ODBC Deployment via GPO

 Deploying ODBC by GPO can be handy when you have a number of systems you need to keep updated.  The first thing is am going to make a few assumptions on this like

1. You already have the driver installed into the system via another method and this is just setting up the connector its self.
2. You know your away around Group Policy Management and import reg keys

You can do this the standard way via the following GPO location

User Configuration > Preferences > Control Panel Settings > Data Sources

But this can have some limitations in what can be done and you can also do it via importing the REG keys from within the GPO.  For this you will need to do the following:

1. Set up the ODBC settings manual within ODBC, make a note if its a System Data or User Data as this changes the key location.
2. Once this is done open reg edit and drill down in to the location of the connector you just made.
   
   User Data Sources
   Located here "HKEY_CURRENT_USER\SOFTWARE\ODBC\ODBC.INI"
   
   System Data Sources
   Located here "HKEY_LOCAL_MACHINE\SOFTWARE\ODBC\ODBC.INI"
3. Once you located the key right click on it and select export and save it to a file.
4. You know just need to open the GPO editor and set up the group policy and use the registry import wizard.
   
   But depending on  if its a system / user data source will change the location of if you do it under Computer or User
   
   Preferences > Windows Settings > Registry
5.  you can then import the reg keys from the above locations, but if you are doing it on a different system then take the reg file you made and import it locally and then in to the GPO.  remember to delete them locally afterwards form the registry

Side note

It also need to export the key from the following location

Software\ODBC\ODBC.INI\ODBC Data Sources

It will make an entry with the same name and a value with which driver you used,  this is needed otherwise it will not show in the ODBC panel

Getting started with Windows AppLocker

AppLocker is a great way to limit the applications a user has access to within Windows 10 or Remote Desk Host systems.

Its quick and easy to get going and once its up and running you can add and change as needed.  Ideally you wan to start it in audit mode only as this way you will get to see what is happening on the Remote Desktop Hosts or the local workstation.

At first you are going to need to make a GPO and give it a name.  it runs at the computer level and not the user so you can disable the user part of the GPO if you do that sort of thing.

The settings are located in Computer Configuration > Polices > Windows Settings > Security Settings > Application Control Polices > AppLocker

Once you are there right click on the "AppLocker" and select "Properties" and mark the polices wish to enforce.

I would suggest at first you set it audit only, so you can monitor what would of happened if it was used.

Once you have set it to audit click "Ok" which will bring you back to the GPO and the AppLocker polices.

Right click on each policy you have enabled and select "Create Default Rules"

This will give a base line of how it just look.

From here you can adjust and add as needed,  just be carful with how many rules you make as each time an application runs the AppLocker will run the rule set until it finds a match and if not kept lean could appear to slow down applications and GPO processing.

Some system variables can be used in path rule condition and some can not,  I found that %USERPROFILE% was not accepted but you can replace it with a wildcard as such "C:\Users\*\APPDATA\LOCAL\MICROSOFT\TEAMS\" say if you wish Microsoft Teams to still work.

Once the policy is set up the only thing left is that you need is to start the Application Identity service other wise the AppLocker will not be enabled on the RDH / local workstation.  you can do this in the GPO under the "System Services" part not the "Services" part but I also like to stick a start for it in "Services" too.

Now its up and running you can check the devices event logs to see what is happening,  the AppLocker logs can be found in.

Applications and Services Log > Microsoft > Windows > AppLocker

Each policy has its own log and Event ID:8003 shows what would of been blocked if the policy was enforced.

Monitor this log for sometime and adjust the AppLocker rules until you are happy then switch to enforce on the GPO.

AppLocker (Windows 10) - Windows security | Microsoft Docs

Requirements to use AppLocker (Windows 10) - Windows security | Microsoft Docs

Optimize AppLocker performance (Windows 10) - Windows security | Microsoft Docs

Understanding the path rule condition in AppLocker (Windows 10) - Windows security | Microsoft Docs

Using Event Viewer with AppLocker (Windows 10) - Windows security | Microsoft Docs

Configure the Application Identity Service | Microsoft Docs

Interactive Logon: Machine inactivity limit not working right

This is a good setting to roll out across your network as it means that devices left unattended for long periods of time will lock them self's but there is a catch.

When you set this time out you must set the screen saver wait time too to be less or equal to the timeout.

If you don't it can default to 60 seconds and lock the desktop even before the machine inactivity limit is reached.  Does not matter if screen saver is enabled or not it still uses the screen saver wait setting.

You can not set the wait setting high then the inactivity limit.

Search Service Tuning on a Remote Desktop Services (RDS) Server GPO Settings

 Recommended GPO Settings

These GPO settings can be updated to turn down the indexing while allowing the Outlook’s instant search feature to function.

• Windows Components/Search
• Allow indexing of encrypted files, Disabled
• Prevent adding UNC locations to index from Control Panel, Enabled
• Prevent adding user-specified locations to the All Locations menu, Enabled
• Prevent automatically adding shared folders to the index, Enabled
• Prevent indexing e-mail attachments, Enabled
• Prevent indexing of certain file types, Enabled
• Prevent indexing public folders, Enabled
• Enable Throttling for online mail indexing, 6 items per minute (maximum is 120 per minute)
• Prevent indexing certain paths:
  file:///C:\*
  outlookexpress://{*}/*
  otfs://{*}/*
  mapi://{*}/*
  mapi15://{*}/*
  ONEINDEX15://{*}/*
  iehistory://{*}/

Copied for Keep sake from

Search Service Tuning on a Remote Desktop Services (RDS) Server - Peters & Associates

Group Policy loopback for Remote Desktop host

When it comes to setting up a Remote Desktop Host,  once you got it running the first thing you will want to do is lock it down.

The issue can be though when you start designing the sites group policy is that what works for a workstation may not work for a desktop host, this is where loopback processing comes in to it.

This setting tells the device how to manage the user and computer polices that are assigned respectively.

The quick answer is to use Replace as this will tell the device to ignore group policy's assigned to user account and only apply polices assigned to the computer account when a user logs in.

https://docs.microsoft.com/en-us/troubleshoot/windows-server/group-policy/loopback-processing-of-group-policy

Group Policy set Start menu on Windows 10 / Remote Desktop Host

 It looks like this may no longer be a developed feature but still works if you make a change to the XML.

https://docs.microsoft.com/en-us/windows/deployment/planning/windows-10-removed-features
Under Taskbar settings roaming, but could be unrelated as its not clear what is included in "Taskbar Settings"

So mileage may vary.

First get a Windows 10 / Remote Desktop host and set up the start menu as you wish it to be.  the open PowerShell and run the following.

Export-StartLayout -Path "<LOCATION>/<FILENAME>.xml"

Open the XML and edit the following line

<DefaultLayoutOverride>

so that it appears like this

<DefaultLayoutOverride LayoutCustomizationRestrictionType="OnlySpecifiedGroups">

save the XML and set the Group policy to the location where it was saved.

User Configuration>Administrative Templates>Start Menu and Taskbar>Start Menu Layout
https://docs.microsoft.com/en-us/windows/configuration/customize-windows-10-start-screens-by-using-group-policy

Windows GPO WMI Filter for Client OS only

 WMI Filters can be used to target devices that GPO should apply to.  This one will only apply to Client OS and not Server.

select * from Win32_OperatingSystem where ProductType="1"