Module 6: Implementing Group Policy

1
Module 6 Implementing Group Policy
2
Overview

• Implementing Group Policy Objects
• Implementing GPOs in a Domain
• Managing the Deployment of Group Policy

3
Lesson Implementing Group Policy Objects

• What Is Group Policy?
• Processing Group Policy Objects
• What Are User and Computer Configuration
  Settings?
• Local Computer Group Policy
• Practice Set Local Computer Group Policy

4
What Is Group Policy?
5
Processing Group Policy Objects

• Group Policies are processed in the following
  order
• Local computer Group Policy
• Group Policy objects linked to the site
• Group Policy objects linked to the domain
• Group Policy objects linked to the OU

6
What Are User and Computer Configuration Settings?

• Group Policy settings for users control
• Software settings
• Windows settings
• Security settings
• Desktop settings
• Group Policy settings for computers control
• Software settings
• Windows settings
• Security settings
• Operating system

7
Local Computer Group Policy
Local Group Policy Snap-in
8
Practice Set Local Computer Group Policy

• In this practice, you will
• Create a custom MMC and add the Group Policy
  snap-in for the local computer
• Configure a Group Policy setting to remove the
  user name from the Start menu
• Configure a Group Policy setting to prevent
  Windows Messenger from automatically running at
  logon

9
Lesson Implementing GPOs in a Domain

• Tools Used to Manage GPOs
• What Is a GPO Link?
• How Group Policy Settings Are Inherited in Active
  Directory
• Backup, Restore, and Import GPOs
• Practice Implementing GPOs in a Domain

10
Tools Used to Manage GPOs

• Default Group Policy tools
• Active Directory Users and Computers
• Active Directory Sites and Services
• Local Group Policy Custom Management Console
• Add-in tools
• Group Policy Management Console (GPMC)

11
What Is a GPO Link?
Domain
OU
Domain GPO
Site GPO
Site
OU
OU
Organizational Unit GPO
Organizational Unit GPO
12
How Group Policy Settings Are Inherited in Active
Directory
Domain
User or Computer Accounts
13
Back Up, Restore, and Import GPOs

• The GPMC allows you to
• Back up GPOs
• Restore GPOs
• Import settings from backed-up GPOs

14
Practice Implementing GPOs in a Domain

• In this practice, you will
• Install the Group Policy Management Console on
  DEN-CL1
• Create an unlinked GPO
• Create a linked GPO
• Back up and restore a GPO

15
Lesson Managing the Deployment of Group Policy

• Attributes of a GPO Link
• Blocking the Inheritance of a GPO
• What Happens When GPOs Conflict
• Filtering the Deployment of a GPO
• Discussion Modifying Group Policy Inheritance
• Practice Managing the Deployment of Group Policy

16
Attributes of a GPO Link

• Enforced
• Take precedence over other GPO settings
• Link Enabled or Disabled
• Links can be disabled for troubleshooting
• Deleted
• Links can be deleted without deleting the GPO
• Multiple Links
• When there are multiple GPOs linked to a
  container there is an order of precedence

17
Blocking the Inheritance of a GPO
Domain
Production
GPOs
Sales
No GPO settings apply
18
What Happens When GPOs Conflict

• How conflicts are resolved
• When Group Policy settings in the Active
  Directory hierarchy conflict, the settings for
  the child container GPO apply

19
Filtering the Deployment of a GPO
Domain
Production
GPO
Sales
Read and Apply Group Policy
Mengph
Allow
Kimyo
Apply Group Policy
Group
Deny
20
Discussion Modifying Group Policy Inheritance
Requirements

• Set up GPOs with the following requirements
• Antivirus protection
• Office suite
• An accounting application

How do you set up your GPOs?
21
Practice Managing the Deployment of Group Policy

• In this practice, you will
• Link a GPO to the domain to remove the Search
  option from the Start menu
• Test the results
• Create a conflicting GPO for the Graphics OU and
  block inheritance at the Sales OU
• Test the results
• Enforce the Remove Search GPO
• Test the results

22
Lab Implementing Group Policy

• In this lab, you will
• Disable and delete a GPO
• Create and link multiple GPOs
• Filter the GPOs to exempt selected users
• Back up and import GPO settings