Lesson 3: Configuring Group Policy

You configure the group policy settings within a GPO by using the Group Policy tool and its extensions in MMC. The extensions in Group Policy display the configurable settings for administrative templates, scripts, security, and folder redirection, in addition to software installation and Remote Installation Services (RIS).

You use Group Policy in MMC to specify group policy settings for a GPO. The group policy settings are separated under Computer Configuration and User Configuration.

You can open Group Policy in two ways:

• On the Group Policy tab in the Properties dialog box for a site, domain, or OU, select the GPO that you want to view in Group Policy, and then click Edit.
• Add the Group Policy tool and any desired extensions to an MMC console and select the GPO you want to configure.

When you open Group Policy by clicking the Edit button, the Group Policy console opens. Figure 6.5 shows a Group Policy window with the Group Policy extensions expanded. When you manually add the Group Policy tool to an MMC console, you can select which extensions to include in the console that you create.

Figure 6.5 Group Policy nodes and extensions

Group policy settings that customize the desktop environment or enforce security policies on computers on the network are contained under the Computer Configuration node in the Group Policy window. Computer configuration policies apply when the operating system initializes.

Computer configuration settings include all computer-related policies that specify operating system behavior, desktop settings, application settings, security settings, assigned applications options, and computer startup and shutdown scripts.

Group policy settings that customize the user's desktop environment or enforce lockdown policies on users on the network are contained under the User Configuration node in the Group Policy window.

User configuration settings include all user-related policies that specify operating system behavior, desktop settings, application settings, security settings, assigned and published applications options, user logon and logoff scripts, and folder redirection options. User-related policies apply when users log on to the computer.

The group policy settings in Computer Configuration and User Configuration are categorized into the following folders:

• Software Settings
• Windows Settings
• Administrative Templates

The subfolders and individual policies within each folder differ according to the item that you select. For example, Folder Redirection settings are displayed in the Windows Settings folder under User Configuration but not under Computer Configuration because folder redirection applies only to users.

The Administrative Templates extension includes all registry-based group policy information. Group policy settings that are specific to a user are written to the registry under HKEY_CURRENT_USER, and computer-specific settings are written under HKEY_LOCAL_MACHINE.

In previous versions of Windows, group policy settings remained in the registry until they were removed, either through an additional group policy setting or by directly editing the registry. Windows 2000, however, automatically removes group policy settings from the registry when the GPO that implemented the group policy no longer applies. To modify group policy settings in the Administrative Templates folder, you would do the following:

1. Open the GPO in Group Policy, expand Computer Configuration or User Configuration, and then expand the Administrative Templates folder.
2. Expand the item that represents the particular policy that you want to modify.

For example, if you wanted to modify the desktop settings for a user, you would expand User Configuration\Administrative Templates\Desktop.

3. Once you have expanded the policy you want to modify, in the details pane, double-click the policy or right-click the policy, and then click Properties.

You configure the group policy settings in the Administrative Templates folder by selecting the appropriate option:

• If the Enabled option button on the Policy tab is selected, the setting is implemented. If this option was selected the last time that the user logged on, no changes are made (see Figure 6.6).
• If the Disabled option button on the Policy tab is selected, the setting is not implemented. If the group policy settings were previously implemented, they are removed from the registry (see Figure 6.6).
• If the Not Configured option button on the Policy tab is selected, Windows 2000 ignores the group policy setting and makes no changes to the computer (see Figure 6.6).

Figure 6.6 Modifying Administrative Template settings

You can move the Properties dialog box to one side so that you can see the group policy settings that are available and then use the Next Policy button and the Previous Policy button to move through the available group policies. In addition, the Properties dialog box has an Explain tab that provides detailed information regarding the purpose and use of individual group policy settings.

In previous versions of Windows NT, scripts were limited to logon scripts. In Windows 2000, the Group Policy tool allows you to assign scripts to both users and computers. For users, you can assign scripts that execute during the logon process, in addition to scripts that execute during the logoff process. For computers, you can assign scripts that execute during the startup process, in addition to scripts that execute during the shutdown process.

Windows 2000 executes scripts according to the following rules:

• When you assign multiple logon/logoff or startup/shutdown scripts to a user or computer, the scripts are executed from top to bottom as listed in the corresponding Properties dialog box.
• When a computer shuts down, Windows 2000 first processes logoff scripts and then processes shutdown scripts.
• By default, the timeout value for processing scripts is two minutes. If a script requires more than two minutes to process, you must adjust the time-out value by modifying the wait time in the following location: Computer Configuration\Administrative Templates\System\Logon\.

The Scripts extension allows you to configure startup and shutdown scripts for a computer and logon and logoff scripts for a user. To set group policy settings for scripts, you would do the following:

1. Open the appropriate GPO in Group Policy.
2. Under either Computer Configuration (for startup and shutdown scripts) or User Configuration (for logon and logoff scripts), expand the Windows Settings folder.
3. Click Scripts.
4. Right-click the appropriate script type (startup, shutdown, logon, or logoff) in the details pane, and then click Properties.
5. In the Properties dialog box, click Add, click Browse, select the script that you copied in the previous step, and then click Open.
6. Add any necessary script parameters, and then click OK. Then close the Properties dialog box.

In this practice you will implement administrative templates.

In this exercise, you will create a GPO at the domain level. You will create a user account, ADAdmin. You will create a group, DCLogin, grant the group the right to log on to the domain controller, and add ADAdmin to the DCLogin group.

1. Log on as Administrator with a password of password.
2. Open the Active Directory Users and Computers tool.
3. If it is not already expanded, expand domain.com.
4. Right-click Administration, and then click Properties.
5. On the Group Policy tab, click New.
6. Type Administration Admin Template Policy and then press Enter.

Administration Admin Template Policy appears in the list of Group Policy Object Links.

7. Close the Administration Properties dialog box.

Leave the Active Directory Users And Computers window open.

1. Right-click Users, point to New, and then click User.

The New Object - User dialog box appears.

2. Type ADAdmin in the First Name box.
3. Type ADAdmin in the User Login Name box, and then click Next.
4. Type password in the Password and Confirm Password boxes, and then click Next.
5. Review the information, and then click Finish to create the user account.
6. Leave the Active Directory Users And Computers window open.

1. Right-click Users, point to New, and then click Group.

The New Object - Group dialog box appears.

2. Type DCLogin in the Group Name box.
3. Ensure that the default group scope, Global, is selected.

4. Ensure that the default group type, Security, is selected.

5. Click OK.

Notice that the group DCLogin is now listed in the details pane.

6. Right-click the group DCLogin, and then click Properties.
7. In the description box type Grants the Log On Locally right.
8. Click the Members tab, and click the Add button.
9. Ensure that the Look In box says domain.com.
10. Select ADAdmin from the list of names in the top Name box, and then click Add.
11. Click OK to close the Select Users, Contacts, Computers, or Groups dialog box.
12. Click OK to close the DCLogin Properties dialog box.
13. Leave the Active Directory Users And Computers window open.

1. On the View menu, click Advanced Features (or ensure that it is active).
2. Right-click Administration, and then click Properties.
3. On the Security tab, click Add.
4. Select ADAdmin from the list of names in the top Name box, and then click Add.
5. Click OK to close the Select Users, Computers, or Groups dialog box.
6. In the Administration Properties dialog box with ADAdmin selected, ensure that a check mark is in the check box in front of both the Read and Write permissions and then click Apply.
7. Click Advanced.
8. Ensure that ADAdmin is selected, and then click View/Edit.

The Permissions Entry For Administration dialog box appears.

9. In the Apply Onto box, click This Object And All Child Objects, and then click OK.
10. Click OK close the Access Control Settings For Administration dialog box.
11. Click OK to close the Administration Properties dialog box.
12. Leave Active Directory Users And Computers open.

1. Log off as Administrator.
2. Log on as ADAdmin with a password of password.

A Logon Message appears indicating that the local policy of this system does not permit you to log on interactively.

1. Log on as Administrator, and open the Active Directory Users And Computers window.
2. Right-click Domain Controllers in the console pane, click Properties, and then click the Group Policy tab.

The Domain Controllers Properties dialog box appears with the Default Domain Policy selected.

3. Click Edit.

The Group Policy window appears.

4. Expand Computer Configuration, expand Windows Settings, expand Security Settings, expand Local Policies, and then click User Rights Assignment.

The rights appear listed in the details pane.

5. In the details pane, right-click Log On Locally, and then click Security.

The Security Policy Setting dialog box for Log On Locally appears.

Notice that Define These Policy Settings is selected and that the groups and users listed have the right to Log On Locally to Domain Controllers.

6. Click Add.

The Add User Or Group dialog box appears.

7. Click Browse.

The Select Users Or Groups dialog box appears.

8. Click DCLogin in the Name box, click Add, and then click OK.

Notice that DOMAIN\DCLogin appears in the User And Group Names box.

9. Click OK.

Notice that DOMAIN\DCLogin appears in the list of users and groups that have the right to Log On Locally to the Domain Controllers.

10. Click OK to close the Security Policy Setting dialog box.
11. Close the Group Policy window.
12. Click OK to close the Domain Controllers Properties dialog box.
13. Close the Active Directory Users And Computers window.

1. Log off as Administrator.
2. Log on as ADAdmin with a password of password.

You were able to log on to the Domain Controller because you successfully assigned the Log On Locally right to the DCLogin group of which ADAdmin is a member.

1. Log on as Administrator with a password of password.
2. Open the Active Directory Users and Computers tool.
3. Right-click Production, and then click Properties.
4. On the Group Policy tab, click the Block Policy Inheritance check box, and then click OK.

This setting will block all policy from parent containers.

5. Right-click Administration, and then click Properties.
6. On the Group Policy tab, right-click Administration Admin Template Policy, and then click No Override.
7. Click OK.
8. Close the Active Directory Users And Computers window.

1. Start the Mmc.exe command from the Run dialog box.
2. On the Console menu, click Add/Remove Snap-In.
3. In the Add/Remove Snap-In dialog box, click Add, click Active Directory Users And Computers, click Add, and then click Close.
4. Click OK to close the Add/Remove Snap-In dialog box.

Active Directory Users And Computers appears in the console pane below the console root.

5. Maximize the Console1 window, expand Active Directory Users And Computers, and then expanddomain.com.
6. Right-click Administration, and then click New Window From Here.

A new window appears with Administration as the root node.

7. On the Console menu, click Options.
8. On the Console tab, change the name of the window to ADAdmin, and then in the Console Mode list, select User Mode - Limited Access, Single Window.
9. Click Do Not Save Changes To This Console, and then click OK.

Notice that the name of the console is now ADAdmin.

10. On the Console menu, click Save As, and then in the Save In list click the drive C icon. Browse to C:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools in the list.
11. Type ADAdmin in the File Name box, and then click Save.

A Microsoft Management Console dialog box appears indicating that you have chosen to display a single window interface when the console opens in user mode. The user will only be able to view the currently active window.

12. Click Yes.
13. Close the ADAdmin console.

In this exercise, you will implement Group Policy.

1. Open Active Directory Users And Computers.
2. Open the Administration Properties dialog box.
3. On the Group Policy tab, ensure that the Administration Admin Template Policy is selected, and then click Edit.
4. If necessary expand User Configuration, and then expand the Administrative Templates folder.
5. Click Start Menu & Taskbar, and then double-click Remove Run Menu From Start Menu.

The Remove Run Menu From Start Menu Properties dialog box appears.

6. On the Policy tab, click the Enabled option button.
7. Click OK.

Notice that the value in the Setting column for this policy has changed to Enabled.

8. Using the following table, enable the remainder of the required restrictions:

Node	Policy
Control Panel/Display	Disable Display In Control Panel
Desktop	Hide My Network Places Icon On Desktop
Windows Components\Windows Explorer	Remove The "Map Network Drive" And "Disconnect Network Drive" Options

9. Close the Group Policy window, and then click OK to close the Administration Properties dialog box.
10. Close the Active Directory Users and Computers tool and log off.

In this exercise, you will first log on as the User1 user to test the group policy settings implemented in Exercise 2. Then you will log on as the ADAdmin user to test the group policy settings implemented in Exercise 2.

1. Log on as User1 with a password of User1.

Were the following restrictions enforced? Why or why not?

No Run command on the Start menu.

No access to Display icon in Control Panel.

No My Network Places icon on the desktop.

No Map Network Drive or Disconnect Network Drive on the Tools menu in Windows Explorer.

2. Log off.
3. Log on as ADAdmin with a password of password.

Were the following restrictions enforced? Why or why not?

No Run command on the Start menu.

No access to Display icon in Control Panel.

No My Network Places icon on the desktop.

No Map Network Drive or Disconnect Network Drive on the Tools menu in Windows Explorer.

4. Log off.

Answers

In this exercise, you will remove the GPOs you created in the previous exercises.

1. Log on as Administrator.
2. Open the Active Directory Users and Computers tool.
3. Open the Administration Properties dialog box for the Administration OU.
4. On the Group Policy tab, ensure that the Administration Admin Template Policy is selected, and then click Delete.

The Delete dialog box appears.

5. Click Remove The Link And Delete The Group Policy Object Permanently, and then click OK.
6. When prompted to confirm the deletion, click Yes.
7. Click Close.
8. Close Active Directory Users And Computers.

In this exercise, you will log on as the User1 user to test the group policy settings removed in Exercise 4.

1. Log on as User1 with a password of User1.

Were the following restrictions enforced? Why or why not?

No Run command on the Start menu.

No access to Display icon in Control Panel.

No My Network Places icon on the desktop.

No Map Network Drive or Disconnect Network Drive on the Tools menu in Windows Explorer.

2. Log off.

Answers

You configure the group policy settings within a GPO by using the Group Policy snap-in and its extensions in MMC. The extensions in Group Policy display the configurable settings for administrative templates, scripts, security, and folder redirection, in addition to software installation and Remote Installation Services (RIS).

Group policy settings that customize the desktop environment or enforce security policies on computers on the network are contained under Computer Configuration in Group Policy. Computer configuration policies apply when the operating system initializes. Computer configuration settings include all computer-related policies that specify operating system behavior, desktop settings, application settings, security settings, assigned applications options, and computer startup and shutdown scripts.

Group policy settings that customize the user's desktop environment or enforce lockdown policies on users on the network are contained under User Configuration in Group Policy. User configuration settings include all user-related policies that specify operating system behavior, desktop settings, application settings, security settings, assigned and published applications options, user logon and logoff scripts, and folder redirection options. User-related policies apply when users log on to the computer.

The way that you implement group policy depends on the structure of your organization and network. However there are some general guidelines you should follow. Limit the use of the Block Policy Inheritance and No Override options. Also limit the use of GPOs linked across domains, and limit the number of GPOs that affect any given user or computer. Computer startup and user logon time are affected by the number of GPOs that must be processed. Make use of security groups to filter the effect of group policies because this will reduce the number of GPOs to be processed. Also disable the unused portion of a GPO. This will speed up the processing of GPOs.