Understanding Group Policy James Michael Stewart CISSP, TICSA, CIW SA, CCNA, MCSE NT & W2K, iNet+

What is Group Policy?  A centralized collection of operational and security controls  Available in Active Directory domains  Contains items previously found in system policies and through editing the Registry (i.e. Windows NT) Submit a question anytime by clicking on the Ask a Question link in the bottom left corner of your presentation screen.

Elements of Group Policy  general security controls  audit  user rights  passwords  accounts lockout  Kerberos  Public key policies  IPSec policies

Divisions of Group Policy  Computer Configuration  User Configuration Submit a question anytime by clicking on the Ask a Question link in the bottom left corner of your presentation screen.

Application of Group Policy  Group Policy Objects – GPOs  Can be applied to any AD container  Application order: LSDOU  Local, Site, Domain, Organizational Unit  Last GPO applied takes precedent Submit a question anytime by clicking on the Ask a Question link in the bottom left corner of your presentation screen.

Group Policy Editors  MMC snap-in: Group Policy  Active Directory Domains and Trusts  Active Directory Sites and Services Submit a question anytime by clicking on the Ask a Question link in the bottom left corner of your presentation screen.

GPO Application  Inheritance by default  No Override – prevents other GPOs from changing settings in this GPO  Disabled – this GPO is not applied to this container  Multiple GPOs on same container – application order  Disable Computer Configuration or User Configuration  Set Allow/Deny for Apply Group Policy to control user/group application

GPO Limitations  If a single user is a member of 70 to 80 groups, the respective GPOs may not be applied  Problem caused by Kerberos token size – 70 to 80 groups fills the token and causes an error  Result is no GPOs are applied

GPO Uses  Local GPO  Windows 2000, XP,.NET Submit a question anytime by clicking on the Ask a Question link in the bottom left corner of your presentation screen.

Security Configuration and Analysis  MMC snap-ins:  Security Configuration and Analysis  Security Templates  Used to customize Group Policies a.k.a. security templates.  Several pre-defined security templates for client, server, and DC systems of basic, compatible, secure, and high security.  Analyze current security state

GPO: Password Policy  Min & max password age (0-999)  Min password length (0-14)  History ( entries)  Passwords must meet complexity requirements  Store passwords using reversible encryption for all users in the domain

GPO: Accounts Policy  Lockout duration (0 – minutes)  Failed logon attempts  Counter reset after time limit Submit a question anytime by clicking on the Ask a Question link in the bottom left corner of your presentation screen.

GPO: Audit Policy  Account logon eventsAccount management  Directory service access  Logon eventsObject access  Policy changePrivilege use  Process trackingSystem events  Object level controls accessed through Advanced Security Properties  Audit policy must be enabled in order for audited events to be recorded in the Security log

GPO: User Rights  To increase security settings, make the following changes:  Log on locally: assigned only to Administrators on Servers  Shutdown the System: assigned only to Administrators, Power Users  Access computer from network: assigned to Users, revoke for Administrators and Everyone  Restore files/directories: revoke for Backup Operators  Bypass traverse checking: assigned to Authenticated Users, revoke for Everyone

GPO: Security Options  Numerous security related controls  Previous found only as Registry edits Submit a question anytime by clicking on the Ask a Question link in the bottom left corner of your presentation screen.

GPO: misc  Scripts  Public Key – EFS  IPSec  Software  Administrative Templates  Templates for Registry alteration

Using GPOs  Group similar users  Place similar users/groups in separate containers (i.e. OUs)  Define universal GPOs at domain level  Define specific GPOs as far down the organizational tree as possible  Avoid changing default inheritance mechanism

Questions? Click on the Ask a Question link in the lower left corner of your screen to ask James Michael Stewart a question.

Thank you for your participation! Did you like this Webcast? Send us your feedback on this event and ideas for other event topics at