Using Group PolicyUsing Group PolicyLesson 4

Skills MatrixSkills Matrix

Technology Skill Objective Domain Skill Domain #Creating and Understanding Group Policy Modeling and Group Policy Results Reports

Troubleshoot security configuration issuesTroubleshoot policy settings

2.2

3.1

Using the Group Policy Results Wizard

Troubleshoot security configuration issues• Run the RSoP toolTroubleshoot policy settings

2.2

3.1

Skills MatrixSkills Matrix

Technology Skill Objective Domain Skill Domain #Understanding Group Policy Results Reports

Run the RSoP toolTroubleshoot policy settings

2.23.1

Understanding Group Policy

Troubleshoot policy settings

3.1

Understanding Group Policy Objects

Local vs. group 3.1

Skills MatrixSkills Matrix

Technology Skill Objective Domain Skill Domain #What’s New in Group Policy for Windows Vista

New settings in Windows Vista

3.1

Configuring Group Policy Troubleshoot policy settings

3.1

Using the Group Policy Modeling Wizard

Troubleshoot policy settings

3.1

Understanding Group Policy Modeling Reports

Troubleshoot policy settings

3.1

Group Policy is the collective set of policy settings for users, computers, and other entities within Active Directory as applied through Group Policy objects.

Group Policy objects (GPOs) are collections of settings that are applied through Active Directory.

Understanding Group Policy

Understanding Group PolicyUnderstanding Group Policy

Administrators LGPO – Settings in this LGPO are applied when an administrator logs on.

Non-Administrators LGPO – Settings in this LGPO are applied when a non-administrator logs on.

User-specific LGPOs – Each Windows Vista installation can have as many of these as there are local users.

Understanding Group Policy Objects

Understanding Group PolicyUnderstanding Group Policy

Local Group Policy objects are applied in the following order:

Administrators LGPO

Non-Administrators LGPO

User-specific LGPOs

Understanding Group Policy Objects (cont.)

Understanding Group PolicyUnderstanding Group Policy

Active Directory Group Policy objects are applied in the following order:

GPOs linked to sites

GPOs linked to domains

GPOs linked to organizational units (OUs)

Understanding Group Policy Objects (cont.)

Understanding Group PolicyUnderstanding Group Policy

GPO application order and scope can also be affected by the following:

Filtering by using security groups

Windows Management Instrumentation filters (WMI filters)

Blocking Group Policy inheritance

Understanding Group Policy Objects (cont.)

Understanding Group PolicyUnderstanding Group Policy

GPO application order and scope can also be affected by the following:

Enforcing a GPO link

Disabling a GPO link

Understanding Group Policy Objects (cont.)

Understanding Group PolicyUnderstanding Group Policy

In previous versions of Windows, there was only one LGPO per Windows installation. This made it difficult to administer non-domain attached computers, such as kiosk computers.

Windows Vista introduces more than 700 new Group Policy settings and has expanded other settings.

What’s New in Group Policy for Windows Vista

Understanding Group PolicyUnderstanding Group Policy

You can use the Group Policy Object Editor to edit the policy settings in a GPO.

In the Start Search text box, type gpmc.msc, and then press Ctrl + Shift + Enter. A User Account Control dialog box appears.

Provide administrator credentials, and then click OK. The Group Policy Management console appears.

Editing a GPO

Configuring Group PolicyConfiguring Group Policy

In the console tree, expand Forest: Forest Name > Domains > Domain Name > Group Policy Objects.

Right-click the Group Policy object that you want to edit, and then click Edit. The Group Policy Object Editor appears with the selected GPO loaded.

Editing a GPO (cont.)

Configuring Group PolicyConfiguring Group Policy

Open the Group Policy Management console.

In the console tree of the Group Policy Management console, expand Forest: ForestName > Domains > DomainName.

Right-click Group Policy Objects, and then click New. The New GPO dialog box appears.

Creating a GPO

Configuring Group PolicyConfiguring Group Policy

In the Name text box, type a name for the GPO and then click OK. The new GPO will appear in the console tree under the Group Policy Objects node.

Creating a GPO (cont.)

Configuring Group PolicyConfiguring Group Policy

GPOs can link to sites, domains, and OUs.

Open the Group Policy Management console.

In the console tree of the Group Policy Management console, right-click the site, domain, or OU to which you want to link a GPO, and then click Link and Existing GPO. The Select GPO dialog box appears.

Linking a GPO

Configuring Group PolicyConfiguring Group Policy

In the Group Policy Objects list box, select the GPO that you want to link, and then click OK.

Linking a GPO (cont.)

Configuring Group PolicyConfiguring Group Policy

GPOs are applied according to the link order. Open the Group Policy Management console.

In the console tree of the Group Policy Management console, select the site, domain, or OU for which you want to change the GPO link order.

In the details pane, select the link that you want to move in the list, and use the arrow buttons on the left to move the link up or down.

Changing GPO Link Order

Configuring Group PolicyConfiguring Group Policy

You can turn off local Group Policy through a setting in an Active Directory GPO.

Open the Group Policy Management console.

In the Group Policy Object Editor, expand Computer Configuration > Administrative Templates > System > Group Policy.

Turning Off Local Group Policy

Configuring Group PolicyConfiguring Group Policy

• In the details pane, right-click Turn off Local Group Policy objects processing, and then click Properties.

• Select Enabled, and then click OK.

Turning Off Local Group Policy (cont.)

Configuring Group PolicyConfiguring Group Policy

Editing Local Group Policy Objects

Configuring Group PolicyConfiguring Group Policy

Selecting the Non-Administrators LGPO in the Browse for a Group Policy Object dialog box

Gpupdate is a command-line tool used to update Group Policy settings on Active Directory objects before the normal update process takes place.

gpupdate [/target:{computer|user}] [/force] [/wait:value] [/logoff] [/boot]

Using Gpupdate

Configuring Group PolicyConfiguring Group Policy

Group Policy Modeling – Simulates and reports on what Group Policy will be for selected configurations of users, computers, containers, security groups, and Windows Management Instrumentation (WMI) filters.

Using the Group Policy Modeling Wizard

Creating and Understanding Group Creating and Understanding Group Policy Modeling and Results ReportsPolicy Modeling and Results Reports

Using the Group Policy Modeling Wizard (cont.)

Creating and Understanding Group Creating and Understanding Group Policy Modeling and Results ReportsPolicy Modeling and Results Reports

Selecting a domain controller in the Group Policy Modeling Wizard

Using the Group Policy Modeling Wizard (cont.)

Creating and Understanding Group Creating and Understanding Group Policy Modeling and Results ReportsPolicy Modeling and Results Reports

Selecting a container in the Choose User Container dialog box

Using the Group Policy Modeling Wizard (cont.)

Creating and Understanding Group Creating and Understanding Group Policy Modeling and Results ReportsPolicy Modeling and Results Reports

Summary of Selections page of the Group Policy Modeling Wizard

Group Policy Modeling reports – Contain all of the information you need to understand how a particular Group Policy scheme will work.

Understanding Group Policy Modeling Reports

Creating and Understanding Group Creating and Understanding Group Policy Modeling and Results ReportsPolicy Modeling and Results Reports

Understanding Group Policy Modeling Reports (cont.)

Creating and Understanding Group Creating and Understanding Group Policy Modeling and Results ReportsPolicy Modeling and Results Reports

Summary tab summarizes the information gathered during the modeling process.

Understanding Group Policy Modeling Reports (cont.)

Creating and Understanding Group Creating and Understanding Group Policy Modeling and Results ReportsPolicy Modeling and Results Reports

Settings tab contains the most pertinent information.

In the Group Policy Management console, expand Forest: ForestName > Group Policy Modeling.

Right-click the Group Policy Modeling query for which you want to view RSoP data, and then click Advanced View.

Close the Resultant Set of Policy console when you have finished.

Viewing Group Policy Modeling Data in the RSoP Snap-in

Creating and Understanding Group Creating and Understanding Group Policy Modeling and Results ReportsPolicy Modeling and Results Reports

Using the Group Policy Results Wizard

Creating and Understanding Group Creating and Understanding Group Policy Modeling and Results ReportsPolicy Modeling and Results Reports

Summary of Selections page for the Group Policy Results Wizard.

Understanding Group Policy Results Reports

Creating and Understanding Group Creating and Understanding Group Policy Modeling and Results ReportsPolicy Modeling and Results Reports

Group Policy Results reports contain all of the information you need to understand the Group Policy settings that are applied to a particular user on a particular computer.

SummarySummary

Group Policy can be used to configure settings for groups of users and computers and other Active Directory objects.

Group Policy objects are collections of Group Policy settings and are the mechanism by which administrators configure Group Policy.

Group Policy in Windows Vista includes more than 700 new settings, as well as an expansion of some existing settings.

You Learned

SummarySummary

You configure Group Policy by using the Group Policy Object Editor to edit GPOs and by using the Group Policy Management console to arrange the GPOs within Active Directory.

You learned how to create, edit, and link GPOs.

You learned how to change GPO link order.

You learned how to turn off local Group Policy.

You Learned (cont.)

SummarySummary

You learned how to edit LGPOs.

You learned how to use gpupdate to reapply all Group Policy settings.

Group Policy Modeling and Group Policy Results reports enable you to model Group Policy through simulation and determine actual Group Policy. These are essential tools in both testing Group Policy settings before rolling them out and in troubleshooting Group Policy issues.

You Learned (cont.)

SummarySummary

The Group Policy Modeling Wizard enables you to model Group Policy before rolling it out to either a production or a test environment.

You learned how to use the Group Policy Modeling Wizard.

You learned how to view Group Policy Modeling data in the RSoP Snap-in.

You learned how to use the Group Policy Results Wizard.

You Learned (cont.)