Logo
PREGNANCY
Windows XP
Windows Vista
Windows 7
Windows Azure
Windows Server
Windows Phone
 
 
Windows Server

Windows Server 2008 R2 : Local Group Policies

3/8/2011 10:08:12 PM
Two different types of policies can be applied to Windows systems and Windows system user accounts: local group policies and Active Directory group policies. Local group policies exist on all Windows systems, but Active Directory group policies are only available in an Active Directory forest. Until the release of Windows Vista and Windows Server 2008, servers and workstations could contain and apply only a single local computer and user policy. This policy contained the settings that could be applied to the local computer and the user objects to control the security and configuration settings.

In many environments, usually due to legacy or line-of-business application requirements, end users were frequently granted local Administrators group membership on workstations and essentially excluded from the application of many security settings applied by both the local and group policies. End users with local Administrators group membership have the ability to override settings and make configuration changes that could compromise the security, or more frequently, reduce the reliability of the system.

Starting with Windows Vista and Windows Server 2008, administrators now have the ability to create multiple local group policies. One of the new features is that specific user group policies can be created for all users, for users who are not administrators, and for users who are members of the local Administrators group on the computers. This new feature can be especially valuable for computers configured in workgroup or standalone configurations to increase the security and reliability of the computer. In domain configurations, computer security policies are usually specified using group policies and applied to the Active Directory computers.

Local Computer Policy

The default local computer policy contains out-of-the-box policy settings, as shown in Figure 1, which are available to configure the computer and user environment. This policy will be applied first for both computer and user objects logging on to the workstation in workgroups or domains.

Figure 1. Examining local computer policy settings.

Local User Policies for Non-Administrators and Administrators

Starting with Windows Vista and Windows Server 2008, and continuing with Windows 7 and Windows Server 2008 R2, administrators now have the option to create multiple local user group policies on a single machine. In previous versions, the single local computer policy allowed administrators to apply the single policy settings to all users logging on to a workstation that is part of a workgroup. Now, workgroup computers and domain computers can have additional policies applied to specific local users. Also, policies can be applied to local computer administrators or nonadministrators. This allows the workstation administrator to leave the user section of the default local computer policy blank, and create a more-restrictive policy for local users and a less-restrictive policy for members of the local workstation Administrators security group.

Other -----------------
- Windows Server 2008 R2 : Group Policy Processing—How Does It Work?
- Understanding DNS in Windows Server 2003 Networks
- Understanding Name Resolution in Windows Server 2003
- Windows Server 2008 R2 Administration : Managing Printers with the Print Management Console
- Windows Server 2008 R2 Administration : Managing Users with Local Security and Group Policies (part 3) - Troubleshooting Group Policy Applications
- Windows Server 2008 R2 Administration : Managing Users with Local Security and Group Policies (part 2) - Configuring and Optimizing Group Policy
- Windows Server 2008 R2 Administration : Managing Users with Local Security and Group Policies (part 1) - Viewing Policies with the Group Policy Management Console & Creating New Group Policies
- Windows Server 2008 R2 Administration : Creating Groups
- Examining Windows Server 2008 R2 Active Directory Groups
- Windows Server 2008 R2 Administration : Configuring Sites (part 2) - Establishing Site Links & Delegating Control at the Site Level
- Windows Server 2008 R2 Administration : Configuring Sites (part 1) - Creating a Site
- Windows Server 2008 R2 Administration : Examining Active Directory Site Administration
- Windows Server 2008 R2 Administration : Defining the Administrative Model
- Migrating to Windows Server 2008 R2 : Lab-Testing Existing Applications
- Migrating to Windows Server 2008 R2 : Verifying Compatibility with Vendors
- Migrating to Windows Server 2008 R2 : Researching Products and Applications
- Migrating to Windows Server 2008 R2 : Preparing for Compatibility Testing
- Migrating from Windows Server 2003/2008 to Windows Server 2008 R2 : Multiple Domain Consolidation Migration (part 5) - Migrating Other Domain Functionality
- Migrating from Windows Server 2003/2008 to Windows Server 2008 R2 : Multiple Domain Consolidation Migration (part 4) - Migrating Computer Accounts
- Migrating from Windows Server 2003/2008 to Windows Server 2008 R2 : Multiple Domain Consolidation Migration (part 3) - Migrating Groups & Migrating User Accounts
 
 
Most view of day
- Microsoft Lync Server 2013 : Configuring the Director (part 1) - SRV Records, Web Services FQDN Overrides
- Microsoft Exchange Server 2007 : Implementing Client Access and Hub Transport Servers - Transport Pipeline
- Adobe Photoshop CS5 : Letting Camera Raw Auto-Correct Your Photos, Adding Snap to Your Images Using the Clarity Slider
- Conducting Research in OneNote 2010 : Researching a Topic, Customizing the Research Task Pane
- Microsoft Access 2010 : Viewing the Design of a Report
- Exchange Server 2007 : Deploying a Cluster Continuous Replication Mailbox Cluster (part 1)
- Microsoft Exchange Server 2010 : Completing Transport Server Setup (part 6) - Verifying Edge Subscriptions, Removing Edge Subscriptions
- Windows 7 Mobility Features : Working with the Windows 7 User Interface
- Windows Phone 8 : Scheduled Tasks - To-Do List Scheduled Task Sample (part 2) - TodoService, TodoItemViewModel
- HP ProLiant Servers AIS : Memory and Cache
Top 10
- Windows Server 2012 : Configuring IPsec (part 7) - Configuring connection security rules - Monitoring IPsec
- Windows Server 2012 : Configuring IPsec (part 6) - Configuring connection security rules - Creating a custom rule, Configuring authenticated bypass
- Windows Server 2012 : Configuring IPsec (part 5) - Configuring connection security rules - Creating an authentication exemption rule, Creating a server-to-server rule, Creating a tunnel rule
- Windows Server 2012 : Configuring IPsec (part 4) - Configuring connection security rules - Types of connection security rules, Creating an isolation rule
- Windows Server 2012 : Configuring IPsec (part 3) - Configuring IPsec settings - Customizing IPsec tunnel authorizations, Configuring IPsec settings using Windows PowerShell
- Windows Server 2012 : Configuring IPsec (part 2) - Configuring IPsec settings - Customizing IPsec defaults
- Windows Server 2012 : Configuring IPsec (part 1) - Understanding connection security
- Microsoft Project 2010 : Linking Tasks (part 8) - Auditing Task Links,Using the Task Inspector
- Microsoft Project 2010 : Linking Tasks (part 7) - Creating Links by Using the Mouse,Working with Automatic Linking Options
- Microsoft Project 2010 : Linking Tasks (part 6) - Creating Links by Using the Entry Table
 
 
Windows XP
Windows Vista
Windows 7
Windows Azure
Windows Server
Windows Phone
2015 Camaro