Week 4 Objectives
description
Transcript of Week 4 Objectives
![Page 1: Week 4 Objectives](https://reader036.fdocuments.net/reader036/viewer/2022062322/5681501f550346895dbe0502/html5/thumbnails/1.jpg)
Week 4 Objectives
•Overview of Group Policy•Group Policy Processing• Implementing a Central Store for Administrative Templates
![Page 2: Week 4 Objectives](https://reader036.fdocuments.net/reader036/viewer/2022062322/5681501f550346895dbe0502/html5/thumbnails/2.jpg)
Components of Group Policy
A Group Policy setting defines a specific configuration change to apply to a user or a computer
A GPO is a collection of Group Policy settings that can be applied to a user, computer, or both, to enact changes
![Page 3: Week 4 Objectives](https://reader036.fdocuments.net/reader036/viewer/2022062322/5681501f550346895dbe0502/html5/thumbnails/3.jpg)
What Are Multiple Local GPOs?
Multiple Local Group Policies:
There are three layers of user configurations:
• User-specific
• Have a single computer configuration that applies to thecomputer for all users who log on
• Have layers of user settings that can apply only to individual users, not to groups
• Non-Administrator
• Administrator
![Page 4: Week 4 Objectives](https://reader036.fdocuments.net/reader036/viewer/2022062322/5681501f550346895dbe0502/html5/thumbnails/4.jpg)
Storage of Domain GPOs
Group Policy Components
GPO•Contains Group Policy settings•Stores content in two locations
Group Policy Container•Stored in AD DS•Provides version information
Group Policy Template•Stored in shared SYSVOL folder •Provides Group Policy settings
![Page 5: Week 4 Objectives](https://reader036.fdocuments.net/reader036/viewer/2022062322/5681501f550346895dbe0502/html5/thumbnails/5.jpg)
What Are Group Policy Preferences?
Using Group Policy preferences, you can:•Configure, deploy, and manage operating system and application settings that are not manageable by using Group Policy
•Apply Group Policy preferences:
• Once, or refreshed at intervals
• Targeted to users or computers
Group Policy preferences:•Expand the range of configurable settings within a GPO
•Are not enforced
•Are not removed when the GPO no longer applies
•Do not disable the interface of the setting; users can changethe setting
•Cannot be used in local group polices
![Page 6: Week 4 Objectives](https://reader036.fdocuments.net/reader036/viewer/2022062322/5681501f550346895dbe0502/html5/thumbnails/6.jpg)
What Are Starter GPOs?
A starter GPO:
• Has preconfigured administrative template settings upon which new GPOs can be based
• Can be exported to .cab files
• Can be imported into other areas of the enterprise
Exported to .cab file
Imported to GPMC
Starter GPO.cabfile
Load .cab file
![Page 7: Week 4 Objectives](https://reader036.fdocuments.net/reader036/viewer/2022062322/5681501f550346895dbe0502/html5/thumbnails/7.jpg)
Delegating Management of GPOs
Delegation of GPO-related tasks allows the administrative workload to be distributed across the enterprise
The following Group Policy tasks can be independently delegated:
• Creating GPOs
• Editing GPOs
• Managing Group Policy links for a site, domain, or OU
• Reading Group Policy Results data in a domain or OU
• Creating WMI filters on a domain
• Performing Group Policy Modeling analysis in a domain or OU
![Page 8: Week 4 Objectives](https://reader036.fdocuments.net/reader036/viewer/2022062322/5681501f550346895dbe0502/html5/thumbnails/8.jpg)
GPO Links
GPOs can be linked to:
GPOs cannot be linked to:
• Sites• Domains• OUs
• Users • Groups• Computers• System containers
To deliver settings to an object, a GPO must be linked to a container
Disabling a link removes the settings from the container
Deleting a link does not delete the GPO
![Page 9: Week 4 Objectives](https://reader036.fdocuments.net/reader036/viewer/2022062322/5681501f550346895dbe0502/html5/thumbnails/9.jpg)
Applying GPOs
• When you apply GPOs, remember that:• Computer settings apply at startup• User settings apply at logon• Polices refresh at regular, configurable intervals• Security settings refresh at least every 16 hours• Policies refresh manually by using:
• The Gpupdate command • The Windows PowerShell cmdlet Invoke-Gpupdate
• With the new Remote Policy Refresh feature in Windows Server 2012, you can remotely refresh policies
![Page 10: Week 4 Objectives](https://reader036.fdocuments.net/reader036/viewer/2022062322/5681501f550346895dbe0502/html5/thumbnails/10.jpg)
Group Policy Processing Order
Site
Domain
GPO2GPO2
GPO3GPO3
GPO4GPO4
OUOUOUOU
OUGPO5GPO5
GPO1
Local Group
Group Policy Processing Order
![Page 11: Week 4 Objectives](https://reader036.fdocuments.net/reader036/viewer/2022062322/5681501f550346895dbe0502/html5/thumbnails/11.jpg)
What Are the Default GPOs?
There are two default GPOs:
•Default Domain Policy
• Used to define the account policies for the domain:
• Password
• Account lockout
• Kerberos protocol
• Default Domain Controllers Policy
• Used to define auditing policies
• Defines user rights on domain controllers
![Page 12: Week 4 Objectives](https://reader036.fdocuments.net/reader036/viewer/2022062322/5681501f550346895dbe0502/html5/thumbnails/12.jpg)
GPO Security Filtering
Apply Group Policy permissions
•GPO has an ACL (Delegation tab, click Advanced)
•Default: Authenticated Users have Allow Apply Group Policy
Scope only to users in selected global or universal groups
•Remove Authenticated Users
•Add appropriate global or universal groups (GPOs do not scope to domain local groups)
Scope to users except for those in selected groups
•On the Delegation tab, click Advanced
•Add appropriate global groups
•Deny the Apply Group Policy permission
![Page 13: Week 4 Objectives](https://reader036.fdocuments.net/reader036/viewer/2022062322/5681501f550346895dbe0502/html5/thumbnails/13.jpg)
What Is the Central Store?
• The Central Store:• Is a central repository for ADMX and ADML files• Is stored in SYSVOL• Must be created manually• Is detected automatically by Windows operating systems
and Windows Server operating systems
ADMX files
Windows workstations
Domain controller with SYSVOL
ADMX files
Domain controller with SYSVOL
![Page 14: Week 4 Objectives](https://reader036.fdocuments.net/reader036/viewer/2022062322/5681501f550346895dbe0502/html5/thumbnails/14.jpg)
What Are Administrative Templates?
.admx
.adml Registry
Administrative Templates determine what settings appear and how they are grouped
in GPO Editor
![Page 15: Week 4 Objectives](https://reader036.fdocuments.net/reader036/viewer/2022062322/5681501f550346895dbe0502/html5/thumbnails/15.jpg)
How Administrative Templates Work
•Policy settings in the Administrative Templates node make changes to the registry
•The Prevent access to registry editing tools setting changes the value of the HKLM\Software\Classes\Regedit
![Page 16: Week 4 Objectives](https://reader036.fdocuments.net/reader036/viewer/2022062322/5681501f550346895dbe0502/html5/thumbnails/16.jpg)
Managed and Unmanaged Policy Settings
Administrative Templates•Managed policy setting
•UI is locked; user cannot make a change to the setting•Changes are made in one of four reserved registry keys•Change and UI locks are released when the user/computer falls out of scope
• Unmanaged policy setting• UI is not locked• Changes made are persistent: tattoos the registry
• Only managed settings are shown by default• Set Filter options to view unmanaged settings