MDM & GP Tips Blog

Feb 2011
09

Group Policy the GPMC–It’s part of the operating system

One thing that seems to be confusing for the newer GP-practitioner is what GPMC version should I use?

The answer: Always the latest one.

That one, right now, is the GPMC for Windows 7 or Windows Server 2008 R2.

Those are equal in their capabilities.

You can install the Windows Server 2008 R2 as a feature of the operating system using the Server Manager utility as seen here.

image

You can install the Windows 7 GPMC by installing a downloadable piece called RSAT Remote Server Administration Toolkit.

That RSAT utility is found here, and note.. there are 32-bit and 64-bit versions.

Once installed (and it takes a while) you can install the GPMC in the Turn Windows features on or off as seen here.

Then, run GPMC.MSC, and you'll be off and running using the GPMC console !

image

By using the latest GPMC, on either Windows 7 or Server 2008 R2, you'll always have access to the latest abilities. Like GP Preferences, or creating AppLocker policies.

So, if you're using the old XP GPMC, get on board with the latest, greatest GPMC. You'll be happy you did !

Jul 2009
30

Policy vs Preference

Team: I had this email exchange with a friend of mine the other day.

The email title was: "Policy vs. Preference (I don't get it.)"

I thought you'd like it. Read all the way thru to the end for how to get more information TOMORROW, Friday at 12.00 PM EST.

[Note, we're having some login issues to the GPanswers.com web accounts. Sorry if you're affected right now; we're working to fix it... Thanks.]

--

Jeremy...

OK I'm having serious brain 'problem.' What, really, is the difference between an unmanaged policy setting and a preference (GPPreferences-style)?

I CAN remember, at this late hour, that managed policy settings are in the Policies key of the registry. Seems to me that unmanaged policy settings (which equate to settings that can tattoo, right?) are elsewhere, yeah? So what makes them different than changes made by Preferences?

I am just trying to hone my use of terminology and make my boss understand "Policy" vs "Preference" vs "PolicyPak". THANKS!!!!

Okay Frank.. So.. I'm sure there's some "complete and proper definition" somewhere at Microsoft about what a Policy is vs. a Preference.

But when I talk with people about "Policy" Vs. "Preference" here's the litmus-test I use to determine "which is which."

I define policy as "three things"... that is, these three things need to be TRUE for you to be able to call it a "True Policy." A policy means that the setting:

1. Properly goes to the "Policies" keys in the registry (one of only FOUR sanctioned locations)

and

2. UI lockout occurs such that users cannot scoot around it

and

3. UI lockout / setting reverts when GPO falls "out of scope" (ie: You whack the GPO.)

So, "Prohibit Access to the Control Panel" is a true POLICY. It meets these three criteria.

If you crack open the ADM/X, you'll see that the registry punch goes to the Policies keys... and once set, users cannot scoot around it.

A Preference is EVERYTHING ELSE.

So.. some criteria to check if it's a Preference would be:

1. Does it store its keys anywhere in the registry? (ie: OUTSIDE the 4 proper Policies keys?)

and

2. Does it still permit a user to manipulate the UI? (ie: No UI lockout?)

So, 99% of hand-created ADM or ADMX templates and a large percentage of GP Prefs items are just that.. Preferences. (Note that many GP Preferences items have a scope which are NOT the registry. For instance, "Local users and groups" deals with the local SAM and NOT the registry. Others, deal with services. But for the purposes of this discussions, I think you're asking about REGISTRY items, and many of the GP Preferences items are, indeed, registry focused.)

So, let's examine the GP Preferences "Internet Explorer Settings." They're Preferences.

Why? Because... once a user gets the settings...

Test #1: The keys aren't contained in the "Policies" keys
Test #2: Users can scoot around and change the values to whatever they want
Test #3: If you whack the GPO with a preference, what happens? It "tattoos" or "leaves behind" the settings you set.

Do note, if you whack the GPO with a GP Preference, on some items there is an extra flag which is called "Remove when no longer applies" which will DELETE THE VALUE (not REVERT the value). Which, could be harmful to your application. Ouch.

So, where does PolicyPak fit in?

In contrast.. POLICYPAK will "bridge the gap" when it comes to Registry punches and settings Applications' settings.

The free PolicyPak Community edition is able to:

1. Write keys anywhere in the registry

while

2. Performing UI lockout

and magically

3. Reverting to the value you want when no longer applies (not totally deleting the value!)

PS: There's a guide which I wrote to help clear up a lot of these questions. Let me know what you think:
https://www.policypak.com/solutions/why-group-policy-admins-need-policypak.html

 

 

Dec 2008
02

DNS is LIFE

Why isn't Group Policy Working on this client?
Did You Check the DNS Configuration of the Client?
---------------------------------------------------

One of the most frequently encountered problems with Windows 2000 and above is that things just 'stop working' when DNS gets out of whack. Specifically, if you're not seeing Group Policy apply to your client machines, make sure their DNS client is pointing to a Domain Controller or other authoritative source for the domain. If it's pointing to the wrong place or not pointing anywhere, Group Policy will simply not be downloaded.

As a colleague of mine likes to say, 'Healthy DNS equals a healthy Active Directory.'

Moreover, in the age of Windows 2003/2008 with its multiple forests with cross-forest trusts, Group Policy could be applying from just about anywhere and everywhere. It's more important than ever to verify that all DNS server pointers are designed properly and working as they should. For instance, if clients cannot access their 'home' Domain Controllers while leveraging a cross-forest trust, they won't get Group Policy.

Finally, to put a fine point on it, DNS leverages only the fully qualified name. It's not enough to verify that you can resolve a computer named xppro1 as opposed to xppro1.corp.com. The first is actually the NetBIOS name and not the fully qualified domain name. The second is the fully qualified domain name. If you find yourself in a DNS resolution situation where resolving the NetBIOS name will work, but the fully qualified name will not work, then you have a DNS problem that needs to be addressed.



Apr 2008
02

Congrats on new GP book for Derek

Derek Melber has a new GP book by Microsoft Press. I'm holding my copy in my hand, and it's a great book for anyone looking to get more rounded on Group Policy. It's a short read, about 500 pages, and has some good information on 3rd party tools and solutions. (Which I'm a big fan of.) Derek's book also cracks open ADMX files (if you're into that kind of thing) as well as details sample output of many of the Group Policy GPMC scripts (available online at Microsoft.com.) So check it out. It's part of the larger Microsoft Server 2008 Resource kit. You can learn more about his book here. Congrats Derek !



Apr 2008
01

ADMX files for Office 2007

It's only 11 months after RTM, so these files are right on time! :-) Just kidding, I'm sure it was a lot of work. These ADMX files for Office 2007 localize the GP settings into 8 languages, so that's pretty impressive. Just pop 'em in your central store, and get a beer. Don't know what ADMX files are? Then read the last two newsletters. Don't know what a central store is? Then read my free Chapter 5 in the "Book Resources" section here on this site. That's what we do here at GPanswers.com -- giving you the building blocks to get smarter in Group Policy. Since 2003 ! Check out the ADM and ADMX files here (one download.)



Apr 2008
01

GP Health Model

I get questions all the time like "Why isn't GP working?" Well, that's not often the easiest question to answer because there's a lot of moving parts to GP. With that in mind, Microsoft has some new documentation called the "GP Health Model" / GP Infrastructure. It's really an "Anatomy of GP" so you can say "Doctor, when I move my arm it hurts!" and see that it's really your shoulder and not your arm. Anyway, check out the doc. Very interesting stuff.



Apr 2008
01

Help out the GP Team!

Want to help out the GP team at Microsoft directly?

The Microsoft Group Policy team would like to hear from you! Please take a few minutes and complete the survey on how you use Group Policy to help Microsoft enhance the manageability Group Policy provides to your organization. The survey can be found here and is completely anonymous. The survey will remain open through Friday, September 28, 2007. Thank you in advance for your time and input!