[There's a reason that Yoda is the unofficial mascot of SBS. Size indeed matters not.] EMET part three - doing the startup script - THE OFFICIAL BLOG OF THE SBS DIVA
Mon, Sep 24 2012 21:34 bradley

EMET part three - doing the startup script

http://technet.microsoft.com/en-us/library/cc779329(v=WS.10).aspx

Following this... we build a start up script for our EMET to take effect

Group Policy object/Computer Configuration/Policies/Windows Settings/Scripts (Startup/Shutdown)

Pick Startup

  1. In the details pane, double-click Startup.
  2. In the Startup Properties dialog box, click Add.
  3. In the Add a Script dialog box, do the following:

    • In Script Name, type the path to the script, or click Browse to search for the script file in the Netlogon shared folder on the domain controller.

I just clicked on new text file and wrote this in notepad and saved the file as EMETstart.bat

The location of the emet_conf.exe file is in Program Files (x86) in a 64bit machine, the folder is called EMET (Tech Preview)

Save the file as a .bat file

Browse to our saved script

And the result looks like this

And the group policy script section like that.

Now let's reboot my PC and see if this worked... I have it set to just apply to my workstation at this point in time.

More good reading here while we're waiting for a reboot -- http://rationallyparanoid.com/articles/microsoft-emet-3.html

# re: EMET part three - doing the startup script

Wednesday, September 26, 2012 2:28 AM by Rolf Niedhorn

Another way could be Sysinternals "psexec" (used with task planer, if you want automatation). I wrote something on my own blog nieronet.wordpress.com/.../verteilen-von-emet-via-gruppenrichtlinien .I hope you don´t mind that Link, Susan, normally I don´t make "ads" :=)

# re: EMET part three - doing the startup script

Wednesday, September 26, 2012 2:29 AM by Rolf Niedhorn

Another way could be Sysinternals "psexec" (used with task planer, if you want automatation). I wrote something on my own blog nieronet.wordpress.com/.../verteilen-von-emet-via-gruppenrichtlinien .I hope you don´t mind that Link, Susan, normally I don´t make "ads" :=)

# re: EMET part three - doing the startup script

Thursday, September 27, 2012 4:39 AM by The Lazy Slug

I would suggest you test this on a single workstation before deplying across your network. We have found that a number of applications have been broken as a result of installing EMET.

(Fortuntely we have learnt from Susan and have good backups!!!)

Susan: from the way you've described the positioning of the EMET group policy in the domain tree, are you implying this should be installed on servers?

# re: EMET part three - doing the startup script

Thursday, September 27, 2012 9:03 AM by bradley

I don't deploy it to servers.  What apps - as I'm not seeing impact here?

# re: EMET part three - doing the startup script

Friday, September 28, 2012 2:25 AM by The Lazy Slug

From your second article, you said

Now go to the top of the group policy structure, right mouse click on the domain name and click on "Create a GPO in this domain, and link it here".

If you do that, you'll end up deploying it to the server itself. I think you probably ment right clicking on the Organisational Unit 'MyBusiness' ?

We've had problems with xPrint.dll (used with Progress OpenEdge databases.) and custom VBA macros that directly access Bloomberg Professional data feeds throught the 'Bloomberg Data Type Library'.

I will be investing further but had to remove EMET for the time being.

# re: EMET part three - doing the startup script

Friday, September 28, 2012 2:30 AM by bradley

No it didn't get deployed to the server.  For one you still have to install it, it doesn't get pushed out.  For two I edited the "applies to" section to only be a couple of computers at this time.

# re: EMET part three - doing the startup script

Friday, September 28, 2012 3:20 AM by The Lazy Slug

Sorry, but it gets installed to the server if you have used the GPO to deploy the msi package using the instructions mention at www.advancedinstaller.com/.../tutorial-gpo.html, although those instructions are a bit out of date refering to creating the GPO from Active Directory Users and Computers.

The default Security Filtering of 'Authenticated Users' causes this.

(Already tested this on my backup server before I posted.)

# re: EMET part three - doing the startup script

Friday, September 28, 2012 8:50 AM by bradley

Remove authenticated users and put in the computers you want.