Use GPO to add a single admin user to only one computer on the domain.

UPDATE: This post has some great ideas, however if you’d like an easier way to accomplish this with Item-level targeting navigate to this new post.

This post I’m going to detour from the usual Home Theatre write up. I still have more Home Theatre to go through, however I though I would give this topic a little attention. So recently I embarked on locking down my companies computer systems and what better way to do it with than Group Policy. Well I ran into a little problem when I tried to assign a single user as a local administrator on a single domain computer, it seemed impossible to accomplish with Restricted Groups as they encompass the entire OU no one single computer.

I searched the dark recesses of the internet and I thought I had found a link on social.technet, but as it turned out this did not allow me to do all the work remotely and I had to add additional groups to the computers. Then further looking over what Alan Burchill wrote I concluded that with his implication of the policy local administrators would be able to add other network users as local administrators, this did not work for me. I want to rule with an Iron Fist!!!

Either way what Allan had set out for me in black and white was a very good start and it really helped . Some of the comments in the post also shone some light on the behaviour of the Policy. You can find Allan’s blog post in regards to this here: http://www.grouppolicy.biz/2010/01/how-to-use-group-policy-preferences-to-secure-local-administrator-groups/.

What’s nice about this method is that it will also clean up your policy each time it gets updated or anyone logs on to the computers in the OU. So if anyone adds another admin user to the group they will be removed. Also if you have some old administrators on PCs that were added manually in the past and have since left this will remove them.

Well let’s get on with it then, shall we.

My environment consists of Server 2008 R2 and Windows 7 machines.

I run my policy editor on my local machine, however I recommend you run it off your server since you can run gpupdate /force from there as it propagates faster this way.

1. Start the policy editor  on your server by going to Start > Run > gpmc.msc

Create a new policy under the OU in which you have your domain computers.

12. Edit the policy and navigate to Local Users and Groups, Computer Configuration > Preferences > Control Panel Settings > Local Users and Groups.

3. Right click in the right pane of the window and select New > Local Group, you will be prompted with a New Local Group Policy window.

4. The Action heading should be set to Update,  from the Group name drop down list select “Administrators (built-in)”, check off  “Delete all member users” and “Delete all member groups”. Only use these options on the first Order policy as these are the options used to clear any previously assigned users and groups to the Local Administrators group.

25. Next we will add a single member to this new Local Admin policy. Click Add and you will be prompted with Local Group Member window, in the Name: section type in “BuiltIn\Administrator” this adds the Administrator account present on all machines to the Administrators group. For Action: select Add to this group.

6. Your Local Group Properties window should look like the following image. If yours looks the same go ahead and click OK.

3

7. This will take you back to the Group Policy Management Editor and you will have one policy with Order 1. The order is the order in which these policies get applied in. Since we’ll be adding more policies you may want to rename this policy in the Editor to something more descriptive like “Built in Local Admin”, highlight the policy and press F2 to do so.

4

In Allan’s blog he groups  the assignment of the Built in Admin account and Domain Administrators group in one Local Group. What I have found to be the case is that if you have more than one member that is to be added to the Local Group and one of these members does not exists or the spelling is incorrect the Local Group policy will stop processing as soon as it encounters and error and refrain from processing any further Member assignments. As a good practice try and assign one member per Order.

8. Let’s create a new policy. This time we will add the Domain Admins group as Administrators to all the OU computers. Follow steps 3 & 4 again, with one exception, do not check off  “Delete all member users” and “Delete all member groups” leave these unchecked otherwise when this policy is processed it will remove the previous members from policy Order 1  (Built in Local Admin).

9. When adding the member as in step 5, click in the Name: field and hit F3. You will be prompted with a Select a Variable window, select “DomainName” and make sure Resolve Variable is checked off then proceed and click Select. This will populate the Name field in the Group Member window add “\Domain Admins” to this so you have “%DomainName%\Domain Admins” in the Name field and click OK.

5

Your new policy should look something like the following image. You may not have a Domain Admins group on your domain, and if that is the case substitute the name of the group to the one that matches up with your domain administrators group. Now you should have two groups, go ahead and rename the second one as well. I renamed mine to Domain Admins.

6

10. In my 3rd order policy, since by default all local Administrator accounts are disabled, I ended up adding a local user account named “User” to all computers in the OU. Right click and select New User. It’s very similar to creating a new user on the domain.

7

11. In my 4th order policy I assign the User account to the Administrators (built-in) group. The only difference between this step and step 9 is instead of using the %DomainName% variable I’m using the %ComputerName% variable. Also to note you don’t need to hit F3 to select the variable you can type the information in manually ie. “%ComputerName%\User”. It should look like the following image. Click ok and rename the policy.

8

12. Now this is where the magic happens and we create an individualized local admin policy for a single computer. Before we create the policy we need to rename the Administrator group on each computer to something unique, after pondering this for a while I came up with the following solution. Create a new Local Group policy. Action: Update, Group Name: Administrators (built-in), Rename to: %ComputerName%.ADMIN. Do not Add any members leave this portion blank and click OK. Rename the policy if you would like.

9

The key here is the %ComputerName%.ADMIN, each computer will rename the Administrators group locally to something unique to that computer in this case it will use it’s name. For example a computer named DMCL-00203 will rename the local admin group to DMCL-00203.ADMIN. As seen below.

13

Once you have this in place you are able to add individual local administrators by creating new Local Group policies with higher orders than the policy which renames the local admin group.

13. To add a local administrator to computer DMCL-00203 create a new Local Group policy, Action: Update, Group name: DMCL-00203.ADMIN add a member using %DomainName%\UserId, UserID being a valid domain account.

11

You can add more member accounts to this policy just know that if it errors out or the account is invalid there is a possibility that the policy will not be applied to the computer. That is it, now you should have 6 policies in place depending on how many computers need local admin users. The order of the policies are important, for example you can not assign a local user to the admin group in order 6 if the user account gets created in order 7. Keep this in mind when designing your policy.

12

IMPORTANT UPDATE: So it seems the Active Directory likes to show all the computer admin groups created with in the policy on one single computer (see below). However that does not mean that the users in these groups have admin access to all computers on the network, having tested this they only have access to the computer they are assigned to. This is purely aesthetic.

adminoooIn order to avoid this purely asthetic replication to other computers except the target machine use “Item-Level Targeting”, it is available under the common tab. So at the end of step 13. click the common tab, and check item level targeting and click the Targeting button. Then in the Targeting Editor select New Item and Computer Name, then Type in the computer name or look it up in the Domain using the … button.

14 15

Pioneer VSX-1123-K

New for 2013 is the VSX-1123-K flagship non Elite series receiver from Pioneer. Airplay, HTC connect, Push Play for Android from the iControlAV2013 app, DLNA, MHL, Pandora and Internet radio. And that’s just scratching the surface. It has a plethora of codecs it can play, lossless audio formats, upconverts sources to HDMI and 4K resolutions, Audio Return Channel and 3D capable. It has two HDMI zones, two Audio zones, 90 watts per channel for 8 ohm impedance speakers and 165 watts per channel for 6 ohm impedance speakers. I would take the wattage with a grain of salt however. This also has the A/B Class amplifiers.

IMG_20130512_151054

First before I begin I think I need to cover Pioneer MCACC a bit. MCACC stands for Multi-Channel Acoustic Calibration System, and it is a piece of software built into the receiver which optimizes the sound for your room. You plug in a mic that comes with the unit and set it up at ear level where you would sit and listen to your music, movies and other audio sources. It will adjust the system sound and generate the best acoustics and listening levels for your room. Your first run you want to run MCACC in Full Auto, ALL CH ADJ, with the following speaker settings, either Normal(SB/FH), Normal (SB/FW), or Speaker B. Unless you have THX speakers set that option to no. Also for the above setting you need to to have at least a 5.1 system. I set my receiver to Speaker B when I ran MCACC. After I ran MCACC and then I copied the results to all 6 memory slots, just so I can have a backup when tweaking the settings. Even though I copied the results I only adjusted the speaker distance and some of the levels on only the first memory slot. Also MCACC will let you know if you have the phase of the speakers crossed, positive going to negative instead of positive going to positive and negative going to negative.

IMG_20130512_151124

This receiver has really good ventilation, nice big gaps in the case for heat dissipation. It gives off a lot less heat then my previous unit. Buying an A/B class amplifier that was my biggest concern, that it will generate a lot of heat. Fortunately that is not the case here, you could potentially put something on top of it provided of course that it has enough clearance but I would advise against it. Unlike my previous receiver this one will not cook breakfast.

Crossover or X.Over frequency is the frequency at which the LFE channel or the .1 channel for the subwoofer gets cut off at. Anything above this frequency will not be sent to the subwoofer. Also, apparently when studios mix the soundtracks to accommodate those without subwoofers the LFE gets mixed to the other channels as well. How much I am not sure. When you set the subwoofer to Plus the receiver will ignore the X.Over and all bass will be sent to this channel. If you have set the front speakers to Large and the Sub to just Yes, the full range of the L+R channel will be sent to the Large speakers. For instance my front speakers have a fq response of 37Hz to 20kHz, the sub covers 37Hz to 200Hz, this means that if I have a X.Over of 80Hz and my speakers set to large, the L+R channel will not be cut off below 80Hz and these channels will receive the full spectrum of the soundtrack. The subwoofer however will only receive the LFE (.1) channel at 80Hz and below. LFE channel only goes up to about 120Hz, so why is 80Hz a popular cut off fq? Several reasons, the Dolby LFE is normally 80Hz and below, DTS contains only about 5% of the LFE between 80 – 120Hz and as far as human perception goes anything 80Hz and under becomes non directional to the human ear more or less. You can set your X.Over at 120Hz or rather 150Hz and get the full LFE track. Alternatively setting a crossover for small speakers will send fq’s above this cut off to the small speakers and anything below to the woofer. If you want some more reading in regards to this, pages 132 to 134 of the official MCACC thread on AVS Forum have more detail. http://www.avsforum.com/t/1112470/official-pioneer-mcacc-thread/3930

I think the biggest mistake people make when they buy this receiver is that they do not run the MCACC, they don’t read the Manual, and that they don’t know how to set the receiver to playback the soundtrack properly. Read the manual, there are a lot of settings on this receiver for a reason and going in blindly will only result in your frustration. Personally there are two settings you need to understand AUTO SURROUND, ALC, DIRECT and PURE DIRECT. Here what the Manual says about these. DIRECT – Plays back sound from the source with the least modification next to PURE DIRECT. With DIRECT, the only modifications added to PURE DIRECT playback are calibration of the sound field by the MCACC system and the Phase Control effect. PURE DIRECT – Plays back unmodified sound from source with only minimal digital treatment. Direct mode uses EQ and Standing Wave. Pure Direct does not. Pure Direct only uses the channel level and distance settings gathered from your calibration. ALC (Auto Level Control) is perfect for night viewing, with this setting all channels will output at the same level. AUTO SURROUND, as it specifies picks the best surround mode for you on the receiver.

I generally use Direct for all my listening needs as it applies the MCACC treatment in only a limited manner. I like the way it sounds, in movies it makes it sound lively. This is a subjective preference though. Compared to my AVR 2650 from Harman Kardon this receiver kicks ass. It does not have that boomy sound, and it balances the Highs, Mediums, and Lows quite nicely. Where as my H/K sounded kind of flat. After running MCACC on this Pioneer and tweaking the levels a bit afterwards I feel immersed in the movies. This device gives me that Theater sound experience that I did not know I was lacking with the H/K Avr 2650. Either way I am satisfied with the sound reproduction on this.

The iControlAV2013 app. I use an Android device the Nexus 4, and the app is a convenient way to browse my music library on my DLNA server and phone itself. The Push Player in the input section of the app tries to mimic the Airplay feature from iOS devices, it does a nice job. The Push Player has a nice layout and is very easy to use. Using the volume rocker on my phone will respectively turn the receiver’s volume up and down. When playing music via push player an icon appears in the status bar of the phone for quick and easy access. The fact that I can be lying on my bed and turn on my receiver via the app is very nice, then I can browse and push songs to it. Before you can do that the Network standby feature needs to be turned on in the menu. You can switch zones and sources with the app, control volume, switch inputs, change listening modes, change the balance, phase, emphasize the bass or treble, and many other features. It is a nice visual representation of the controls available for the receiver. Mostly I use the app for playing music, when I’m watching TV or Movies I reach for the remote. Also the App is free for both Android and iOS.

The DLNA server connectivity option is also great, I have a linux media server at home and this device connects to DLNA server perfectly. I use Plex Media Server. I love being able to stream my complete music library to the receiver and with this supporting lossless formats I don’t need to convert anything. One thing to note and I have found this a constant on the net, and even in my past personal experience windows DLNA server which is built into some of Microsoft products is less than stellar and has connectivity issues. Even if you get the device to see the server once that does not necessarily mean it will see it again. Take it from an IT guy, find yourself a third party applications like Plex, TVersity or Twonky. These applications are more reliable and are universal not proprietary to the manufacturer. Microsoft product only works well with microsoft product, avoid like the plague.

IMG_20130512_150852The remote has a ton of buttons, I like options, so the buttons are very welcome. Learn the remote and all it’s functions, it can be a quick and easy way to make changes on your receiver. Also it can be used as a universal remote, it is capable of learning other remote codes effectively eliminating a bluray player, TV remote, or any other IR remote. The remote feels very light and flimsy, however the button presses are very responsive and I like the receiver function button. For anyone with kids this prevents the little ones from making changes to the settings if they decide to pick up and play with the remote.

The OSD is not pretty by any means, but who cares it has to be functional. As far as I’m concerned I care about the functionality of the device and the quality of sound reproduction than a pretty interface.

Wi-Fi and Bluetooth are available via adapters, unfortunately you have to buy them seperate. Personally I try not to use Wi-Fi where I can, most of my house is wired, I have two gigabit switches sitting in each room that has a TV and network capable devices. I only use Wi-Fi on my phone and laptop. So this receiver is wired. Bluetooth is very lossy, generally I stay away from streaming music via Bluetooth there is too much quality loss. Also it is very susceptible to interference, if you’re an audiophile this is probably not your cup of tea anyways. Now Pioneer says that it has some sort of tech that improves this, the only way I would consider Bluetooth as a streaming option is if the Bluetooth copied the entire digital file and buffered it in memory for playback. This is the only way that I can see the original file retaining it’s quality, unfortunately I can not find any information on the Pioneer Bluetooth streaming except that you require the Air Jam application for android to stream the songs to the Bluetooth device. Also the Pioneer devices are Apple friendly, including AirPlay and such.

With 7 HDMI inputs and analog source to HDMI and 4K up-scaling you can’t go wrong. It has a second HDMI Zone out, so you can have a different sources on two different TV’s add Zone B speakers and this thing is a sure winner. This device will allow HDMI pass through after it has been switched off. It will pass through the last source that was selected on the receiver before it was turned off.

moses-rtfm

Zone 2 functionality seems to be somewhat of a mystery to people when it comes to this unit. Don’t worry it was to me as well, but then I did a little digging or rather reading and got it going. Remember, RTFM. Either way it was a non issue after that. Settings for Zone 2 are as follows, in the receiver menu go to 4.System Setup – 4a.Manual SP Setup – 4a1.Speaker System and change to ZONE 2.
Then go to 4f.Other Setup – 4f7.Play ZONE Setup, set Play ZONE to ZONE 2. If you are using the secondary HDMI zone you will need to make changes to the HDZONE settings.

You are able to change the contrast, hue, saturation, etc… on this device. Just like the audio options there are many video adjustments that can be made.

ARC also supported on this receiver, unlike my previous receiver this time around it was pretty much plug and play. On the receiver you need to go to the Sytem Setup – HDMI Setup and turn Control On and ARC On. Once you do this you need to setup your TV on Samsungs it’s called AnyNet+ on LG SIMPLINK… etc. Each manufacturer has their own proprietary ame for the CEC control standard. I tested ARC with Netflix and the receiver was playing back the DD 5.1 soundtrack perfectly. For ARC to work in any setup one needs to user an HDMI 1.4 spec cable, see the chart below taken from Wikipedia.

HDMI version

1.0

1.1

1.2x

1.3

1.3x

1.4x

2.0

sRGB

Yes

Yes

Yes

Yes

Yes

Yes

Yes

YCbCr

Yes

Yes

Yes

Yes

Yes

Yes

Yes

8 channel LPCM, 192 kHz, 24-bit audio capability

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Blu-ray Disc and HD DVD video and audio at full resolution[F]

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Consumer Electronic Control (CEC)[G]

Yes

Yes

Yes

Yes

Yes

Yes

Yes

DVD-Audio support

No

Yes

Yes

Yes

Yes

Yes

Yes

Super Audio CD (DSD) support[H]

No

No

Yes

Yes

Yes

Yes

Yes

Deep color

No

No

No

Yes

Yes

Yes

Yes

xvYCC

No

No

No

Yes

Yes

Yes

Yes

Auto lip-sync

No

No

No

Yes

Yes

Yes

Yes

Dolby TrueHD bitstream capable

No

No

No

Yes

Yes

Yes

Yes

DTS-HD Master Audio bitstream capable

No

No

No

Yes

Yes

Yes

Yes

Updated list of CEC commands[I]

No

No

No

Yes

Yes

Yes

Yes

3D over HDMI[142]

No

No

No

No

No

Yes

Yes

Ethernet channel

No

No

No

No

No

Yes

Yes

Audio return channel (ARC)

No

No

No

No

No

Yes

Yes

4K resolution support[143]

No

No

No

No

No

Yes

Yes

Two things, I read somewhere that ARC puts a strain on the HDMI board on the Receiver and that it is recommended to use the Optical instead. I don’t know how much truth that holds. I also want to add that I am no longer using the Geffen HDMI detective with this receiver, I do not get audio and video flicker anymore. If you’re wondering what that is just have a look see at my previous blog post “The device that saved my home theatre.”. It appears that it was the Harman Kardon receivers fault after all, poor HDMI boards.

A lot of people think that you should be able to plug and play something and it should sound amazing. Unfortunately this is the culture a lot of manufacturers are breeding, specifically Apple. I have to disagree. You are able to get away on this receiver by just running the Advanced MCACC and leave it at that, and the receiver will sound beautiful. However if you want the Maximum out of your experience I suggest you play with some of the sound options. Start with the basic stuff like levels and balance, then perhaps work your way up to adjusting the EQ and seeing what sounds the best for your environment and listening pleasure. One buys a receiver so they can get the best out of their home theatre, take some time and learn the functions if you don’t understand them, play with them see what they do to your sound reproduction.

I have to give a big shout out to the people of AVS Forum in the MCACC thread. While I was figuring out this receiver they were a huge help, and very knowledgeable. A lot of professionals and enthusiasts that have a passion for this stuff. If you ever have any questions about AV stuff I recommend navigating over there and asking some questions. Thanks

I give this receiver 8 out of 10, the instructions could have been much clearer and the X Over settings are very confusing to beginners. However the sound and connectivity of this unit are simply amazing.

Things to come.

It’s been a month since I posted, but the blog has been on the back of my mind and I have a series of posts that I have drafted in my memory. I’ve been a little busy setting up my home theatre and dealing with defective receivers/TV’s.

I’m still waiting on my passive 3D TV from LG, it should be in at some point this week. I even bought a couple 3D blurays to test the 3D out. Jurassic Park and The Hobbit. 

As far as my receiver trouble goes, the HDMI board blew on my Harman Kardon AVR 2650, so I have been dealing with that. This was my second H/K receiver in one year and so I returned the product for a full refund to Amazon. In the last few weeks I have been researching a replacement, finally I decided on a Pioneer VSX-1123-K. I liked the feature set and connectivity options this receiver had to offer. Also in the AVS Forum pioneer receivers came highly recommended so I took the plunge.

First Impressions were good, I liked the fact that the remote was riddled with buttons, labels and sub labels. To me this means one thing this thing has options, and if there is one thing I like in my electronics, it is options. The remote felt kind of light and cheap, H/K remote was a bit heavier and beefier.

The sound after running the MCACC is much nicer on the Pioneer, it seemed the the HK preferred the boomy sound over a fine balance of highs, mids, and lows. I really love the sound on this receiver, it is very movie theatre like.

I no longer need the HDMI detective, video and sound flicker is gone this receiver has none, and finally I have the ARC working from my TV to the receiver. 

The Android app for the receiver is a nice bonus as well.

I will do a full review on the Receiver in the near future, I’m still playing with it and figuring out the speaker settings. The cross over on the Pioneers is a little different than the competition, instead of each speaker having it’s own crossover the crossover is universal, however there are other factors that play into Pioneers crossover.

In the next series of posts I will cover a home theatre setup, starting with server and media player, receiver, and finally TV. 

Cheers.