Logo
PREGNANCY
Windows XP
Windows Vista
Windows 7
Windows Azure
Windows Server
Windows Phone
 
 
Windows Server

Windows Server 2008 R2 : Local Group Policies

3/8/2011 10:08:12 PM
Two different types of policies can be applied to Windows systems and Windows system user accounts: local group policies and Active Directory group policies. Local group policies exist on all Windows systems, but Active Directory group policies are only available in an Active Directory forest. Until the release of Windows Vista and Windows Server 2008, servers and workstations could contain and apply only a single local computer and user policy. This policy contained the settings that could be applied to the local computer and the user objects to control the security and configuration settings.

In many environments, usually due to legacy or line-of-business application requirements, end users were frequently granted local Administrators group membership on workstations and essentially excluded from the application of many security settings applied by both the local and group policies. End users with local Administrators group membership have the ability to override settings and make configuration changes that could compromise the security, or more frequently, reduce the reliability of the system.

Starting with Windows Vista and Windows Server 2008, administrators now have the ability to create multiple local group policies. One of the new features is that specific user group policies can be created for all users, for users who are not administrators, and for users who are members of the local Administrators group on the computers. This new feature can be especially valuable for computers configured in workgroup or standalone configurations to increase the security and reliability of the computer. In domain configurations, computer security policies are usually specified using group policies and applied to the Active Directory computers.

Local Computer Policy

The default local computer policy contains out-of-the-box policy settings, as shown in Figure 1, which are available to configure the computer and user environment. This policy will be applied first for both computer and user objects logging on to the workstation in workgroups or domains.

Figure 1. Examining local computer policy settings.

Local User Policies for Non-Administrators and Administrators

Starting with Windows Vista and Windows Server 2008, and continuing with Windows 7 and Windows Server 2008 R2, administrators now have the option to create multiple local user group policies on a single machine. In previous versions, the single local computer policy allowed administrators to apply the single policy settings to all users logging on to a workstation that is part of a workgroup. Now, workgroup computers and domain computers can have additional policies applied to specific local users. Also, policies can be applied to local computer administrators or nonadministrators. This allows the workstation administrator to leave the user section of the default local computer policy blank, and create a more-restrictive policy for local users and a less-restrictive policy for members of the local workstation Administrators security group.

Other -----------------
- Windows Server 2008 R2 : Group Policy Processing—How Does It Work?
- Understanding DNS in Windows Server 2003 Networks
- Understanding Name Resolution in Windows Server 2003
- Windows Server 2008 R2 Administration : Managing Printers with the Print Management Console
- Windows Server 2008 R2 Administration : Managing Users with Local Security and Group Policies (part 3) - Troubleshooting Group Policy Applications
- Windows Server 2008 R2 Administration : Managing Users with Local Security and Group Policies (part 2) - Configuring and Optimizing Group Policy
- Windows Server 2008 R2 Administration : Managing Users with Local Security and Group Policies (part 1) - Viewing Policies with the Group Policy Management Console & Creating New Group Policies
- Windows Server 2008 R2 Administration : Creating Groups
- Examining Windows Server 2008 R2 Active Directory Groups
- Windows Server 2008 R2 Administration : Configuring Sites (part 2) - Establishing Site Links & Delegating Control at the Site Level
- Windows Server 2008 R2 Administration : Configuring Sites (part 1) - Creating a Site
- Windows Server 2008 R2 Administration : Examining Active Directory Site Administration
- Windows Server 2008 R2 Administration : Defining the Administrative Model
- Migrating to Windows Server 2008 R2 : Lab-Testing Existing Applications
- Migrating to Windows Server 2008 R2 : Verifying Compatibility with Vendors
- Migrating to Windows Server 2008 R2 : Researching Products and Applications
- Migrating to Windows Server 2008 R2 : Preparing for Compatibility Testing
- Migrating from Windows Server 2003/2008 to Windows Server 2008 R2 : Multiple Domain Consolidation Migration (part 5) - Migrating Other Domain Functionality
- Migrating from Windows Server 2003/2008 to Windows Server 2008 R2 : Multiple Domain Consolidation Migration (part 4) - Migrating Computer Accounts
- Migrating from Windows Server 2003/2008 to Windows Server 2008 R2 : Multiple Domain Consolidation Migration (part 3) - Migrating Groups & Migrating User Accounts
 
 
Most view of day
- Conducting Research in OneNote 2010 : Handling the Research Task Pane
- Microsoft Lync Server 2013 : Deploying Lync Online - Configuring Dial-in Conferencing, Configuring Lync Properties for User Accounts
- Duplicating and Copying DVDs (part 1) - Duplicating DVD Movies
- SQL Server 2012 : Data Architecture (part 1) - Information Architecture Principle, Database Objectives
- Extending Dynamics GP with Free Software : Preventing date errors with DocDateVerify, Executing SQL from the Support Administrator Console
- QuarkXPress 8 : Checking spelling (part 2) - Searching and replacing, Exporting text
- Plug and Play and Power Management : WMI Request Handler, Synchronization Issues, Security
- System Center Configuration Manager 2007 : Customizing Configuration Manager Reports (part 1) - Customizing Report Layout and Display
- SQL Server 2008 R2 : Performance Monitoring Tools (part 10) - Creating an Extended Events Session
- Microsoft Exchange Server 2007 : Hub Transport Server Policy Compliance Features (part 4) - Message Classification , Rights Management and the Hub Transport Server
Top 10
- Windows Server 2012 : Configuring IPsec (part 7) - Configuring connection security rules - Monitoring IPsec
- Windows Server 2012 : Configuring IPsec (part 6) - Configuring connection security rules - Creating a custom rule, Configuring authenticated bypass
- Windows Server 2012 : Configuring IPsec (part 5) - Configuring connection security rules - Creating an authentication exemption rule, Creating a server-to-server rule, Creating a tunnel rule
- Windows Server 2012 : Configuring IPsec (part 4) - Configuring connection security rules - Types of connection security rules, Creating an isolation rule
- Windows Server 2012 : Configuring IPsec (part 3) - Configuring IPsec settings - Customizing IPsec tunnel authorizations, Configuring IPsec settings using Windows PowerShell
- Windows Server 2012 : Configuring IPsec (part 2) - Configuring IPsec settings - Customizing IPsec defaults
- Windows Server 2012 : Configuring IPsec (part 1) - Understanding connection security
- Microsoft Project 2010 : Linking Tasks (part 8) - Auditing Task Links,Using the Task Inspector
- Microsoft Project 2010 : Linking Tasks (part 7) - Creating Links by Using the Mouse,Working with Automatic Linking Options
- Microsoft Project 2010 : Linking Tasks (part 6) - Creating Links by Using the Entry Table
 
 
Windows XP
Windows Vista
Windows 7
Windows Azure
Windows Server
Windows Phone
2015 Camaro