[研究][GCB]LocalGPO.msi試用 (Windows Server 2019)
2020-06-30
以前微軟官方有提供下載,現在不提供了。
根據
LocalGPO Tool 只支援到 NT 6.2,並沒有支援
NT 6.3 - Windows 8.1, Windows Server 2012 R2
NT 10.0 - Windows 10, Windows Server 2016, Windows Server 2019
********************************************************************************
這裡有方法可以修改,讓 LocalGPO 可以在新版 Windows 上執行。
( 若為 x64 系統,則為 C:\Program Files (x86)\LocalGPO\LocalGPO.wsf,此事該文件沒寫 )
2.搜尋「Sub ChkOSVersion」
把
If(Left(strOpVer,3) = "6.2") and (strProductType <> "1") then
strOS = "WS12" |
改成下面,存檔。
If(Left(strOpVer,3) = "10.") and (strProductType <> "1") then
strOS = "WS12"
ElseIf(Left(strOpVer,3) = "10.") and (strProductType <> "1") then
strOS = "Win8"
ElseIf(Left(strOpVer,3) = "6.3") and (strProductType <> "1") then
strOS = "WS12"
ElseIf(Left(strOpVer,3) = "6.3") and (strProductType <> "1") then
strOS = "Win8" |
Windows Server 2019 和 Windows Server 2016 是相同核心,都為 NT 10.0,理論上 GPO 可以通用。
為了驗證套用情況,把 Windows Server 2019 遠端桌面開啟,先測試可以正常登入。
開始套用GPO,執行
C:\Program Files (x86)\LocalGPO>cscript LocalGPO.wsf /path:C:\GCB\GPO\GCB-WindowsServer2016-gpos\WindowsServer2016AccountSettings\{4eab021f-d752-4ede-9230-e4eaedbe4172}
Microsoft (R) Windows Script Host Version 5.812 Copyright (C) Microsoft Corp. 1996-2006, 著作權所有,並保留一切權利
Modifying Local Policy... this process can take a few moments.
Applied valid INF from C:\GCB\GPO\GCB-WindowsServer2016-gpos\WindowsServer2016AccountSettings\{4eab021f-d752-4ede-9230-e4eaedbe4172} No valid Audit Policy CSV to apply in C:\GCB\GPO\GCB-WindowsServer2016-gpos\WindowsServer2016AccountSettings\{4eab021f-d752-4ede-9230-e4eaedbe4172}
Local Policy Modified!
Please restart the computer to refresh the Local Policy
C:\Program Files (x86)\LocalGPO>cscript LocalGPO.wsf /path:C:\GCB\GPO\GCB-WindowsServer2016-gpos\WindowsServer2016CommonSettings\{2AB0C8F5-631B-48DB-B420-083580D08176} Microsoft (R) Windows Script Host Version 5.812 Copyright (C) Microsoft Corp. 1996-2006, 著作權所有,並保留一切權利
Modifying Local Policy... this process can take a few moments.
Applied valid INF from C:\GCB\GPO\GCB-WindowsServer2016-gpos\WindowsServer2016CommonSettings\{2AB0C8F5-631B-48DB-B420-083580D08176} Applied valid Machine POL from C:\GCB\GPO\GCB-WindowsServer2016-gpos\WindowsServer2016CommonSettings\{2AB0C8F5-631B-48DB-B420-083580D08176} Applied valid User POL from C:\GCB\GPO\GCB-WindowsServer2016-gpos\WindowsServer2016CommonSettings\{2AB0C8F5-631B-48DB-B420-083580D08176} Applied valid Audit Policy CSV from C:\GCB\GPO\GCB-WindowsServer2016-gpos\WindowsServer2016CommonSettings\{2AB0C8F5-631B-48DB-B420-083580D08176}
Local Policy Modified!
Please restart the computer to refresh the Local Policy
C:\Program Files (x86)\LocalGPO>gpupdate /force 正在更新原則...
電腦原則更新已成功完成。 使用者原則更新已成功完成。
C:\Program Files (x86)\LocalGPO> |
執行錯誤情形 (弄錯路徑)
C:\Program Files (x86)\LocalGPO>cscript LocalGPO.wsf /path:C:\GCB\GPO\GCB-WindowsServer2016-gpos\WindowsServer2016AccountSettings Microsoft (R) Windows Script Host Version 5.812 Copyright (C) Microsoft Corp. 1996-2006, 著作權所有,並保留一切權利
Modifying Local Policy... this process can take a few moments.
No valid INF file to apply in C:\GCB\GPO\GCB-WindowsServer2016-gpos\WindowsServer2016AccountSettings No valid Audit Policy CSV to apply in C:\GCB\GPO\GCB-WindowsServer2016-gpos\WindowsServer2016AccountSettings
There are no settings to apply in C:\GCB\GPO\GCB-WindowsServer2016-gpos\WindowsServer2016AccountSettings
No changes made to Local Policy!
C:\Program Files (x86)\LocalGPO>
|
(下圖)再次執行遠端登入到該台電腦
注意,套用後,administrator 會被改名為 Renamed_Admin,且關閉遠端桌面登入。
還原執行
C:\Program Files (x86)\LocalGPO>cscript LocalGPO.wsf /Restore Microsoft (R) Windows Script Host Version 5.812 Copyright (C) Microsoft Corp. 1996-2006, 著作權所有,並保留一切權利
Modifying Local Policy... this process can take a few moments.
Restoring Security Settings... Restoring Administrative Template settings... Restoring Advanced Audit Policy... Restoring MLGPO... Refreshing Local Group Policy...
Local Policy default values restored!
Please restart the computer to refresh the Local Policy
C:\Program Files (x86)\LocalGPO>gpupdate /force
C:\Program Files (x86)\LocalGPO> |
再次測試遠端桌面,應該可用 administrator 登入成功。
( 如果是用 LGPO.exe,則無法把遠端桌面設定還原回來,因為 LGPO提供的是匯入,不是還原,你可以匯入之前匯出的備份,但這不是還原)
PS:LGPO.exe v2.2 – Local Group Policy Object Utility
因為 LocalGPO微軟不再支援和更新,LGPO有還原限制,目前要管控欲套用的 GCB GPO 的啟用和還原,比較好只有 AD (Active Directory) 環境。
********************************************************************************
2023-12-05 補
參考
下載 LGPO.zip
解壓得到
\LGPO_30\LGPO.exe
\LGPO_30\LGPO.pdf
\LGPO_30\Microsoft Security Compliance Toolkit - Standalone Use Terms.pdf
其中 LGPO.exe 是 3.0 版,是 2020-04-14 釋出
(完)
相關
[研究][GCB]先套用GCB後安裝SQL Server 2019測試
[研究][GCB]Windows 2019 AD 主機套用 GCB、啟用、停用
[研究][GCB]已安裝SQL Server 2019後套用GCB測試
[研究][GCB]「本機安全性原則 (secpol.msc)」還原LGPO套用GCB測試
[研究][GCB]遠端桌面連線出現「系統管理員已限制您可以使用的登入類型 (網路或互動式)。」
[研究][GCB]LGPO.exe試用 (Windows 2019)
[研究][GCB]LocalGPO.msi試用 (Windows 2019)
[研究][GCB] Microsoft Security Compliance Manager 4.0 安裝試用