Recycling Bin with Redirected Folders

 Recycle Bins and Redirection

The Recycling Bin found on your desktop opens up a window and within that window you have all the items that you have deleted, either accidentally or deliberately.

What you might not know is that every redirected folder has its own recycling bin.  If you have 10 redirected folders you have 10 additional recycling bins, all with their own settings and storage capacities.

You also always have your local recycling bin for every drive. So if you have a C:\ and D:\ drive, you have a recycling bin for both the C:\ and D:\ Drives.

10 Redirected folders + 2 Drives = 12 individual recycling bins.

If you have redirected the music, video and pictures to follow the my documents, you have -3 recycling bins because the music, video and pictures will use the my documents recycling bin.  Just to add to that annoyance.

So when you open the recycling bin from the desktop, you are basically taking all x amount of recycling bins (in our example 12) and viewing them all in one place with no indication of which recycling bin the files exist in.

Below is an example where I have made Pictures and Music have their own redirection and "Videos" follows the Documents folder.

So even though I have one view, the files are actually stored in a completely different locations.

Locations

So lets say you map a drive the P:\ drive to the client.  This P:\ drive is their personal drive.  This drive is a unc path of: 

\\file-server-01\studentsdrives\%username%\documents. 

The Recycling Bin will be found by adding $recycle.bin to the end of that unc path.  

Following from my example above I see:

Notice now in my "Documents" recycling bin I have lost the Music and Pictures files.  This is because they reside in a different recycling bin:

• \\file-server-01\studentsdrives\%username%\Music\$Recycle.Bin 
• \\file-server-01\studentsdrives\%username%\Pictures\$Recycle.bin

So what does this mean for me?

You are an IT Admin and you damn well know people store stuff in their recycling bin and don't delete it.  Now if they do this, then you could have large files that are pending deletion sitting on your server as every redirected folder has their own recycling bins.

I found that a student.. copied a DVD to his "My Videos" file (3.2GB), watched the DVD and then deleted the file.  To him, the file was deleted.  To the Server, it was still there in his Recycling Bin. Even though the My Documents Recycling bin was limited in size, his My Videos Recycling bin has its own size limit and as a result he ended up with a total of 11GB of deleted files when we calculated the combined total of his recycling bin. 

That was one student.. . In high schools with over 1k in student numbers, this is a massive drain on server resources, naturally it justifies the nice new SAN system you want, but schools don't have much money anymore, they never did to begin with and it is just getting worse. 

So how to I manage it?

Well this is the tricky bit now, because there is no pre-set GPO to deal with this.

The easiest way is to use File/Folder Quota Management.  Each recycling bin is set to use a percentage of the allocated size of the allowed disk, but this depends on your folder structures and redirection as you can say your personal folders are only allowed 10GB but your profile folders might be in a different location and you need to then set quotas for those as well. 

Customized GPO

Reference GPO in Zip file

I took the liberty to create a GPO that will enable you to disable and/or specify sizes for each individual redirected folder recycling bin.  

I have tested this with Windows 7 and have confirmed the settings for higher versions.

You can completely disable the redirected folder recycling bin (above)

Or you can specify the size of each redirected folder's recycle bin.

If you right click on your recycling bin on your client computer,  you will find where these settings will apply:

For each recycling bin you either set it so it doesn't move the files to the recycling bin and just deletes them with immediate effect or alternatively you can set the size in MB within the policy. 

For example, I have had my Pictures, Videos and Music to follow the documents folder, I have set, using my GP Objects to limit the documents recycle bin to 3GB and have disabled every other recycling bin.

If they deleted an item from their downloads folder by accident, I can recover it anyway using shadow copy. 

This is how I solved it and if anyone else if having these issues, buy all means try my policies.  The alternative way is to manually alter the registry for each redirected folder, but that made up about 12 preferences which I could do without. Looks messy. 

Hope this helps some out there. 

Regards, 

Open File Security Warning - Complete Resolution

This is one of the most popular topics on the web, its absolutely crazy how many people have been involved in discussions about it.

Welcome to our version on Thoughts of Primary School Tech, ironically with me, a college tech (and manager I might add), my my we have moved one since we first starting blogging on here.

Lets sort the questions out once and for all and get some pictures involved.  None of this, "just add it to gpo" generic responses, or "that is trusted zone, just add it there", nothing more annoying when someone posts up a solution in their own language and you have no clue how to solve the problem.

The Policies

First lets bring up a picture, we all understand pictures.

For those with visual difficulty, this picture shows a side by side comparison of the Server 2012 group policy which affects the 4 security zones found on the security tab in Explorer.

In Group Policy this is found in the following location:

Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Site to Zone Assignment List.

On the Client machine the security page is found by going to:

In go to Tools (Alt+X), then go to Internet Settings.  Choose the Security Tab.

Now even though we are playing within Internet explorer settings, you should know windows well enough to know that a window that shows your files is using the Explorer.exe process. Just because these settings live in internet explorer, doesn't mean they do not affect the settings within the rest of the operating system.  This is a big reason to why removing internet explorer is almost impossible without breaking something else, it is part of the operating system and the settings affect the system as well.

Drive Mappings

Right a mapped drive defined by either a script or preferences is just putting a friendly look on what would would be an UNC path which non technical folk, bless them, would never understand.

The mapped R:\ drive for example, would actually be the location \\Servername\sharename\resources but we cannot expect our users to know this, so we just say it's the R:\ drive.  Simple.

Now you can map this location in five potential (realistic) ways.

• You map it based on the NETBIOS name of the server, so lets say our server is called File-SVR-01, so the map would look like \\File-SVR-01\Sharename\resources.
• You can map it based on the server's IP address so: \\192.168.10.4\Sharename\resources
• You can map it based on an alias of your server so: \\Files\Sharename\resources
• You can map it based off a DFS namespace so: \\domain.local\NS\Sharename\resources
• You can map it based off the full FQDN of the file server so: \\File-SVR-01.domain.local\Sharename\resources

There are probably plenty of others, especially we get SANS involved, but I feel for the majority of us, these five should be the most common ways.

Now I know that stuff like using NETBIOS or the FQDN are essentially the same, and yes in all intensive purposes you would be correct, but for this file security warning we suffer on a daily basis it can matter in which method you used.  Consistency is important when mapping drives, if you use the FQDN, then you must use it for every share, do not cut corners here or you can get some unexpected results. 

Fix the problem

Lets fix the problem on one machine first, prove the fix and just get rid of that open file security warning once and for all. I do not want you to start deploying out policies you might not have full understanding of because whats the point if you do not learn anything from it.  

Get on a machine, login, ideally you need to be on an account that has permission to alter the internet explorer security settings, so domain administrator on a machine in a different OU unrestricted by policies. You need to have mapped drives however to test.

Find a .exe file in the mapped drive and attempt to use it.  It should not run immediately and you get the famous:

Open Security File Warning

Notice that even as an administrator, this still appears.

Notice at the bottom the warning you receive, this is important. 

"While files from the internet can be useful, this file type can potentially harm your computer.  Only run software from publishers you trust"

This is the error we would like to see, as this entire topic is based on this particular one.  The following two errors are different problems:

User Account Control Error

  

Fix found here: Turn off UAC via GPO

Digital Signature Error

Fix found here: Fix Digital Signature Security Warning

Now that you understand the differences between the three errors above, lets assume you have got the first error screen the one specifying it is a file from the internet and poses a security risk.

Now you know that the file is not from the internet and is from your local network, you know this because you know your mapped drive is a server location. So now you need to add your server to your intranet zone, not trusted zone, not restricted, not internet zone, your intranet zone. 

This is important as there are a lot of people out there that are all like, stick it in your trusted zones, this can actually cause you more headache sometimes. The reason being is because in all server versions with the exception of 2008R2 and above, the trusted zone would of actually worked.  

Weird right?  I never tested this theory but apparently after endless searches and realization of the pattern, everyone who has this problem on 2008 or lower, resolved it, yet those that have 2008R2 or higher, said it doesn't, so I have to make that connection there.  Might not be true, but I never said I was honest. 

The reason being is that trusted sites does not turn off prompts, intranet does. 

Before we even touch server side, lets make it work on one machine, then we know what to type in on the server, as the server does not have any validation of the information you type into it, meaning you might attempt to force incorrect keys onto your clients, which is not good and causes errors, these errors will be explained at the end of this post.

Go to: In IE ->  Tools (Alt+X) -> Internet Settings ->  Security Tab -> Local Intranet -> Sites -> Advanced

Type in *.domain.local  (filling in domain.local with the full name of your domain).

If you do not type it in correctly, you will be presented with this error:

This error explains the syntax that can be put in this setting.  If you do not meet the syntax requirements, it tells you about it. However, if you type the incorrect syntax on the sever, it will still accept it. This is why we do it on the client first, once we do it right here, we know exactly what to type on the server.

After you have typed in your wildcard domain, press ok and exit out of Internet explorer. 

Now try to open your .exe you tried before and hopefully the security file type will vanish.  You have successfully found the fix for the problem and can move to the Server Side Policies.  

Continue Only if the security file prompt still appears, if it has vanished, go to the server side settings.

If it is still not working, then continue.

Now go back to the same advanced menu and remove the *.domain.local setting, since we know it does not work with just this, there is no point in it now.  

Now the reason this wouldn't work is most likely because of the way you are mapping your drives, if your drives are not being mapped with a Netbios or FQDN name, then this would the reason for it.  If you map using IP Addresses, then this is a common reason for the failure.

So this time in the advanced menu you must put the IP Addresses of your file server(s) and if you want the entire scope to treat the entire domain as intranet. 

Remember the syntax and no /24 /23 subnets do not qualify.  

The trick now is trial and error and requires you to make some decisions.  I do not know your network and frankly would confused you if I started recommending some things.  Try different combinations.  The benefit however is that you know when you type something in, it is valid if it accepts it and is invalid if it doesn't, take advantage of this validation as the server does not give you this luxury.  

Eventually you will find that it accepts something and as you test the .exe from the mapped location, bang, the .exe starts to run without the warning, at this point cheer!  Remember the setting, the exact setting remember the syntax like it was your own name. Lets move to the server now.

IMPORTANT - Remember this setting, it is your fix and you need to type it in on the server. 

Server Side

• Go to your primary domain controller
• Open up group policy management.
• Go to: Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page

• In here I have manually enabled the following policies:
• Intranet Sites: Include all local (intranet) sites not listed in other zones
• Intranet Sites: Include all sites that bypass the proxy server
• Intranet Sites: Include all network paths (UNCs)
• I have disabled
• Turn on automatic detection of intranet

These polices affect the settings in the Local Intranet window found by going to:

In IE ->  Tools (Alt+X) -> Internet Settings ->  Security Tab -> Local Intranet -> Sites

Applying the policies above will grey out and prevent change in this area. 

Now Site to Zone Assignment policy (below) will affect everything within the Advanced menu from here, as you can see the "advanced" button above.

Site to Zone Assignment

This is the advanced menu where the settings will appear.

The setting will not appear if you do not specify the value of "1" to the value name (see next image)

Within this policy you can specify the security zones for your intranet.

Values are:

1. Intranet Zone
2. Trusted Site Zone
3. Internet Zone
4. Restricted Zone

To prevent file security windows appearing when opening up a certain file type from a mapped drive, you must know how your mapped drive is mapped first.  The setting you discovered by following this document will be the setting you need to deploy out.

So type in your setting e.g. *.domain.local in the Value name field and type in 1 in the value field.

Now remember that Validation error:

This will not happen if you make a mistake here, the server will accept it regardless of if it is right or not. This is bad and should not be done.

Gpupdate and RESTART your client machines once you have put in the setting and applied it in group policy.

Open up a client affected by the policy, go to the advanced menu in Internet explorer intranet settings and see if your policy has applied.

Try and open a .exe as a restricted user and by magic, your file security warnings now vanish as if they were never a problem.  Such a pain in the backside, but all this work is worth it, especially if you use software that when updated server side runs .exes when loading up client side.


Known Errors

If you find other errors that relate to this, please tell us in comments, the longer the list the easier it is for those struggling to find this blog.

Error 1
Windows failed to apply the Internet Explorer Zonemapping settings.  Internet Explorer Zonemapping settings might have its own log file. Please click on the "More information" link.

Cause
You've typed something in wrong in the Site-to-Zone Assignment policy that does not meet the requirements of the syntax.

Resolution
Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Site to Zone Assignment

Stick to the recommended syntax sequence, below is an image showing examples of the correct sequences supported by Windows.

No Policies Applying, Temporary Login, Windows 7

No Policies Applying, Temporary Login, Windows 7 x64/x86

You have been logged in with a temporary profile..  even though the user in Active Directory (AD) is setup correctly and the NTFS/Share permissions are also.. setup correctly.

Whats going on? Hopefully this post will help.

Applies to: Windows 7 x86/x64, Windows 2008R2 Domain

Symptoms

• No Group Policies have applied to the profile
• No Mapped Drives/Printers
• No Preferences Applying
• Admin (like) control of the machine, no restrictions set
• An explanation mark (!) in a blue circle appears in the system tray
• A balloon appears/tries to appear notifying the user that they are logged in with a temporary profile
• The login is way too quick.
• If you log out and log back in sometimes the profile works fine, sometimes it logs back in again as a temporary profile. 
• The issue is intermittent with little/no pattern, sometimes does it, sometimes it does not. Not machine specific, not user specific.
• If you wait for a few seconds before logging in, the chances of the profile working correctly improves.
• Occurs more often on wireless devices than wired, but isn't limited to wireless.

Reasons

When Windows 7 was the new big thing, Microsoft had a page about all the cool new features of their brand new operating system.  There was one feature (which unfortunately I have forgotten the name of) but it boasted about priority, fast logins.  Essentially, it meant that if Windows 7 noticed there would be a delay in the logging in, it chose to prioritise just getting the user to the desktop rather than waiting to ensure the login was correctly done.

This is what you are encountering.  Some networks, particularily wireless ones take that little bit longer to establish a new IP address, down to poor signal strength or just generally the type of wireless card you have in your device.

So when a typical user, types in their username and password within seconds of the machine first booting, the chances are the computer hasn't yet got an IP address or stable connection with the server but still attempts to log them in regardless.  Windows 7, realising that there is a networking issue, rather than saying to the user, "Please wait a sec, I haven't fully established a trust with the server", it simply goes, "oh who needs a server, I know your credentials are correct, thats all I basically need, heres a desktop", perfect if you are a home user, really annoying if they are domain user.

Resolutions

Nice and Easy, theres a group policy for it.  Inside that needle in a haystack database there is a policy that ensures the computer (regardless of whether its wireless or not) will make sure the user will not be able to login until a stable connection is first established.

Located Here

Windows Server 2008R2
Computer Configuration -- Policies -- Administrative Templates -- System --  Logon

Windows Server 2003R2
Computer Configuration -- Administrative Templates -- System -- Logon

Policy Name

Always Wait For The Network At Computer Startup And Logon

Set to: Enable

How it works

This is a brilliant policy when applied as it ensures that when a computer is loading up and a user attempts to login the second they can type, it overrides the client operating system's decision to prioritise getting the user to the desktop. 

All policies will therefore come down to the client and apply to the user and computer, thus ensuring that their logins are correctly redirected and their resources (shared areas and Printers) are correctly applied in accordence to your ICT policy.



I hope this helps you all out, I understand that Windows 8 is out soon but for those looking to upgrade to Windows 7, this is a small bug i'm sure you will come across.

It is easy to ignore when testing as when it happens you log off and you log back in and it all seems fine, but bear in mind, you are a technician, you use computers in the way they should be used.  True testing comes from the end user and not the ICT department.

I'm happy to help out anyone with any more issues in relation to this, just leave a comment below.  Additionally, any other fancy features you may of found in the GPO Needle in a haystack database, which you feel will help optimise Windows 7's logging in speed and/or reliability, never hesitate to post a comment, we are all on the same team here, all help is much appreciated.

Speak to you all soon,

The ITMagician

Network Font Installation

Do you constantly get requested by users to install fonts? Or would you like to give users the ability to install their own fonts?

Save the code below as a vbs file, and add it the the computer startup. All you or your users have to do then is put any fonts you/they want installing, into the shared server folder (\\server\share\fonts in the example).

It's built as a subroutine, so you can easily add it to an existing script or run it on its own.

If you ever want to add a new font, just copy it to the server; next time the machines reboot they'll install it. I've made the shared folder available to end users so they can add their own, obviously they need to be aware not to copy hundreds at a time, otherwise other users are not going to be too please next time they start their PCs.

Code:

Sub InstallFonts

   on error resume next

   Const FONTS = &H14

   dim oFSO,oShell,oFolder1,oFolder2,sRoot

   sRoot=\\server\share\fonts\

   set oShell = CreateObject("Shell.Application")

   set oFSO=createobject("scripting.filesystemobject")

   set oFolder1 = oShell.Namespace(FONTS)

   set oFolder2=ofso.getfolder(sRoot)  

   for each oFile in oFolder2.files

   sName=lcase(oFile.name)

      if right(sName,4)=".ttf" then

         if not ofso.fileexists(oFolder1.self.path & "\" & sName) then

            oFolder1.copyhere sRoot & sName

         end if    

      end if  

next  

on error goto 0

End Sub

InstallFonts

Original Source: http://www.edugeek.net/forums/scripts/4756-script-install-fonts-workstations.html#post370283 Thanks to Steve Rochford for this code.

Dell Optiplex 390 fails to apply GPO settings

At work we have been deploying Dell Optiplex 390’s with XP using an MDT task sequence, the build works perfectly however once the machine attempts to apply group policy we have failures, this causes the machine to fail to install allocated msi packages. Obviously not a great situation to be in.
Following some research I have found that the issue appears to occur mostly in situations where a client is using a Gig speed network card and where network connections are teamed. The issue appears to be caused by the network card switching between speeds and full/half duplex to find the mode it can operate at. By adding a registry key we can prevent this checking from happening which will provide a more stable connection during the all important startup process.
This solution has been tested to work in our environment, obviously your mileage may vary and if you choose to make this change you do so at your own risk, playing with the networking settings in Windows may break more than it fixes however in our testing this has been an easy and successful workaround.

The key details are as follows
Key Location : HKLM\System\CurrentControlSet\Services\Tcpip\Parameters
Key Name : DisableDHCPMediaSense
Key Type : Reg_Dword
Key Value : 00000001

These settings can either be added using a reg entry or a command line as follows

reg add HKLM\System\CurrentControlSet\Services\Tcpip\Parameters /v DisableDHCPMediaSense /t REG_Dword /d 00000001

In our case we have added a command line near the end of our task sequence which we have filtered using WMI in a way similar to the one we used in a previous post. In this case the WMI filter we used is as follows

Select * from Win32_ComputerSystemProduct WHERE Name LIKE "%Optiplex 390%"

Again we are running this against the root\cimv2 namespace. This query could be repeated in the task sequence options filtering for additional hardware which exhibits this particular issue, thereby allowing you to keep a smaller number of task sequences in your deployment share.

Update : 29-06-2012

We have begun rolling out Samsung N200 laptops, these also exhibit the issue with needing DHCPMediaSense to be set, for ease of use here is the WMI code needed

Select * from Win32_ComputerSystemProduct WHERE Name LIKE "300V3A/300V4A/300V5A/200A4B/200A5B"

Reference:

Technet User Discussion

Serverfault Question

Deploying Drivers

Have you ever just finished building a load of PCs, to have someone come up and ask for some dodgy piece of hardware to be installed on all PCs, and the drivers required are unsigned, and aren't pre-packaged in an easily deployable silent package or MSI. Or you've been given some dodgy new hardware (you know the companies I'm talking of), to install.

Well its easier than you think to deploy drivers as either a script or as part of an MSI package. I am assuming that you, the reader, are capable of writing a script and/or creating a suitable MSI, so I will not insult your intelligence by giving you a completed script/msi. If you're anything like me (God help you if you are!) you'll learn better by doing, rather than seeing.

Anyway, by using a small executable provide by Microsoft, DPInst.exe, available as part of the Windows Driver Kit (WDK), Download available here, we can indeed make drivers available on any windows OS system, to be installed as and when needed.

Once you have download and installed the WDK (btw you only need to install the tools part), you can find different architectural/language versions of the DPInst.exe in C:\WinDDK\7600.16385.1\redist\DIFx\dpinst (assuming you install to the default location, and the version number hasn’t changed since writing).

Place the correct version of DPInst.exe in with your driver .inf files. If you were to run the dpinst.exe now, you would be presented with a wizard for installing the drivers onto the system. If you were to step through the wizard, it will complete, but it will only be successfully if the drivers are signed.

However, that’s not what we really want, we need no user interaction at all, and we need to be able to install unsigned driver*. To install any drivers without the end user noticing, call the DPInst.exe with the following commands:

/Q  - This is for quiet install with no user interaction,
/LM – This is for unsigned drivers.

Now the drivers are installed, or technically they are made available to be installed when the hardware is connected. Now if your drivers are signed that is the end of the story, however, if like me, you have been given a host of cheap hardware made in china, with unsigned drivers, you will need to adjust the following 2 Group Policies*:

Computer Configuration>Windows Settings>security Settings>Local Policies>User Rights Assignment:
Policy: “Load and unload device drivers”
Setting: DomainName\Domain Users

User Configuration>Admin Templates>System>Driver Installation:
Policy: “Code signing for device drivers”
Setting: Enabled – ignore

Click here for a full overview of DPInst, and here for a full list of command switches.

* Please note that installing unsigned drivers and/or modifying Group Policy is done at the readers own risk, and the writers of “Thoughts of a Primary School Tech” are in no way responsible/liable for any loss/damage caused to any system(s) by following the instructions provided here. Whilst every effort has been made to ensure this works correctly on any windows system, your milage may vary.

Group Policy Setting - Verbose vs normal status messages

During a major roll out of software using Group Policy on a Windows 7 Client System, I had cause to want to know what was happening during the roll out, to see if any software was sticking. To enable more detailed messages on screen (other than "Please Wait") enable the following in an appropriate GPO:

Computer > Policies > Administrative Templates > System > Verbose vs normal status message

This setting displays a number of extra status messages during the start up and shutdown of the computer and when the user is logging on and off. Some of the verbose status messages you will see are (but not limited to):

Software Deployment
Mapping Drives
Playing Logon Sound
Mapping Printers
Applying Power Settings
Stopping Services

You will still see your Applying Computer settings and Preparing Desktop messages however these will be shown for a lot shorter time.

Also by enabling this option end users think that their PC is faster, due the reduced time each message is displayed. It certainly seems to speed it up for me anyway. This is still a handy setting to enable as at the very least will help your IT support troubleshoot log on performance issues.

This setting will work on Windows 2000 and above and it will also show the processing of newer Group Policy Preferences.

Original Source:
http://www.grouppolicy.biz/2009/11/group-policy-setting-of-the-week-2-verbose-vs-normal-status-messages/

Removing Items from Navigation Pane.

The other week I happened to be testing the pupil lockdown of Windows 7, and realised that users could access things in the navigation bar that I didn't want them to access. Things like computers on the network, favourites (not IE favourites), Homegroup (which is empty, so is pointless being there) and Libraries.

No problem I thought, it must be a Group Policy I've overlooked...Nope. It seems that microsoft don't want Network administrators to be able to remove these from the end users. Not easily anyway. So I turn to my tried and trusted friend, Bing (You were expecting Google, right?), and found the answers. I provide a quick explaination here, mainly for my own benefit, and the original source is linked at the bottom, there you will also find a way of removing computer from the Navigation Pane, and the pane itself if you wish to go down that route.

To modify items in the navigation pane, you must first give administrator full control to the following registry keys:

For x32 and x64 Systems.
Favourites: HKEY_CLASSES_ROOT\CLSID\{323CA680-C24D-4099-B94D-446DD2D7249E}\ShellFolder
Libraries: HKEY_CLASSES_ROOT\CLSID\{031E4825-7B94-4dc3-B131-E946B44C8DD5}\ShellFolder
Homegroup: HKEY_CLASSES_ROOT\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\ShellFolder
Network: HKEY_CLASSES_ROOT\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\ShellFolder

Additional for x64 Systems Only.
Favourites: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{323CA680-C24D-4099-B94D-446DD2D7249E}\ShellFolder
Libraries: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{031E4825-7B94-4dc3-B131-E946B44C8DD5}\ShellFolder
Homegroup: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\ShellFolder
Network: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\ShellFolder

Theoretically administrator accounts should already have full control to these keys, but I found that without doing the above, the items were not modified. It may also turn out that you do not need to add the first set of registry keys for a x64 system, but I have not tested that yet, if I ever get around to it I will update this post accordingly.

Now for adding/removing the items. Please modify the Attribute Values below the above keys as required below:

Favourites On: a0900100 (Default Setting)
Favourites Off: a9400100
Libraries On: b080010d (Default Setting)
Libraries Off: b090010d
Homegroup On: b084010c (Default Setting)
Homegroup Off: b94010c
Network On: b0040064 (Default Setting)
Network Off: b0940064

I made the necessary modifications using a combination of Group Policy (for the registry permissions) and Preferences (for modifying the value), but feel free to make the changes how you feel most comfortable.

The original information found at:
http://www.sevenforums.com/tutorials/38933-favorites-add-remove-navigation-pane.html
http://www.sevenforums.com/tutorials/35627-libraries-folder-add-remove-navigation-pane.html
http://www.sevenforums.com/tutorials/39670-homegroup-add-remove-navigation-pane.html
http://www.sevenforums.com/tutorials/39699-network-add-remove-navigation-pane.html

WMI Filters for different Windows versions

In order to run multiple operating systems in the same OU structure  and have relevant GPO's applied we can make use of WMI filters. These filters can be used to interrogate the operating system and either apply or not based on the result.

I will not go into how to create a WMI filter here as if you are here looking at this then you only really want the query needed to create the filter.

The basic filter will take the following format

Select * from Win32_OperatingSystem Where Version like “x” and ProductType = “y" 

OS Version

The relevant  OS version values are as follows, these can be substituted in place of x:

Windows 7 or Server 2008 R2 = “6.1%”
Windows Vista or Server 2008 = “6.0%”
Windows XP = “5.2%”
Windows 2000 = “5.0%”

Product Type

 To filter by roles the computer may perform, change the ProductType (y) to:

Client = “1”
Server running a Domain Controller role = “2”
Member server (server that’s not a DC) = “3”