1. Understanding Group Policy on Windows Server 2003 John Howard, IT Pro Evangelist, Microsoft UK http://blogs.technet.com/jhoward

2. Introducing Group Policy Common tasks with Group Policy Planning & Best Practices Agenda

3. Introducing Group Policy Basic Understanding Works with Windows 2000 and later Enable one-to-many management of users and computers Simplify administrative tasks Implement security settings Implement standard computing environments

4. Introducing Group Policy Group Policy Terms Group Policy Management Console Group Policy settings Group Policy Object Editor Active Directory containers SiteDomainOUs Child OUs

5. Registry-based Policy Introducing Group Policy Group Policy Capabilities

6. Registry-based Policy Security Settings Introducing Group Policy Group Policy Capabilities

7. Registry-based Policy Security Settings Software Restrictions Introducing Group Policy Group Policy Capabilities

8. Registry-based Policy Security Settings Software Restrictions Software Distribution Introducing Group Policy Group Policy Capabilities

9. Registry-based Policy Security Settings Software Restrictions Software Distribution Computer and User Scripts Introducing Group Policy Group Policy Capabilities

10. Registry-based Policy Security Settings Software Restrictions Software Distribution Computer and User Scripts Roaming Profiles and Redirected Folders Introducing Group Policy Group Policy Capabilities

11. Registry-based Policy Security Settings Software Restrictions Software Distribution Computer and User Scripts Roaming Profiles and Redirected Folders Offline Folders Introducing Group Policy Group Policy Capabilities

12. Registry-based Policy Security Settings Software Restrictions Software Distribution Computer and User Scripts Roaming Profiles and Redirected Folders Offline Folders Internet Explorer Maintenance Introducing Group Policy Group Policy Capabilities

13. Introducing Group Policy Default Policies Local Security Policy Default Domain Policy Default Domain Controllers Policy

14. Introducing Group Policy Where is Group Policy Stored

16. Local Security Policy Introducing Group Policy Order of Precedence

17. Local Security Policy Site Policy Introducing Group Policy Order of Precedence

18. Local Security Policy Site Policy Domain Policy Introducing Group Policy Order of Precedence

19. Local Security Policy Site Policy Domain Policy Parent OU Policy Introducing Group Policy Order of Precedence

20. Local Security Policy Site Policy Domain Policy Parent OU Policy Child OU Policy Introducing Group Policy Order of Precedence

21. Introducing Group Policy Group Policy Management Console Unified, easy to use GUI Backup/Restore of GPOs Import/Export and Copy/Paste of GPOs Simplified security HTML reporting Scripting of Group Policy tasks

22. Introducing Group Policy Group Policy Objects & Links GPMC manages GPO Links Scope Of Management (SOM) GPOs contain policy settings Links define what objects the GPO will target Scope Of Management (SOM) Site, Domain, OU, OU,…. Filtering can be based on links to SOM Better illustrates the relationship between GPOs and Links

23. Introducing Group Policy Demo

24. Common tasks with Group Policy Planning & Best Practices Agenda

25. Common tasks Using Administrative Templates Enables configuration of policy settings Do not actually contain policy settings Used by Group Policy Object Editor Policy settings are contained registry.pol Windows Server 2003 contains: System.admInetres.admConf.admWmplayer.admWuau.adm

26. Common tasks Using Administrative Templates KB 816662 – “Recommendations for Managing Group Policy Administrative Template Files” Superset principle from WS2003 RTM onwards Historical.adm files available online Never edit the OS-shipped.adm files Know the benefits of a “true policy” (as compared to preferences) Security (local administrators) Cleanup (if GPO is out of scope)

27. Common Tasks Account Policies Password Account lockout Kerberos settings Domain level vs OU level setting

28. Common Tasks Software Restriction Policies Windows Server 2003 and Windows XP Base philosophies Unrestricted All programs run except those I select Disallowed Use with care Policy rules HashCertificatePath Internet Explorer Zone

29. Common Tasks Restricted Groups Membership of Active Directory security groups No-one can be in Enterprise Administrators Only these users are helpdesk staff Membership of Local Groups Helpdesk are members of local administrators

30. Common Tasks Some of the rest…. Additional security Registry Access Control Lists (ACLs) File System Access Control Lists (ACLs) Service Startup Mode Internet Explorer Maintenance Audit Policies Especially on servers

31. Common Tasks with Group Policy Demo

32. Introducing Group Policy Common tasks with Group Policy Planning & Best Practices Agenda

33. Planning & Best Practices OU Design Why create OU’s Segment by role Domain controllers ComputersUsers Redirect default OU for new accounts redirusr.exe and redircmp.exe Use delegation of administration Create/Update/Link GPOs

34. Planning & Best Practices Group Policy Objects Normalise GPOs – “GP Common Scenarios” Naming conventions Clear purpose and intent 3-segment string: Scope/Purpose/Managed By e.g. WW-Outlook-OTG What about the number of GPOs? MYTH: Fewer GPOs=Better performance FACT: Number of settings is more important

35. Planning & Best Practices General Guidance Avoid Cross-Domain GPO links Performance overhead Alternative - GPMC scripts Use the following sparingly Enforce (no override) Block Inheritance Loopback Keep it simple

36. Planning & Best Practices Using WMI Filters XP and Windows Server 2003 Only Performance hit Limit to known lifetime if possible Scriptomatic

37. Summary Group Policy serves many purposes If you’re not already using GPMC, why not? It’s not as hard as it looks …but without planning, it’s easy to make it look hard http://www.microsoft.com/windowsserver2003/ technologies/management/grouppolicy http://www.microsoft.com/windowsserver2003/ technologies/management/grouppolicy

38. Recommended Reading “Group Policy, Profiles and Intellimirror for Windows 2003, Windows XP and Windows 2000” By Jeremy Moskowitz www.gpanswers.com

39. © 2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.

41. Understanding Group Policy on Windows Server 2003 John Howard, IT Pro Evangelist, Microsoft UK http://blogs.technet.com/jhoward