Sign in
 
HomeLibraryWikiLearnGalleryDownloadsSupportForumsBlogs
Resources for IT Professionals >
> 
> 
> 
Why?

Answered Why?

  • Monday, August 27, 2012 6:46 PM
     
     
    Sign In to Vote
    0
        I'm not understand why Microsoft would enable something that controls settings "BY DEFAULT".  This by nature is a land mine waiting for the trigger to set it off, as other have pointed out.  BTW I wasted HOURS of my life trying to figure out why my image was resulting in settings being changed when I was not changing them and come to find out this "feature" was controlling them when I did not ask it to..... BULLSHIT! Microsoft needs to rethink there "standard" practices.
     

All Replies

  • Monday, August 27, 2012 7:03 PM
     
     
    Sign In to Vote
    0

    Can you provide some additional details?  You haven't provided any context in your e-mail for us to know what you are referring to.

    Thanks,
    -Michael Niehaus
    Senior Product Marketing Manager, Windows Deployment
    http://blogs.technet.com/mniehaus
    mniehaus@microsoft.com

     
  • Monday, August 27, 2012 8:41 PM
     
     
    Sign In to Vote
    0
    Sorry thought I hit reply to an existing thread of people complaining about "Apply Local GPO Pack" being turned on by default in MDT 2012.  Guess I hit new message.
     
  • Monday, August 27, 2012 9:22 PM
     
     Answered
    Sign In to Vote
    0

    Ah, that makes much more sense.

    The decision to add the recommended SCM GPO pack templates was made to ensure that enterprises were using the recommended enterprise security settings.  We talk about this in the documentation, release notes, etc.  It's easy to turn off, either through CustomSettings.ini by setting:

    ApplyGPOPack=NO

    Or by disabling the step in the task sequence.  You can also add your own customized GPO pack (created using SCM and exported as a local GPO), if you want to change any of the settings.  And as always, because these settings are implemented via a local GPO object, they will always be overridden by Active Directory GPOs.

    The only items in the local GPO that generally cause issues are the ones related to clear text passwords and signed SMB communication. 

    Thanks,
    -Michael Niehaus
    Senior Product Marketing Manager, Windows Deployment
    http://blogs.technet.com/mniehaus
    mniehaus@microsoft.com