Group Policy - Part 2 of 3 Rick Claus IT Pro Advisor Microsoft Canada rick.claus@microsoft.com http://blogs.technet.com/rclaus

What Will We Cover? Advanced Group Policy management Deploying software with Group Policy Group Policy troubleshooting

Agenda Implementing Group Policy Deploying Software Troubleshooting Group Policy

Domain-Level Security Settings Account Policies Account Policies Local Policies Local Policies IP Security Policies IP Security Policies File and Registry ACLs File and Registry ACLs Software Restriction Policies Software Restriction Policies

Demo demonstration Configuring Domain Policies

Software Restriction Policies Hash Rule Certificate Rule Path Rule Application started Internet Zone Rule

Using Software Restriction Policies Rule Type of Rule Description Setting 1 Hash rule Hash of pagefileconfig.vbs Disallowed 2 Certificate rule IT management certificate Unrestricted 3 Path rule %windir%\system32\*.vbs 4 *.vbs 5 %\windir% C:\WINDOWS\SYSTEM32\pagefileconfig.vbs C:\WINDOWS\SYSTEM32\eventquery.vbs C:\Documents and Settings\ILUVU.txt.vbs \\LOGIN_SRV\Scripts\CustomerScript1.vbs

Demo demonstration Software Restriction Policies

Managing Desktops Local Folder Shared Network Folder Elevated privileges

Demo demonstration Managing Desktops

Group Policy Filtering Security filtering Refines which users and computers process GPO WMI filtering Filter based on attributes of target computer Best practice: If you deny GPOs to certain users, disable Read access as well.

Group Policy Inheritance Link order Block inheritance Enforcement Link status www.microsoft.com/windowsserver2003/gpmc/gpmcwp.mspx

Demo demonstration Group Policy Filtering and Inheritance

Agenda Implementing Group Policy Deploying Software Troubleshooting Group Policy

Software Deployment Options SMS Approve and distribute critical updates Targeted software deployment WSUS Rich, granular software distribution Group Policy

Group Policy Software Deployment

Demo demonstration Deploying Software with Group Policy

Session Recap Domain-level security settings Software restriction policies Group Policy filtering and inheritance Software deployment with Group Policy

Agenda Implementing Group Policy Deploying Software Troubleshooting Group Policy

Use the Troubleshooting Flowchart Is the setting listed? Is the GPO in the Denied list? Yes No Does Group Policy Results lists the policy as applied? Yes No Yes No 1. Inheritance 2. Asynchronous 3. Loopback 1. Replication 2. GP Refresh 3. Slow Link 1. Security Filtering 2. Disabled GPO 3. WMI Filter 1. SOM 2. GP Refresh 3. Network

Network and Replication Issues DNS SMB and LDAP Slow Link Connections Intersite Replication

Group Policy Troubleshooting Tools > GPResult.exe > GPMonitor.exe > GPOTool.exe > ADDiag.exe

Demo demonstration Troubleshooting Group Policy

Session Summary Group Policy is a powerful tool Deploy software through Group Policy Several tools are available for troubleshooting Group Policy

For More Information Visit TechNet at www.microsoft.ca/technet Rick Claus IT Pro Advisor Microsoft Canada rick.claus@microsoft.com http://blogs.technet.com/rclaus