This message was deleted.
# _generals
Slackbot
08/05/2021, 3:23 PMThis message was deleted.
j
James Rankin
08/05/2021, 3:25 PMDepends how they are doing the filtering I think (although am not an expert). I think the policy applies at a Security Filter level and then the WMI filter denies it
r
Ryan Butler
08/05/2021, 3:41 PMWMI filtering on the root domain sounds fun
👍 1
m
Mike Streetz (O_P)
08/05/2021, 3:47 PMWhat I’m worried about is that because every policy is at the root level even if it’s not enforced and they block inheritence it still show up in the applied list
Mike Streetz (O_P)
08/05/2021, 3:48 PMso it’s taking time to process even when the settings are being denied
j
James Rankin
08/05/2021, 3:48 PMYeah seems really stupid
m
Mike Streetz (O_P)
08/05/2021, 3:48 PMI really just want to build a new domain at this point
Mike Streetz (O_P)
08/05/2021, 3:49 PMsome people who are in 40 AD groups have logons of 400 seconds or more
Mike Streetz (O_P)
08/05/2021, 3:49 PMbecause they also have loopback merge
j
James Rankin
08/05/2021, 3:50 PMOof
r
Ryan Butler
08/05/2021, 3:51 PMoh my
Ryan Butler
08/05/2021, 3:51 PMSeeing a bunch of "enforced" ones too?
m
Mike Streetz (O_P)
08/05/2021, 3:51 PMno, hardly anything is enforced, that’s the insane thing
Mike Streetz (O_P)
08/05/2021, 3:52 PMit’s all just dumped at the root level and then blocked lower down
Mike Streetz (O_P)
08/05/2021, 3:53 PMwell, 3 things are enforced, one of them being logon scripts…
k
Kasper Johansen
08/05/2021, 4:26 PMWhy do people do stuff like that?
m
Mike Streetz (O_P)
08/05/2021, 4:28 PMit looks like all the logon scripts are applying even from policies that aren’t enforced
Mike Streetz (O_P)
08/05/2021, 4:29 PMI’m not sure if that’s normal for stuff applied at the root level because literally nobody else does it this way and I’ve never seen it before
k
Kasper Johansen
08/05/2021, 4:30 PMI have seen it plenty of times here in DK.
It's like some people don't understand how GPOs work which is a bit scary since they have been around for more than 20 years
r
Ryan Butler
08/05/2021, 4:30 PMyep that would be normal with the login scripts applying
Ryan Butler
08/05/2021, 4:31 PMThere should be next to no policies at the root outside maybe a domain password pol
k
Kasper Johansen
08/05/2021, 4:31 PMTotally agree
r
Ryan Butler
08/05/2021, 4:32 PMI have had customers do this as well and always painful. The next step I see admins do outside of fixing the problem is create OUs with "block inheritance" and reapply the policies they need
Ryan Butler
08/05/2021, 4:33 PMSo you end up with a bunch of OUs with fed up policies vs just fixing it at the beginning
k
Kasper Johansen
08/05/2021, 4:33 PMYep, seen that too.
I have also seen that loopback processing has been enabled in every single GPO configured on the terminal server OU, because someone thought it was a requirement
😀 1
r
Ryan Butler
08/05/2021, 4:34 PMWMI filtering is garbage and will cause even more processing issues. That's the whole reason for OUs
m
Mike Streetz (O_P)
08/05/2021, 4:47 PMI just want to build them a new domain at this point
😮 1
Mike Streetz (O_P)
08/05/2021, 4:50 PMit has WMI filtering, logon scripts, loopback merge, blocked inheritance and relinking, and 100 GPOs at the root level 1/3 of which are marked as inaccessible
😮 2
j
James Rankin
08/05/2021, 4:50 PMRun GPOZaurr on it and see how the reports look
m
Mike Streetz (O_P)
08/05/2021, 4:51 PMI’ve not used that before, I take it it’s good?
j
James Rankin
08/05/2021, 4:52 PMSomeone here recommended it to me, pumps out a huge HTML file full of GPO data with options to export reports and recommendations - I'm sold https://github.com/EvotecIT/GPOZaurr
m
Mike Streetz (O_P)
08/05/2021, 5:02 PMnice
Mike Streetz (O_P)
08/05/2021, 8:05 PMthere’s a lot of red in these reports