Entries tagged with group policy - TechNet Edge

Active Directory Group Policy Object (GPO) Delegation and Approval Workflow With AGPM 3.0 in MDOP 2008 R2

yung — Mon, 01 Dec 2008 08:01:00 GMT

In the TechNet Webcast: Microsoft Solutions for Windows Vista Management (Level 300), I will demo a number of capabilities includnig Microsoft Advanced Group Policy Management (AGPM) 3.0 for managing Vista desktops and Windows environment in general. AGPM 3.0 is one of the 5 components in Microsoft Desktop Optimization Pack for Software Assurance (MDOP) 2008 R2. AGPM enables the change-approval workflow of Group Policy Objects (GPOs) and is something I thought worth a special introduction here. Meanwhile I am also developing a screencast and will publish it here soon.

AGPM is to help customers better manage GPOs, particularly those with complex information technology (IT) environments. A robust delegation model, role-based administration, and change-request approval provide granular administrative control as described in the overview whitepaper and shown below.

For example, you can delegate Reviewer, Editor, and Approver roles to other administrators — even administrators who do not have access to production GPOs. The Editor role can edit GPOs but not deploy them; the Approver role can deploy GPO changes. AGPM also helps reduce the risk of widespread failures. You can use AGPM to edit GPOs offline, outside of the production environment, and then audit changes and easily find differences between GPO versions. In addition, AGPM supports effective change control by providing version tracking, history capture, and quick rollback of deployed GPO changes. It also supports a management workflow by allowing you to create GPO template libraries and send GPO change e-mail notifications. Step-by-Step and Operations Guides of AGM 3.0 are also readily available.

For those who are interested in finding more, MDOP 2008 R2 was RTM in September of 2008. Here are demos, more demos, and FAQ. Subscribers can download MDOP 2008 R2 from the TechNet and MSDN subscription sites. The availability of the components is as follows through Microsoft Volume Licensing Service (MVLS):

The official MDOP blog is the channel to get the latest.

Jeremy Moskowitz: GP troubleshooting

Joey — Fri, 02 May 2008 16:39:00 GMT

Jeremy is the author of "Group Policy: Management, Troubleshooting and Security." We caught up with him after his session at MMS to talk about what's new for Vista policy management, troubleshooting GP Prefs, and a little bit about Application Virtualization.

Fine Grained Password Policy Screencast

Joey — Wed, 09 Apr 2008 07:01:00 GMT

Have you ever wanted to setup different password policies for different users in the same domain? In this screencast, Corey Hynes takes us through the setup and configuration of the new fine grained password policy in Windows Server 2008. Corey utilizes a free tool from Special Operations Software called Specops Password Policy BASIC in this demo. For more information about their tool visit http://www.specopssoft.com/products/specopspasswordpolicy/.

Group Policy Preferences Screencast

Joey — Fri, 28 Mar 2008 07:01:00 GMT

This week we've had an interview and a blog post showing how Group Policy preference items increase the manageability of Windows Server 2008, Windows Vista, Windows Server 2003, and Windows XP. Today MVP Corey Hynes demonstrates how to configure Group Policy Preferences including a really cool demonstration on how to configure filtering of Group Policy Preferences.

A quick glance at Group Policy Preferences

Joey — Thu, 27 Mar 2008 07:01:00 GMT

As a tool to manage end user desktops, Group Policy is very powerful, but how many times have you wanted to manage a users printer settings or drive mappings and not been able to do it outside of a script? How about the challenge of copying a set of files or a registry change for a set of computers? Again Group Policy isn’t the best answer and we are forced to scripting. Well let me introduce you to a new feature in Windows Server:

Windows Server 2008 Group Policy Preferences

Who’s it for? IT Professionals who manage desktop systems.

What is it? Group Policy Preferences allows IT Professionals to manage operating system and application settings via centralized Policy previously unavailable via Group Policy.

What can I do with Group Policy Preferences? There are too many items to list here (over 20 new policy extensions) but some of the items available for configuration are:

· Create, replace, update and delete files, folders, and .ini files on destination computers.

· Create, replace, update, and delete network drive mappings.

· Create, replace, update, and delete registry settings on multiple computers.

· Configure ODBC data sources! That’s right you can create, replace, update, and delete for both user and Computer ODBC data sources. This is one item that regular Group Policy lacks.

· Remote networking options such as VPN Connections and Dial Up Networking and then target the configuration specifically at mobile PC’s in your environment.

This sounds an awful lot like Group Policy. What’s the difference?

It really comes down to enforcement. Group policy strictly enforces policy settings. When Group Policy is processed settings are written to the policy areas of the registry and then secured via ACL that prevents users from changing them. If a user does change the setting, periodic policy refresh intervals reset the settings.

Group Policy Preferences do not strictly enforce preferences. Preferences are not written in the policy branches in the registry, they are written to the same locations in the registry that the setting would be written to if the user themselves made the change. Because of this model, preferences can support features and applications that are typically not Group Policy aware. Group Policy preference settings are also not secured via ACL’s that prevents the user from changing the setting. This allows you to set a particular preference one time and then allow the user to change it, or you can have the preference refreshed using the same interval used by Group Policy.

There are also significant differences in how you are able to filter or target Group Policy Preferences. In regular Group Policy you are limited to filtering using WMI and those filters determine whether the entire GPO (Group Policy Object) is applied. You cannot specify individual settings within a GPO. Group Policy Preferences support item-level targeting. Imagine a policy that has 50 settings and each setting can be targeted on criteria such as IP address, if that machine is a laptop or desktop, security group membership and so on. Group Policy Preferences then becomes a very powerful tool to manage desktops.

How do I get Group Policy Preferences? Group Policy Preferences are available in the GPMC on Windows Server 2008 systems and also available to run on Windows Vista with the release of the Remote Server Administration Tools.

What systems can I use Group Policy Preferences on? In order to take advantage of Group Policy Preferences, the following clients require the installation of the Client Side Extensions (CSE’s) that have been released as separate downloads (hyper link leads to the download site for the CSE). Windows Server 2008 ships with these extensions already installed.

· Windows XP 32 Bit

· Windows XP x64 Edition

· Windows Server 2003 32 Bit

· Windows Server 2003 x64 Edition

· Windows Vista 32 Bit

· Windows Vista x64 Edition

In closing: Group Policy Preferences comes at no added cost and are available to use with NO TRAINING to the IT Professional. A simple user interface allows for easy configuration of policy preferences helping to decrease the configuration errors that are common when deploying and managing desktop systems. With over 20 available settings with the flexibility to filter and apply settings to specific users, groups, computer types and more the IT Professional has a new tool that will help reduce the reliance on logon scripts and fine-tune settings for users and computers in users organizations.

Get started:

Check out the Edge screen cast here.

The essential resource for Group Policy Preferences is the Group Policy Preferences White Paper.

A FAQ is also available.

Remote Server Admin Tools (RSAT) with Jason Leznek

AdamBomb — Wed, 26 Mar 2008 07:01:00 GMT

Jason looks after management in Vista, which makes him a busy guy. He was able to find time a quick 8 minutes for us between two meetings to give me a quick demo of the new RSAT tools for remote management of Windows Server 2003 and 2008. The new tool also includes support for Group Policy Preferences, which is a slick new feature that allows you to set defaults on a machine in the same way you'd set policy, but the user can later change them if they want to.
You can find more info at http://www.microsoft.com/grouppolicy