Skip to content

0.3.0

Choose a tag to compare

View all tags
@tebbiworld tebbiworld released this 06 Oct 08:03
· 43 commits to main since this release
0.3.0
50b7bc7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • Logon rules (new page Logon): who may log on to the computers of an OU, locally, through Remote Desktop, or denied. One GPO per rule with user rights by SID. The local Administrators are always kept in the rights that grant a logon, Administrators and Domain Admins can never be denied. Before saving, the page lists other GPOs on the path that set the same rights and tells which one wins (computed like Windows applies GPOs); saving then needs a confirmation, and so does a link to the whole domain.
  • Scripts (new page Scripts): PowerShell logon scripts for users and startup scripts for computers, stored in the GPO folder. A warning for lines that look like a password (SYSVOL is readable by every domain user). Each script can have a cleanup script that runs while the set is being removed.
  • Removal with a waiting period for deployments, policy profiles, logon rules and script sets. Starting the removal keeps the GPO linked and makes the computers remove what it left (tasks are deleted, policy settings go back to the Windows defaults, rights are restored, cleanup scripts run). The removal can be cancelled; after the period (default 14 days, set in the settings and per removal) a daily timer deletes the GPO, or the admin does it on the page. Every step needs a reason and is logged.
  • Policy option "allow convenience PIN sign-in", with a caution: Windows keeps the domain password on the computer for it.
  • GPOs can carry a user part with its own version (needed by logon scripts).

Changed

  • Refused logins of the domain admin or the service account show one neutral message in the UI; the task log says why in one plain line (e.g. account disabled, AD code 533) instead of a traceback.
  • The domain admin fields explain which account is expected (a member of Domain Admins, or the account chosen when the domain was set up).
  • Policy profiles left half removed by the two-step removal of 0.2.0 are taken over by the waiting period on update.

Fixed

  • Renaming a policy profile or a deployment renamed only the entry in the module, not its GPO (displayName in the directory and in GPT.INI).
  • The GPO version was raised also for a delete of a file that does not exist.
  • Missing LDAP attributes were reported as the text b''.

Install or update from the Software Center (catalog of tebbiworld/ns8-repo), or: add-module ghcr.io/tebbiworld/windeploy:0.3.0 1

Assets 2
Loading