Install printer drivers without being a local administrator.

To enable a normal user to be able to point to a network printer, install the drivers and print.  the follow will need to be in place.

1.  Enable the following group policies:  Computer Configuration | Administrative Templates | System | Driver Installation | Allow non-administrators to install drivers for these devices setup classes.

2.  Printer Classes GUID would be :  {4d36e979-e325-11ce-bfc1-08002be10318}
 A list of classes can be found here.

3.  Computer Configuration | Administrative Templates | Printers | Point and Print Restriction.  Disable this setting.

When the policy setting is disabled: 
-Windows Vista client computers can create a printer connection to any server using Point and Print.
-Windows Vista computers will not show a warning or an elevated command prompt when users create a printer connection to any server using Point and Print.
-Windows Vista computers will not show a warning or an elevated command prompt when an existing printer connection driver needs to be updated.


Reference:  http://social.technet.microsoft.com/Forums/en-US/w7itprosecurity/thread/df21d2c2-c2d4-4107-bfe3-bf8c5a1cd946/

Userenvlog for Windows 7

User Environment Log is useful in troubleshooting login issues.  UserEnvLog is not enable by default, this is how you enable it:

1.  Create this folder if it does not exist:  %windir%\debug\usermode
2.  Create a registry subkey "Diagnostics" under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion
3.  Create a new DWORD key  GPSvcDebugLevel
4.  Enter the value 30002 (hex)   http://blogs.technet.com/b/instan/archive/2008/04/17/troubleshooting-the-intermittent-slow-logon-or-slow-startup.aspx

5.  Reboot your machine and login, you should be able to find the Gpsvc.log in the folder %windir%debug\usermode directory.

Enabling winlogon.log
1.  Navigate to the this registry key.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}.
2.  Edit this value :  ExtensionDebugLevel   DWORD    2
3.  Reboot
4.  Log file will be located at %systemroot%\security\logs

Location of My Documents Folder - Folder Redirection

The path to the My Documents folder is stored in the following registry key, where path is the complete path to your storage location:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Value Name: Personal
Value Type: REG_SZ
Value Data: path

Any modification from the default is recorded in the following location and the path listed earlier is also updated:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

Value Name: Personal
Value Type: REG_SZ
Value Data: path

If the administrator redirects My Documents by using group policy folder redirection, the path is present in this value and the option to modify the location of the My Documents folder is not available when you view properties of the My Documents folder.

Display Information about previous logons during user logon - Windows 7

When Windows Active Directory been raised to Windows 2008 domain functional level. you can specify a group policy settings to display information about previous logon. This is a good feature to have especially if you are really security fanatic guy and want to know if your domain account's been compromise in any sense.

The group policy setting is at:
Computer Configuration | Administrative Templates | Windows Components | Windows Logon Options

Display information about previous logons during user logon : Enabled.


Things to watch out for. 

1.  The domain controller will need to have this same setting set to "enabled" before the workstation get the policy otherwise you will get a nasty information like "Security policies on this computer are set to display information about the last interactive login.  Windows could not retrieve this information" and could never login to the domain.

2.  If you have a screen logout policy in place which lock the screen every 15 mins of inactivity, eveytime you hit Control-Alt-Delete to login to the domain, you will be presented with these logon information, user account attributes will be updated and the domain controller will be working extremely hard to replicate these information between each other.  I find this put a lot of load on the DC and really annoying at times.

3.  The registry settings is at : [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"DisplayLastLogonInfo"=dword:00000001

So, if you decided to rollback this settings and disabled the group policy on the domain controller and workstation but your user still getting the nasty information and not able to login.  Most likely you will need to login as local admin and delete this registry key.

Reference:  http://blogs.dirteam.com/blogs/jorge/archive/2008/02/10/showing-last-logon-info-at-logon-in-windows-server-2008.aspx

Enabling Folder Redirection Logging to gather verbose troubleshooting

http://support.microsoft.com/kb/907355

To enable Folder Redirection logging for troubleshooting purposes.  Create a registry key under:
(Please note this only applies to pre-Windows Vista machines)

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics

New DWORD   |  FdeployDebugLevel

0000000F for verbose logging

00000000 for normal logging

The log files will be located at %windir%\debug\usermode\fdeploy.log

For Windows Vista and above, the logs will be in the application log or go straight into the Windows component, Folder Redirection log.

Viewing MSS: GPO settings in GPMC.

Ever wonder how you can view the MSS settings in the management console to look at those FDCC group policy settings from NIST?

1.  Download the Windows 7 Security Compliance Management Toolkit.  This tool replaces the previous version called GPO Accelerator

2.  Install the Windows 7 SCM Toolkit with elevated admin privillege. 

3.  Install the LocalGPO from Start Menu | All Programs | Microsoft Security Compliance Manager | Local GPO

4.  Once installed, go to Start Menu | All Programs | LocalGPO | LocalGPO command-line and Run as Administrator

5.  Execute this command "cscript LocalGPO.wsf /ConfigSCE"

6.  Wait for "Security Configuration Editor has been modified successfully" message.

Launch your GPMC and you should see the MSS settings. i.e. Computer Configuration | Windows Settings | Security Settings | Local Policies | Security Options

Event 1096 The processing of Group Policy failed.

We came across this issue and I think it's worth mentioning it here.

There was the laptop which was not getting any domain machine policy.  Looking at the GPRESULT policy event, it has a lot of Event ID 1096 errors "The processing of Group Policy failed.  Windows could not apply the registry-based policy settings for group policy object LocalGPO."

When you do a "gpupdate /force", you see errors like these:

"Computer policy could not be updated successfully. The following errors were encountered:
The processing of Group Policy failed. Windows could not apply the registry-based policy settings for the Group Policy
bject LocalGPO. Group Policy settings will not be resolved until this event is resolved. View the event details for mor
 information on the file name and path that caused the failure."

So, it turned out that the domain policy cannot be processed due to a problem with the local policy.   To fix this problem, the local policy file will have to be removed.  There is this registry.pol file located at:
c:\Windows\System32\GroupPolicy\Machine.  Rename this file to .bak or whatever and refresh the policy with a gpupdate /force.  The problem will go away.  The policy file could have been corrupted.

Source:  http://social.technet.microsoft.com/Forums/en-US/w7itprosecurity/thread/ccf3b6ef-1321-46bc-95ae-03e534b5ae5c/

Enabling User Environment Debug Logging..

The following KB article is particularly useful if you are troubleshooting group policy issues.
http://support.microsoft.com/kb/221833

Enable logging by inserting the following registry key.

Entry: UserEnvDebugLevel  (DWORD) 
Type:  DWORD
Value: 10002

UserEnvDebugLevel can have the following values:

NONE 0x00000000
NORMAL 0x00000001
VERBOSE 0x00000002
LOGFILE 0x00010000
DEBUGGER 0x00020000

Location in registry:

HKLM | Software | Microsoft | Windows NT | CurrentVersion | Winlogon


Reboot your system and the log file will be created here.

%Systemroot%\Debug\UserMode\Userenv.log

*** Please note that this only work on Windows XP machines.  For Vista and Windows 7, you will need to check the group policy operational log.

Event 8194, The Client-side extension could not remove computer policy settings for { } because it failed with error code '0x8007000d The data is invalid.' See trace file for more details.

I am seeing this error in the application event log on a few Windows 7 clients.
"Event 8194, The Client-side extension could not remove computer policy settings for { } because it failed with error code '0x8007000d The data is invalid.' See trace file for more details."

Resolution:


- Log on to the machine
- Open Windows Explorer
- Navigate to %ALLUSERSPROFILE%\Application Data\Microsoft\Group Policy\History
- Delete all subdirectories under History.  (Please note %ALLUSERPROFILE% would be c:\programdata)


- Open a command prompt
- In the command prompt, enter gpupdate /force
- Verify that subdirectories will populate under %ALLUSERSPROFILE%\Application Data\Microsoft\Group Policy\History

Note: %ALLUSERSPROFILE%\Application Data\Microsoft\Group Policy\History contains a copy of the preferences contained in GPOs. If the copy process failed somehow, an invalid XML file may be left in one of the subdirectories, thus creating the 0x8007000d Error. By following the method described above, a clean copy of the GPOs is created and the GPO is working again.

Also, The following GUID registry keys under both of the following will need to be deleted too.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History