Windows Server 2003 群組原則設定與管理 林寶森

Introduction to Group Policy Group Policy Enables You to: –Set centralized and decentralized policies –Ensure users have their required environments –Lower total cost of ownership by controlling user and computer environments –Enforce corporate policies Site Domain OU Windows Applies Settings Continually Users Computers Administrator Sets Group Policy Once Group Policy

Group Policy Settings IntelliMirror Technology Establish Enforceable Configurations Specify Settings for:AdministrativeTemplatesAdministrativeTemplatesSecuritySecurity SoftwareInstallationSoftwareInstallation ScriptsScripts Folder Redirection Registry-based policy settings Options for local, domain, and network security Central management of software installation Startup, shutdown, logon, and logoff scripts Store users’ folders on the network

What Are User and Computer Configuration Settings? Group Policy settings for users: –Desktop settings –Software settings –Windows settings –Security settings Group Policy settings for computers: –Desktop behavior –Software settings –Windows settings –Security settings

When Is Group Policy Applied? Computer starts Computer settings applied Startup scripts run Computer settings applied Startup scripts run Refresh Interval User logs on User settings applied Logon scripts run User settings applied Logon scripts run Refresh Interval The GetGPOList Function Executes on the Client Computer During:

GPO Components Contains Group Policy settings Stores content in two locations Group Policy Object Stored in shared SYSVOL folder Provides Group Policy settings Stored in shared SYSVOL folder Provides Group Policy settings Group Policy Template Stored in Active Directory Provides version information Stored in Active Directory Provides version information Group Policy Container

What Is a GPO Link? Organizational Unit GPO Site GPO Domain GPO Site Domain OU

Group Policy Objects and Active Directory Containers GPO Settings Affect User and Computer Objects Within Sites, Domains, and OUs to Which a GPO Is Linked –You can link one GPO to multiple sites, domains, or OUs –You can link multiple GPOs to one site, domain, or OU You Cannot Link GPOs to Default Active Directory Containers Site Domain OU OU GPO Site GPO Domain GPO

Group Policy Inheritance Windows 2003 Applies GPO Settings in a Specific Order Child Containers Inherit GPO Settings from Parent Containers Domain OU Site GPO Computers Users Payroll Domain Domain GPO

What Is Local Group Policy?

Tools Used to Create GPOs Default Group Policy tools –Active Directory Users and Computers Domain and organizational unit GPOs –Active Directory Sites and Services Site GPOs –Local Security Policy Local computer security settings Add-in tools –Group Policy Management Domain, organizational unit, and site GPOs

Creating a Group Policy Object dsa - [Active Directory Users and Computers] Console Window Help Active View Active Directory Samerica1.contoso. Builtin Computers Domain Controllers Ohio Users Accounting Delegate control… Add members to a Group Move... Find…. New All Tasks View New Window from Here Delete Rename Refresh Export List… Properties Help Delegate control… Add members to a Group Move... Find…. New All Tasks View New Window from Here Delete Rename Refresh Export List… Properties Help Properties Accounting Properties GeneralManaged By Group Policy Current Group Policy Object Links for Account Group Policy Object Links No OverrideDisabled Group Policy Objects higher in the list have the highest priority. This list obtained from the primary domain controller. NewAdd...Edit Options...Delete...Properties Block Policy inheritance OKCancel Apply UpUp UpUp Down New Properties

Examining the Group Policy Interface Group Policy Editor ActionView TreeName Default Domain Policy [London.conto Computer configuration Software Settings Windows Settings Administrative Templates User Configuration Software Settings Windows Settings Administrative Templates Computer Configuration User Configuration

What Are Disabled and Enabled Group Policy Settings? Enable / Disable Multi-valued settings

What Is GPO Management?

What Is Group Policy Reporting?

What Is a Copy Operation? A copy of a GPO transfers only the settings within a GPO The new GPO is created unlinked A copy of a GPO transfers only the settings within a GPO The new GPO is created unlinked DACL User 1 GPO1 Read Full Control DACL User 1 GPO2 Read Full Control Copy Operation

What Is a Backup Operation? In a backup operation, Group Policy Management export all data in the GPO to the selected file and saves the GPT files Backup Operation Backup of a GPO Backup of a GPO GPO1

What Is a Restore Operation? In a restore operation, the contents of the GPO are returned to exactly the same state Restore Operation GPO1 Backed-up GPO GPO1

What Is an Import Operation? In an import operation, all GPO settings are copied from the source to the target GPO GPO1 Import Operation GPO2 GPO Settings GPO Settings

What Are Administrative Templates? Administrative Template Settings Modify Registry Settings That Control User Environments Settings Modify Registry Settings in the Registry Subtrees –HKEY_LOCAL_MACHINE for computer settings –HKEY_CURRENT_USER for user settings If a GPO No Longer Applies, Policy Settings Are Removed Windows 2003 Applies Both Group Policy and Local Default-Registry Settings Unless There Is a Conflict Use administrative template (.adm) files to control the user environment of client computers Windows XP Service Pack 2 administrative templates: –system.adm, inetres.adm, conf.adm, wmplayer.adm, wuau.adm

How Computers Apply Administrative Template Settings GPO List 11 Client computer starts or user logs on, retrieves a list of GPOs that apply Client computer connects to SYSVOL and locates the Registry.pol files Sysvol Registry.pol GPT 22 Client computer writes to the registry subtrees (HKLM or HKCU) Registry.pol HKCU Registry.pol HKLM 33 Logon dialog box (for computer) or the desktop (for user) appears4

What Is a Security Policy?

What Are Security Templates? TemplateDescription Default Security (Setup security.inf) Specifies default security settings Domain Controller Default Security (DC security.inf) Specifies default security settings updated from Setup security.inf for a domain controller Compatible (Compatws.inf) Modifies permissions and registry settings for the Users group to enable maximum application compatibility Secure (Securedc.inf and Securews.inf) Enhances security settings that are least likely to impact application compatibility Highly Secure (Hisecdc.inf and Hisecws.inf) Increases the restrictions on security settings System Root Security (Rootsec.inf) Specifies permissions for the root of the system drive

What Are Security Template Settings? Security Template: Setup Security Sample of Settings