- Printers: set policy to automatically deploy printers, then allow logon to trigger the deployment and set a default printer
- Computer Configuration – Policies – Windows Settings – Printer Connections – Path = \\printserver\{printer_name}
- Computer Configuration – Policies – Windows Settings – Administrative Templates – All Settings – User Group Policy loopback processing mode = enabled (mode: merge)
- User Configuration – Preferences – Control Panel Settings – Printers – Share Printer (name: \\printserver\{printer_name}) – update – Common – Item Level Targeting – computers in OU…
- Printers: allow users to install drivers
- Computer Configuration\Policies\Administrative Templates\System\Driver Installation\Allow non-administrators to install drivers for these devices setup classes >> Enabled >> Device class GUID of printers: {4d36e979-e325-11ce-bfc1-08002be10318}
- User Configuration/Policies/Administrative Templates/Control Panel/Printers/Point and Print Restrictions
- User can only P&P to these servers => Disabled
- User can only P&P to machines in their forest => Enabled
- When installing drivers for a new connection => Do not show warning or elevation prompt
- When installing drivers for an existing connection => Do not show warning or elevation prompt
- Allow users to change system time
- Computer Configuration – Windows settings – security settings – local policy – user rights- change system time
- Allow users to install software (Methods)
- If PCs are Windows 7 Enterprise or above, use AppLocker in AD
- If Network is protected by Enterprise Antivirus, use Endpoint Protection Manager
- Local Administrators Option: create a group such as “LocalAdmins” >> add managers into that group >> Apply a new GP to correct OU >> Computer Configurations\Windows Settings\Security Settings\Restricted Groups >> add “Software Installers” as “Administrators” and “Remote Desktop Users”
- If going the deployed software route: Users > Policy > Software Settings > Software installation then go New > Package… Select the Advanced option and then change the Deployment type to “Published”
- Password Policy
- Computer Configuration – Policies – Windows Settings – Security Settings
- Disable some default Windows behaviors
- Computer Configuration – Policies – Administrative Templates:
- Don’t display the Getting Started welcome screen at logon – enabled
- Disable showing the splash screen – enabled
- Do not show First Use Dialog Boxes – Enabled
- Prevent Quick Launch Toolbar Shortcut Creation – Enabled
- Do not automatically start Windows Messenger – Enabled
- Do not allow Windows Messenger to be run – Enabled
- Lock Control Panel (more restrictive)
- User Configuration > Administrative Templates > Control Panel > double-click “Prohibit access to Control Panel and PC settings” > Enabled > OK
- Launch IE at startup with default Intranet
- Lauch IE: User Configuration\Admin Templates\System\Logon\Run these Programs at logon > Enabled >Items to run at logon: click Show > value=iexplore.exe > OK > OK
- Whitelist Intranet URL:
- User Configuration\Preferences\Windows Settings\ > right-click Registry > New > Registry Item
- Action: Update
- Hive: HKEY_CURRENT_USER
- Key Path: Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\{Intranet.net}\
- Value name: http (and a second key for https)
- Value type: REG_DWORD
- Value data: 1 (base decimal)
- Computer Configuration\Preferences\Windows Settings\Registry\http\Common
- Stop processing items on this extension if an error occurs on this item No
- Run in logged-on user’s security context (user policy option) No
- Remove this item when it is no longer applied No
- Apply once and do not reapply No
- Repeat: Computer Configuration\Preferences\Windows Settings\Registry\https\General and Common
- Repeat: User Configuration\Preferences\Windows Settings\Registry\{http|https}\{General|Common}
- Set default home page of IE: User Configuration > Policies > Administrative Templates > Windows Components > Internet Explorer > right-click “Disable changing home page settings” > Edit > Enabled > Home Page = {Intranet_url}
Categories:
