Implementing Group Policy

ImplementingGroupPolicyOverviewIntroductiontoGroupPolicyGroupPolicyStructureWorkingwithGroupPolicyObjectsHowGroupPolicySettingsAreAppliedinActiveDirectoryModifyingGroupPolicyInheritanceDelegatingAdministrativeControlofGroupPolicyMonitoringandTroubleshootingGroupPolicyBestPracticesIntroductiontoGroupPolicyGroupPolicyEnablesYouto:SetcentralizedanddecentralizedpoliciesEnsureusershavetheirrequiredenvironmentsLowertotalcostofownershipbycontrollinguserandcomputerenvironmentsEnforcecorporatepoliciesSiteDomainOUWindows2000AppliesContinuallyUsersComputersAdministratorSetsGroupPolicyOnceGroupPolicyGroupPolicyStructureTypesofGroupPolicySettingsGroupPolicyObjectsGroupPolicySettingsforComputersandUsersGroupPolicyObjectsandActiveDirectoryContainersTypesofGroupPolicySettingsTypesofGroupPolicySettingsAdministrativeTemplatesRegistry-basedGroupPolicysettingsSecuritySettingsforlocal,domain,andnetworksecuritySoftwareInstallationSettingsforcentralmanagementofsoftwareinstallationScriptsStartup,shutdown,logon,andlogoffscriptsRemoteInstallationServicesSettingsthatcontroltheoptionsavailabletouserswhenrunningtheClientInstallationwizardusedbyRISInternetExplorerMaintenanceSettingstoadministerandcustomizeMicrosoftInternetExploreronWindows2000–basedcomputersFolderRedirectionSettingsforstoringofusers’foldersonanetworkserverGroupPolicyObjectsGroupPolicyObjectContainsGroupPolicysettingsContentstoredintwolocationsLocatedindomaincontrollersharedSysvolfolderProvidesGroupPolicysettingsthatcomputersrunningWindows2000obtainandapplyLocatedinActiveDirectoryProvidesversioninformationusedbydomaincontrollersGroupPolicyTemplate(GPT)GroupPolicyContainer(GPC)GroupPolicySettingsforComputersandUsersGroupPolicySettingsforComputers:Specifyoperatingsystembehavior,desktopbehavior,securitysettings,computerstartupandshutdownscripts,computer-assignedapplicationoptions,andapplicationsettingsApplywhentheoperatingsysteminitializesandduringtheperiodicrefreshcycleGroupPolicySettingsforUsers:Specifyoperatingsystembehavior,desktopsettings,securitysettings,assignedandpublishedapplicationoptions,applicationsettings,folderredirectionoptions,anduserlogonandlogoffscriptsApplywhenuserslogontothecomputerandduringtheperiodicrefreshcycleUsersComputersGroupPolicyObjectsandActiveDirectoryContainersGPOSettingsAffectUserandComputerObjectsWithinSites,Domains,andOUstoWhichaGPOIsLinkedYoucanlinkoneGPOtomultiplesites,domains,orOUsYoucanlinkmultipleGPOstoonesite,domain,orOUYouCannotLinkGPOstoDefaultActiveDirectoryContainersSiteDomainOUOUOUOUGPOOUGPOSiteGPODomainGPOWorkingwithGroupPolicyObjectsCreatingLinkedGroupPolicyObjectsCreatingUnlinkedGroupPolicyObjectsLinkinganExistingGroupPolicyObjectSpecifyingaDomainControllerforManagingGroupPolicyObjectsCreatingLinkedGroupPolicyObjectsToApplyGroupPolicytoaContainer,CreateaGPOLinkedtotheContainer:CreateGPOslinkedtodomainsandOUsbyusingActiveDirectoryUsersandComputersCreateGPOslinkedtositesbyusingActiveDirectorySitesandServicescontoso.msftPropertiesGeneralManagedByObjectSecurityGroupPolicyCurrentGroupPolicyObjectLinksforcontoso.msftGroupPolicyObjectLinksNoOverrideDisabledDefaultDomainPolicyAccountLockoutPolicyPasswordsPolicyGroupPolicyObjectshigherinthelisthavethehighestpriority.Thislistobtainedfrom:London.contoso.msftNewOptions...Add...Delete...EditPropertiesUpDownBlockPolicyinheritanceCloseCancelApplyTocreateaGPONameoflinkedGPOCreatingUnlinkedGroupPolicyObjectsSelectGroupPolicyObjectLocalComputerBrowse…AllowthefocusoftheGroupPolicySnap-intobechangedwhenlaunchingfromthecommandline.Thisonlyappliesifyousavetheconsole.ViewArrangeIconsLineupIconsRefreshNewTocreateanunlinkedGPOBrowseforaGroupPolicyObjectDomains/OUsSitesComputersAllLookin:contoso.msftAllGroupPolicyObjectsstoredinthisdomain:NameApplicationDeploymentDefaultDomainControllersPolicyDefaultDomainPolicyNewGroupPolicyObjectNewGroupPolicyObjectNewGroupPolicyObjectNewGroupPolicyObjectTestLinkinganExistingGroupPolicyObjectcontoso.msftPropertiesGeneralManagedByObjectSecurityGroupPolicyCurrentGroupPolicyObjectLinksforcontoso.msftGroupPolicyObjectLinksNoOverrideDisabledDefaultDomainPolicyAccountLockoutPolicyPasswordsPolicyGroupPolicyObjectshigherinthelisthavethehighestpriority.Thislistobtainedfrom:London.contoso.msftNewOptions...Add...Delete...EditPropertiesUpDownTolinkanexistingGPOAddaGroupPolicyObjectLinkDomains/OUsSitesAllLookin:GroupPolicyObjectslinkedtothiscontainer:NameDomainDomainControllers.nwtraders.msftAccounting.nwtraders.msftHumanResources.nwtraders.msftDefaultDomainPolicyRedirectMyDocumentPolicyLogonAttemptsPolicyPasswordsPolicyStartMenuPolicyOKCancelcontoso.msftSelectcontainerinwhichGPOresidesSelectGPOtolinkSelectappropriatetabSpecifyingaDomainControllerforManagingGroupPolicyObjectsWhenYouCreateaNewGPOorEditanExistingGPO,byDefault,theDomainControllerThatHoldsthePDCEmulatorRolePerformstheOperationTheOptionsAvailabletoSpecifyaDomainControllerforManagingGPOsInclude:TheonewiththeOperationsMastertokenforthePDCemulatorTheoneusedbytheActiveDirectory