You can use dynamic package assignments to have the package only apply to workstations.ī) Create a new include filter in the event log that looks for 4663 events that with the Removable Storage category as shown in the screenshot below. If step 1 & 2 were implemented correctly on a supported platform, then you should see 4663 events being generated on the host where files are being copied to a USB drive.Ī) Create a new event log package (if necessary), assign it accordingly. Unfortunately a reboot is required for this change to become effective. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Storage, HotPlugSecureOpen = 1 (REG_DWORD) Newer Windows 10 builds require a registry value to be present before removable storage auditing is active, as such we recommend simply creating the necessary registry value on all Windows 10 machines: Note: Attached bellow you will find a Windows Batch File that will help to set the correct registry and check the audit policy. Let's see if there is a solution until the October 2022 patchday.See this article on instructions on how to adjust your audit settings. In other words: Microsoft probably tried to patch something, but didn't really get it right. I have installed kb5017308 und yesterday kb5017380, and still I can redproduce the problems with deploy files via gpp, if the "in user context"-box is checked. On the other hand, Rene-Comedian negates this very insight in MS Answers, writing: Yes it resolved our apparent issues with Group Policy Preferences- File actions… we'll see what else is broken soon lol. No idea if this is true – a user named DomLu confirms it: We have an open Microsoft case, and we just got a message from Microsoft that installing Preview Update KB5017380 solve the problem. Because in the Microsoft Answers forum a user wrote:Įveryone with this issue should try latest Preview Update KB5017380 which probably addresses an issue that affects Group Policy Objects. In an email to me, a blog reader raised the question of whether the WSUS snafu, which I addressed in the blog post WSUS chaos: Preview updates for Windows and Net withdrawn as superseded on, had anything to do with the GPO problem.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |