Lesson 1: Understanding Group Policy

You can lower your network's total cost of ownership (TCO) by using Group Policy in Microsoft Windows 2000 to create a managed desktop environment that is tailored to the user's job responsibilities and experience level. TCO is the cost that is involved in administering distributed personal computer networks. Recent studies on TCO cite lost user productivity as one of the major costs to corporations. Lost productivity is often due to user error, such as modifying system configuration files and thereby rendering the computer unusable. Group Policy provides the network administrator with greater control over computer configurations, thus reducing the potential for lost user productivity.

Group Policy in Windows 2000 allows an administrator to establish a requirement for a user or a computer once and have that requirement continually enforced. For example, the administrator can implement group policy settings that will run a startup script on all computers in an organizational unit (OU) or audit all failed logon attempts in a domain.

You use the Group Policy tool and its extensions in Microsoft Management Console (MMC) to define group policy settings for desktop configurations for computers and users. You can specify group policy settings with the following Group Policy extensions:

• Administrative Templates (Computers) and Administrative Templates (Users). The Administrative Templates extensions allow you to control the registry-based group policy settings that configure the application settings and customize desktop appearances and behavior of system services.
• Folder Redirection Editor. The Folder Redirection Editor extension allows you to redirect folders like My Documents to network locations, so that users' folders are stored on the network rather than on the user's local computer.
• Internet Explorer Maintenance. The Internet Explorer Maintenance extension allows you to administer Internet Explorer settings.
• Remote Installation Services. The Remote Installation Services extension allows you to predefine configuration options such as operating system selection and client computer naming conventions to provide better disaster recovery and easier operating system and application management.
• Scripts (Logon/Logoff) and Scripts (Startup/Shutdown). The Scripts extensions allow you to configure scripts for when a computer starts and shuts down and when a user logs on and logs off.
• Security Settings. The Security Settings extension extends the Group Policy snap-in and allows you to define security policies for computers in your domain.
• Software Installation (Computers) and Software Installation (Users). The Software Installation extensions allow you to control the central management of software including installation, updates, and removal.

In Windows 2000, you create a Group Policy Object (GPO) and then configure the settings for that specific GPO. The GPO is a virtual storage location for the group policy settings. The contents of the GPO are stored in two different locations, the Group Policy Container and the Group Policy Template.

The Group Policy Container (GPC) is an Active Directory object that contains GPO attributes and includes subcontainers for group policy information about computers and users. The GPC includes the following information:

• Version information. Ensures that the information in the GPC synchronizes with the Group Policy Template information.
• Status information. Indicates whether the GPO is enabled or disabled.
• List of components (extensions). Lists any of the Group Policy extensions that are used in the GPO.

The Group Policy Template (GPT) is a folder hierarchy in the Sysvol folder on domain controllers. The GPT is the container for all group policy information on administrative templates, security, software installation, scripts, and folder redirection.

When you create a GPO, Windows 2000 creates the corresponding GPT folder hierarchy. The name of the GPT folder is the globally unique identifier (GUID) of the GPO that you created.

For example, if you associate a GPO with the domain domain.com, and the GPO is assigned a GUID of {A3A2C853-F033-11D1-9BE4-00C0DFE00C63}, the resulting GPT folder name would be systemroot\Sysvol\Sysvol\domain.com\ Policies\{A3A2C853-F033-11D1-9BE4-00C0DFE00C63}

When you create a GPO, you associate it with a selected Active Directory container, such as a site, domain, or organizational unit. Within the hierarchical structure of the Active Directory directory services, child containers inherit GPOs from parent containers. You must understand the processing order of GPOs to plan your group policy implementation. You can filter the scope of the GPO and delegate control of a GPO with permissions. The attributes of a GPO offer you other options for managing how you apply group policy settings.

Group policy settings are inherited, cumulative, and affect all computers and user accounts in the Active Directory container with which the GPO is associated. You can associate multiple Active Directory containers with the same GPO and multiple GPOs with a single Active Directory container.

Windows 2000 evaluates GPOs starting with the Active Directory container furthest away (highest up the hierarchical structure) from the computer or user. The order of group policy inheritance is site, domain, and then organizational unit. With this order, the GPOs of the OU that the computer or user is a member of are the final group policy settings that Windows 2000 applies to the computer or user.

This default behavior allows a group policy setting in the Active Directory container closest to the computer or user to override a conflicting group policy setting in a container that is higher up in the Active Directory hierarchy.

When a group policy setting is configured for a parent OU, and the same group policy setting is not configured for a child OU, the objects in the child OU inherit the group policy setting from the parent OU. However, a group policy setting can be configured in the GPO for both the parent and child OU. In that case, the compatibility of the group policy settings determines the result.

When the parent OU and child OU both have a configured group policy setting and the settings are compatible, the settings from both OUs apply. If a group policy setting that is configured for a parent OU is incompatible with the same group policy setting that is configured for a child OU, the child OU does not inherit the group policy setting from the parent, but retains its own group policy setting.

The group policy settings in a GPO are processed in a specific order. Some group policy settings for users can affect computers also. For example, the permission to use the Run command on the Start menu can affect computers and users both. By understanding the order in which Windows 2000 processes group policy settings, you can avoid overwriting settings.

The group policy settings are processed in the following sequence:

1. When the computer starts, group policy settings for computers process. This is done synchronously by default.
2. Startup scripts run synchronously by default. This means that each script must complete or time out before the next one will start.
3. When a user logs on, group policy settings for users process. This is also done synchronously by default.
4. Logon scripts run. Logon scripts in GPOs run asynchronously by default. If you have scripts that are associated with a user object, they run last.

Windows 2000 periodically refreshes group policy settings throughout the network. This is done by default on client computers every 90 minutes with a randomized offset of plus or minus 30 minutes. For domain controllers, the default period is every 5 minutes. You can change the default values by modifying the settings in Administrative Templates. You cannot schedule the application of a GPO to the client computers.

The Windows 2000 Group Policy tool allows an administrator to manage desktop environments throughout the network by applying configuration settings to computers and users within a site, domain, or organizational unit. Group policy settings are contained in Group Policy Objects. A GPO is a virtual storage location for the group policy settings whose contents are stored in two different locations, the Group Policy Container and the Group Policy Template.

You use the Group Policy tool and its extensions in MMC to define group policy settings for desktop configurations for computers and users. The extensions available for Group Policy include Administrative Templates, (Computers), Administrative Templates (Users), Folder Redirection Editor, Internet Explorer Maintenance, Remote Installation Services, Scripts (Logon/Logoff), Scripts (Startup/Shutdown), Security Settings, Software Installation (Computers), and Software Installation (Users). These extensions allow you to specify additional group policy settings. The settings contained in the GPOs are applied in a specific order. When the computer is started, the group policy settings for the computers process. Next any startup scripts run. When a user logs on, the group policy settings for users process, and finally, if there are any logon scripts, they run.