Windows Server 2008 R2 : Administer Group Policy (part 1) - Use the Group Policy Management Console

1. Use the Group Policy Management Console

The Group Policy Management Console is the main tool where you manage the deployment of Group Policy. This includes creating and linking your GPOs to the appropriate site, domain, or organizational unit. You also can manage security filtering, WMI filtering, administration delegation of Group Policy, and various other tasks with the GPMC. In addition, you can also use it to gain access to the GPME to edit the settings for your GPOs (you will learn about the GPME in the next section). You can also view the settings for your various Group Policy objects. You can find the GPMC in the administrative tools on your Windows Server 2008 R2 server. Select Start Administrative Tools => Group Policy Management to load the GPMC; your screen will resemble Figure 1.

Figure 1. Group Policy Management Console

When you first open the GPMC, expand the management tree; you will see two GPOs that are configured by default: the Default Domain Policy and the Default Domain Controllers Policy. These two policies contain the default security policies for the domains. To view the settings of the default policies, follow these steps:

Figure 2. Default Domain Policy

1.1. Work with Group Policies

Creating, linking, and setting security for group policies starts with knowing what scope you want to apply the policy to. Additionally, you want to know what users in the scope you want to apply the policies to.

Figure 3. Creating a GPO

You can also create a GPO without having the policy linked directly to a scope initially, and you can create a policy via the GPO container. After you create the GPO, you can easily link the GPO to a scope by simply dragging and dropping the GPO on the scope you want the policy to apply to.

1.2. Work with Starter GPOs

Starter GPOs allow you to create a template for quickly creating new GPOs, with a predefined list of settings. They can save you a lot of time because part of the challenge of working with GPOs is the number of settings you can modify. There are literally thousands of settings you can manipulate with Group Policy. Learning which settings work best in your environment is key to using Group Policy effectively. By using starter GPOs, you can reuse a list of frequent settings when you create new GPOs, which will save you time. It is important to note that starter GPOs contain settings only from the Administrative Templates section of Group Policy. You edit the settings in the GPOs just like any other GPO.

To create a starter GPO, click Starter GPOs in the GPMC tree. If this is the first time you have clicked Starter GPOs, you will see a screen similar to Figure 4.

Figure 4. Creating a starter GPO

You need to create a folder to store the starter GPOs, so click the Create Starter GPOs Folder button to create the folder. Once you create the folder, you will see a few starter GPOs provided by Microsoft by default. There are two acronyms you'll see with all the built-in starter GPOs, and these provide the key to what type of settings are in the policies. EC stands for "enterprise client" and provides basic security and power settings, among others, for your infrastructure. SSLF stands for "specialized security limited functionality," which provides robust security-enabled clients. Note this starter may cause compatibility issues with applications. To view the settings for any of these starter GPOs, select one, and click the Settings tab.

1.3. Work with Group Policy Object Links

After you create the GPO, you will see the link of the object associated with your container. You should take note that is this the link for the GPO, not the GPO itself. This is an important distinction to make, because there are different administrative tasks that you can perform for either the GPO link or the GPO itself. To see a list of all the GPOs in your domain, click the Group Policy Objects container located in your management tree.

Working with GPO links provides you with the ability to set the enforced setting, as mentioned earlier. You can also enable or disable the link on the scope. You also control all the filtering of the GPO by working with the link. To access and see the tasks you can perform on links, you can either right-click the link and select the appropriate option (link enabled or enforced). You can also select the link and click the Action menu and you will see same options (link enabled or enforced) to control the link.

Working with the GPOs provides you with the ability to back up and recover them. You can also import settings from previously backed up items. To access these tasks, as with GPO links, you can simply right-click the object and you will see the various actions you can perform (backup, import and so on), or you can highlight the object and then click the Action menu. Remember, you can link GPOs to more than one scope of management. While viewing the objects, you can also link the GPO to other sites, domains, or OUs. To link a GPO to a scope, you can either drag and drop the object on the scope you want to target or right-click the scope and select Link An Existing GPO. When you edit the GPO, you are modifying the object, and all the changes you make will apply to all the scopes linked to the GPO.

There are a few common tasks that you can perform on both the links and the GPOs. You can access the Group Policy Management Editor by selecting Edit, and you can save all the settings into an HTML file by selecting the Save Report Action item, as shown in Figure 5.

Figure 5. Settings report

GPO Status One of the special tasks you can perform on the GPOs is to control which sections of the GPO are applied. When you right-click the GPO (or select the GPO and click the Action menu), one of the items you can select is GPO Status, as shown here. The GPO has four status options: Enabled: Both user and computer settings are enabled. User Configuration Settings Disabled: User settings are disabled, and computer settings are enabled. Computer Configuration Settings Disabled: User settings are enabled, and computer settings are disabled. All Settings Disabled: Both user and computer settings are disabled. The purpose of these settings is for GPO processing efficiency. When you create a GPO, you can have both user and computer settings in the GPO. However, you may create a GPO without one of the two settings; if you do this, it is recommended that you disable the portion that has no settings. This will improve how the targeted systems process group policies.

1.4. Filter Group Policies with GPMC

When working with Group Policy links, you have additional control over the objects targeted by your GPO. Typically, when you link a GPO to an OU, for example, you want all the objects in the OU impacted by the GPO. However, there may be some scenarios where you want only some of the objects to have the group policy applied to them. In Group Policy, you have two main mechanisms for filtering GPOs. Two of the filters you can work with are Windows Management Instrumentation (WMI) filters and security filters.

WMI filtering provides a very powerful filtering tool that allows you to leverage WMI scripting to filter which objects are targeted by your GPOs. WMI scripting leverages an industry standard for how to work with systems across network infrastructures. In a nutshell, WMI scripting will allow you find out various inventory types of information about computers—from what OS they are running to what applications are installed to what type of hardware, and so on. What this provides for GPOs is the ability to target systems meeting very specific criteria. For example, you could use Group Policy to install a software application and then use WMI filtering to make sure only systems having the required amount of free hard drive space to support the application have the application installed on them. To see what WMI filters are currently installed on the system, look in the WMI Filters container in the GPMC.

Security filtering is another great way to filter objects. To access the security filter for a GPO link, click the link you want to view, and make sure you are on the Scope tab for the GPO link. You can see the list of users and groups in the Security Filtering section. By default, the group Authenticated Users is added to the security for all GPOs. When you work with security permissions, there are two permissions required for your users to process a Group Policy object targeted on the OU:

• Read

• Apply Group Policy

You can use security filtering to prevent applying a GPO to security groups or users. For example, say you have an OU containing a group of people including Harold, the manager, of the group, and you want the policy to apply to everyone in the OU except Harold. You could simply add Deny access to either Read or Apply Group Policy for Harold. You can see an example of this in Figure 6.

Figure 6. Denying a user a group policy

You can view the security filtering for a GPO by clicking the GPO link for the targeted scope. On the Scope tab, you will see the current security filtering for the GPO in the Security Filtering section of the details pane inside the GPMC. To modify the security filtering for a GPO, follow these steps:

Figure 8. GPO advanced security filtering

Figure 9. Denying Read for a GPO

Advanced Group Policy Management Tool