Group Policy

Over the years I have worked with Group Policy in many different ways. My experience ranges from helping an enterprise client establish a brand new set of policies for physical PCs and VDI machines to authoring ADM/ADMX/ADML files. Last year I presented and wrote a very detailed analysis of the impact of Group Policy on user logon performance (blog posts). Along the way I learned a lot about the strengths but also about the weaknesses of Group Policy. This article is an account of the latter.

This article is based on my Citrix Synergy 2015 session and is the fourth in a mini-series on Group Policy performance. All measurements by uberAgent on Windows Server 2012 R2 with Citrix XenApp 7.6 in a steady state. Please start reading with the first article.

This article is based on my Citrix Synergy 2015 session and is the third in a mini-series on Group Policy performance. All measurements by uberAgent on Windows Server 2012 R2 with Citrix XenApp 7.6 in a steady state. Please start reading with the first article.

This article is based on my Citrix Synergy 2015 session and is the second in a mini-series on Group Policy performance. All measurements by uberAgent on Windows Server 2012 R2 with Citrix XenApp 7.6 in a steady state. Please start reading with the first article.

This article is based on my Citrix Synergy 2015 session and is the first in a mini-series on Group Policy performance. All measurements by uberAgent on Windows Server 2012 R2 with Citrix XenApp 7.6 in a steady state.

Among the many security options that are configurable via Group Policy, there is a setting Interactive logon: Require Domain Controller authentication to unlock workstation. For security reasons, this is often enabled. Let’s have a closer look at the implications. Those are different from what one might think because the name is a little misleading.

Managing Internet Explorer via group policy is a daunting task. Hundreds of policies are available to control the browser’s user interface, security settings and much more. This article lists strategies and scripts I have found helpful.

As before this is mainly a condensed and beautified version of my twitter postings. You can get them unfiltered and without delay by following me. Office 2010 Here is a nice overview of the new Office suite by Mark Wilson. By the way: Although available as 32-bit and 64-bit versions, the 32-bit version is the default and recommended by Microsoft for the time being.

Bugs and Annoyances ICA connections initiated over the ICA client object (ICO) SDK fail because 128-bit encryption cannot be enabled. Apparently, setting EncryptionLevelSession does not work. Annoyingly, this bug is more than a year old, was fixed in the ICA client 10.2 and reappeared in the current version 11.0. Bugs like this one are bad for the entire Citrix ecosystem, because they break cool tools like Citrix Quick Launch, xConnect and others I may not even know about. [Update 2009-09-30: this bug has been fixed in ICA client 11.2.]

The documentation of Citrix User Profile Manager (UPM, for short) recommends excluding the following registry keys from processing: HKEY_CURRENT_USER\Software\Policies HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies The net effect of this is that the Citrix profiles managed by UPM do not contain any policy settings. The reasoning behind this being: Policies are reapplied anyway during the next logon, so there is no reason to waste CPU cycles on synchronizing such “redundant” information.

I confess: I like group policies. They are and have always been a great way of managing computer and user settings ever since their conception and introduction with Windows 2000. Of course, at the beginning management tools were nonexistent. But we were so happy not to have to rely on NT4’s system policies any more that we did not even notice. Then came GPMC, and life started to become truly great. RSOP! Group Policy modelling! Those are great tools for every admin!

Update: The ADM file can now be downloaded here. I recently came across a post in the Windows Server Performance Team’s blog that lists several registry values which can be used to tune Explorer’s SMB performance by modifying the following: