Network Implementation and Support Lesson 09 Group Policy - Eric Vanderburg

1. Network Implementation &
Support
Chapter 9
Group Policy
Eric Vanderburg © 2006

2. Group Policy
• Contained in GPO (Group Policy Objects) which
are linked to Sites, Domains, or OUs
• GPC (Group Policy Container) – Info about the
GPO such as version used for synchronization.
– Enable advanced view AD Users &
ComputersSystemPolicies
• GPT (Group Policy Template) – All the settings
for the policy. Stored in %Systemroot
%SysvolDomainPolicies
• Registry.pol – All registry settings
• GUID (Global Unique Identifier) – 128 bit
number used to identify GPCs and GPTs.
Unique to the forest.
Eric Vanderburg © 2006

3. Scripts
• Computer
– Startup
– Shutdown
• User
– Logon
– Logoff
•
•
•
•
•
Software settingsWindows settings
Modify order
Time out
Asynchronous – run at same time
Hidden or not
Eric Vanderburg © 2006

4. Default GPOs
• Default Domain Policy
– Applied to domain
– Password policy, account policy, & kerberos
can only be set here
• Default Domain Controllers Policy
– Applied to DC container
• Create others in the Group Policy Object
Editor MMC or from AD Users &
Computers
Eric Vanderburg © 2006

5. Settings
• Undefined – can be set by a higher GPO
• Enabled
• Disabled
• Priorities
– LSDOU (Local Site Domain Organizational
Unit)
– The last one applied takes precedence
– No override (under options)
– Block Policy Inheritance (under options)
Eric Vanderburg © 2006

6. Applying Group Policy
1. Computer starts up & queries the DC for GPOs
that apply
2. Startup scripts run
3. GPTs are downloaded form the sysvol share
and applied in order
4. User logs on
5. DC is queried again
6. Logon scripts run
7. GPTs are downloaded and applied
8. Software policies execute
Eric Vanderburg © 2006

7. • Administrative Templates
–
–
–
–
User settings
Applications
Control panel
GUI
• Windows Settings
– IE
– RIS
– Folder redirection
• Software Settings
– Installation & maintenance / upgrade
Eric Vanderburg © 2006

8. Administrative Templates
• Windows Components (both)
– IE, Netmeeting, Tasks
• System (both)
– Disks quotas, Driver signing, Code signing
• Network (both)
– Offline files & folders, dial up connections, VPNs
• Printers (computer)
• Start menu & taskbar
• Desktop (user)
– Wallpaper, which icons display, Active desktop enabled
• Control panel (user)
– Applets that appear
• Shared folders (user)
– DFS
Eric Vanderburg © 2006

9. Security Settings
• Local Policies
– Applied first
– Audit policy – what is in the event logs
– User Rights Assignment – what can be done
on the machine
– Security Options – Logon banner, restrict
access to media, remove logon
• Event Log – size, retention
• Restricted groups – restores users to
certain groups or groups to groups
Eric Vanderburg © 2006

10. Security Settings
• System Services – how they start up (auto
manual, on off)
• Registry – permissions to registry
• File Systems – permissions & auditing
• Wireless network – SSID, encryption,
order
• Public Key Policies – EFS, autoenrollment, CA trusts
• Software Restriction Policies
• IP Security Policies – enable policies
Eric Vanderburg © 2006

11. Folder Redirection
• Folders
– Application Data
– Desktop
– My Documents
– Start Menu
• Stored on network
• Settings
– Grant permissions to folder
– Move contents to network
– Redirect back to local when removed
Eric Vanderburg © 2006

12. Permissions
• Must have these permissions for the GP to
apply
– Apply Group Policy permissions
– Read
• Gpresult – RSoP (Resultant Set of
Policies)
• Gpupdate /force
Eric Vanderburg © 2006

13. Software Deployment
• Place MSI in shared folder
• EXE can be installed with ZAP file
– ZAPs cannot be assigned and will not repair
themselves
• Assigned Apps – shortcut is created and it is
installed on first run
• Published Apps – appears in Add/Remove
programs
• Upgrades – mandatory, optional, completely
redeploy
• Removal – forced or optional, no new installs
Eric Vanderburg © 2006

14. Acronyms
•
•
•
•
•
•
GUID, Global Unique Identifier
GPC, Group Policy Container
GPO, Group Policy Object
GPT, Group Policy Template
MSI, Microsoft Installer
RSoP, Resultant Set of Policy
Eric Vanderburg © 2006