The Comms Room

5:00 PM

@HopelessN00b Permissions on the GPO to block the child OU members? Not really well-versed in group policy things.

@HopelessN00b At the OU level, no, there's not - but you could use WMI filters (not recommended) or a Groups based deny (Or more selective apply)

Alternatively, apply an override to disable software restriction

Finally, apply the software restrictions policies further down the tree to remove inheritance altogether / create your OU at a higher level

Dirty hack would be to block inheritence on that OU and apply all other GPO's manually - I have to do this all the time on customer sites to stop shite GPO's hitting my stuff

HopelessN00b

@Dan yeah, I tried linking an inverse policy in the child OU, but did shit, I ended up with matching disallow and unrestricted rules, and the disallows have precedence. Blech. The Groups idea is a good one, though. I'll give that a go.

Basically just need an OU/group to temporarily put computers in for installing software, because it seems that every damned installer in the world runs afoul of our anti-ransomware SRPs. I'm a bit surprised that it's this... um ... convoluted to implement.

Dan

@HopelessN00b I'd just do a clean OU with block inheritence, tbh

Although you'll then get dicked with idiots click the "Enforce" option because they think it's enforcing the settings with the GPO for some reason

HopelessN00b

@Dan Yeah, but then they lose their site-specific settings, firewall exceptions slam shut, big pain in the ass, given that most of our users are at remote sites and dumb as house plants.

Dan

@HopelessN00b Ooh, I see, not like a build OU

In that case, skip the OU

Add a group called "Temporary Software Installation" or something and deny the SRP GPO for that group. Reboot the machine, job done :)

HopelessN00b

5:11 PM

I can't find a decent Q about this on the main... May as well post one, I suppose. Have a reasonable question in a sea of "how do I sync my code repository to India" and "my super-PC is borken" questions.

cole

@MichelZ I thought so

I'm looking at it like "That's not...a service account"

Nathan C

Trying to troubleshoot our phone system...figures we'd get one where support is ...lacking.

At least without filing a detailed support ticket.

Magellan

5:28 PM

That's what support contracts are for

Mornin all

mfinni

1

Q: Quest Migration Manager for Exchange, and custom Managed Folders - causing duplicates

So, we're doing a big cross-forest Exchange (2010->2010) migration, using Quest. It is not working correctly for mailboxes that have custom Managed Folders, which my client uses instead of retention policies. Quest will bring over the "Managed Folders" hierarchy to the target mailbox, but not as...

exchange-2010

Quest DIE DIE DIE DIE

MichelZ

DELL you mean

:)

Nathan C

@Magellan Yeah I know...it's just a weird issue. Phones outside the VOIP network can see the configuration server (as it's being routed by our firewall so people can access their control panels) and get calls and all that stuff ...except they can't view voicemail on the phone.

When they get voicemail, it takes over a day for the phone to recognize it

Transcript for