Re: DST Updates Deployed via Group Policy

On Mar 7, 10:59 pm, "Roger Abell [MVP]" <mvpNoS...@xxxxxxx> wrote:
Hi Jordan, if they are just reg settings and nothing more then
yes, it would not matter how the reg settings got set.
However, I do not know if that is all in the patch.
I am in Arizona and we do not doDSTever, so it is non-issue.
You could try looking at the bulletin/KB as these often list
file versions when files get replaced. You could also unpack
the patch and see what is in there.

Roger

"Jordan" <n...@xxxxxxxx> wrote in message

news:ubnVFgSYHHA.596@xxxxxxxxxxxxxxxxxxxxxxx

In KB914387 Microsoft gives you the registry keys that need to be changed
for W2K. Aren't these "patches" for XP and 2003 just the same registry
entries in a
patch file or is there something more to it?

I am in the EST time zone and when I applied the XP patch to my computer I
saw that my EST reg entries were the same as my 2003 server and 2000
workstations that I patched so far. If these patches are just registry
entries can't I just create apolicyto deploy these registry entries to
all computers

There is a FREE utility from DesktopStandards callled PolicyMaker Registry
Extensions to import the registry keys easily and automatically viaGroup
Policies. Could I just make this a domainpolicyand never have to worry
about patching a computer in the future regardless of XP, 2000, or 2003?

"Roger Abell [MVP]" <mvpNoS...@xxxxxxx> wrote in message
news:%23$TENjLYHHA.4368@xxxxxxxxxxxxxxxxxxxxxxx

"Jeff" <J...@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:08CD91E4-A618-477E-9874-101C2C366F21@xxxxxxxxxxxxxxxx
Thanks for the reply. Yes, your description is accurate, however a
previous
response to my post (from Florian) states that a GPO cannot be linked to
a
SecurityGroup. I thought that it could, but now that its not working,
I
can
see that this must be true (I need to brush up on ADS skills). However,
I
WAS able to select thegroupin the GPO editor so I assumed that it
could
work without creating an OU and moving computer accounts there.

But, if you did do as I had described, then you used what is called
securitygroupfiltering. If the GPO carries computer section settings,
and if you have removed Authenticated Users and replaced this with
your customgroupfor the Read/Apply settings, then the GPO will
be applied by machines that are members of that customgroup,
provided
1) the GPO is linked so that the computers are within its scope
(i.e. linked to the domain, or to an OU that has the computer
objects within or within a sub-OU of the link-point)
2) if the computers at in an OU, that OU is not blocking inheritance
if the GPO is linked at site, domain, or a higher OU level
3) a later applied GPO does not reset thepolicyvalues - not a
concern here where you are using (startup ?) script
4) things are working, that is, the machines are being healthy little
domain members and GPO distribution is working

I am using one machine to test the script at the moment and rebooting it
did
not apply theupdate, however I have not tested the script locally on
the
machine from the Netlogon share because this is the only machine I can
test
without disrupting users at the moment.

No troubleshooting steps except for checking for log entries, however I
am
going to run thepolicyfrom an OU as opposed to thegroupand test it.
--
Thanks, Jeff

"Roger Abell [MVP]" wrote:

So, you are having a startup or shutdown script run, as defined
in a GPO that you have filtered by use of a securitygroupthat
you defined having the machine accounts of W2k machines as
members. This security filtered GPO you have then linked to
the domain, or otherwise sufficiently high that all W2k machine
objects are within its scope of application.
Is this correct?
Have the W2k machines rebooted (needed to see the newgroup
membership as well as to cause the script to run)?
If you place something simple in the script, like
echo this junk > c:\text.txt
can you verify that the script is running?
If you log into one of the machines as an admin can you
manually run the script sourced from the network location ?
What other troubleshooting step/info have your taken/gathered?

Roger

"Jeff" <J...@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:C458D398-DD94-4391-B4E2-6CCF8114AC2B@xxxxxxxxxxxxxxxx
Hello everyone,

Although our shop is mostly XP Pro, sp2 and 2003 servers, we have
some
Windows2000 Pro machines and 2Windows2000 Servers that require
this
update. I've followed instructions in the following KB article:

http://support.microsoft.com/kb/914387/en-us

and all the scripts are setup and replicated, yet none of mywindows
2000
machines are getting theupdate. I have setup a specificgroupfor
Windows
2000 machines and created the GPO object to run that script. We are
using
Windows2003 servers running ADS.

Any ideas?

--
Thanks, Jeff

Also the Microsoft registry fix doesn't work with Group policy as a
computer startup script, you have to change a path inside the
refreshTZinfo.vbs file

replace this:
objSh.Run "control.exe timedate.cpl,,/Z" & szTzKey

with:
objSh.Run "%SystemRoot%\system32\control.exe %SystemRoot%
\system32\timedate.cpl,,/Z" & szTzKey

.

Relevant Pages

  • Re: DST Updates Deployed via Group Policy
    ... if they are just reg settings and nothing more then ... WAS able to select the group in the GPO editor so I assumed that it ... things are working, that is, the machines are being healthy little ... however I have not tested the script locally on ...
    (microsoft.public.windows.group_policy)
  • Re: DST Updates Deployed via Group Policy
    ... In KB914387 Microsoft gives you the registry keys that need to be changed ... saw that my EST reg entries were the same as my 2003 server and 2000 ... WAS able to select the group in the GPO editor so I assumed that it could ... things are working, that is, the machines are being healthy little ...
    (microsoft.public.windows.group_policy)
  • Re: DST Updates Deployed via Group Policy
    ... I did run the script locally on the testing machine ... WAS able to select the group in the GPO editor so I assumed that it could ... things are working, that is, the machines are being healthy little ... Windows 2000 Pro machines and 2 Windows 2000 Servers that require this ...
    (microsoft.public.windows.group_policy)
  • RE: Disabling USB mass storage
    ... > registry on each to disable usb drive creation. ... As part of your script, have it report back on the status. ... customer machines, but everything we do has to be deployable on a very large ... > We tried restricting usbstor.sys through the GPO, ...
    (Focus-Microsoft)
  • Re: DST Updates Deployed via Group Policy
    ... WAS able to select the group in the GPO editor so I assumed that it could ... I am using one machine to test the script at the moment and rebooting it did ... Have the W2k machines rebooted (needed to see the new group ... Windows 2000 Pro machines and 2 Windows 2000 Servers that require this ...
    (microsoft.public.windows.group_policy)