Windows Forensics and Incident Recovery

Getting Under the Hood

Most of the capabilities provided by the security configuration templates and Group Policies are nothing more than Registry and ACL settings under the hood. Group Policies provide a hierarchical mechanism for enforcing policies throughout the enterprise. However, these modifications can also be made to individual systems through the use of the MMC snap-ins or batch files. This can be particularly useful in expanding the functionality of the configuration templates by adding settings not covered by the templates. Batch files are essentially scripts containing lists of commands to be run on the system. Copying the batch file and any programs it depends on to a diskette makes it easy to update systems. The commands in the ...