O'Reilly logo

Windows Vista Security: Praxisorientierte Sicherheit für Profis by Marcus Nasarek

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

848
|
Chapter 26: Using Group Policy with Windows Vista
Exploring Group Policy in Windows Vista
In Windows Vista, the overall architecture of Group Policy has changed in several
fundamental ways. Windows Vista:
Includes a new Group Policy Client service
Makes multiple Local Group Policy Objects (LGPOs) available
Integrates Group Policy with Network Location Awareness
Features updated management tools and policy file formats
I discuss each enhancement in the sections that follow.
Introducing the Group Policy Client Service
One of the most significant changes is the introduction of the Group Policy Client
service to completely isolate Group Policy notification and processing from the Win-
dows logon process. Separating Group Policy from the Windows Logon process:
Ensures that a single service can deliver the needed Group Policy functionality
Enables more dynamic control over how policy settings are applied, maintained,
and updated
Reduces the resources used for background processing of policies while increas-
ing overall performance
Allows delivery of new Group Policy files as part of the update process and
application of those updates without restart
The Group Policy Client service is a standalone service that runs under the Svchost
process and no longer uses the trace logging functionality in userenv.dll. As a result,
Group Policy event messages are now written to the system log with the event source
of Microsoft-Windows-GroupPolicy, and the Group Policy Operational log replaces
previous Userenv logging. The operational event log provides detailed event mes-
sages specific to Group Policy processing. When troubleshooting Group Policy
issues, you’ll use this log rather than userenv.log in the %WINDIR%\Debug\
Usermode folder.
Using Multiple Local Group Policy Objects
Unlike earlier implementations of Group Policy, Group Policy in Windows Vista
allows the use of multiple LGPOs on a single computer. Previously, computers had
only one LGPO. Windows Vista allows you to assign a different LGPO to each local
user or group. This allows the application of a policy to be more flexible and sup-
port a wider array of implementation scenarios.
Multiple LGPOs are particularly useful when computers are being used in a standal-
one configuration rather than a domain configuration, because local administrator

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required