1. 9.1 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  To create a GPO for a site  Use the Active Directory Sites and Services console  Use the Group Policy Management Console (GPMC), which combines the functionality of various consoles  Active Directory Users and Computers  Active Directory Sites and Services  ACL Editor  Delegation Wizard  Resultant Set of Policy tool Introducing Group Policy (5) (Skill 1)

2. 9.2 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy Figure 9-1 Download the GPMC (Skill 1)

3. 9.3 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  Two types of GPOs  Local GPOs are stored on each Windows Server 2003 computer  Active Directory-based GPOs  Are stored on a domain controller in the Active Directory environment  Are replicated to all domain controllers in the domain Introducing Group Policy (6) (Skill 1)

4. 9.4 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  GPO is made up of two parts  Group Policy Container (GPC)  GPO attributes  Extensions  Version information  Group Policy Template (GPT)  Collection of folders  Stored on each Windows Server 2003 domain controller Introducing Group Policy (7) (Skill 1)

5. 9.5 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy Figure 9-2 GPC containers in the Active Directory Users and Computers console (Skill 1)

6. 9.6 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  Group Policy Template (GPT)  A collection of folders stored on each Windows Server 2003 domain controller in the folder %Systemroot%\SYSVOL\sysvol\ \Policies  For each GPO, a folder hierarchy composed of the physical files and settings required by the GPO is automatically created  These settings are applied to the Windows 2000, Windows Server 2003, and Windows XP clients on a network Introducing Group Policy (9) (Skill 1)

7. 9.7 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy Figure 9-3 The Add Standalone Snap-in dialog box (Skill 1)

8. 9.8 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy Figure 9-4 The Group Policy Wizard (Skill 1)

9. 9.9 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy Figure 9-5 The Add/Remove Snap-in dialog box (Skill 1)

10. 9.10 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy Figure 9-6 Configuring Local Computer Policy (Skill 1)

11. 9.11 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  Group Policy settings are divided into two categories  Computer Configuration settings  These settings refer to Group Policies that apply to computers, regardless of what user logs on  These settings apply to a computer during the initialization of the operating system  User Configuration settings  These settings refer to Group Policies for users, regardless of what computer the users log on to  These settings apply at user logon Introducing the Types of Group Policy Settings and the GPMC (Skill 2)

12. 9.12 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  Both Computer Configuration settings and User Configuration settings contain three main containers that include a number of related policies  Software Settings  Windows Settings  Administrative Templates Introducing the Types of Group Policy Settings and the GPMC (2) (Skill 2)

13. 9.13 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy Figure 9-7 The three main categories of User Configuration and Computer Configuration Group Policy (Skill 2)

14. 9.14 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  Software Settings  This configuration setting node is used to determine the applications distributed to computers or users via a GPO  You use Software Settings to assign applications to computers or to assign or publish applications to users  If you use the Computer Configuration node to assign an application to a computer, the application appears on the Start menu for all computers in the domain, site, or OU Introducing the Types of Group Policy Settings and the GPMC (3) (Skill 2)

15. 9.15 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  Software Settings  If you publish an application to users, it appears in the Add/Remove Programs Wizard for all users in the domain, site, or OU  If you assign an application to users using the User Configuration node  It displays on the Start menu for all users in the site, domain, or OU  It does not install until the user invokes it  This functionality is called “advertising” Introducing the Types of Group Policy Settings and the GPMC (4) (Skill 2)

16. 9.16 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy Figure 9-8 Software installation (Skill 2)

17. 9.17 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  Windows Settings  In the Computer Configuration node, the Windows Settings node contains the Scripts and Security Settings extensions  Scripts extension: Used to specify startup and shutdown scripts for computers, as well as logon and logoff scripts for users on a network  Security Settings extension: Used by administrators to configure security settings for the local computer or for a GPO Introducing the Types of Group Policy Settings and the GPMC (5) (Skill 2)

18. 9.18 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy Figure 9-9 Scripts (Skill 2)

19. 9.19 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  Windows Settings  In the User Configuration node, the Windows Settings node has five folders  Remote Installation Services  Scripts  Security Settings  Internet Explorer Maintenance  Folder Redirection Introducing the Types of Group Policy Settings and the GPMC (6) (Skill 2)

20. 9.20 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy Figure 9-10 Types of Folder Redirection policies (Skill 2)

21. 9.21 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  Administrative Templates  Contains all Registry-based Group Policy settings, including settings for Windows Components, System, and Network  Group Policy settings for Printers are available only in the Computer Configuration container  Other settings, including Start Menu and Taskbar, Desktop, Control Panel, and Shared Folders are available only in the User Configuration container Introducing the Types of Group Policy Settings and the GPMC (8) (Skill 2)

22. 9.22 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy Figure 9-11 Types of Administrative Templates policies (Skill 2)

23. 9.23 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  Group Policy Management Console (GPMC)  Comprehensive tool for Group Policy administration for Windows 2000 and Windows Server 2003 domains  Provides administrators with the ability to backup, restore, import, and copy/paste GPOs, as well as to create, delete, and rename them  Use it to link GPOs and search for GPOs  Use it to delegate Group Policy-related features and for policy-related permission for sites, domains, and OUs Introducing the Types of Group Policy Settings and the GPMC (9) (Skill 2)

24. 9.24 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy Figure 9-12 Group Policy Objects in the GPMC (Skill 2)

25. 9.25 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  The role of a Group Policy begins when a computer starts up or when a user logs on  During startup and logon, both Computer Configuration and User Configuration settings are applied in a specific sequence Identifying the Role of a Group Policy at Startup and Logon (Skill 3)

26. 9.26 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy Figure 9-15 The sequence in which Computer Configuration and User Configuration settings are applied (Skill 3)

27. 9.27 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  Every computer has one GPO that is stored locally  This local Group Policy Object (LPGO) is applied first  The processing sequence becomes very important when dealing with multiple policies  If there are no conflicts between the policies, all settings from all of the policies apply  However, if a conflict occurs the policy to apply last wins Identifying the Role of a Group Policy at Startup and Logon (2) (Skill 3)

28. 9.28 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  Sequence in which Group Policy settings are processed  Local GPO  Site GPOs  Domain GPOs  OU GPOs (LSDOU) Identifying the Role of a Group Policy at Startup and Logon (3) (Skill 3)

29. 9.29 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  If more than one GPO is linked  The policies are processed in reverse order for each individual container  This is done so that the policy that is considered to be the most important is displayed at the top of the list of all GPOs applied to a particular container Identifying the Role of a Group Policy at Startup and Logon (4) (Skill 3)

30. 9.30 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  Like files and folders, Group Policies are also inherited from parent containers to child containers  You can specifically set a separate Group Policy setting for a child container to override the settings it inherits from its parent container  It is extremely important to note that like OU structures, Group Policies do not flow between domains Identifying the Role of a Group Policy at Startup and Logon (5) (Skill 3)

31. 9.31 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  Group Policy applied to a parent domain  Does not apply to its child domain or domains  The only container that can apply Group Policies to multiple domains is the site container  Group Policy applied to a site  Affects all users and computers in the site, regardless of domain  For this reason, you must be an Enterprise Admin in order to apply a Group Policy to a site Identifying the Role of a Group Policy at Startup and Logon (6) (Skill 3)

32. 9.32 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  Exceptions to the order in which GPOs are processed  If a computer belongs to a workgroup, it processes only local GPOs  You can modify the default behavior using the Block Inheritance option, but this can make GPO administration more complicated and it should be used sparingly  You can block inheritance for GPO links for an entire domain, for all domain controllers, or for an OU Identifying the Role of a Group Policy at Startup and Logon (7) (Skill 3)

33. 9.33 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy (Skill 3) Figure 9-16 Blocking Inheritance for the GPO links for all domain controllers

34. 9.34 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  Exceptions to the order in which GPOs are processed  The default order for processing Group policy settings is also affected when you set the GPO link to Enforced  Policy settings in the GPO link take precedence over child object settings  Gives the parent GPO link precedence so that the default behavior does not apply (formerly called the No Override option)  GPO administration is more complex  GPOs cannot have their inheritance blocked Identifying the Role of a Group Policy at Startup and Logon (8) (Skill 3)

35. 9.35 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy Figure 9-17 The Enforced setting (Skill 3)

36. 9.36 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  Exceptions to the order in which GPOs are processed  If Block Inheritance option is set for a domain or OU  The GPOs above that point in the structure do not affect users or computers in that structure; they are blocked  If there is a conflict between Enforced and Block Inheritance, Enforced always wins Identifying the Role of a Group Policy at Startup and Logon (9) (Skill 3)

37. 9.37 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  Exceptions to the order in which GPOs are processed  You can disable a GPO link to block that GPO from being applied for the selected site, domain, or OU  Disables the GPO only for the selected container object; it does not disable the GPO itself  If the GPO is linked to other sites, domains, or OUs, they continue to process the GPO as long as their links are enabled  Processing is enabled for all GPO links by default  To disable a GPO link, right-click it and select the Link Enabled command (a check mark indicates it is enabled) Identifying the Role of a Group Policy at Startup and Logon (10) (Skill 3)

38. 9.38 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  Exceptions to the order in which GPOs are processed  Group Policies are never applied to Windows NT, 95, 98, or Windows Me computers Identifying the Role of a Group Policy at Startup and Logon (12) (Skill 3)

39. 9.39 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  When you install Active Directory on your network, two GPOs are created automatically  Default Domain Policy, which is linked to the domain  Default Domain Controllers Policy, which is linked to the Domain Controllers OU  You can use these policies to assign standard settings to the domain and the domain controllers in a domain, respectively Creating a Group Policy Object (Skill 5)

40. 9.40 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  GPOs can be linked to sites, domains, and OUs  To link a GPO to a site, use the Active Directory Sites and Services console or the GPMC  To link GPOs to domains and OUs, use either the Active Directory Users and Computers console or the GPMC Creating a Group Policy Object (2) (Skill 5)

41. 9.41 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  You can create a stand-alone GPO console for a GPO and access it directly from the All Programs/Administrative Tools menu  Steps to create a GPO console 1.Open Add Standalone Snap-in dialog box from an MMC console 2.Select Group Policy Object Editor from the list of available snap-ins Creating a Group Policy Object (3) (Skill 5)

42. 9.42 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  Steps to create a GPO console 3.Click the Browse button in the Group Policy Wizard 4.In the Browse for a Group Policy Object dialog box, select the GPO for which you want to create a console The selected GPO name is added to the Group Policy Object text box on the Select Group Policy Object screen in the wizard 3.From the File menu, save the console for the GPO to make it available on the All Programs/Administrative Tools menu Creating a Group Policy Object (4) (Skill 5)

43. 9.43 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy Figure 9-21 Creating a GPO (Skill 5)

44. 9.44 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy Figure 9-22 The New GPO dialog box (Skill 5)

45. 9.45 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy Figure 9-23 New Group Policy Object in a domain (Skill 5)

46. 9.46 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  Assign permissions to delegate administrative control over a GPO on the Delegation tab in the GPMC  There are three standard permissions you can assign to a GPO  However, five permission levels display on the Delegation tab  Each of these permission levels represents a combination of Active Directory permissions Delegating Control for a Group Policy Object (Skill 6)

47. 9.47 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  To delegate permissions for a GPO, you must have the Edit settings, delete, and modify security permission for the GPO  To view the permissions for groups with custom permissions or to set custom permissions, click the Advanced button to open the ACL Editor for the GPO ( Security Settings dialog box) Delegating Control for a Group Policy Object (2) (Skill 6)

48. 9.48 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy  You must assign the Edit settings, delete, and modify security permission to at least one group or user for each GPO  If there is only one user or group with this permission level, you cannot remove this user or group  Permissions inherited from parent containers cannot be removed Delegating Control for a Group Policy Object (3) (Skill 6)

49. 9.49 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy Figure 9-24 Setting GPO permissions (Skill 6)

50. 9.50 © 2004 Pearson Education, Inc. Exam 70-294 Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Lesson 9: Implementing Group Policy Figure 9-25 The Delegation tab in the GPMC (Skill 6)