INTRODUCTION TO GROUP POLICY

1
INTRODUCTION TO GROUP POLICY

• Chapter 7

2
WHAT CAN YOU DO WITH GROUP POLICY?

• Control the user environment.
• Manipulate Start menu options, wallpaper, colors,
  etc.
• Prevent users from using Control Panel.
• Control the computer settings.
• Configure DNS client settings.
• Configure the time server client computers use.
• Distribute software.
• Force software installation (assigned).
• Allow for easy optional software installation
  through Add/Remove Programs (published).

P160
3
POLICY SETTINGS

• Registry-based
• Software installations and repairs
• Folder redirection and offline storage
• Disk quotas
• Scripts
• Remote Installation Services
• Internet Explorer configuration
• Security

P160
4
LATENT APPLICATIONS OF GROUP POLICY

• Term describes a group of policies.
• Policies are not applied directly to groups.
• Policies can be linked to
• Sites
• Domains
• OUs
• Applied to users and computers within these
  containers.

P160
5
GROUP POLICY BENEFITS

• User benefits
• Access to files either offline or online.
• Consistent environment.
• Files are centrally backed up.
• Administrator benefits
• Centralized management of computer and user
  settings.
• Centralized application distribution.
• Centralized backup.
• Centralized security enforcement.

P161
6
UNDERSTANDING GPOs

• Local GPO
• Gpedit.msc (Local Computer Policy)
• Local Security Policy
• Non-Local Group Policy Objects
• Stored in Sysvol
• Linked to sites, domains, or OUs

P162
7
LOCAL GROUP POLICY
P162
8
GROUP POLICY CONTAINER OBJECT
P163
9
GROUP POLICY TEMPLATE (GPT)
P164
10
GPT STRUCTURE AND GPT.INI
P165
11
GROUP POLICY OBJECT EDITOR FOR DOMAINS AND OUS
P166
12
GROUP POLICY OBJECT EDITOR FOR SITES
P167
13
GROUP POLICY SETTINGS
P167
14
SOFTWARE SETTINGS
P168
15
WINDOWS SETTINGS
P168
16
ADMINISTRATIVE TEMPLATES
P168
17
ADMINISTRATIVE TEMPLATE SETTING OPTIONS
P169
18
GROUP POLICIES AND THE ACTIVE DIRECTORY STRUCTURE

• Linked to siteAffects all users and computers in
  the site to which the policy is linked,
  regardless of domain membership
• Linked to domainAffects all users and computers
  in the domain to which the policy is linked
• Linked to OUAffects all users and computers in
  the OU to which the policy is linked

P171
19
HOW GROUP POLICIES ARE PROCESSED

• Local-Site-Domain-OU (LSDOU) order.
• Different settings are merged.
• If there is a conflict on a particular setting
• By default, the last policy applied wins.
• Exceptions No Override, Block Policy
  Inheritance, and User Group Policy loopback
  processing mode.

P172
20
SCHOOL OF FINE ART AND GROUP POLICY APPLICATION
P173
21
MULTIPLE POLICIES LINKED TO A CONTAINER
P173
22
GROUP POLICY PROCESSING AT STARTUP AND LOGON

• 1) During computer startup, a list of GPOs for
  the computer is obtained.
• 2) Computer settings are applied during startup.
• 3) Startup scripts are run.
• 4) Windows Logon prompt appears when step 3
  completes.
• 5) Upon successful validation of user, the user
  profile loads.
• 6) A list of GPOs for the user is obtained.
• 7) Logon scripts are run.
• 8) The user interface appears.

P173
23
NO OVERRIDE

• Ensures policy is applied, regardless of
  priority, hierarchy, inheritance blocking, or
  conflicting settings
• Configured on a per-policy basis

P174
24
BLOCK POLICY INHERITANCE

• Prevents policies from being inherited from
  higher levels in the Active Directory hierarchy
• Can be used at the Domain or OU level onlynot
  per policy
• Cannot stop a policy marked as No Override

P175
25
USER GROUP POLICY LOOPBACK PROCESSING MODE

• Maintains a specified user environment, no
  matter which user logs on
• Allows a computer account to apply User Settings
  last
• In merge mode, any conflicting settings are won
  by the loopback-enabled Group Policy.
• In replace mode, all user settings are set to
  whatever is configured in the loopback-enabled
  Group Policy.

P176
26
SUMMARY

• Group Policy is used to control both User
  settings and Computer settings.
• GPOs can be linked to sites, domains, and OUs.
• GPOs have two parts GPC and GPT.
• Default GPOs.
• Default Domain Policy
• Default Domain Controllers Policy
• Processing Order L-S-D-OU.
• Exceptions Block Policy Inheritance, No
  Override, and loopback.