diff --git a/ansible/roles/win_domain_controller/files/OpenStackADBuildv7.5.2.ps1 b/ansible/roles/win_domain_controller/files/OpenStackADBuildv7.5.2.ps1
index 02bc882..62af5c8 100644
--- a/ansible/roles/win_domain_controller/files/OpenStackADBuildv7.5.2.ps1
+++ b/ansible/roles/win_domain_controller/files/OpenStackADBuildv7.5.2.ps1
@@ -1,27 +1,32 @@
-set-timezone -id UTC
+set-timezone -Id 'GMT Standard Time'
+
+$DomainInfo = Get-ADDomain
+
+# Get Windows Project
+$winProject = $DomainInfo.DNSRoot.split('.')[0]
+
+# Get DC01 name
+$DC01 = (Get-ADComputer -Identity "$winProject-DC01").Name
+
+# Set RDS Server
+$RDSServer = $DC01
 
-#Gather DC IP and Name
-$domaindetails = get-adcomputer -filter 'Name -like "*DC01*"' | foreach {$_.name}
-#$domaindcdns = get-dnsserver -computername $domaindetails | foreach {$_.computername}
-$RDSServer = $domaindetails
 #Workbench OU
-$workbenchOU = Get-ADOrganizationalUnit -Filter 'Name -like "Workbench"'| foreach {$_.DistinguishedName}
-$DomainOU = Get-ADDomain | foreach {$_.DistinguishedName}
-$domainID = Get-ADDomain | foreach {$_.DNSRoot}
-$winProject = (Get-ADDomain).DNSRoot.split('.')[0]
-$computersOU = get-addomain | foreach {$_.ComputersContainer}
-$domaincontrollersOU = get-addomain | foreach {$_.DomainControllersContainer} 
-$homepage = "https://www.epcc.ed.ac.uk/"
+$DomainOU = $DomainInfo.DistinguishedName
+$domainID = $DomainInfo.DNSRoot
+$workbenchOU = (Get-ADOrganizationalUnit -Identity "OU=Workbench,$DomainOU").DistinguishedName
+
+$computersOU = $DomainInfo.ComputersContainer
+$domaincontrollersOU = $DomainInfo.DomainControllersContainer
+
 #get wsus server name
-$wsusserver = get-adcomputer -Filter 'Name -like "*-wsus*"' | foreach {$_.Name}
+$wsusserver = (Get-ADComputer -Identity "$winProject-WSUS").Name
 
-##New OU
-New-ADOrganizationalUnit -Name WorkBench
-#Workbench OU
-$workbenchOU = Get-ADOrganizationalUnit -Filter 'Name -like "Workbench"' | foreach {$_.DistinguishedName} 
-#Move WB machines (when prefix is wb)
-$computers = Get-ADComputer -Filter * | Where-Object { $_.name -match "^.*(wb)[0-9]+$" } | ForEach-Object { $_.DistinguishedName }
-$computers | move-adobject -TargetPath $workbenchOU
+$homepage = "https://www.epcc.ed.ac.uk/"
+
+#Move WB machines (when prefix is wb) SHOULD NOT BE NEEDED ANSIBLE DOES THIS. CAN CHANGE REGEX TO ALSO ADD APP AND GPU
+$computers = Get-ADComputer -Filter * | Where-Object { $_.name -match "^.*(wb|app|gpu)[0-9]+$" } | ForEach-Object { $_.Name }
+#$computers | move-adobject -TargetPath $workbenchOU
 
 #Create RDS Settings GPO
 New-GPO -Name "RDS Settings" -comment "RDS Settings for the workbench"
@@ -128,8 +133,8 @@ Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "DisableUPnPRegistr
 Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "DisableInBand802DOT11Registrar" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WCN\Registrars" -Value 0 -Type DWord
 Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "DisableFlashConfigRegistrar" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WCN\Registrars" -Value 0 -Type DWord
 Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "DisableWPDRegistrar" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WCN\Registrars" -Value 0 -Type DWord
-Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "MaxWCNDeviceNumber" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WCN\Registrars" -Value -Type String
-Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "HigherPrecedenceRegistrar" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WCN\Registrars" -Value -Type String
+Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "MaxWCNDeviceNumber" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WCN\Registrars" -Value -Type String #MISSING_VALUE
+Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "HigherPrecedenceRegistrar" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WCN\Registrars" -Value -Type String #MISSING_VALUE
 Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "DisableWcnUi" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WCN\UI" -Value 1 -Type DWord
 Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "ScenarioExecutionEnabled" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d}" -Value 0 -Type DWord
 Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "Disabled" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\Windows Error Reporting" -Value 1 -Type DWord
@@ -138,10 +143,10 @@ Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "NoAUShutdownOption
 Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "UseWUServer" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Value SGSTD-DC01 -Type String
 Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "DeferQualityUpdates" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WindowsUpdate" -Value 1 -Type DWord
 Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "DeferQualityUpdatesPeriodInDays" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WindowsUpdate" -Value 0 -Type DWord
-Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "PauseQualityUpdatesStartTime" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WindowsUpdate" -Value -Type DWord
+Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "PauseQualityUpdatesStartTime" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WindowsUpdate" -Value -Type DWord #MISSING_VALUE
 Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "DeferFeatureUpdates" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WindowsUpdate" -Value 1 -Type DWord
 Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "DeferFeatureUpdatesPeriodInDays" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WindowsUpdate" -Value 0 -Type DWord
-Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "PauseFeatureUpdatesStartTime" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WindowsUpdate" -Value -Type String
+Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "PauseFeatureUpdatesStartTime" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WindowsUpdate" -Value -Type String #MISSING_VALUE
 Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "AllowDigest" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WinRM\Client" -Value 0 -Type DWord
 Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "AllowRemoteShellAccess" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WinRM\Service\WinRS" -Value 1 -Type DWord
 Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "DisableRunAs" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows\WinRM\Service" -Value 1 -Type DWord
@@ -162,10 +167,10 @@ Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "EnableAuthEpResolu
 Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "IncludeRecommendedUpdates" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value 999999 -Type DWord
 Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "NoAutoRebootWithLoggedOnUsers" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value 0 -Type DWord
 Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "fAllowToGetHelp" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value 0 -Type DWord
-Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "fAllowFullControl" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value -Type String
-Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "MaxTicketExpiry" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value -Type String
-Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "MaxTicketExpiryUnits" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value -Type String
-Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "fUseMailto" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value -Type String
+Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "fAllowFullControl" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value -Type String #MISSING_VALUE
+Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "MaxTicketExpiry" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value -Type String #MISSING_VALUE
+Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "MaxTicketExpiryUnits" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value -Type String #MISSING_VALUE
+Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "fUseMailto" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value -Type String #MISSING_VALUE
 Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "DisablePasswordSaving" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value 1 -Type DWord
 Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "fDisableCcm" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value 1 -Type DWord
 Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "fDisableLPT" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\Windows NT\Terminal Services" -Value 1 -Type DWord
@@ -194,13 +199,13 @@ Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "UseMachineId" -Key
 Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "LmCompatibilityLevel" -Key "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa" -Value 5 -Type DWord
 Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "NTLMMinServerSec" -Key "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0" -Value 537395200 -Type DWord
 Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "FilterAdministratorToken" -Key "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Value 1 -Type Dword
-Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "ConsentPromptBehaviorAdmin" -Key "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Value ^2$ -Type DWord
+Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "ConsentPromptBehaviorAdmin" -Key "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Value 2 -Type DWord
 Set-GPRegistryValue -Name "Default Domain Policy" -ValueName "ConsentPromptBehaviourUser" -Key "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Value 0 -Type DWord
 
 
 
-#Folder redirection
-enable-folderredirection -AllFolder
+#Folder redirection - MISSING MODULE??
+#enable-folderredirection -AllFolder
 
 #Domain Password Policy
 Set-ADDefaultDomainPasswordPolicy -identity $DomainID -MaxPasswordAge "42" -MinPasswordAge "1" -MinPasswordLength "12" -PasswordHistoryCount "24" -ComplexityEnabled $true -ReversibleEncryptionEnabled $false -LockoutThreshold "0"
@@ -268,7 +273,7 @@ Set-GPRegistryValue -Name "Firefox" -ValueName "MoreFromMozilla" -Key "HKEY_LOCA
 Set-GPRegistryValue -Name "Firefox" -ValueName "SkipOnboarding" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\UserMessaging" -Value 1 -Type DWord
 Set-GPRegistryValue -Name "Firefox" -ValueName "WhatsNew" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\UserMessaging" -Value 0 -Type DWord
 Set-GPRegistryValue -Name "Firefox" -ValueName "URL" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\Homepage" -Value $homepage -Type String
-Set-GPRegistryValue -Name "Firefox" -ValueName "StartPage" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\Homepage" -Value homepage -Type DWord
+Set-GPRegistryValue -Name "Firefox" -ValueName "StartPage" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Mozilla\Firefox\Homepage" -Value $homepage -Type DWord
 
 
 #Create Edge GPO
@@ -277,7 +282,7 @@ Set-GPRegistryValue -Name "Edge" -ValueName "AllowSurfGame" -Key "HKEY_LOCAL_MAC
 Set-GPRegistryValue -Name "Edge" -ValueName "ConfigureDoNotTrack" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge" -Value 0 -Type DWord
 Set-GPRegistryValue -Name "Edge" -ValueName "EnhanceSecurityModeOptOutUXEnabled" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge" -Value 1 -Type DWord
 Set-GPRegistryValue -Name "Edge" -ValueName "URL" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge" -Value $homepage -Type String
-Set-GPRegistryValue -Name "Edge" -ValueName "StartPage" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge" -Value homepage -Type DWord
+Set-GPRegistryValue -Name "Edge" -ValueName "StartPage" -Key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Edge" -Value $homepage -Type String
 
 
 #Create Profile redirection GPO
@@ -309,21 +314,36 @@ Set-GPRegistryValue -Name "wb servers" -ValueName "ShutdownReasonOn" -key "HKEY_
 
 #Create firewall GPO
 New-GPO -Name "firewall" -comment "firewall Settings for the end user servers"
-Set-GPRegistryValue -Name "firewall" -ValueName "EnableFirewall" -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" -Value 1 -Type DWord
-Set-GPRegistryValue -Name "firewall" -ValueName "EnableFirewall" -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" -Value 1 -Type DWord
-Set-GPRegistryValue -Name "firewall" -ValueName "EnableFirewall" -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile" -Value 1 -Type DWord
+Set-GPRegistryValue -Name "firewall" -ValueName "EnableFirewall" -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile" -Value 0 -Type DWord
+Set-GPRegistryValue -Name "firewall" -ValueName "EnableFirewall" -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" -Value 0 -Type DWord
+Set-GPRegistryValue -Name "firewall" -ValueName "EnableFirewall" -key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile" -Value 0 -Type DWord
 Set-GPRegistryValue -Name "firewall" -ValueName "fEnableWddmDriver" -key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services" -Value 1 -Type DWord
 Set-GPRegistryValue -Name "firewall" -ValueName "LogFilePath" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging" -Value %systemroot%\system32\logfiles\firewall\domainfw.log -Type String
 Set-GPRegistryValue -Name "firewall" -ValueName "LogFileSize" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\WindowsFirewall\DomainProfile\Logging" -Value 32096 -Type DWord
 Set-GPRegistryValue -Name "firewall" -ValueName "DisableNotifications" -Key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\WindowsFirewall\DomainProfile" -Value 1 -Type DWord
 Set-GPRegistryValue -Name "firewall" -ValueName "PolicyVersion" -key "HKEY_LOCAL_MACHINE\software\Policies\Microsoft\WindowsFirewall" -Value 543 -Type DWord
-Import-Module -Name NetSecurity
 
-$fwgpo = Get-GPO -Name "Firewall"
-$fwgponame = $fwgpo.DomainName + "\" + $fwgpo.DisplayName
-$FWGPOSession = Open-NetGPO -PolicyStore $fwgponame
-Net-NetFirewallRule -DisplayName "Allow Ansible" -direction Inbound -localport "5985-5986" -protocol TCP -Action Allow -GPOSession $FWGPOSession
-Save-NetGPO -GPOSession $FWGPOSession
+############# Workaround - Adam #############
+$GpoName = "Disable Windows Firewall"
+$DomainName = "$winProject.loc"
+
+# Create and link GPO
+New-GPO -Name $GpoName
+New-GPLink -Name $GpoName -Target "DC=$($DomainName.Split('.')[0]),DC=$($DomainName.Split('.')[1])"
+
+# Configure GPO to disable Windows Firewall
+Set-GPRegistryValue -Name $GpoName -Key "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" -ValueName "EnableFirewall" -Type DWord -Value 0
+Set-GPRegistryValue -Name $GpoName -Key "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile" -ValueName "EnableFirewall" -Type DWord -Value 0
+Set-GPRegistryValue -Name $GpoName -Key "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile" -ValueName "EnableFirewall" -Type DWord -Value 0
+############# Workaround - Adam #############
+
+#Import-Module -Name NetSecurity
+#
+#$fwgpo = Get-GPO -Name "Firewall"
+#$fwgponame = $fwgpo.DomainName + "\" + $fwgpo.DisplayName
+#$FWGPOSession = Open-NetGPO -PolicyStore $fwgponame
+#New-NetFirewallRule -DisplayName "Allow Ansible" -Action Allow -Direction Inbound -LocalPort 5985-5986 -Protocol TCP -GPOSession $FWGPOSession
+#Save-NetGPO -GPOSession $FWGPOSession
 
 #Create proxy GPO
 New-GPO -Name "proxy" -comment "proxy Settings for the end user servers"
@@ -351,27 +371,28 @@ Set-GPRegistryValue -Name "proxy" -ValueName "Mode" -Key "HKEY_LOCAL_MACHINE\Sof
 #Set up Auditing 
 #https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol-set
 
+$computers | ForEach-Object {
+     Set-GPPermission -Name "rds settings" -TargetName $_ -TargetType Computer -PermissionLevel GpoApply
+     Set-GPPermission -Name "Chrome" -TargetName $_ -TargetType Computer -PermissionLevel GpoApply
+     Set-GPPermission -Name "Firefox" -TargetName $_ -TargetType Computer -PermissionLevel GpoApply
+     Set-GPPermission -Name "Edge" -TargetName $_ -TargetType Computer -PermissionLevel GpoApply
+     Set-GPPermission -Name "wb servers" -TargetName $_ -TargetType Computer -PermissionLevel GpoApply
+     Set-GPPermission -Name "Disable Internet Explorer" -TargetName $_ -TargetType Computer -PermissionLevel GpoApply
+}
+
 #Set permissions
 Set-GPPermission -Name "rds settings" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
-Set-GPPermission -Name "rds settings" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
 #Set-GPPermission -Name "NTLM" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
 #Set-GPPermission -Name "NTLM" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
 Set-GPPermission -Name "Chrome" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
-Set-GPPermission -Name "Chrome" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
 Set-GPPermission -Name "Firefox" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
-Set-GPPermission -Name "Firefox" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
 Set-GPPermission -Name "Edge" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
-Set-GPPermission -Name "Edge" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
 Set-GPPermission -Name "wb servers" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
-Set-GPPermission -Name "wb servers" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
 Set-GPPermission -Name "Disable Internet Explorer" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
-Set-GPPermission -Name "Disable Internet Explorer" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
 Set-GPPermission -Name "WSUS" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
 Set-GPPermission -Name "WSUS" -TargetName "Domain computers" -TargetType Group -PermissionLevel GpoApply
 Set-GPPermission -Name "Disable Internet Explorer" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
-Set-GPPermission -Name "Disable Internet Explorer" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
-Set-GPPermission -Name "Disable Internet Explorer" -TargetName "Domain Users" -TargetType Group -PermissionLevel GpoApply
-Set-GPPermission -Name "Disable Internet Explorer" -TargetName $computers -TargetType Computer -PermissionLevel GpoApply
+Set-GPPermission -Name "Disable Internet Explorer" -TargetName "Domain Computers" -TargetType Group -PermissionLevel GpoApply
 Set-GPPermission -Name "Default Domain Policy" -TargetName "Domain Computers" -TargetType Group -PermissionLevel GpoApply
 Set-GPPermission -Name "Default Domain Controllers Policy" -TargetName "Domain Controllers" -TargetType Group -PermissionLevel GpoApply
 Set-GPPermission -Name "WSUS" -TargetName "Domain Computers" -TargetType Group -PermissionLevel GpoApply
@@ -389,7 +410,7 @@ New-GPLink -Name "wb servers" -Target $workbenchou
 New-GPLink -Name "Edge" -Target $workbenchou
 New-GPLink -Name "Firefox" -Target $workbenchou
 New-GPLink -Name "Chrome" -Target $workbenchou
-New-GPLink -Name "firewall" -Target $workbenchou
+#New-GPLink -Name "firewall" -Target $workbenchou
 
 #add entry for WSUS