the best way to create the GPO's for W7 workstations. Can we just use the exisiting XP GPO's or is it best to duplicate the GPO's with WMI filtering for the different OS's, checking which of the XP GPO settings will no longer apply to W7. Thanks.
3s-gtech Posted January 26, 2011 Posted January 26, 2011 Time and testing! There are many, many new settings in the new GPs. I exported my exisiting XP GPO to a new one, then started tweaking and altering on a test machine with it. Had to lose all my old logon scripts, some printer settings, etc. Had to add settings for Libraries, themes, network settings etc. It can be a big job, but just take your time, change just the settings you need, test, then tweak some more. Once done, my staff and student policies work fine on both XP and 7, I don't need to use WMI filtering. 1
jsnetman Posted January 26, 2011 Posted January 26, 2011 I'm still applying my old XP gpo's to win 7. But have the win 7 machine in an OU below the xp OU and applying a seperate policy to win 7 machines via loop back processing. Any policies that aren't relevant to win 7 don't apply and vice versa. We still have the odd old bit of kit still on XP and they both work in this type of setup.
ZeroHour Posted January 26, 2011 Posted January 26, 2011 I duplicated the xp polices and then added all the w7 settings I wanted and used WMI filters myself as some settings were not the same as the xp policy.
badders Posted January 26, 2011 Author Posted January 26, 2011 Think I'll get a w7 vm installed and start looking at how the current GPO's apply and then create duplicates and tweak.
edutech4schools Posted January 26, 2011 Posted January 26, 2011 All our scripts still worked on 7 and most xp policies, only needed to look at folder sync gpo.
kennysarmy Posted January 26, 2011 Posted January 26, 2011 I duplicated the xp polices and then added all the w7 settings I wanted and used WMI filters myself as some settings were not the same as the xp policy. Could you expand on this please? Duplicated - as I just copied and renamed? Added the w7 settings - how? By editing the adm file on a w7 pc? I intend to follow something along your lines and use the WMI filter...but just starting out with w7 so any help would be great...
Stuart_C Posted January 26, 2011 Posted January 26, 2011 I just used my existing ones then whent through and looked at the extra setting for 7. I creteated a temp GPO ten using a 7 test machine applied my current policies and the temp gpo. Spent ages tweeking and playing got what I wanted then copied the settings into my main GPO so it covered very PC. I'd also recomend finding out how to script the pinning of items to the startmenu and task bar if you don't already know how to do it.
ZeroHour Posted January 26, 2011 Posted January 26, 2011 Could you expand on this please? Duplicated - as I just copied and renamed? Added the w7 settings - how? By editing the adm file on a w7 pc? I intend to follow something along your lines and use the WMI filter...but just starting out with w7 so any help would be great... Duplicated using gpmc and renamed to windows 7, to do the wmi filter look at the Windows 7 Gotchas/Tips sticky thread here: http://www.edugeek.net/forums/windows-7/47835-windows-7-gotchas-tips-fyi.html#post554604
kennysarmy Posted January 26, 2011 Posted January 26, 2011 struggling Have edited my Folder redirection policy to apply the WMI filter but it is still applying to the windows 7 test pc as well. screenshots attached. any ideas?
ZeroHour Posted January 26, 2011 Posted January 26, 2011 [ATTACH=CONFIG]9252[/ATTACH][ATTACH=CONFIG]9253[/ATTACH]struggling Have edited my Folder redirection policy to apply the WMI filter but it is still applying to the windows 7 test pc as well. screenshots attached. any ideas? Hmm it all looks okay, can you do a gpresult (its in the gpmc too) and see what it says.
kennysarmy Posted January 26, 2011 Posted January 26, 2011 ah It somehow had kept some cache of the desktop so it looked like all was well.... Once I deleted from the C:\Users folder the test users folder (named 199) and re-logged on it did indeed NOT do the desktop redirecting. Progress! Next question - how do I prevent the local data from caching the desktop?
kennysarmy Posted January 26, 2011 Posted January 26, 2011 bugger that caused a problem...."you have been logged on with a temporary profile windows 7 you cannot access your files" fixed using this guide: Temporary profile is loaded when logged on to the computer. sighs...
SYNACK Posted January 26, 2011 Posted January 26, 2011 I would heavily recommend starting from scratch and using WMI filters for sepoate XP and 7 Policies as I have lost count of how many questions I have answered on this forum alone that have been caused by slightly corupted GPOs or settings that have not converted quite right. My personal solutions to GPOs is to start fresh, read through all of the options and set the ones that need setting. Clean policies mean clean and quick logons without extrenuous registry fragments for XP being pumped into your fresh Windows 7 registry hives.
ZeroHour Posted January 26, 2011 Posted January 26, 2011 bugger that caused a problem...."you have been logged on with a temporary profile windows 7 you cannot access your files" fixed using this guide: Temporary profile is loaded when logged on to the computer. sighs... Thats in the gotchas thread too http://www.edugeek.net/forums/windows-7/47835-windows-7-gotchas-tips-fyi.html#post438279
kennysarmy Posted January 26, 2011 Posted January 26, 2011 Yay I have created a new w7 only policy for disabling w7 gadgets
ZeroHour Posted January 26, 2011 Posted January 26, 2011 One thing I would do is redirect the w7 app data to a different folder from your xp redirection to ensure you have less issues.
SYNACK Posted January 26, 2011 Posted January 26, 2011 Thats in the gotchas thread too http://www.edugeek.net/forums/windows-7/47835-windows-7-gotchas-tips-fyi.html#post438279 and here http://www.edugeek.net/forums/windows-vista/49947-solution-vista-always-loads-temporary-profile-specific-user-account.html?highlight=solution our google rankings must be slipping.
kennysarmy Posted January 26, 2011 Posted January 26, 2011 I would heavily recommend starting from scratch and using WMI filters for sepoate XP and 7 Policies as I have lost count of how many questions I have answered on this forum alone that have been caused by slightly corupted GPOs or settings that have not converted quite right. My personal solutions to GPOs is to start fresh, read through all of the options and set the ones that need setting. Clean policies mean clean and quick logons without extrenuous registry fragments for XP being pumped into your fresh Windows 7 registry hives. Just to be clear to do this I would: 1. Make every existing GPO filtered via WMI to just apply to XP computers. 2. Create blank GPO's filtered via WMI to just apply to w7 computers named as existing prefixed perhaps with "7-" eg. 7-default domain policy & 7-student lockdown policy 3. Edit the new w7 GPO's settings to do what the XP ones did AND more 4. test test test
SYNACK Posted January 26, 2011 Posted January 26, 2011 Just to be clear to do this I would: 1. Make every existing GPO filtered via WMI to just apply to XP computers. 2. Create blank GPO's filtered via WMI to just apply to w7 computers named as existing prefixed perhaps with "7-" eg. 7-default domain policy & 7-student lockdown policy 3. Edit the new w7 GPO's settings to do what the XP ones did AND more 4. test test test Yes, that would be my recomendation, it limits the chances of getting some random setting from old policies that cause all sorts of difficult to trace issues and some things you will want to do differently in 7 which can cause issues if overridded from an XP policy. Specificly the start menu styles in my experience. 1
kennysarmy Posted January 26, 2011 Posted January 26, 2011 Great That's what I will do. One final quetion How do I ensure when I am testing that something is behaving differently due to having logged on with the test user before? I mean how can I make a change to the GPO's, test, logout then ensure when I login again that it's a new clean state? My w7 pc is a virtual machine so is there a better way than constantly having to undo changes or take snapshots etc etc. Cheers.
SYNACK Posted January 26, 2011 Posted January 26, 2011 (edited) Great That's what I will do. One final quetion How do I ensure when I am testing that something is behaving differently due to having logged on with the test user before? I mean how can I make a change to the GPO's, test, logout then ensure when I login again that it's a new clean state? My w7 pc is a virtual machine so is there a better way than constantly having to undo changes or take snapshots etc etc. Cheers. You could leave the profile path blank in AD for the test user so that it saves locally then restart the workstation after each test, delete the local copy with the admin account and then login as the test user again. Local profiles and snapshotting may be quicker or you could make a startup script that wiped the local profile on boot for testing. Edited January 26, 2011 by SYNACK
shoggie Posted January 26, 2011 Posted January 26, 2011 does anyone have any clean new GPO setup for restricting win 7 stations via 2008 r2 servers. Yes I know not all will be good for evey school but somewhere to start would be great. Is this not what edugeek is all about help and advice, if you have done it why not share to save others time. Believe me it would be much appreciated
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now