12.7. Committing to AGPM via Group Policy Permissions
AGPM is great. But by now, you can see the back door that prevents its immediate usefulness. That is, if someone created a GPO before the AGPM system was installed, then, well, that person could just continue to "work around" the AGPM system if they wanted to.
In other words, they can continue to edit the live GPO instead of using the archive. That's not good, because then you would have no record of anything they did because history is recorded only when someone uses the AGPM system to manage copies of the GPO and put them into production.
There are really only a few required steps to guarantee that (under normal circumstances) everyone must use AGPM and not fall back into old habits. Those ...
Get Group Policy: Fundamentals, Security, and Troubleshooting now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
