GPO (Windows)

A dedicated Device Security Group should be created by the Windows Administrator. This group will contain all user devices intended for PAC distribution.

GPO Deployment for Registration Script

The PAC Registration Script will be pushed to the devices through Group Policy Objects (GPO) as a Scheduled Task.
The script will run when the system restarts, ensuring that the necessary operations are performed with administrator privileges.

Administrative Privileges Requirement

The Registration Script requires administrator privileges to import the CA Certificate and to read/write registry keys.
This necessitates that the script runs under the System account during startup.

GPO Application to the Device Organizational Unit (OU)

The Registration Script GPO will be applied specifically to the Device Security Group created earlier.
The script will execute the next time any device in the Security Group restarts, ensuring proper registration and PAC enforcement.

Flow diagram showing the PAC Registration Process via GPO in 5 steps: (1) Download Registration Script from WitnessAI Console, (2) Set up Scheduled Task GPO for script push, (3) Client Machines download GPO during next sync, (4) PAC Registrations during Restart - execute registrations on device reboot, (5) PAC Enforced on Device - apply PAC settings.

Detailed Solution Workflow

Step	Action	Outcome/Purpose
1	Download ZIP (Registration and Flush Script) from WitnessAI Console.	Obtain necessary files for device registration and proxy setup. ZIP file containing the registration and flush script is downloaded.
2	Create a Security Group for Pushing the Registration Script	A security group containing the devices intended for PAC distribution is created.
3	Place the registration and Flush Script in a Network share accessible by the client machines.	Scripts are placed in a Network share path accessible by the client machines. Ex: SysVol Path
4	Create a GPO for pushing the registration script and creating a scheduled task to run the registration script at startup.	Scheduled Task GPO created with Scope assigned to the Security Group created in Step 2.
5	GPO gets downloaded by the devices in scope during the next group policy update.	PAC Registration GPO gets downloaded by the client machine.
6	The registration script runs on the next device restart.	PAC registration should happen during next restart and logs will be stored at C:\Windows\Temp\pac-registration-log.txt
7	PAC Configuration Enforced and Registry Keys created.	PAC Registration is completed and configuration is enforced.

Configuration Guide

Scheduled Task - Method

Note: This method relies on copying the registration script to C:\Windows\Temp\path on the local machine using GPO and then triggering that script at device startup using Task Scheduler.

This method ensures that the script run happens even when the client machine is unable to connect to the Domain Controller.

Create a Security Group which contains all the devices intended for PAC distribution.

Open Active Directory Users and Computers.
Right-click the desired OU or container, select New > Group.
Name the group (1) (ex: "WitnessAI-PAC-Devices").
Set Group Scope to Global (2) and Group Type to Security (3).
Click Ok

Windows Active Directory ‘New Object - Group’ dialog for creating a security group for Witness Anywhere PAC distribution. Callouts: (1) Group name ‘WitnessAI-PAC-Devices’, (2) Group scope set to ‘Global’, (3) Group type set to ‘Security’. Create in: witness.lab/Dev-PAC-Devices.

Right-click the group, go to Properties > Members, Click on Object Types and select Computers. Then find and add required windows devices which need to be onboarded to Witness Anywhere Solution..

Windows ‘Witness-PAC-Devices Properties’ dialog showing the Members tab with columns for Name and Active Directory Domain Services Folder. The Members list is empty with Add and Remove buttons available. Used to add Windows computer objects to the PAC devices security group.

Place the registration and flush script in a network share that is accessible by the devices or place it in the Sysvol scripts path as given below.

Ex: \\witness.lab\SysVol\witness.lab\scripts\

Open Group Policy Management:

Go to Administrative Tools > Group Policy Management.

Windows Server Manager showing the DNS node selected with a Tools menu open, highlighting ‘Group Policy Management’ as the option to navigate to for creating and managing Group Policy Objects (GPOs).

Create a New GPO:

Right-click the domain or OU, click “Create a GPO in this domain, and Link it here…”, name the GPO (e.g., “Witness-PAC-Registration”), and click OK.

Group Policy Management console showing the domain tree with ‘Witness-Devices’ OU selected and a right-click context menu displaying the ‘Create a GPO in this domain, and Link it here…’ option for creating the Witness-PAC-Registration GPO.

Windows ‘New GPO’ dialog with ‘Witness-PAC-Registration’ entered as the GPO name and Source Starter GPO set to ‘(none)’. Used to name the new Group Policy Object for deploying the PAC registration script.

Edit the GPO:

Right-click the GPO, select Edit, and navigate to:

Computer Configuration > Preferences > Windows Settings > Files
Right Click and Select New > File

Group Policy Management console showing ‘Witness-PAC-Registration’ GPO selected under witness.lab/Witness-Devices OU. The right panel shows the GPO’s Links section with location, Enforced=No, Link Enabled=Yes, Path=witness.lab/Witness-Devices. A context menu shows ‘Edit…’ option highlighted.

Group Policy Management Editor showing the Files section under Witness-PAC-Registration GPO > Computer Configuration > Preferences > Windows Settings > Files. A right-click context menu shows ‘New > File’ option to create a new file preference item for copying the registration script.

Set the action as Replace
Set the source file as the Network share path where the script is stored.

\\witness.lab\SysVol\witness.lab\scripts\register_device_ad_joined.ps1

Set the Destination file as C:\Windows\Temp\register_device_ad_joined.ps1

GPO file preference ‘register_device_ad_joined.ps1 Properties’ dialog showing General tab with Action=Replace, Source file path in SysVol (ss.lab\scripts\register_device_ad_joined.ps1), Destination file path (C:\Windows\Temp\register_device_ad_joined.ps1), and Archive attribute checked.

Select the Common Tab and Enable the “Remove this item when it is no longer applied” checkbox.
Click Apply and then OK.

GPO file preference ‘register_device_ad_joined.ps1 Properties’ dialog showing the Common tab. The ‘Remove this item when it is no longer applied’ checkbox is checked. Other options like Stop processing items if error, Apply once and do not reapply, and Item-level targeting are unchecked.

Next, navigate to Computer Configuration > Preferences > Control Panel Settings > Scheduled Tasks

Right click and select New > Scheduled Task (At least Windows 7)

Group Policy Management Editor showing the Scheduled Tasks section under Witness-PAC-Registration GPO. A right-click context menu displays ‘New > Scheduled Task (At least Windows 7)’ option highlighted, used to create the task that runs the PAC registration script at startup.

In the new Task Window

Select the Action as Replace
Give the name as WitnessAI-PAC-Register

(NOTE: If you use a different, make sure that your task name starts with WitnessAI)

Click on Change User or Group

Type in System as the object name and click Check Names.
Then click OK.

Windows ‘Select User or Group’ dialog showing Object Types as ‘User or Built-in security principal’, Location as ‘witness.lab’, and ‘system’ entered as the object name to select. Used to configure the scheduled task to run under the SYSTEM account.

Select the Configure For value as Windows 7, Windows Server 2008R2

Scheduled task ‘Witness-PAC-Register Properties’ dialog showing the General tab. Action=Replace, Name=WitnessAI-PAC-Register, Author=WITNESS\administrator. Security options show NT AUTHORITY\System account, ‘Run only when user is logged on’ selected. Configure for Windows 7/Server 2008R2.

Select the Trigger Tab, and click on New.

Select the value for Begin the Task as At log on and click OK

Note: Begin the Task value can be set as At task creation/modification as well if the registration script needs to be run immediately as soon as the GPO is applied. But this method makes troubleshooting difficult in case the PAC registration is failing due to any reason, as to re-run the registration script, a GPO update or scheduled task removal on device locally as an administrator would be required..

Scheduled task ‘New Trigger’ dialog configured with Begin the task set to ‘At log on’, ‘Any user’ selected, and Enabled checkbox checked. Advanced settings show default values. Used to trigger the PAC registration script at user logon.

Select on the Actions Tab and click on New.
Enter the Program/Script value as PowerShell.exe
Enter the Add Arguments Filed as -ExecutionPolicy Bypass -command "&C:\Windows\Temp\register_device_ad_joined.ps1"
Click OK.

Scheduled task ‘New Action’ dialog with Action=’Start a program’, Program/script=PowerShell.exe, Add arguments showing ‘-ExecutionPolicy Bypass -command &C:\Windows\Temp\register_device_ad_joined.ps1’. Used to configure the scheduled task to run the PAC registration PowerShell script.

Click on the Common Tab and Enable the “Remove this item when it is no longer applied” checkbox.

Scheduled task ‘WitnessAI-PAC-Register Properties’ dialog showing the Common tab. The ‘Remove this item when it is no longer applied’ checkbox is checked. Used to ensure the scheduled task is removed when the GPO is unapplied from the device.

Finally Click Apply and then OK.

In the Witness-PAC-Registration GPO, Under Security Filtering:

Remove Authenticated Users
Add the Witness-PAC-Devices Security Group.

Group Policy Management showing the Witness-PAC-Registration GPO with Security Filtering section. A ‘Select User, Computer, or Group’ dialog is open with ‘WitnessPAC-Devices’ entered as the object name, to restrict the GPO to only apply to the PAC devices security group.

The GPO will be applied during the next GPO refresh interval and the Registration will happen during the next user log on event.

To update the GPO immediately, On the Client Machine:

Open Command Prompt as admin, and run the command:

gpupdate /force

Test the Configuration:

Restart the client machine to confirm the registration script runs.
If the registration script ran successfully:

The PAC URL should be applied under Proxy Settings.
The Registry Key Computer\HKEY_CURRENT_USER\Software\WitnessAI should be created.

If the PAC URL/Registry Key is not seen check the logs at

C:\Windows\Temp\pac-registration-log.txt

After the PAC registration is confirmed, remove the devices from the Security Group (WitnessAI-PAC-Devices) as the GPO does not need to be applied once the registration is completed.

In case the GPO is not removed, during the subsequent device restarts the script will identify that the Device is already registered and will exit.

Debugging

To verify if the GPO was applied to the device, Open a command prompt as Admin on the client machine and run the command gpresult /r

If the GPO is applied successfully it should show up under the “Applied Group Policy Objects” section.

Windows Administrator Command Prompt showing output of ‘gpresult /r’ (Group Policy Result tool). Shows RSOP data for the device VINEETHBHAS1431. Under ‘Applied Group Policy Objects’, ‘Witness-PAC-Registration’ is highlighted. Under security groups, ‘Witness-PAC-Devices’ is highlighted, confirming successful GPO application.

Once the GPO is applied on the device, at the next device restart the script will be run automatically and the registration should happen.
If the PAC Registration is successful, the script will create a registry key to store the Device Fingerprint and PAC URL under Computer\HKEY_CURRENT_USER\Software\WitnessAI
Since the registration script is executed directly on the client machine, the output and results are not captured on the Active Directory. Therefore, all console outputs, including logs and error messages, will be saved locally on the client machine within the C:\Windows\Temp\pac-registration-log.txt file.
Common Errors

DNS Resolution Errors for Registration URL
Connectivity Issues towards the Registration Server (tcp/443 connection failure)
Invalid or expired PAC Token. (Error Code: 403)
Username Validation Failure (Username not present in Console User List/DB)
Invalid User/Device Fingerprinting data inputs (Error: Deserialization Error / Validation Error / Schema Error)

In the Scheduled Task method, the registration script will be copied to C:\Windows\Temp\register_device_ad_joined.ps1 once the GPO is applied successfully.

If the file is not available in this path, the registration will not happen during the next reboot.

If the file is missing even after the GPO is applied successfully, check the System Logs under Windows Event Logs to understand why the file copy is failing.

If the source file path specified in the GPO is not accessible by the device, this issue might arise.
Make sure that the device is a member of the Witness-PAC-Devices Security Group which is used as the Security Restriction for this GPO.

PAC Flush

PAC configuration can be flushed by removing the device from the security group used for pushing the registration script and adding it to another group used for pushing the Flush script during startup.

Configuration

Create a Security Group which contains all the devices intended for PAC Flush as mentioned in Step 1.

Name it "PAC-Flush-Devices"

Note: Ensure that these devices are first removed from the Security Group used for the PAC Registration GPO (WitnessAI-PAC-Devices).

Create a Security Group which contains all the devices intended for PAC distribution.

Open Active Directory Users and Computers.
Right-click the desired OU or container, select New > Group.
Name the group (ex: "WitnessAI-PAC-Flush").
Set Group Scope to Global and Group Type to Security.
Click Ok

Windows Active Directory ‘New Object - Group’ dialog for creating the PAC Flush security group. Group name ‘WitnessAI-PAC-Flush’, Group scope set to ‘Global’, Group type set to ‘Security’. Create in: witness.lab/Dev-PAC-Devices. Used to target devices that need PAC configuration flushed.

Right-click the group, go to Properties > Members, Click on Object Types and select Computers. Then find and add required windows devices which need to be onboarded to Witness Anywhere Solution..

Windows ‘WitnessAI-PAC-Flush Properties’ dialog showing the Members tab with empty member list. Used to add Windows computer objects to the PAC Flush security group for targeting devices that need PAC configuration removed.

Open Group Policy Management:

Go to Administrative Tools > Group Policy Management.

Windows Server Manager showing the DNS node with Tools menu open, highlighting ‘Group Policy Management’ to navigate to for creating the PAC Flush GPO. (PAC Flush section)

Create a New GPO:

Right-click the domain or OU, click “Create a GPO in this domain, and Link it here…”, name the GPO (e.g., “Witness-PAC-Flush”), and click OK.

Group Policy Management console showing ‘Witness-Devices’ OU selected with context menu showing ‘Create a GPO in this domain, and Link it here…’ option highlighted. Used for creating the Witness-PAC-Flush GPO in the PAC Flush section.

Windows ‘New GPO’ dialog with ‘Witness-PAC-Flush’ entered as the GPO name and Source Starter GPO set to ‘(none)’. Used to create the Group Policy Object for deploying the PAC flush script.

Edit the GPO:

Right-click the GPO, select Edit, and navigate to:

Computer Configuration > Preferences > Windows Settings > Files
Right Click and Select New > File

Group Policy Management console showing ‘Witness-PAC-Flush’ GPO selected under Witness-Devices OU with context menu showing ‘Edit…’ option. The Linked Group Policy Objects tab shows the GPO with Link Enabled=Yes. Used for editing the PAC Flush GPO.

Group Policy Management Editor for Witness-PAC-Flush GPO showing the Files section under Computer Configuration > Preferences > Windows Settings > Files, with a right-click context menu showing ‘New > File’ option to create a file preference item for copying the flush script.

Set the action as Replace
Set the source file as the Network share path where the Flush script is stored in Step 2 of Registration.

\\witness.lab\SysVol\witness.lab\scripts\flush.ps1

Set the Destination file as C:\Windows\Temp\flush.ps1

GPO file preference ‘flush.ps1 Properties’ dialog showing General tab with Action=Replace, Source file path in SysVol (witness.lab\SysVol\witness.lab\scripts\flush.ps1), Destination file path (C:\Windows\Temp\flush.ps1), and Archive attribute checked. Used to copy the PAC flush script to client machines.

Select the Common Tab and Enable the “Remove this item when it is no longer applied” checkbox.
Click Apply and then OK.

GPO file preference ‘register_device_ad_joined.ps1 Properties’ dialog showing the Common tab with ‘Remove this item when it is no longer applied’ checkbox checked. This is in the PAC Flush section for configuring the flush script file preference cleanup behavior.

Next, navigate to Computer Configuration > Preferences > Control Panel Settings > Scheduled Tasks

Right click and select New > Scheduled Task (At least Windows 7)

Group Policy Management Editor for Witness-PAC-Flush GPO showing the Scheduled Tasks section. A right-click context menu displays ‘New > Scheduled Task (At least Windows 7)’ option highlighted, used to create the scheduled task that runs the PAC flush script.

In the new Task Window

Select the Action as Replace
Give the name as WitnessAI-PAC-Flush

(NOTE: If you use a different, make sure that your task name starts with WitnessAI)

Click on Change User or Group

Type in System as the object name and click Check Names.
Then click OK.

Windows ‘Select User or Group’ dialog with ‘system’ entered as the object name, used to configure the WitnessAI-PAC-Flush scheduled task to run under the SYSTEM account. Object type is ‘User or Built-in security principal’, location is ‘witness.lab’.

Select the Configure For value as Windows 7, Windows Server 2008R2

Scheduled task ‘WitnessAI-PAC-Flush Properties’ dialog showing the General tab. Action=Replace, Name=WitnessAI-PAC-Flush, Author=WITNESS\administrator. Security options show NT AUTHORITY\System account, ‘Run only when user is logged on’ selected. Configure for Windows 7/Server 2008R2.

Select the Triggers Tab, and click on New.

Select the value for Begin the Task as At task creation/modification and click OK

Scheduled task ‘New Trigger’ dialog for PAC Flush task, configured with Begin the task set to ‘At task creation/modification’ and Enabled checkbox checked. This ensures the flush script runs immediately when the GPO is applied, removing PAC configurations.

Select on the Actions Tab and click on New.
Enter the Program/Script value as PowerShell.exe
Enter the Add Arguments Filed as -ExecutionPolicy Bypass -command "&C:\Windows\Temp\flush.ps1"
Click OK.

Scheduled task ‘New Action’ dialog for PAC Flush task with Action=’Start a program’, Program/script=PowerShell.exe, Add arguments showing ‘-ExecutionPolicy Bypass -command &C:\Windows\Temp\flush.ps1’. Used to configure the scheduled task to run the PAC flush PowerShell script.

Click on the Common Tab and Enable the “Remove this item when it is no longer applied” checkbox.

Scheduled task ‘WitnessAI-PAC-Register Properties’ dialog showing the Common tab for the PAC Flush scheduled task. The ‘Remove this item when it is no longer applied’ checkbox is checked. Used to ensure the flush scheduled task is removed when the GPO is unapplied.

Finally Click Apply and then OK.
In the Witness-PAC-Flush GPO, Under Security Filtering:

Remove Authenticated Users
Add the Witness-PAC-Flush Security Group.

Group Policy Management showing ‘Witness-PAC-Flush-GPO’ selected with Security Filtering section and a ‘Select User, Computer, or Group’ dialog open with ‘Witness-PAC-Flush’ entered as the object name. Links section shows GPO linked to Witness-Devices with Link Enabled=Yes.

The flush script will run as soon as the GPO is applied during the GPO sync and will remove all PAC configurations.

A reboot is not required for the Flush script to run as the task is scheduled to run at Task creation.

Deploying on Windows with Group Policy Deployment Overview Detailed Solution Workflow Configuration Guide Scheduled Task - Method Debugging PAC Flush