利用群組原則 GPEDIT 禁止使用程式(阻止變種病毒)

1. 開啟群組原則：開始 → 執行 → 鍵入gpedit.msc → 確定。
2. 選使用者設定 → 系統管理範本 → 系統 → 在右邊視窗裏選「不要執行已指定的Windows應用程式」。
3. 在「設定」一欄下，選「已啟用」→ 顯示 → 分別新增 happys.exe、svch0st.exe、spoclsv.exe、 nvscv32.exe acad.fas Krvnseuve.exe 等己知的相關變種病毒名稱 → 確定 → 關閉群組原則。

如何將windows 2003 server 列於終端機服務管理員清單中

REF URL:http://support.microsoft.com/kb/262852/zh-tw
根據預設值， 僅 Windows Server 2003 終端機服務伺服器及 Windows 2000 為基礎的伺服器與終端機服務安裝在應用程式伺服器模式或在 「 遠端管理 」 模式下通告本身為終端機服務 」 伺服器。 Windows XP 架構的電腦及 Windows Server 2003 的電腦與只能啟用 [ 遠端桌面進行才通告本身為終端機服務 」 伺服器。
意思為:WINDOWS 2003 及 WINDOWS XP 不會出現在DOMAIN 之終端機服務管理員清單中,如要改為可列出時,
A.啟用該台SERVER 之終端機服務(應可用GPO 下全開, LATER TESTING)
B.1. 啟動 「 登錄編輯程式 」 (Regedt 32. exe) 。
B.2. 找出並按一下登錄中的下列機碼：:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server
3. 新增/修改下列登錄值： TSAdvertise
資料類型： REG_DWORD
資料 0x0000001(1)
4. 結束 [登錄編輯程式].
5. 重新開機.

2011/02 notes

add windows 2008

Enable Multiple Remote Desktop Connections in Window

ref http://http://i.nconspicuo.us/2008/11/20/enable-multiple-remote-desktop-connections-in-window-server-2008/

On Windows Server 2008, the Restrict Terminal Services users to a single remote session Group Policy setting determines whether you can connect to your existing physical console session. When this option is enabled, when logging on by default, you will be restricted to a single remote session.

This setting is available in the Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Connections node of the Local Group Policy Editor. You can also configure this setting in Terminal Services Configuration. The Restrict each user to a single session setting appears in Edit settings in the General section.

If you would like to have multiple simultaneous sessions for the same user, please uncheck this setting or set this group policy as Disabled.

*************************

the ref. had some detail and simple description

http://http://theangryangel.co.uk/blog/ms-windows-server-2008-multiple-rdp-connections-per-user

At work it's sometimes useful to allow multiple connections to a server, from the same user account, so that we can get more done at once, or to help out each other.

By default on Windows 2008 server you can't do this. Simple fix: Start up gpedit.msc, go to Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Connections\, find "Restrict each user to a single session" and disable. If you're on a domain and want to apply it to multiple machines, you obviously need to make it a domain policy.

用Window AD /GPMO 發佈Adobe Reader 8.x

1.REF:http://www.adobe.com/devnet/acrobat/pdfs/gpo_ad_8.pdf
2.該MSI 檔之SHARE FOLDER 權限需DOMAIN COMPUTER 或EVERYONE READ
3.MSI 檔可從ftp://ftp.adobe.com/pub/ 進入,至ftp://ftp.adobe.com/pub/adobe/reader/win/8.x/8.1.2/cht/ download 下來

如何以GPO限制WINDOWS AD 人員不能執行某些程式

以 AD 進入,EDIT POLICY AS PIC