Gpupdate /force on a D.C.? Not positive that forces all Just a thought I had
Sent from my iPhone On Jun 28, 2017, at 10:17 AM, Michael Leone <oozerd...@gmail.com<mailto:oozerd...@gmail.com>> wrote: Notice: This email is from an outside source. Please do not open any attachments, click on any hyperlinks, or respond without first confirming the authenticity of the email. OK, so I've made that change in the GPO, and it creates the file appropriately. So how do I force all my servers to refresh their GPOs, without going to each and doing a "gpupdate /force"? When they automatically check in the next time, this policy should be applied. But how to make that happen NOW, rather than within the next 24 hours (or whatever)? On Wed, Jun 28, 2017 at 9:23 AM, Kennedy, Jim <kennedy...@elyriaschools.org<mailto:kennedy...@elyriaschools.org>> wrote: I will ground my son who wrote that. It should be ‘replace’. That will create it or replace it. Now, why you are not seeing it in gpresult I dunno. You ran the gpresult as a local admin? From: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> [mailto:listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com>] On Behalf Of Michael Leone Sent: Wednesday, June 28, 2017 9:13 AM To: ntsysadm@lists.myitforum.com<mailto:ntsysadm@lists.myitforum.com> Subject: [NTSysADM] Using GPP to fight Petya So I'm confused. Looking at this page: https://www.binarydefense.com/petya-ransomware-without-fluff/ Shows using GPP to create a file "c:\windows\perfc.dat". Apparently, if this file exists, the malware stops (yes, I know that there will be a variant Real Soon Now that avoids this). So I made this change: Computer\Preferences\Windows Settings\Files And followed the web page ("update", copy windowsupdate.log to c:\windows\perfc.dat", make it read-only. Did all this on a testing GPO I keep around for this purpose. Doing Group Policy Modeling Wizard, I see this being applied as a setting to my test VM. Yet when I go an look in c:\windows, I don't see the file.Nor do I see that setting in "gpresult /r /v". What have I done wrong? This e-mail and any files transmitted with it are property of Indiana Members Credit Union, are confidential, and are intended solely for the use of the individual or entity to whom this e-mail is addressed. If you are not one of the named recipient(s) or otherwise have reason to believe that you have received this message in error, please notify the sender and delete this message immediately from your computer. Any other use, retention, dissemination, forwarding, printing, or copying of this email is strictly prohibited. Please consider the environment before printing this email.
