Stop processing items on this extension if an error occurs on this item

Задача: настроить на компьютерах организации экран блокировки отображающий набор картинок
Серверная ОС: Windows Server 2008 R2 с установленной ролью контроллера домена
Клиентская ОС: Windows 7 Pro являющаяся частью домена

Открыть оснастку Group Policy Manager, перейти в Group Policy Objects, создать групповую политику block_screensaver_slideshow
Перейти в режим редактирования групповой политики.

1. Указать права доступа локального каталога хранения изображений.

Computer Configuration -> Policies -> Windows Settings -> Security Settings -> File System
(правой кнопкой мыши New -> Add File)

2. Создать локальный каталог хранения изображений

Computer Configuration -> Preferences -> Windows Settings -> Folder
(правой кнопкой мыши New -> Folder)

3. Копирование файлов изображений в локальный каталог screensaver

Computer Configuration ->Preferences -> Windows Settings -> Files
(правой кнопкой мыши New -> File)

4. Параметры экранной заставки

User Configuration -> Preferences -> Windows Settings -> Registry
(правой кнопкой мыши New -> Registry Item)

User Configuration -> Preferences -> Windows Settings -> Registry
(правой кнопкой мыши New -> Registry Item)

Примечание: праметр EncryptedPIDL содержит путь до изображений в зашифрованном виде, поэтому, что бы получить хэш требуемого пути выполните настройки персонализации на вашем локальном компьетере -> Заставка, выберите заставку «Фотографии» и укажите в параметрах путь, потом скпируейт полученный хэш из реестра (Key path: SoftwareMicrosoftWindows Photo ViewerSlideshowScreensaver)

4. Примените политику на компьютеры и пользователей

AD, group policy, screensaver, slideshow, windows, групповые политки, домен, экранная заставка

Microsoft

Group Policy Objects

Offline Files – Force Offline Files On with Conflict Resolution Policies

Scope Tab:

Location: Apply to your Computers OU or the Root domain, or wherever you want these settings to take effect. They will be scoped by the security filtering.
Security Filtering: Remove Authenticated users, Add CONF_Offline Files_On

Details Tab:

GPO Status: User configuration settings disabled (best practice as we’re not using any user configuration settings in this GPO)

Delegation Tab:

Add, Authenticated Users, Read Permission (best practice and now a requirement with KB3163622)

Edit the policy

Computer Configuration > Policies > Administrative Templates > Network > Offline Files

Allow or Disallow use of the Offline Files feature: Enabled
Configure Background Sync: Enabled
Configure background sync:
Sync Interval (minutes): 10
Sync Variance (minutes): 5
Maximum Allowed Time Without A Sync (minutes): 30
Blockout Start Time (HHMM): 0
Blockout Duration (minutes): 0
Enable Background Sync for shares in user selected “Work Offline” mode: Enabled
Configure slow-link mode: Enabled
UNC Paths:
\domain.localDrives* : Latency=300
\serverUsers : Latency=300
\domain.localDrivesRedirectedFolders : Latency=1
Enable file screens: Enabled
Extensions: <leave empty>
Files not cached: Enabled
Extensions: <leave empty>
Limit disk space used by Offline Files: Enabled
Total size of offline files: 999999
Size of auto-cached files: 999999

Computer Configuration > Preferences > Windows Settings > Registry

\domain.localDrivesRedirectedFolders* (Order: 1)
Action: Update
Hive: HKEY_LOCAL_MACHINE
Key path: SoftwareMicrosoftWindowsCurrentVersionNetCacheSyncConflictHandling
Value name: \domain.localDrivesRedirectedFolders*
Value type: REG_EXPAND_SZ
Value data: 1

Common Tab

Stop processing items on this extension if an error occurs on this item: No
Remove this item when it is no longer applied: No
Apply once and do not reapply: No

The possible values for SyncConflictHandling and a description of each value is listed below:
————————-
0 = No resolution. The conflict is unresolved. This allows the conflict to be processed by other handlers in the system.
1 = Keep the local state. This overwrites the remote copy with the local copy’s contents. If the local copy was deleted, this deletes the remote copy on the server.
2 = Keep the remote state. This overwrites the local copy with the remote copy’s contents. If the remote copy was deleted, this deletes the local copy in the Offline Files cache.
3 = Keeps both copies. Note that this resolution is valid only for sync conflict states where both the server and client copies exist and where at least one of the items is a file. This resolution type is not available when one of the items has been deleted or both items are directories.
4 = Retains the state of the latest operation as determined by last-change times of the items in conflict. If the local item was deleted, the time of deletion is used for comparison.
5 = Write an entry to the sync conflict log and perform no further attempts at resolving the conflict. The interactive user will resolve the conflict through Sync Center at a later time.
6 = Do not resolve the conflict. Do not record an entry in the sync conflict log
7 = Cancel the synchronization operation

Offline Files – Force Offline Files Off

Scope Tab:

Location: Apply to your Computers OU or the Root domain, or wherever you want these settings to take effect. They will be scoped by the security filtering.
Security Filtering: Remove Authenticated users, Add CONF_Offline Files_Off

Details Tab:

GPO Status: User configuration settings disabled (best practice as we’re not using any user configuration settings in this GPO)

Delegation Tab:

Add, Authenticated Users, Read Permission (best practice and now a requirement with KB3163622)

Edit the policy

Computer Configuration > Policies > Administrative Templates > Network > Offline Files

Allow or Disallow use of the Offline Files feature: Disabled

Computer Configuration > Preferences > Windows Settings > Registry

FormatDatabase (Order: 1)
Action: Update
Hive: HKEY_LOCAL_MACHINE
Key path: SYSTEMCurrentControlSetServicesCSCParameters
Value name: FormatDatabase
Value type: REG_DWORD
Value data: 0x1 (1)

Common Tab

Stop processing items on this extension if an error occurs on this item: No
Remove this item when it is no longer applied: No
Apply once and do not reapply: Yes

Redirected Folders (Redirected Folder Users)

Scope Tab:

Location: Apply to your Users OU or the Root domain, or wherever you want these settings to take effect. They will be scoped by the security filtering.
Security Filtering: Remove Authenticated users, Add Redirected Folder Users

Details Tab:

GPO Status: Computer configuration settings disabled (best practice as we’re not using any computer configuration settings in this GPO)

Delegation Tab:

Add, Authenticated Users, Read Permission (best practice and now a requirement with KB3163622)

Edit the policy

User Configuration > Policies > Windows Settings > Folder Redirection

Desktop

Setting: Basic (Redirect everyone’s folder to the same location)
Path: \domain.localDrivesRedirectedFolders%USERNAME%Desktop
Options
Grant user exclusive rights to Desktop: Disabled
Move the contents of Desktop to the new location: Enabled
Also apply redirection policy to Windows 2000, Windows 2000 server, Windows XP, and Windows Server 2003 operating systems: Disabled
Policy Removal Behavior: Restore contents

Documents

Setting: Basic (Redirect everyone’s folder to the same location)
Path: \domain.localDrivesRedirectedFolders%USERNAME%Documents
Options
Grant user exclusive rights to Documents: Disabled
Move the contents of Documents to the new location: Enabled
Also apply redirection policy to Windows 2000, Windows 2000 server, Windows XP, and Windows Server 2003 operating systems: Disabled
Policy Removal Behavior: Restore contents

Downloads

Setting: Basic (Redirect everyone’s folder to the same location)
Path: \domain.localDrivesRedirectedFolders%USERNAME%Downloads
Options
Grant user exclusive rights to Downloads: Disabled
Move the contents of Downloads to the new location: Enabled
Also apply redirection policy to Windows 2000, Windows 2000 server, Windows XP, and Windows Server 2003 operating systems: Disabled
Policy Removal Behavior: Restore contents

Favorites

Setting: Basic (Redirect everyone’s folder to the same location)
Path: \domain.localDrivesRedirectedFolders%USERNAME%Favorites
Options
Grant user exclusive rights to Favorites: Disabled
Move the contents of Favorites to the new location: Enabled
Also apply redirection policy to Windows 2000, Windows 2000 server, Windows XP, and Windows Server 2003 operating systems: Disabled
Policy Removal Behavior: Restore contents

Links

Setting: Basic (Redirect everyone’s folder to the same location)
Path: \domain.localDrivesRedirectedFolders%USERNAME%Links
Options
Grant user exclusive rights to Links: Disabled
Move the contents of Links to the new location: Enabled
Also apply redirection policy to Windows 2000, Windows 2000 server, Windows XP, and Windows Server 2003 operating systems: Disabled
Policy Removal Behavior: Restore contents

Music

Setting: Basic (Redirect everyone’s folder to the same location)
Path: \domain.localDrivesRedirectedFolders%USERNAME%Music
Options
Grant user exclusive rights to Music: Disabled
Move the contents of Music to the new location: Enabled
Also apply redirection policy to Windows 2000, Windows 2000 server, Windows XP, and Windows Server 2003 operating systems: Disabled
Policy Removal Behavior: Restore contents

Pictures

Setting: Basic (Redirect everyone’s folder to the same location)
Path: \domain.localDrivesRedirectedFolders%USERNAME%Pictures
Options
Grant user exclusive rights to Pictures: Disabled
Move the contents of Pictures to the new location: Enabled
Also apply redirection policy to Windows 2000, Windows 2000 server, Windows XP, and Windows Server 2003 operating systems: Disabled
Policy Removal Behavior: Restore contents

Videos

Setting: Basic (Redirect everyone’s folder to the same location)
Path: \domain.localDrivesRedirectedFolders%USERNAME%Videos
Options
Grant user exclusive rights to Videos: Disabled
Move the contents of Videos to the new location: Enabled
Also apply redirection policy to Windows 2000, Windows 2000 server, Windows XP, and Windows Server 2003 operating systems: Disabled
Policy Removal Behavior: Restore contents

Testing and Implementation

Now that you have the Groups, Folder, and GPOs setup, it’s time to add your first user. Add the user directly to the “Redirected Folder Users” group. The next time the user logs in, this policy will take effect and set up the redirected folders structure and move their existing items to the new location.

Add the computer that they log into directly to the “CONF_Offline Files_On” group (after testing, you may nest these groups into other groups if you wish). The next time the policy refreshes on the machine, offline files will be enabled and the automatic conflict resolution policy will be enforced. If you don’t want the computer to use Offline Files, add the computer to the “CONF_Offline Files_Off” group.

If you transition from On to Off, normally the offline files would still remain on the system, however in the Offline Files – Force Offline Files Off GPO, we setup a registry preference to wipe the Client Side Cache database using FormatDatabase. After applying this registry key, a restart is required to actually format the database and remove the files from the system.

Troubleshooting Issues

If you end up having the odd issue here and there, the easiest way to fix it is to rebuild the Client Side Cache (CSC). This will wipe the offline files cache and rebuild it. You shouldn’t have very many issues due to the nature of how this works, but we all know computers occasionally glitch and have issues. To rebuild the CSC, you can execute the command from an elevated command prompt:

REG ADD HKLMSYSTEMCurrentControlSetservicesCSCParameters /v FormatDatabase /t REG_DWORD /d 1

or

Start RegEdit.exe with elevated permissions
Browse to HKEY_LOCAL_MACHINESYSTEMCurrentControlSetservicesCSCParameters
Create new REG_DWORD key with name FormatDatabase with value of 1

or

Copy and paste the following into a “Reset Offline Files.reg” file and then import this into the Windows Registry by using regedit or double clicking on it.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesCSCParameters]
“FormatDatabase”=dword:00000001

After applying this registry key, a restart is required to actually format the database and remove the files from the system.

For a recent XenApp 7.6 project, the IT Manager wanted no one to access various folders shown in the Navigation pane in Explorer, Save, or SaveAs dialogs. This article shows how I solved this request.

Note: This article was updated on 28-Feb-2017 with information some people had requested from Alain Assaf. Alain’s updates are at the bottom of this article.

Updated on 2-Dec-2019 with the missing MSDN link for Default Known Folders in Windows.

The manager wanted the Desktop, Documents and other folders, as shown in Figure 1, removed from under “This PC” for all users for every published resource on every XenApp 7.6 server.

All that should remain is the Local C drive and any mapped drives the user had access to.

The only way I could find to do this is by deleting data from the registry. Insert standard disclaimer for mucking around in the registry here. Make sure you make a backup of the registry keys involved before implementing these changes.

I created a group policy with a Computer Startup script. I named my script DeleteFoldersFromNavigationPane.bat, which has the following content:

reg delete HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerMyComputerNameSpace{B4BFCC3A-DB2C-424C-B029-7FE99A87C641} /f
reg delete HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerMyComputerNameSpace{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0} /f
reg delete HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerMyComputerNameSpace{374DE290-123F-4565-9164-39C4925E467B} /f
reg delete HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerMyComputerNameSpace{1CF1260C-4DD0-4ebb-811F-33C572699FDE} /f
reg delete HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerMyComputerNameSpace{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA} /f
reg delete HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerMyComputerNameSpace{A0953C92-50DC-43bf-BE83-3742FED03C9C} /f

My apologies, but I forgot to save the link to the MSDN article that gave the {CLSID} values for the various folders, and now I can’t find the article.

Update on 2-Dec-2019: I get a lot of requests for other folders. I finally found the MSDN article.

Default Known Folders in Windows

The values for the various folders:

Desktop:   {B4BFCC3A-DB2C-424C-B029-7FE99A87C641}
Documents: {A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}
Downloads: {374DE290-123F-4565-9164-39C4925E467B}
Music:     {1CF1260C-4DD0-4ebb-811F-33C572699FDE}
Pictures:  {3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}
Videos:    {A0953C92-50DC-43bf-BE83-3742FED03C9C}

PLEASE MAKE A BACKUP of the following registry key BEFORE using this StartUp script.

HKLMSOFTWAREMicrosoftWindowsCurrent VersionexplorerMyComputerNameSpace

Once the group policy and script have been created and linked to the Organizational Unit that contains your XenApp 7.x servers, the folders will be removed for EVERY user, as shown in Figure 2.

I could not find a way to make this per user, only per computer. Sorry about that.

I personally think this is an ugly solution but the only solution I could come up with within the time I had.

Update 28-Feb-2017 by Alain Assaf:

To apply these settings to a Windows 2012 R2 deployment, I did the following.

I created a User Policy that I applied to all of my W2012R2 XenApp Servers. I created a Registry Collection and added the following registry settings to remove items from the Navigation Pane within this policy. You will notice some duplication below. In my environment, I had to hide the regular favorites shortcut along with the Library shortcut. In addition, I found different CLSID values for Music, Pictures, Videos, and Documents, so I applied these as well. Note the websites listed in the descriptions below. These sites led me to use a particular registry setting.

Thanks

Webster