Module 6: Managing user settings with Group Policy Lab: Managing user settings with Group Policy (VMs: 20742B-LON-DC1, 20742B-LON-CL1) Exercise 1: Using administrative templates to manage user settings Task 1: Import administrative templates for Microsoft Office 2016 1. On LON-DC1, on the taskbar, click the File Explorer icon. 2. In File Explorer, in the navigation pane, expand Allfiles (E:), expand Labfiles, and then click Mod06. 3. Double-click admintemplates_x64_4390-1000_en-us.exe. 4. In The Microsoft Office 2016 Administrative Templates dialog box, select the Click here to accept the Microsoft Software License Terms check box, and then click Continue. 5. In the Browse for Folder dialog box, click Desktop, and then click OK. 6. In The Microsoft Office 2016 Administrative Templates dialog box, click OK. 7. In File Explorer, in the navigation pane, click Desktop, and then in the content pane, double-click admx. 8. Press Ctrl+A to select all files, right-click, and then click Copy. 9. In the navigation pane, expand Local Disk (C:), expand Windows, right-click PolicyDefinitions, and then click Paste. 10. Close File Explorer. Task 2: Configure Office 2016 settings 1. On LON-DC1, in Server Manager, click Tools, and then click Group Policy Management. 2. Switch to the Group Policy Management window. 3. In the navigation pane, expand Forest: Adatum.com, expand Domains, expand Adatum.com, and then click Group Policy Objects. 4. Right-click Group Policy Objects, and then click New. 5. In the New GPO dialog box, type Office 2016 settings and then click OK. 6. In the contents pane, right-click Office 2016 settings, and then click Edit. 7. In the Group Policy Management Editor, in the navigation pane, expand User Configuration, expand Policies, expand Administrative Templates, and then click Microsoft Excel 2016. 8. Expand Microsoft Excel 2016, expand Excel Options, click Customize Ribbon, and then double-click Display Developer tab in the Ribbon. 9. In the Display Developer tab in the Ribbon dialog box, click Enabled, and then click OK. 10. In the Group Policy Management Editor, click Save, and then double-click Default file location. 11. In the Default file location dialog box, click Enabled, in the Default file location text box, type %UserProfile%\Desktop and then click OK. 12. Close the Group Policy Management Editor. 13. In Group Policy Management, right-click the Adatum.com domain, and then click Link an Existing GPO. 14. In the Select GPO dialog box, click Office 2016 settings, and then click OK. Task 3: Apply and verify settings on the client computer 1. Switch to LON-CL1. 2. Right-click Start, and then click Command Prompt. 3. In the Command Prompt window, type the following command, and then press Enter: Gpupdate /force 4. Close the Command Prompt window. 5. Click Start, and then click Excel 2016. 6. In the Microsoft Office Activation Wizard dialog box, click Close. 7. In the First things first dialog box, select the Ask me later option, and then click Accept. 8. Click Blank workbook. 9. Verify that the Developer tab displays on the ribbon. 10. If the Developer tab is not displayed on the ribbon, perform the following steps: a. Right-click Start, hover over Shutdown or Sign out, and then click Restart. b. After the computer has restarted, sign in as Adatum\Administrator with the password Pa55w.rd c. Perform steps 5-9 again. 11. Click File, click Save, and then click Browse. 12. In the Save as dialog box, in the address bar, verify that Desktop displays, and then click Cancel. 13. Close Excel 2016. Results: After this exercise, you should have extended administrative templates with templates for Office 2016 and configured some Office settings by using Group Policy. Exercise 2: Implementing settings by using Group Policy preferences Task 1: Set up the current environment 1. Switch to LON-DC1. 2. On LON-DC1, on the taskbar, click the File Explorer icon. 3. In the navigation pane, expand Allfiles (E:), expand Labfiles, and then click Mod06. 4. In the details pane, right-click Mod06-1.ps1, and then click Run with PowerShell. 5. If prompted, type Y, and then press Enter. 6. Right-click BranchScript.cmd, and then click Copy. 7. Switch to the Group Policy Management window. 8. In the navigation pane, right-click Group Policy Objects, and then click Refresh. 9. Right-click the Branch1 Group Policy Object (GPO), and then click Edit. 10. In the Group Policy Management Editor window, under User Configuration, expand Policies, expand Windows Settings, and then click Scripts (Logon/Logoff). 11. In the details pane, double-click Logon. 12. In the Logon Properties dialog box, click Show Files. 13. In the details pane, right-click a blank area, and then click Paste. 14. Close the Logon window. 15. In the Logon Properties dialog box, click Add. 16. In the Add a Script dialog box, click Browse. 17. Click BranchScript.cmd, and then click Open. 18. Click OK twice to close all dialog boxes. 19. Close the Group Policy Management Editor window. Task 2: Test mapped drive for Branch Office 1 users 1. Switch to LON-CL1. 2. Right-click Start, hover over Shut down or sign out, and then click Restart. 3. When the computer has restarted, sign in as Adatum\Abbi with the password Pa55w.rd 4. On the taskbar, click the File Explorer icon. 5. In File Explorer, click This PC. 6. Verify that in the details pane, in the Network Locations section, drive S displays. 7. If drive S is not available, perform these steps: a. Right-click Start, and click Command Prompt. b. In the Command Prompt window, type the following two commands, and press Enter after each command: Gpupdate /force Shutdown /r /t 0 c. Perform steps 3-6 again. Task 3: Create a Preferences GPO with the required Group Policy preferences 1. Switch to LON-DC1. 2. On LON-DC1, switch to Server Manager, click Tools and then click Active Directory Users and Computers. 3. In the Active Directory Users and Computers window, right-click IT, hover over New, and then click Group. 4. In the New Object – Group dialog box, in the Group name text box, type Computer Administrators, and then click OK. 5. Switch to the Group Policy Management Console, right-click the Adatum.com domain, and then click Refresh. 6. Expand Branch Office 1, right-click the Branch1 GPO, and then click Delete. 7. In the Group Policy Management dialog box, click OK. 8. Right-click the Adatum.com domain, and then click Create a GPO in this domain, and Link it here. 9. In the New GPO dialog box, in the Name text box, type Preferences and then click OK. 10. In the navigation pane, right-click Preferences, and then click Edit. 11. Expand User Configuration, expand Preferences, expand Windows Settings, right-click Shortcuts, hover over New, and then click Shortcut. 12. In the New Shortcut Properties dialog box, in the Action list, click Create. 13. In the Name text box, type Notepad 14. In the Location box, click the arrow, and then select All Users Desktop. 15. In the Target path box, type C:\Windows\System32\Notepad.exe 16. On the Common tab, clear the Run in logged-on user’s security context (user policy option) check box. 17. Select the Item-level targeting check box, and then click Targeting. 18. In the Targeting Editor dialog box, click New Item, and then click Security Group. 19. In the lower part of the dialog box, click the ellipsis button (…). 20. In the Select Group dialog box, in the Enter the object name to select (examples) box, type IT and then click OK. 21. Click OK two more times. 22. Right-click Drive Maps, hover over New, and then click Mapped Drive. 23. In the New Drive Properties dialog box, in the Location text box, type: \\LON-DC1\Branch1 and then select the Reconnect check box. In the Label as text box, type Drive for Branch Office 1 in the Use drop-down list box, select S. 24. On the Common tab, select the Run in logged-on user’s security context (user policy option) check box. 25. Select the Item-level targeting check box, and then click Targeting. 26. In the Targeting Editor dialog box, click New Item, and then click Organizational Unit. 27. In the lower part of the dialog box, click the ellipsis button (…). 28. In the Find Custom Search dialog box, in the Search results list, select Branch Office 1, and then click OK. 29. Click OK two more times. 30. Expand Computer Configuration, expand Preferences, and then expand Control Panel Settings. 31. Right-click Local Users and Groups, hover over New, and then click Local Group. 32. In the New Local Group Properties dialog box, in the Group name text box, type Administrators, and then click Add. 33. In the Local Group Member dialog box, click the ellipsis button (…). 34. In the Select User, Computer or Group dialog box, in the Enter the object name to select (examples) text box, type Computer Administrators and then click OK twice. 35. In the New Local Group Properties dialog box, click the Common tab. 36. On the Common tab, select the Item-level targeting check box, and then click Targeting. 37. In the Targeting Editor dialog box, click New Item, and then click Operating System. 38. In the Product drop-down list box, select Windows Server 2016 Family, and then click OK twice. 39. Close all open windows except Group Policy Management and Server Manager. Task 4: Test the preferences 1. Switch to LON-CL1.