book

Group Policy: Fundamentals, Security, and the Managed Desktop

Name: Group Policy: Fundamentals, Security, and the Managed Desktop
Author: Jeremy Moskowitz
ISBN: 9780470581858

by Jeremy Moskowitz

May 2010

Intermediate to advanced

936 pages

28h 35m

English

Sybex

Read now

Unlock full access

Copyright
Dear Reader,
Acknowledgments
About the Contributors
Introduction
Group Policy DefinedGroup Policy vs. Group Policy Objects vs. Group Policy PreferencesWhere Group Policy AppliesThe "Too Many Operating Systems" ProblemThis Book and Beyond
1. Group Policy Essentials
1.1. Getting Ready to Use This Book1.2. Getting Started with Group Policy1.2.1. Group Policy Entities and Policy Settings1.2.2. The 18 (Original) Categories of Group Policy1.3. Understanding Local Group Policy1.3.1. Local Group Policy on Pre-Vista Computers1.3.2. Local Group Policy on Vista and Later1.3.2.1. Understanding Multiple Local GPOs1.3.2.2. Trying Out Multiple Local GPOs on Windows Vista and Later1.3.2.3. Local GPOs Final Thoughts1.4. Active Directory-Based Group Policy1.4.1. Group Policy and Active Directory1.4.2. Linking Group Policy Objects1.5. An Example of Group Policy Application1.6. Examining the Resultant Set of Policy1.6.1. At the Site Level1.6.2. At the Domain Level1.6.3. At the OU Level1.6.3.1. Bringing It All Together1.7. Group Policy, Active Directory, and the GPMC1.7.1. GPMC Overview1.7.1.1. About the GPMC1.7.2. Implementing the GPMC on Your Management Station1.7.2.1. Using a Windows 7 or Windows Server 2008 R2 Management Station1.7.2.2. Using a Windows Server 2008 R2 Machine as Your Management Station1.7.2.3. Using Windows 7 as Your Management Machine1.7.3. Creating a One-Stop-Shop MMC1.8. Group Policy 101 and Active Directory1.8.1. Active Directory Users and Computers vs. GPMC1.8.2. Adjusting the View within the GPMC1.8.3. The GPMC-centric View1.9. Our Own Group Policy Examples1.9.1. More about Linking and the Group Policy Objects Container1.9.1.1. Understanding Our Actions1.9.2. Applying a Group Policy Object to the Site Level1.9.2.1. Verifying Your Changes at the Site Level1.9.3. Applying Group Policy Objects to the Domain Level1.9.3.1. Verifying Your Changes at the Domain Level1.9.4. Applying Group Policy Objects to the OU Level1.9.4.1. Preparing to Delegate Control1.9.4.2. Delegating Control for Group Policy Management1.9.4.2.1. Performing Your First Delegation1.9.4.2.2. Adding a User to the Server Operators Group (Just for This Book)1.9.5. Testing Your Delegation of Group Policy Management1.9.6. Understanding Group Policy Object Linking Delegation1.9.7. Granting OU Admins Access to Create New Group Policy Objects1.9.8. Creating and Linking Group Policy Objects at the OU Level1.9.8.1. Verifying Your Changes at the OU Level1.9.9. Creating a New Group Policy Object Affecting Computers in an OU1.9.10. Moving Computers into the Human Resources Computers OU1.9.11. Verifying Your Cumulative Changes1.10. Final Thoughts
2. Managing Group Policy with the GPMC
2.1. Common Procedures with the GPMC2.1.1. Raising or Lowering the Precedence of Multiple Group Policy Objects2.1.2. Understanding GPMC's Link Warning2.1.3. Stopping Group Policy Objects from Applying2.1.3.1. Preventing Local GPOs from Applying2.1.3.2. Disabling the Link Enabled Status2.1.3.3. Disabling "Half" (or Both Halves) of the Group Policy Object2.1.3.4. Deleting and Unlinking Group Policy Objects2.1.3.5. Deleting the Link to the Group Policy Object2.1.3.6. Truly Deleting the Group Policy Object Itself2.1.4. Block Inheritance2.1.5. The Enforced Function2.2. Security Filtering and Delegation with the GPMC2.2.1. Filtering the Scope of Group Policy Objects with Security2.2.1.1. Group Policy Object Filtering Approach #1: Leverage the Security Filtering Section of the Scope Tab in GPMC2.2.1.2. Testing Your First Filters2.2.1.3. What's Going on under the Hood for Filtering2.2.1.4. Filtering Approach #2: Identify Those You Do Not Want to Get the Policy2.2.2. User Permissions upon Group Policy Objects2.2.3. Granting Group Policy Object Creation Rights in the Domain2.2.4. Special Group Policy Operation Delegations2.2.5. Who Can Create and Use WMI Filters?2.2.5.1. Delegating Who Can Create WMI Filters2.2.5.2. Delegating Who Can use WMI Filters2.3. Performing RSoP Calculations with the GPMC2.3.1. What's-Going-On Calculations with Group Policy Results2.3.2. What-If Calculations with Group Policy Modeling2.4. Searching and Commenting Group Policy Objects and Policy Settings2.4.1. Searching for GPO Characteristics2.4.2. Filtering Inside a GPO for Policy Settings2.4.2.1. Where Did Filtering Come From?2.4.2.2. What's Available to Filter2.4.2.3. Keyword Filters2.4.2.4. Type of Settings to Display2.4.2.5. Requirements Filters2.4.2.6. Results of Your Filter2.4.2.7. Browsing the Results2.4.2.8. Filter Options On/Off2.4.2.9. The All Settings Node2.4.2.10. Using the All Settings Node in Conjunction with Filtering2.4.2.11. Using the All Settings Node without the Use of Filtering2.4.3. Comments for GPOs and Policy Settings2.4.3.1. Comments about a Specific GPO2.4.3.2. Leaving a Comment inside a GPO2.4.3.3. Reading a Comment about a GPO2.4.3.4. Comments about Specific GPO Settings2.4.3.5. Leaving a Comment inside a Specific GPO Setting2.4.3.6. Reading a Comment inside a Specific GPO Setting2.4.3.7. Looking at Comments While Editing the GPO2.4.3.8. Looking at All Comments While inside the GPMC2.5. Starter GPOs2.5.1. Creating a Starter GPO2.5.2. Editing a Starter GPO2.5.3. Leveraging a Starter GPO2.5.3.1. Using the Starter GPOs Node2.5.3.2. Creating a New GPO and Selecting a Starter GPO2.5.4. Delegating Control of Starter GPOs2.5.5. Wrapping Up and Sending Starter GPOs2.6. Back Up and Restore for Group Policy2.6.1. Backing Up Group Policy Objects2.6.2. Restoring Group Policy Objects2.6.3. Backing Up and Restoring Starter GPOs2.6.4. Backing Up and Restoring WMI Filters2.6.5. Backing Up and Restoring IPsec Filters2.7. GPMC At-a-Glance Icon View2.8. The GPMC At-a-Glance Compatibility Table2.9. Final Thoughts
3. Group Policy Processing Behavior Essentials
3.1. Group Policy Processing Principles3.1.1. Don't Get Lost3.1.2. Initial Policy Processing3.1.2.1. Windows 2000 (and Windows Server 2003 and Windows Server 2008) Initial Policy Processing3.1.2.2. Windows XP and Later Initial Policy Processing3.1.3. Background Refresh Policy Processing3.1.3.1. Background Refresh Intervals for Windows 2000/2003/2008 Member Servers3.1.3.2. Background Refresh Intervals for Windows 2000/2003/2008 Domain Controllers3.1.3.3. Background Refresh Exemptions3.1.3.4. Windows XP and Later and Background Processing3.1.3.4.1. Windows XP and Later Fast-Boot Results3.1.3.4.2. Windows XP and Later Fast Boot Group Policy Processing Details3.1.3.4.3. Automatically Killing Fast Boot with Special User Account Attributes3.1.3.4.4. Manually Turning Off Windows XP and Later Fast Boot3.1.3.5. Forcing Background Policy Processing3.1.4. Security Background Refresh Processing3.1.4.1. Background Security Refresh Processing3.1.4.2. Mandatory Reapplication for Nonsecurity Policy3.1.4.3. Manually Forcing Clients to Process GPOs (Revisited)3.1.5. Special Case: Moving a User or a Computer Object3.2. Policy Application via Remote Access, Slow Links, and after Hibernation3.2.1. Windows 2000 and Windows XP Group Policy over Slow Network Connections3.2.2. Windows 7 Group Policy over Slow Network Connections3.2.3. What Is Processed over a Slow Network Connection?3.3. Using Group Policy to Affect Group Policy3.3.1. Affecting the User Settings of Group Policy3.3.1.1. Group Policy Refresh Interval for Users3.3.1.2. Group Policy Slow Link Detection3.3.1.3. Group Policy Domain Controller Selection3.3.1.4. Create New Group Policy Object Links Disabled by Default3.3.1.5. Default Name for Group Policy Objects3.3.1.6. Enforce Show Policies Only3.3.1.7. Turn Off Automatic Update of ADM Files3.3.1.8. Disallow Interactive Users from Generating Resultant Set of Policy Data3.3.2. Affecting the Computer Settings of Group Policy3.3.2.1. Turn Off Background Refresh of Group Policy3.3.2.2. Group Policy Refresh Interval for Computers3.3.2.3. Group Policy Refresh Interval for Domain Controllers3.3.2.4. User Group Policy Loopback Processing Mode3.3.2.5. Allow Cross-Forest User Policy and Roaming User Profiles3.3.2.6. Group Policy Slow Link Detection3.3.2.7. Turn Off Resultant Set of Policy Logging3.3.2.8. Remove Users' Ability to Invoke Machine Policy Refresh3.3.2.9. Disallow Interactive Users from Generating Resultant Set of Policy Data3.3.2.10. Registry policy Processing (where p in policy is lowercase)3.3.2.11. Internet Explorer Maintenance Policy Processing3.3.2.12. Software Installation Policy Processing3.3.2.13. Folder Redirection Policy Processing3.3.2.14. Scripts Policy Processing3.3.2.15. Security Policy Processing3.3.2.16. IP Security Policy Processing3.3.2.17. EFS Recovery Policy Processing3.3.2.18. Wireless Policy Processing3.3.2.19. Wired Policy Processing3.3.2.20. Disk Quota Policy Processing3.3.2.21. Always Use Local ADM Files for Group Policy Object Editor3.3.2.22. Turn Off Local Group Policy Objects Processing3.3.2.23. Startup Policy Processing Wait Time3.3.3. The Missing Group Policy Policy Settings3.4. Final Thoughts
4. Advanced Group Policy Processing
4.1. WMI Filters: Fine-Tuning When and Where Group Policy Applies4.1.1. Tools (and References) of the WMI Trade4.1.2. WMI Filter Syntax4.1.3. Creating and Using a WMI Filter4.1.3.1. WMI Filter Creation4.1.3.2. WMI Filter Usage4.1.4. Final WMI Filter Thoughts4.2. Group Policy Loopback Processing4.2.1. Reviewing Normal Group Policy Processing4.2.2. Group Policy Loopback—Merge Mode4.2.3. Group Policy Loopback—Replace Mode4.2.3.1. Creating a New OU4.2.3.2. Moving a Client into the Public Kiosk OU4.2.3.3. Creating a Group Policy Object with Group Policy Loopback—Replace Mode4.2.3.4. Verifying That Group Policy Loopback—Replace Mode Is Working4.2.3.5. Group Policy Loopback—Replace Mode for Terminal Services4.2.3.6. Additional Terminal Services Tips4.3. Group Policy with Cross-Forest Trusts4.3.1. What Happens When Logging onto Different Clients across a Cross-Forest Trust?4.3.2. Disabling Loopback Processing When Using Cross-Forest Trusts4.3.3. Older Machine Types and Cross-Forest Trusts4.3.4. Understanding Cross-Forest Trust Permissions4.4. Final Thoughts
5. Group Policy Preferences
5.1. Powers of the Group Policy Preferences5.1.1. Computer Configuration Preferences5.1.1.1. Computer Configuration Preferences Windows Settings5.1.1.1.1. Environment Extension5.1.1.1.2. Files Extension5.1.1.1.3. Folders Extension5.1.1.1.4. .INI Files Extension5.1.1.1.5. Registry Extension5.1.1.1.6. Network Shares Extension5.1.1.1.7. Shortcuts Extension5.1.1.2. Computer Configuration Preferences Control Panel Settings5.1.1.2.1. Data Sources Extension5.1.1.2.2. Devices Extension5.1.1.2.3. Folder Options Extension5.1.1.2.4. Local Users and Groups Extension5.1.1.2.5. Network Options Extension5.1.1.2.6. Power Options Extension5.1.1.2.7. Printers Extension5.1.1.2.8. Scheduled Tasks Extension5.1.1.2.9. Services Extension5.1.2. User Configuration Preferences5.1.2.1. User Configuration Preferences Windows Settings5.1.2.1.1. Applications Extension5.1.2.1.2. Drive Maps Extension5.1.2.2. User Configuration Preferences Control Panel5.1.2.2.1. Folder Options Extension5.1.2.2.2. Internet Settings Extension5.1.2.2.3. Printers Extension5.1.2.2.4. Regional Options Extension5.1.2.2.5. Start Menu Extension5.2. Group Policy Preferences Architecture and Installation Instructions5.2.1. Installing the Client-Side Extensions on Your Client Machines5.2.1.1. The CSEs for Windows 7, Windows Server 2008, Windows Server 2008 R25.2.1.2. The CSEs for Windows Server 2003, Windows XP, and Windows Vista5.2.1.2.1. Installing the Prerequisites and CSEs for Windows Server 2003 and Windows XP by Hand5.2.1.2.2. Installing the CSEs for Windows Vista by Hand5.2.1.2.3. Installing the Prerequisites and CSEs for All Operating Systems Automatically5.3. Group Policy Preferences Concepts5.3.1. Preference vs. Policy5.3.1.1. Why Group Policy Works—a Review5.3.1.2. Why ADM/ADMX Files Are and Aren't So Awesome5.3.1.3. Group Policy Preferences Are Like ADM/ADMX Files (Mostly)5.3.1.4. Group Policy Preferences Advantages over ADM/ADMX Files5.3.2. The Overlap of Group Policy vs. Group Policy Preferences and Associated Issues5.3.2.1. Classic vs. Group Policy Preferences Overlap Areas5.3.2.1.1. Group Policy Deployed Printers vs. GPPrefs Printers Extension5.3.2.1.2. Group Policy Internet Explorer and Group Policy IE Maintenance Configuration vs. the GPPrefs Internet Settings Extension5.3.2.1.3. Group Policy Power Management vs. GPPrefs Power Options Preference Extension5.3.2.1.4. Group Policy File Security vs. GPPrefs Files Preference Extension5.3.2.1.5. Group Policy System Services vs. GPPrefs Services Preference Extension5.3.2.1.6. Group Policy Device Installation Restrictions vs. GPPrefs Devices Preference Extension5.3.2.1.7. Group Policy Start Menu Policy Settings vs. GPPrefs Start Menu5.3.2.1.8. Group Policy Restricted Groups vs. Local Users and Groups Preference Extension5.3.2.2. How Does the Group Policy Engine Deal with Overlaps?5.3.2.2.1. The Short Answer: Policy Wins over Preferences5.3.2.2.2. The Middle-Length Answer: Sometimes Preferences Win over Policy5.3.2.2.3. The Longer Answer: Understanding CSE Timing and Overlap5.3.2.2.4. Other Items That Can Affect Group Policy and GPPrefs Processing5.3.3. The Lines and Circles and the CRUD Action Modes5.3.3.1. The Lines and the Circles5.3.3.2. Warning: Visiting Multiple Tabs Can Be Hazardous to Your Network's Health5.3.3.3. The CRUD Method: Create, Replace, Update, or Delete5.3.4. Common Tab5.3.4.1. "Stop Processing Items in This Extension If an Error Occurs"5.3.4.2. "Run In Logged-on User's Security Context (User Policy Option)"5.3.4.3. "Remove This Item When It Is No Longer Applied"5.3.4.3.1. Finding a Value to Change with the Registry Extension5.3.4.3.2. Using the Registry Preference Extension to Dictate the Setting to the Human Resources Users OU5.3.4.3.3. Testing the Delivery of Our Settings5.3.4.3.4. Testing the Default Group Policy Preferences Behavior5.3.4.3.5. Resetting for Our Next Test5.3.4.3.6. Turning on "Remove This Item When It Is No Longer Applied"5.3.4.3.7. Testing the Redelivery of Our Settings5.3.4.3.8. Seeing the Result of "Remove This Item When It Is No Longer Applied"5.3.4.3.9. Putting the World Right Again for Sol5.3.4.3.10. Final Thoughts about "Remove This Item When It Is No Longer Applied"5.3.4.4. "Apply Once and Do Not Reapply"5.3.4.5. Targeting Your Preference Items5.3.4.5.1. The Targeting Editor5.3.4.5.2. Adding Additional Collections5.3.4.5.3. Other Targeting Editor Tricks5.3.4.5.4. Description Field5.4. Group Policy Preferences Tips, Tricks, and Troubleshooting5.4.1. Quick Copy, Drag and Drop, Cut and Paste, and Sharing of Settings5.4.1.1. Quick Copy/Paste5.4.1.2. Drag (or Paste) a Group Policy Preference Extension to a File5.4.1.3. Sharing Your Wisdom with Others5.4.2. Multiple Preference Items at a Level5.4.2.1. Filtering Each Preference Item at a Level5.4.2.2. Changing the Order of Preference Items at a Level5.4.2.3. Renaming Preference Items at a Level5.4.3. Temporarily Disabling a Single Preference Item or Extension Root5.4.4. Environment Variables5.4.5. Managing Group Policy Preferences: Hiding Extensions from Use5.4.6. Troubleshooting: Reporting, Logging, and Tracing5.4.6.1. Reporting: Settings Tab, GPMC Reporting, and GPresult5.4.6.1.1. The Group Policy Results Reports from the GPMC5.4.6.1.2. Gpresult.exe5.4.6.2. Event Logs5.4.6.3. Tracing5.5. Final Thoughts

6. Managing Applications and Settings Using Group Policy
6.1. Administrative Templates: A History and Policy vs. Preferences6.1.1. Administrative Templates: Then and Now6.1.2. Policy vs. Preference6.2. ADM vs. ADMX and ADML Files6.2.1. ADM File Introduction6.2.2. Updated GPMC's ADMX and ADML Files6.2.3. ADM vs. ADMX Files—At a Glance6.3. ADMX and ADML Files: What They Do and the Problems They Solve6.3.1. Problem and Solution 1: Tackling SYSVOL Bloat6.3.2. Problem 2: How Do We Deal with Multiple Languages?6.3.3. Problem 3: How Do We Deal with "Write Overlaps"?6.3.4. Problem 4: How Do We Distribute Updated Definitions to All Our Administrators?6.4. The Central Store6.4.1. The Windows ADMX/ADML Central Store6.4.1.1. Creating the Central Store6.4.1.2. Populating the Central Store6.4.1.3. Verifying That You're Using the Central Store6.4.1.4. Updating the Central Store6.5. Creating and Editing GPOs in a Mixed Environment6.5.1. Scenario 1: Start Out by Creating and Editing a GPO Using the Older GPMC. Edit Using Another Older GPMC Management Station.6.5.2. Scenario 2: Start Out by Creating and Editing a GPO with the Older GPMC. Edit Using the Updated GPMC.6.5.3. Scenario 3: Start Out by Creating and Editing a GPO Using the Updated GPMC. Edit Using Another Updated GPMC Management Station.6.5.4. Scenario 4: Start Out by Creating and Editing a GPO Using an Updated GPMC Management Station. Edit Using an Older GPMC Management Station.6.6. ADM and ADMX Templates from Other Sources6.6.1. Leveraging ADM Templates from Your Windows Management Station6.6.2. Microsoft Office ADM Templates6.6.2.1. Office 2000, Office XP, Office 2003, and Office 2007 ADM Templates6.6.2.1.1. Implementing a Customized Office Policy6.6.2.2. Other Microsoft ADM Templates6.6.2.2.1. Microsoft Software Update Services (SUS) and Windows Server Update Services (WSUS)6.6.2.2.2. Microsoft Corporate Error Reporting6.6.3. Using ADMX Templates from Other Sources6.6.3.1. ADMX Templates for Office 20076.6.3.2. ADMX Templates from Other Sources6.6.3.3. Deciding How to Use ADMX Templates6.7. ADMX Migrator and ADMX Editor Tools6.7.1. ADMX Migrator6.7.2. ADMX Editor6.8. PolicyPak Community Edition6.8.1. PolicyPak Concepts and Installation6.8.2. Creating Your First PolicyPak6.8.2.1. The PolicyPak AutoUI Wizard6.8.2.2. The PolicyPak Design Studio6.8.2.2.1. Setting Registry Punches Using PolicyPak Design Studio6.8.2.3. Compiling Your PolicyPak in Group Policy6.8.2.4. Deploying Your First Compiled PolicyPak Extension6.8.2.5. Testing Your PolicyPak6.9. Final Thoughts
7. Troubleshooting Group Policy
7.1. Under the Hood of Group Policy7.1.1. Inside Local Group Policy7.1.1.1. Where Local Group Policy Lives7.1.1.2. Three Use-at-Your-Own-Risk Local Group Policy Tips7.1.2. Inside Active Directory Group Policy Objects7.1.2.1. Group Policy Objects from a Domain Perspective7.1.2.2. Group Policy Objects from an OU Perspective7.1.2.3. Group Policy Objects from a Site Perspective7.2. The Birth, Life, and Death of a GPO7.2.1. How Group Policy Objects Are "Born"7.2.2. How a GPO "Lives"7.2.2.1. Group Policy Containers (GPCs)7.2.2.2. Who Really Has Permissions to Do What?7.2.2.2.1. Who Can Create New Group Policy Objects?7.2.2.2.2. Who Can Manipulate and Edit Existing Group Policy Objects?7.2.2.3. Group Policy Templates7.2.2.4. Group Policy Settings Storage7.2.2.5. Verifying That GPCs and GPTs Are in Sync7.2.2.5.1. Using Gpotool.exe7.2.2.5.2. Using Replmon to See the Version Numbers7.2.2.5.3. Isolating Replication Problems7.2.3. Death of a GPO7.3. How Client Systems Get Group Policy Objects7.3.1. The Steps to Group Policy Processing7.3.1.1. Core Processing for XP Machines7.3.1.2. Core Processing for Windows 77.3.1.2.1. Windows 7's Slow Link Detection7.3.2. Client-Side Extensions7.3.2.1. CSEs for XP Machines7.3.2.2. CSEs for Windows Vista and Windows Server 2008 Machines7.3.2.3. CSEs for Windows 7 and Windows Server 2008 R2 Machines7.3.2.4. Additional CSEs for the Group Policy Preferences7.3.2.5. Inside CSE Values7.3.3. Where Are Administrative Templates Registry Settings Stored?7.4. Why Isn't Group Policy Applying?7.4.1. Reviewing the Basics7.4.1.1. Is the Group Policy Object or Link Disabled?7.4.1.2. Are You Sure about the Inheritance?7.4.1.3. Are You Trying to Apply Policy to a Group Inside an OU?7.4.1.4. Multiple Group Policy Objects at a Level7.4.1.5. Examining Your Block Inheritance Usage7.4.1.6. Examining Your "Enforced" Usage7.4.1.7. Are Your Permissions Set Correctly?7.4.2. Advanced Inspection7.4.2.1. Is Windows XP (and Later) Fast Boot On?7.4.2.2. Is Asynchronous Processing Turned On in Windows 2000?7.4.2.3. Are Both the GPC and GPT Replicated Correctly?7.4.2.4. Did You Check the DNS Configuration of the Server and Client?7.4.2.5. Are You Really Logged On?7.4.2.6. Did Something Recently Move?7.4.2.7. Is the Machine Properly Joined to the Domain?7.4.2.8. Is Loopback Policy Enabled?7.4.2.9. How Are Slow Links Being Defined, and How Are Slow Links Handled?7.4.2.10. Troubleshooting NLA in Windows 77.4.2.11. Are the Date and Time Correct on the Client System?7.4.2.12. Are Your Active Directory Sites Configured Correctly?7.4.2.13. Did You Check the DNS Configuration of the Client?7.4.2.14. Are You Trying to Set Password or Account Policy on an OU?7.4.2.15. Did Someone Muck with Security behind the Group Policy Engine's Back?7.4.2.16. Is the Target Computer in the Correct OU? Is the Target User in the Correct OU?7.4.2.17. Is There a Firewall on (or between) Your Domain Controllers?7.4.2.18. Did You Disable ICMP (Ping) from Your Clients to Your Domain Controllers? (For XP Machines)7.4.2.19. Did Someone Muck with the ACLs of the GPT Part of the GPO in SYSVOL?7.5. Client-Side Troubleshooting7.5.1. RSoP for Windows Clients7.5.1.1. GPResult for Windows 2003, Windows Vista RTM, and Windows XP7.5.1.2. GPResult for Windows 7, Windows Vista/SP1, and Windows Server 2008 and R27.5.1.3. Remotely Calculating a Client's RSoP (Using the GPResult from Windows XP and Later)7.5.1.4. Remotely Calculating a Client's RSoP (When You've Delegated Permissions to Someone Who's Not a Local Administrator of the Target Machine)7.5.1.5. Remotely Calculating a Client's Group Policy Modeling Analysis Data (When You've Delegated Permissions to Someone Who's Not a Local Administrator of the Target Machine)7.6. Advanced Group Policy Troubleshooting with Log Files7.6.1. Using the Event Viewer7.6.1.1. Diagnostic Event Logging (for XP)7.6.1.2. Diagnostic Event Logging (Windows 7)7.6.2. Turning On Verbose Logging7.6.2.1. Verbose Logging (for XP)7.6.2.2. Other Types of Verbose Logging7.6.2.3. Verbose Logging in Windows 77.6.2.4. Leveraging Windows 7 Admin Logs for Troubleshooting7.6.2.5. Leveraging Windows 7 Operational Logs for Troubleshooting7.6.2.6. GPLogView7.6.2.7. Enabling Tracing for the Group Policy Preference Extensions7.6.3. Group Policy Processing Performance7.7. Final Thoughts
8. Implementing Security with Group Policy
8.1. The Two Default Group Policy Objects8.1.1. GPOs Linked at the Domain Level8.1.1.1. Special Policy Settings for the Domain Level8.1.1.2. Modifying the "Default Domain Policy" GPO Directly8.1.1.3. Creating Your Own Group Policy Object Linked to the Domain Level and Changing the Precedence8.1.1.4. Which Approach Do You Take?8.1.2. Group Policy Objects Linked to the Domain Controllers OU8.1.3. Oops, the "Default Domain Policy" GPO and/or "Default Domain Controllers Policy" GPO Got Screwed Up!8.1.3.1. Repairing the Defaults for Windows 2003/2008 Domains8.1.3.2. Repairing the Defaults for Windows 2000 Domains8.2. The Strange Life of Password Policy8.2.1. What Happens When You Set Password Settings at an OU Level8.2.2. Fine-Grained Password Policy with Windows Server 20088.2.2.1. Getting Ready for Fine-Grained Password Policy8.2.2.2. Creating a Password Setting Object (PSO)8.2.2.2.1. Creating a Password Settings Object8.2.2.3. Resulting Set of PSOs8.2.2.3.1. The Active Directory Users and Computer Attribute Editor8.2.2.3.2. PSO Precedence8.2.2.3.3. Using Specops Password Policy Basic (Free Edition)8.2.2.3.4. Command-Line PSO Management8.2.2.4. More Information on Fine-Grained Password Policy8.3. Inside Auditing With and Without Group Policy8.3.1. Auditable Events using Group Policy8.3.2. Auditing File Access8.3.3. Auditing Group Policy Object Changes8.3.3.1. Group Policy Auditing Event IDs for Windows Server 20038.3.3.2. Group Policy Auditing Event IDs for Windows Server 20088.3.4. Advanced Audit Policy Configuration8.3.4.1. Advanced Auditing Example: Auditing Directory Service Changes8.3.4.2. Enabling Advanced Auditing for Windows Server 2008 R2 and Windows 78.3.4.3. Enabling Advanced Auditing for Windows Server 2008 and Windows Vista8.3.4.4. Auditing the Specific OU8.3.4.5. The Results8.4. Restricted Groups8.4.1. Strictly Controlling Active Directory Groups8.4.1.1. When Restricted Groups Settings Take Effect8.4.1.2. When Restricted Groups Settings Get Refreshed8.4.2. Strictly Applying Group Nesting8.4.3. Which Groups Can Go into Which Other Groups via Restricted Groups?8.5. Restrict Software: Software Restriction Policy and AppLocker8.5.1. Inside Software Restriction Policies8.5.2. Software Restriction Policies' "Philosophies"8.5.3. Software Restriction Policies' Rules8.5.3.1. Setting Up a Software Restriction Policy with a Rule8.5.3.2. Testing Your Software Restriction Policies8.5.3.3. Understanding When Software Restriction Policies Apply8.5.3.4. Troubleshooting Software Restriction Policies8.5.3.4.1. Inspecting the Software Restriction Policies Location in the Registry8.5.3.4.2. Software Restriction Policies Advanced Logging8.5.3.5. Oops, I Locked Myself Out of My Machine with Software Restriction Policies8.5.4. Restricting Software Using AppLocker8.5.4.1. AppLocker: Rules and Rule Conditions8.5.4.2. Leveraging Law 1: Blacklisting Specific Applications with an Explicit Deny8.5.4.3. AppLocker Actions: Enforcement or Auditing8.5.4.4. AppLocker: The AppID Service8.5.4.4.1. Turning On the AppID Service Manually8.5.4.4.2. Turning On the AppID Service "En Masse" Using Group Policy Preferences8.5.4.5. AppLocker: Testing It Out8.5.4.6. AppLocker: Modifying What the Client Sees8.5.4.7. AppLocker: Wrapping Up Our Tests8.5.4.8. Leveraging Laws 2 and 3: Whitelisting Only Known Good Applications8.5.4.8.1. Testing AppLocker's Law #3: Default Deny8.5.4.8.2. Automatically Generating Rules for AppLocker Whitelisting8.5.4.9. AppLocker: Importing and Exporting Rules8.5.4.10. AppLocker Final Thoughts and Resources8.6. Controlling User Account Control (UAC) with Group Policy8.6.1. Just Who Will See the UAC Prompts, Anyway?8.6.1.1. Which Groups Are Affected by UAC8.6.1.2. Elevated Rights and SE Privileges8.6.2. Understanding the Group Policy Controls for UAC8.6.2.1. User Account Control: Admin Approval Mode for the Built-in Administrator Account8.6.2.2. User Account Control: Allow UIAccess Applications to Prompt for Elevation without Using the Secure Desktop8.6.2.3. User Account Control: Behavior of the Elevation Prompt for Administrators in Admin Approval Mode8.6.2.4. User Account Control: Behavior of the Elevation Prompt for Standard Users8.6.2.5. User Account Control: Detect Application Installations and Prompt for Elevation8.6.2.6. User Account Control: Only Elevate Executables That Are Signed and Validated8.6.2.7. User Account Control: Only Elevate UIAccess Applications That Are Installed in Secure Locations8.6.2.8. User Account Control: Run All Administrators in Admin Approval Mode8.6.2.9. User Account Control: Switch to the Secure Desktop When Prompting for Elevation8.6.2.10. Virtualize File and Registry Write Failures to Per-User Locations8.6.3. UAC Policy Setting Suggestions8.6.3.1. Case 1: Enterprise Desktop: Standard User (Who Gets Help Remotely When Needed)8.6.3.2. Case 2: Enterprise Desktop: Standard User (Who Gets "Over-the-Shoulder Help" When Needed)8.6.3.3. Case 3: Enterprise Desktop: Protected Administrator8.6.3.4. Case 4: Enterprise Desktop (Running Only Windows Vista "logo'd" Software)8.6.3.5. Case 5: Enterprise Desktop: Protected Administrator (All Applications Are Signed)8.6.3.6. Case 6: Power User—Style User Who Shares Computers with Standard Users8.6.3.7. Case 7: Your Users Request Assistance with Windows Remote Assistance8.6.3.8. UAC Final Thoughts and References8.7. Wireless (802.3) and Wired Network (802.11) Policies8.7.1. 802.11 Wireless Policy for Windows XP8.7.2. 802.11 Wireless Policy and 802.3 Wired Policy for Windows Vista and Later8.8. Configuring Windows Firewall with Group Policy8.8.1. Manipulating the Windows XP and Windows Server 2003 Firewall8.8.1.1. Domain vs. Standard Profiles for Windows XP and Windows Server 20038.8.1.2. Killing the Firewall for Windows XP and Windows Server 20038.8.1.3. Opening Specific Ports, Managing Exceptions, and More for Windows XP and Windows Server 20038.8.2. Windows Firewall with Advanced Security (for Windows Vista and Windows Server 2008)—WFAS8.8.2.1. Getting Started with WFAS "Properties"8.8.2.2. Creating New Inbound and Outbound Rules with the WFAS8.8.2.3. Inbound and Outbound Rule Types8.8.2.4. Connection Security Rules8.8.2.5. Rule Precedence8.8.3. IPsec (Now in Windows Firewall with Advanced Security)8.8.3.1. IPsec General Resources8.8.3.2. Getting Started with IPsec with WFAS8.8.3.3. Understanding How WFAS IPsec Rules Work8.8.4. How Windows Firewall Rules Are Ultimately Calculated8.8.4.1. Precedence Order for Properties8.8.4.2. Precedence Order for Rules8.9. Final Thoughts
9. Profiles: Local, Roaming, and Mandatory
9.1. What Is a User Profile?9.1.1. The NTUSER.DAT File9.1.2. Profile Folders for Type 1 Computers (Windows 2000, Windows 2003, and Windows XP)9.1.2.1. Understanding the Contents of a User's Profile (for Type 1 Computers)9.1.3. Profile Folders for Type 2 Computers (Windows 7, Windows 2008, and Windows Server 2008 R2)9.1.3.1. Understanding the Contents of a User's Profile (for Type 2 Computers)9.1.3.2. Adjusting for Windows XP Holdovers9.1.3.3. The Public Profile (for Type 2 Computers)9.1.4. The Default Local User Profile9.1.5. The Default Domain User Profile9.1.5.1. Default Domain User Profiles for Type 1 Computers9.1.5.2. Default Domain User Profiles for Type 2 Computers9.2. Roaming Profiles9.2.1. Setting Up Roaming Profiles9.2.2. Testing Roaming Profiles9.2.2.1. Roaming from Windows XP to Windows XP9.2.2.2. Roaming from Windows 7 to Windows 79.2.2.3. Back on the Server9.2.2.4. Upshot of Roaming Profiles in a Mixed Windows 7 and Windows XP World9.2.3. Migrating Local Profiles to Roaming Profiles9.2.3.1. Automatic Upload of Existing Local Profiles9.2.3.2. Manual Upload of Existing Local Profiles9.2.4. Roaming and Nonroaming Folders9.2.4.1. Roaming and Nonroaming Folders for Type 1 Computers9.2.4.1.1. Type 1 Profile Directories That Do Not Roam9.2.4.1.2. Type 1 Profile Directories That Do Roam9.2.4.2. Roaming and Nonroaming Folders for Type 2 Computers9.2.4.2.1. Type 2 Profile Directories That Do Not Roam9.2.4.2.2. Type 2 Profile Directories that Roam9.2.5. Managing Roaming Profiles9.2.5.1. Merging Local Profile and Roaming Profile9.2.5.2. Guest Account Profile9.2.5.3. Cross-Forest Trusts9.2.6. Manipulating Roaming Profiles with Computer Group Policy Settings9.2.6.1. Do Not Check for User Ownership of Roaming Profile Folders9.2.6.2. Delete Cached Copies of Roaming Profiles9.2.6.3. Delete User Profiles Older Than a Specified Number of Days9.2.6.4. Slow Network Connection Timeout for User Profiles9.2.6.5. Do Not Detect Slow Network Connections9.2.6.6. Wait for Remote User Profile9.2.6.7. Prompt User When a Slow Network Connection Is Detected9.2.6.8. Timeout for Dialog Boxes9.2.6.9. Do Not Log Users on with Temporary Profiles9.2.6.10. Maximum Retries to Unload and Update User Profile9.2.6.11. Add the Administrators Security Group to Roaming User Profiles9.2.6.12. Prevent Roaming Profile Changes from Propagating to the Server9.2.6.13. Only Allow Local User Profiles9.2.6.14. Leave Windows Installer and Group Policy Software Installation Data9.2.6.15. Do Not Forcefully Unload the Users Registry at User Logoff9.2.6.16. Set Roaming Profile Path for All Users Logging Onto This Computer9.2.6.17. Set Maximum Wait Time for the Network if a User Has a Roaming User Profile or Remote Home Directory9.2.6.18. Background Upload of a Roaming User Profile's Registry File While User Is Logged On9.2.6.19. One More Policy Setting That You Might Like9.2.7. Manipulating Roaming Profiles with User Group Policy Settings9.2.7.1. Limit Profile Size9.2.7.2. Excluding Directories in Roaming Profile9.2.7.3. Connect Home Directory to Root of the Share9.3. Mandatory Profiles9.3.1. Establishing Mandatory Profiles from a Local Profile9.3.2. Mandatory Profiles from an Established Roaming Profile9.3.3. Forced Mandatory Profiles (Super-Mandatory)9.4. Final Thoughts
10. Implementing a Managed Desktop, Part 1: Redirected Folders, Offline Files, and the Synchronization Manager
10.1. Overview of Change and Configuration Management10.2. Redirected Folders10.2.1. Available Folders to Redirect10.2.2. Redirected Documents/My Documents10.2.2.1. Basic Redirected Folders10.2.2.2. The Target Tab10.2.2.3. The Settings Tab10.2.2.4. Advanced Redirected Folders10.2.2.5. Testing Folder Redirection of Documents/My Documents10.2.3. Redirecting the Start Menu and the Desktop10.2.4. Redirecting the Application Data10.2.5. Group Policy Setting for Folder Redirection10.2.5.1. Do Not Automatically Make Redirected Folders Available Offline (User Side Only)10.2.5.2. Use Localized Subfolder Names When Redirecting Start and My Documents (Both User and Computer)10.2.6. Troubleshooting Redirected Folders10.2.6.1. Windows XP (and Later) Fast Boot and Folder Redirection10.2.6.2. Permissions Problems10.2.6.3. Use GPResult for Verification10.2.6.4. Enabling Advanced Folder Redirection Logging10.2.6.4.1. Turning on Advanced Folder Redirection Logging for Pre-Vista10.2.6.4.2. Turning on Advanced Folder Redirection Logging for Windows 7 Machines10.3. Offline Files and Synchronization10.3.1. Making Offline Files Available10.3.1.1. Only the Files and Programs that Users Specify Will Be Available Offline10.3.1.2. All Files and Programs that Users Open from the Share Will Be Automatically Available Offline10.3.1.3. Files or Programs from the Share Will Not Be Available Offline10.3.1.4. Another Option: Optimized for Performance10.3.2. Inside Windows XP Synchronization10.3.2.1. Inside the Windows XP Offline Files and Synchronization Manager Interface10.3.2.2. Understanding Offline Files and Synchronization Manager Interaction10.3.3. Inside Windows 7 File Synchronization10.3.3.1. Better Handling of Downed Shares10.3.3.2. Better Handling of Synchronization10.3.3.3. No More Logon/Logoff Syncing Files Dialog Boxes10.3.3.4. Better Transfer Technology10.3.3.5. Better User Interface Design and Experience10.3.3.6. Better Offline Experience (Unified "Namespace" View)10.3.3.7. Better Cache Encryption10.3.3.8. Other Random New Goodies for Windows 710.3.4. Handling Conflicts10.3.5. Client Configuration of Offline Files10.3.5.1. The "Do Nothing" Approach10.3.5.1.1. Windows 2000 Reaction to Enabling Caching on Shares10.3.5.1.2. Windows XP Reaction to Enabling Caching on Shares10.3.5.1.3. Windows Vista and Windows 7 Reaction to Enabling Caching on Shares10.3.5.2. It's Not Offline Files—It's Explorer!10.3.5.3. Running Around to Each Client to Tweak Offline Files and the Synchronization Manager10.3.5.3.1. Manually Tweaking the Offline Files Interface for Pre-Vista Machines10.3.5.3.2. Manually Tweaking the Offline Files Interface for Windows 7 Machines10.3.5.3.3. More to Tweak in Windows 7: Offline Files Sync Schedule10.4. Using Folder Redirection and Offline Files over Slow Links10.4.1. Synchronizing over Slow Links with Redirected My Documents10.4.2. Synchronizing over Slow Links with Regular Shares10.4.2.1. Windows 2000 Offline Files over Slow Links10.4.2.2. Windows XP Synchronization Manager over Slow Links10.4.2.3. Windows Vista's Synchronization Engine over Slow Links10.4.2.4. Windows 7's Synchronization Engine over Slow Links10.4.2.5. Teaching Windows Vista and Windows 7 How to React to Slow Links10.4.3. Using Group Policy to Configure Offline Files (User and Computer Node)10.4.3.1. Configure Background Sync10.4.3.2. Enable Transparent Caching10.4.3.3. Prohibit User Configuration of Offline Files10.4.3.4. Synchronize All Offline Files When Logging On10.4.3.5. Synchronize All Offline Files Before Logging Off10.4.3.6. Synchronize Offline Files Before Suspend10.4.3.7. Action on Server Disconnect10.4.3.8. Non-default Server Disconnect Actions10.4.3.9. Remove 'Make Available Offline'10.4.3.10. Prevent Use of Offline Files Folder10.4.3.11. Administratively Assigned Offline Files10.4.3.12. Turn Off Reminder Balloons10.4.3.13. Reminder Balloon Frequency10.4.3.14. Initial Reminder Balloon Lifetime10.4.3.15. Reminder Balloon Lifetime10.4.3.16. Event Logging Level10.4.3.17. Prohibit 'Make Available Offline' for These File and Folders10.4.3.18. Do Not Automatically Make Redirected Folders Available Offline10.4.4. Using Group Policy to Configure Offline Files (Exclusive to the Computer Node)10.4.4.1. Allow or Disallow Use of the Offline Files Feature10.4.4.2. Default Cache Size10.4.4.3. Files Not Cached10.4.4.4. Exclude Files from Being Cached10.4.4.5. At Logoff, Delete Local Copy of User's Offline Files10.4.4.6. Subfolders Always Available Offline10.4.4.7. Encrypt the Offline Files Cache10.4.4.8. Configure Slow Link Speed10.4.4.9. Configure Slow-Link Mode10.4.4.10. Turn On Economical Application of Administrative Assigned Offline Files10.4.4.11. Limit Disk Space Used by Offline Files10.4.5. Troubleshooting Sync Center10.4.5.1. Enabling the Offline Files Log10.4.5.2. Enabling the Sync Log10.4.6. Turning Off Folder Redirection's Automatic Offline Caching for Desktops10.4.6.1. Using WMI Filters to Forcibly Apply This Setting Specifically to Desktops10.4.6.2. Using Group Policy Preference Extensions to Force the Value (Just for Users on Desktops)10.4.6.3. Using PolicyPak to Apply This Setting to Specific Computers10.5. Final Thoughts
11. The Managed Desktop, Part 2: Software Deployment via Group Policy
11.1. Group Policy Software Installation (GPSI) Overview11.1.1. The Windows Installer Service11.1.2. Understanding .MSI Packages11.1.3. Utilizing an Existing .MSI Package11.1.3.1. Setting Up the Software Distribution Share11.1.3.2. Setting Up an Administrative Installation (for .MSI Files that Need Them)11.2. Assigning and Publishing Applications11.2.1. Assigning Applications11.2.1.1. What Happens When You Assign Applications to Users11.2.1.2. What Happens When You Assign Applications to Computers11.2.2. Publishing Applications11.2.3. Rules of Deployment11.2.4. Package-Targeting Strategy11.2.4.1. Creating and Editing the GPO to Deploy Office11.2.4.2. Understanding When Applications Will Be Installed11.2.4.3. Testing Assigned Applications11.2.5. Understanding .ZAP Files11.2.5.1. Creating Your Own .ZAP File11.2.5.2. Publishing Your Own .ZAP File11.2.5.3. Testing Your .ZAP File11.2.6. Testing Publishing Applications to Users11.2.7. Application Isolation11.3. Advanced Published or Assigned11.3.1. The General Tab11.3.2. The Deployment Tab11.3.2.1. The Deployment Type Section11.3.2.2. The Deployment Options Section11.3.2.3. The Installation User Interface Options Section11.3.2.4. The Advanced Button11.3.2.5. The Advanced Deployment Options Section11.3.2.6. The Advanced Diagnostic Information Section11.3.3. The Upgrades Tab11.3.4. The Categories Tab11.3.5. The Modifications Tab11.3.5.1. Using the Office .MST Generation Tool11.3.5.2. Applying Your .MST File to the Installation11.3.6. The Security Tab11.4. Default Group Policy Software Installation Properties11.4.1. The General Tab11.4.2. The Advanced Tab11.4.3. The File Extensions Tab11.4.4. The Categories Tab11.5. Removing Applications11.5.1. Users Can Manually Change or Remove Applications11.5.2. Automatically Removing Assigned or Published .MSI Applications11.5.3. Forcibly Removing Assigned or Published .MSI Applications11.5.3.1. Immediately Uninstall the Software from Users and Computers11.5.3.2. Allow Users to Continue to Use the Software, but Prevent New Installations11.5.4. Removing Published .ZAP Applications11.5.5. Troubleshooting the Removal of Applications11.6. Using Group Policy Software Installation over Slow Links11.7. Managing .MSI Packages and the Windows Installer11.7.1. Inside the MSIEXEC Tool11.7.1.1. Using MSIEXEC to Install an Application11.7.1.2. Using MSIEXEC to Repair an Application11.7.1.3. Using MSIEXEC to Patch a Distribution Point11.7.2. Affecting Windows Installer with Group Policy11.7.2.1. Computer-Side Policy Settings for Windows Installer11.7.2.1.1. Disable Windows Installer11.7.2.1.2. Always Install with Elevated Privileges11.7.2.1.3. Prohibit Rollback11.7.2.1.4. Remove Browse Dialog Box for New Source11.7.2.1.5. Prohibit Patching11.7.2.1.6. Prohibit Flyweight Patching11.7.2.1.7. Disable IE Security Prompt for Windows Installer Scripts11.7.2.1.8. Enable User Control over Installs11.7.2.1.9. Enable User to Browse for Source While Elevated11.7.2.1.10. Enable User to Use Media Source While Elevated11.7.2.1.11. Enable User to Patch Elevated Products11.7.2.1.12. Allow Admin to Install from Terminal Services Session11.7.2.1.13. Cache Transforms in Secure Location on Workstation11.7.2.1.14. Logging11.7.2.1.15. Prohibit User Installs11.7.2.1.16. Turn off Creation of System Restore Checkpoints11.7.2.1.17. Prohibit Removal of Updates11.7.2.1.18. Enforce Upgrade of Component Rules11.7.2.1.19. Prohibit Nonadministrators from Applying Vendor Signed Updates11.7.2.1.20. Baseline File Cache Maximum Size11.7.2.1.21. Prohibit Use of Restart Manager11.7.2.1.22. Disable Logging via Package Settings11.7.2.2. User-Side Policy Settings for Windows Installer11.7.2.2.1. Always Install with Elevated Privileges11.7.2.2.2. Prevent Removable Media Source for Any Install11.7.2.2.3. Prohibit Rollback11.7.2.2.4. Search Order11.8. Deploying Office 2007 and Office 2010 Using Group Policy11.8.1. Office 2007 and Group Policy11.8.1.1. What Happens When You Assign Office 2007 to Users?11.8.1.2. What Happens when you Assign Office 2007 to Computers?11.8.1.3. Using GPSI and Customizing Office 2007 Deployments11.8.1.4. Office 2007 and Office 2010 via Group Policy—Another Way?11.8.2. The "Right" Answer for Office 2007 and Office 2010 Deployment (Using Group Policy)11.9. Do You Need a "Big" Management Tool for Your Environment?11.9.1. SMS vs. GPOs: A Comparison Rundown11.9.1.1. Hardware and Software Inventory11.9.1.2. Remote Control11.9.1.3. Software Metering11.9.1.4. Operating System Deployment11.9.1.5. Software Deployment11.9.1.6. Patch Management11.9.2. GPSI and SMS Coexistence11.10. Final Thoughts
12. Finishing Touches with Group Policy: Scripts, Internet Explorer, Hardware Control, Deploying Printers, and Shadow Copies
12.1. Scripts: Logon, Logoff, Startup, and Shutdown12.1.1. Non-PowerShell-Based Scripts12.1.1.1. Startup and Shutdown Scripts (Non-PowerShell)12.1.1.2. Logon and Logoff Scripts (Non-PowerShell)12.1.1.3. Script Processing Defaults (and Changing Them)12.1.1.4. Don't Panic: What to Do If Login Scripts with Network Drive Mappings Aren't Working as Expected with Windows Vista12.1.1.4.1. Vista Logon Script Remediation 112.1.1.4.2. Vista Logon Script Remediation 212.1.2. Deploying PowerShell Scripts to Windows 7 Clients12.2. Managing Internet Explorer with Group Policy12.2.1. Internet Explorer Maintenance (IEM) and Group Policy Preferences Settings12.2.1.1. Making IE Preferences Settings Reapply (or Not)12.2.1.1.1. Reapply/Not Reapply IEM Settings12.2.1.1.2. Reapply/Not Reapply IE Group Policy Preferences Settings12.2.2. Internet Explorer's Group Policy Settings12.3. Restricting Access to Hardware via Group Policy12.3.1. Devices Extension12.3.1.1. Deciding to Disable the Device Class or Device Type12.3.1.2. What Happens When a Device Is Restricted?12.3.1.3. Dealing with Devices That Aren't Listed12.3.1.4. Why Is There an Option to Disable and Enable?12.3.2. Restricting Driver Access with Policy Settings for Windows 712.3.3. Getting a Handle on Classes and IDs12.3.4. Restricting or Allowing Your Hardware via Group Policy12.3.5. Understanding the Remaining Policy Settings for Hardware Restrictions12.3.5.1. Allow Administrators to Override Device Installation Restrictions12.3.5.2. Allow Installation of Devices Using Drivers that Match These Setup Classes12.3.5.3. Prevent Installation of Devices Using Drivers that Match These Device Setup Classes12.3.5.4. Display a Custom Message When Installation Is Prevented by Policy (Balloon Text) and Display a Custom Message When Installation Is Prevented by Policy (Balloon Title)12.3.5.5. Allow Installation of Devices that Match Any of These Device IDs12.3.5.6. Prevent Installation of Devices that Match Any of These Device IDs12.3.5.7. Prevent Installation of Removable Devices12.3.5.8. Prevent Installation of Devices Not Described by Other Policy Settings12.3.5.9. Time (in Seconds) to Force Reboot When Required for Policy Changes to Take Effect12.4. Assigning Printers via Group Policy12.4.1. Zapping Down Printers to Users and Computers (a Refresher)12.4.1.1. Trickier: Zapping Down Specific Printers to Users on Specific Machines12.4.1.2. Deploying the Same Printer to All Computers in the Zone12.4.1.3. Deploying a Shared Printer to Only the Shared Computers in All Zones12.5. Shadow Copies (aka Previous Versions)12.5.1. Setting Up and Using Shadow Copies for Local Windows 7 Machines12.5.2. Setting Up Shadow Copies on the Server12.5.3. Restoring Files with the Shadow Copies Client12.5.3.1. Reverting to a Previous Version of a File12.5.3.2. Restoring a Previous Version of a File12.5.4. Group Policy Settings for Shadow Copies12.5.4.1. Prevent Restoring Previous Versions from Backups12.5.4.2. Hide Previous Versions of Files on Backup Location12.5.4.3. Hide Previous Versions List for Local Files12.5.4.4. Prevent Restoring Local Previous Versions12.5.4.5. Hide Previous Versions List for Remote Files12.5.4.6. Prevent Restoring Remote Previous Versions12.6. Final Thoughts for This Chapter and for the Book
A. Group Policy Tools
A.1. Securing Workstations with TemplatesA.1.1. Incremental Security TemplatesA.1.1.1. Domain Controller .INF Template FilesA.1.1.2. XP Professional. INF Template FilesA.1.2. Other Security Template SourcesA.1.2.1. Security Templates from Uncle BillA.1.2.2. Security Templates from Uncle SamA.1.3. Applying Security Templates with Group PolicyA.2. The Security Configuration WizardA.2.1. Security Configuration Wizard Primer and InstallationA.2.1.1. Installing the SCW for Windows Server 2003 (SP1 and later)A.2.1.2. Installing the SCW for Windows Server 2008A.2.2. A Practical SCW ExampleA.2.2.1. Initial SCW KickoffA.2.2.2. Role-Based Configuration SectionA.2.2.3. Network Security SectionA.2.2.4. Registry Settings SectionA.2.2.5. Audit Policy SectionA.2.2.6. Save Security Policy SectionA.2.3. Converting Your SCW Policy to a GPOA.2.3.1. Viewing and Applying Your Transformed GPOA.2.4. SCW CaveatsA.3. Migrating Group Policy Objects between DomainsA.3.1. Basic Interdomain Copy and ImportA.3.1.1. The Copy OperationA.3.1.2. The Import OperationA.3.2. Copy and Import with Migration TablesA.4. Microsoft Tools RoundupA.4.1. Group Policy Tools from MicrosoftA.4.1.1. Active Directory Monitor and GPOTOOLA.4.1.2. GPMonitor—Group Policy Monitor ToolA.4.1.3. GPInventory—Group Policy Inventory ToolA.4.1.4. ADMX MigratorA.4.1.5. Group Policy Log View (GPLogView)A.4.2. Profile Tools from MicrosoftA.4.3. Utilities and Add-OnsA.5. Third-Party Vendors List
13. Scripting Group Policy Operations with Windows PowerShell
BC1.1. Using PowerShell to Do More with Group PolicyBC1.1.1. Preparing for Your PowerShell ExperienceBC1.1.1.1. Installing PowerShellBC1.1.1.1.1. Running PowerShell for the First TimeBC1.1.1.1.2. Preparing to Run Our ScriptsBC1.1.1.2. Optional, but Recommended: Downloading and Installing Free Helper Group Policy CmdletsBC1.1.1.2.1. Finding and Downloading the Helper CmdletsBC1.1.1.2.2. Installing and Verifying the Helper CmdletsBC1.1.2. Getting Started with PowerShell in Windows 7 (or Windows Server 2008 R2)BC1.1.2.1. Windows 7 Remote Server Administration ToolsBC1.1.2.2. Adding the Group Policy ModuleBC1.1.3. Documenting Your Group Policy World with PowerShellBC1.1.3.1. Listing GPOsBC1.1.3.1.1. Get-SDMGPOBC1.1.3.2. Creating GPO ReportsBC1.1.3.2.1. Using Out-SDMgpsettingsreportBC1.1.3.3. Documenting GPO LinksBC1.1.3.3.1. Using Get-SDMgplinkBC1.1.3.4. Documenting WMI Filters and LinksBC1.1.3.4.1. Using SDM Software CmdletsBC1.1.3.5. Listing GPO PermissionsBC1.1.3.5.1. Using Get-SDMgpoSecurityBC1.1.4. Setting GPO PermissionsBC1.1.5. Manipulating GPOs with PowerShellBC1.1.5.1. Creating New GPOsBC1.1.5.1.1. Using New-SDMgpoBC1.1.5.2. Modifying GPO SettingsBC1.1.5.2.1. Get-GPPrefRegistryValueBC1.1.5.2.2. Set-GPPrefRegistryValueBC1.1.5.2.3. Get-GPRegistryValueBC1.1.5.2.4. Set-GPRegistryValueBC1.1.5.3. Linking a GPOBC1.1.5.4. Removing a GPO LinkBC1.1.5.5. Backing Up Group Policy ObjectsBC1.1.5.5.1. Backing Up One or All GPOsBC1.1.5.5.2. Using Export-SDMgpoBC1.1.5.6. Managing GPO BackupsBC1.1.5.7. Restoring a GPOBC1.1.5.8. Importing GPOsBC1.2. Making PowerShell Even Easier with Commercial ToolsBC1.2.1. GPExpert Scripting Toolkit for PowerShellBC1.2.1.1. InstallBC1.2.1.2. Verify the InstallationBC1.2.1.3. Getting InformationBC1.2.1.3.1. Getting the GPOBC1.2.1.3.2. Getting the Section PathBC1.2.1.3.3. Processing the SettingsBC1.2.1.4. Setting Group Policy SettingsBC1.2.1.4.1. Getting the Section PathBC1.2.1.4.2. Setting the Proxy SettingsBC1.2.2. Specops Software's Specops CommandBC1.3. Replacing Microsoft's GPMC Scripts with PowerShell EquivalentsBC1.4. Final Thoughts
14. Advanced Group Policy Management (AGPMv4)
BC2.1. The Challenge of Group Policy Change ManagementBC2.2. Architecture and Installation of AGPMBC2.2.1. AGPM ArchitectureBC2.2.2. Installing AGPMBC2.2.2.1. Installing the AGPM Server ServiceBC2.2.2.2. Installing the AGPM ClientBC2.3. What Happens after AGPM is Installed?BC2.3.1. GPMC Differences with AGPM ClientBC2.3.2. What's With All the Access Denied Errors?BC2.3.3. Does the World Change Right Away?BC2.4. Understanding the AGPM Delegation ModelBC2.4.1. AGPM Delegation RolesBC2.4.1.1. Deeper with AGPM Roles and RightsBC2.5. AGPM Common TasksBC2.5.1. Understanding and Working with AGPM's FlowBC2.5.2. Controlling Your Currently Uncontrolled GPOsBC2.5.3. Creating a GPO and Immediately Controlling ItBC2.5.4. Check Out a GPOBC2.5.5. Viewing Reports about a Controlled GPOBC2.5.6. Editing a Checked-Out Offline Copy of a GPOBC2.5.6.1. What's Happening Under the Hood during a Check OutBC2.5.6.2. What's Not Controlled During a Check OutBC2.5.6.3. Performing Your Offline EditBC2.5.7. Check In of a Changed GPOBC2.5.8. Deploying a GPO into ProductionBC2.5.9. Making Additional Changes to a GPO and Labeling a GPOBC2.5.10. Using History and Differences to Roll Back a GPOBC2.5.10.1. Inside the History ViewBC2.5.10.2. Performing a Difference ReportBC2.5.10.3. Performing a Rollback Based upon a DifferenceBC2.5.11. Using "Import from Production" to Catch Up a GPOBC2.5.12. Uncontrolling, Restoring, and Destroying a GPOBC2.5.12.1. Uncontrolling a GPO (Deleting It from the Archive)BC2.5.12.2. Restoring from the Change Control Recycle BinBC2.5.12.3. Permanently Deleting a GPO and Its HistoryBC2.5.13. Searching for GPOs using the Search BoxBC2.6. AGPM Tasks with Multiple AdminsBC2.6.1. Email Preparations and Configurations for AGPM RequestsBC2.6.2. Adding Someone to the AGPM SystemBC2.6.2.1. Setting Permissions within the AGPM SystemBC2.6.2.2. Installing the AGPM Client on Management StationsBC2.6.2.3. Setting Up Mail Accounts for Each AGPM UserBC2.6.3. Requesting the Creation of New Controlled GPOBC2.6.4. Approving or Rejecting a Pending RequestBC2.6.5. Email Notifications from AGPMBC2.6.5.1. Tending to the Pending RequestBC2.6.6. Editing the GPO Offline via Check Out/Check InBC2.6.7. Requesting Deployment of the GPOBC2.6.8. Analyzing a GPO (as a Reviewer)BC2.6.9. Deploying a GPO into ProductionBC2.7. Advanced Configuration and Troubleshooting of AGPMBC2.7.1. Production DelegationBC2.7.2. Auto-Deleting old GPO versionsBC2.7.3. Export and Import of Controlled GPOs between Forests and/or DomainsBC2.7.4. Troubleshooting AGPM PermissionsBC2.7.4.1. Trouble Deploying Controlled GPOsBC2.7.4.2. Trouble Creating New Controlled GPOsBC2.7.5. Leveraging AGPM TemplatesBC2.7.5.1. Making a GPO into a TemplateBC2.7.5.2. Spawning a New Controlled GPO Based upon a TemplateBC2.7.5.3. Setting the Default TemplateBC2.7.5.4. Editing a TemplateBC2.7.5.5. Finding Differences between a Deployed GPO and a TemplateBC2.7.6. Changing Permissions on GPO ArchivesBC2.7.7. Backing Up, Restoring, and Moving the AGPM ServerBC2.7.7.1. Backing Up the AGPM ServerBC2.7.7.2. Restoring the AGPM ServerBC2.7.7.3. Changing the Location of the Clients to the New ServerBC2.7.8. Changing the Port that AGPM UsesBC2.7.9. Events from AGPMBC2.7.10. Leveraging the Built-in AGPM ADMX TemplateBC2.7.11. ADMX Template Settings That Tell Your AGPM Client which AGPM Server to UseBC2.7.11.1. Honing the AGPM Client ViewBC2.7.11.2. AGPM: Show Change Control TabBC2.7.11.3. AGPM: Show History tab for linked GPOsBC2.7.11.4. AGPM: Show History Tab for GPOsBC2.7.12. AGPM Tracing Clients and ServersBC2.8. Final Thoughts
15. Full Lockdown with Windows SteadyState
BC3.1. Windows SteadyState Concepts and InstallationBC3.1.1. SteadyState ConceptsBC3.1.1.1. General Machine Shared Computer UseBC3.1.1.2. Internal Corporate Shared Computer UseBC3.1.1.3. Why Shared Computing Is HardBC3.1.1.4. The SteadyState MissionBC3.1.2. Preparing for Windows SteadyStateBC3.1.2.1. Preparing a New Clean MachineBC3.1.3. Installing Windows SteadyStateBC3.2. Configuring Windows SteadyState (for Nondomain-Joined Computers)BC3.2.1. User SettingsBC3.2.1.1. Creating a Public UserBC3.2.1.2. Setting the User SettingsBC3.2.2. Global Computer SettingsBC3.2.2.1. Set Computer RestrictionsBC3.2.2.2. Schedule Software UpdatesBC3.2.2.2.1. The Schedule Software Updates OptionsBC3.2.2.2.2. The Scheduled Updates ProcessBC3.2.2.2.3. What if WSUS Is Used?BC3.2.2.3. Protect the Hard DiskBC3.2.3. Application Installation Strategy (for Nondomain-Joined Windows SteadyState Machines)BC3.2.3.1. Installing Packages before Turning on Windows Disk ProtectionBC3.2.3.2. Installing and Upgrading Packages after Turning on Windows Disk ProtectionBC3.2.3.3. Multitier Access EnvironmentsBC3.2.3.4. Setting User Profiles for Multitier Access EnvironmentsBC3.2.3.5. Persistent Storage Space for Your UsersBC3.3. Configuring Windows SteadyState (for Domain-Joined Computers)BC3.3.1. Joining the Computer to the Domain and Moving It into Its OUBC3.3.2. Create GPOs That Will Affect All Users Who Use the ComputerBC3.3.2.1. Creating and Linking the GPO and Setting Up Restrictions for SteadyStateBC3.3.2.2. Checking Out the SCTsettings.adm RestrictionsBC3.3.2.3. Creating a Loopback Group Policy ObjectBC3.3.3. Testing Your Group PolicyBC3.3.4. Turning On Windows Disk ProtectionBC3.3.4.1. Manually Turning On WDPBC3.3.4.2. Remotely Turning On WDPBC3.3.4.2.1. Turn Windows Disk Protection On or Off via the Command LineBC3.3.4.2.2. Turn Windows Disk Protection On or Off via ScriptBC3.3.5. Deciding When to Clean UpBC3.3.5.1. Option 1: Set a Scheduled Task to Restart the MachineBC3.3.5.2. Option 2: Use a Logoff Script to Force a RebootBC3.3.5.3. Option 3: The Best of All Worlds—Rebooting and Cleaning Up When No One Is AroundBC3.3.6. Deploying Software When Using Windows SteadyStateBC3.3.6.1. Deploying Software Using GPSIBC3.3.6.2. Deploying Software Using App-V (Microsoft Application Virtualization)BC3.3.7. Remotely Updating the Custom Updates ScriptBC3.4. Final Thoughts

Content preview from Group Policy: Fundamentals, Security, and the Managed Desktop

Chapter 14. Advanced Group Policy Management (AGPMv4)

Let's start with the bad news. Because there's a lot of good news in this chapter, and I don't want anyone to say, "Hey! I'm 30 pages into this chapter and he didn't tell me [this very important fact I'm about to tell you]."

That is, to use the stuff we're going to talk about in this chapter, you have to pay Microsoft a little extra. That's right. Everything we've talked about in this book so far is "free," inasmuch as it's in the box when you buy Windows and spin up an Active Directory, install your Windows clients, perform some downloads, and so on.

But this chapter is different. In this chapter, we're going to talk about a Microsoft tool called Advanced Group Policy Management, or AGPM for ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Group Policy: Fundamentals, Security, and the Managed Desktop

MCSE Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure (Exam 70-294)

Syngress

Publisher Resources

ISBN: 9780470581858Purchase book

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Group Policy: Fundamentals, Security, and the Managed Desktop

by Jeremy Moskowitz

Chapter 14. Advanced Group Policy Management (AGPMv4)

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.