8 Group Policies

3930 P-08 3/12/03 10:26 AM Page 293 Chapter 8 Group Policies Windows Server 2003 offers extensive control over system configuration and user environments through a feature called Group Policy. Group Policy settings may be applied to domain, site, and organizational unit (OU) Active Directory containers, giving the administrator more granular control over system configurations and user settings. The OS adds refinements to the group policies functions but does not substantially change the administrative interface or their basic nature in Windows 2000. More than 160 new policy settings are now available in Windows Server 2003. Among the affected functionality are settings for Control Panel, error reporting, Terminal Server, Remote Assistance, networking and dial-up connec- tions, Domain Name System (DNS), network logon, Group Policy, and roaming profiles. This chapter is divided into three main sections. The first reviews the concept of group policies; the second provides a number of implementation examples; and the third explores the underlying concepts of Microsoft’s IntelliMirror. Upon com- pleting this chapter, you should have the following: • A working knowledge of group policies • The ability to establish and modify group policy properties. • The ability to apply group policies to user accounts • An understanding of IntelliMirror technology and the ability to employ it UNDERSTANDING GROUP POLICIES Since group policies are designed to apply to a great number of users, they have the potential to reduce system administration support. Once a Group Policy setting 293 3930 P-08 3/12/03 10:26 AM Page 294 294 CHAPTER 8 GROUP POLICIES is established on a user account, it is automatically applied to the desired administrative unit. This facility is especially helpful when applying security policies, but it is also widely used to establish consistency in user environments. For example, through the use of group policies, an administrator can control the options available on users’ desktops and the delivery of applications. Group Policy also implements the bulk of the Microsoft IntelliMirror technology. This strategy capitalizes on the centralized management of client/server systems while maintaining the flexibility and convenience of the distributed computing model. For example, users can log on from anywhere in the network and preserve user profiles, application data, security requirements, application access, and backup offline files. Microsoft’s IntelliMirror, as discussed in this chapter, provides more examples and details for this technology. Group policies can be extended by third-party application vendors as well to manage desktop settings for their applications. NOTE A user planning to modify group policies must have administrative privileges for the Active Directory and associated containers. Group Policy Management and Active Directory Group Policy management is accomplished by assigning Group Policy Objects (GPOs) to specific machines, sites, domains, and OUs from the Active Directory. Applying Group Policy involves determining which users and computers require policy settings so that selected Active Directory containers can group users and computers accordingly. GPOs are then applied to the desired Active Directory containers and are inherited by child containers. Windows Server 2003 follows the LSDOU model in which inheritance flows in this order: local computer (L) → site (S) → domain (D) → organizational unit (OU). The LSDOU inheritance model may seem unnatural at first (Figure 8.1). Local computer GPOs are the first applied to any user who logs on to that par- ticular system. They can be overridden by the GPOs assigned to the user’s site, which are overridden by domain GPOs, which are overridden by relevant OU GPOs. This order gives the local administrator the first chance to set the computer’s policies. When GPO policies are enforced, any child GPO settings applied to a system are disabled. The local computer GPOs may not enforce policies. They are the first to be set, but may be nullified by further policy inheritance. 3930 P-08 3/12/03 10:26 AM Page 295 Understanding Group Policies 295 Local Computer Local Computer Policy The order of policy inheritance flows from the Site Policy GPO local computer, Site through the site, domain, and OU. Default Domain Policy GPO EntCert2.com Domain Public Docs Engineering Policies GPO Engineer Marketing Market Policies GPO OU Policies GPO OU Sustain Develop Comp Channel OU OU Marketing Marketing OU OU FIGURE 8.1 The Order of Policy Inheritance NOTE The exception to the LSDOU model comes into play when using Windows NT 4.0 policies that are set with the Policy System Editor. These are applied before the local GPOs. In other words, if the NTConfig.pol file exists, it will be used first to apply policies. These policies may be overwritten by GPOs applied to the domain, site, and OU containers. The LSDOU model provides a reference point for determining the users and computers a GPO affects. A GPO can be applied to any of three container types: site, domain, and OU. In Figure 8.1, the Default Domain Policy GPO has been assigned to the Entcert2.com domain, so the users and computers in that domain as 3930 P-08 3/12/03 10:26 AM Page 296 296 CHAPTER 8 GROUP POLICIES well as all OUs within it will receive these policy settings. The same GPO may also be applied to more than one Active Directory container. In the figure, the Public Docs Policies GPO is applied to both the Engineering OU and the Marketing OU. This is referred to as linking. GROUP POLICY OBJECT STORAGE Before introducing the Group Policy feature set, it is important to understand, on the local and domain levels, Group Policy storage. Local computer policies are stored on the local system in the %SystemRoot%System32\GroupPolicy directory. They are not replicated to other systems, nor do they cover the complete range of policies accessible to enterprise-wide GPOs applied to Active Directory containers. Active Directory GPO storage is a little more complicated. These policies are stored in the Group Policy container (GPC) and the Group Policy template (GPT). The GPC includes version, status, and extensions for the GPO. As discussed earlier, it may be a site, domain, or OU Active Directory object, and is synchronized with other domain controllers on its own update schedule. Small amounts of information that are modified infrequently are stored in the GPC, which is assigned a globally unique identifier (GUID), such as {31B2F340-016D-11D2-945F-00C04FB984F9}, which corresponds to a GPT. Data stored in the GPC is used to determine whether the GPO is enabled and to ensure that the correct GPT version is applied to user and computer accounts in the container. The GPT is stored on domain controllers in the %SystemRoot%\SYSVOL\sysvol\ domainname\Policies\GUID folder for domain-wide replication and access. Stan- dard folders in this directory are Adm, USER, and MACHINE. All user and computer policy settings for the GPO are stored in the GPT and synchronized on a different schedule from that of its sister GPC information. The GPT contains the raw policy settings, including security settings and software installation information. It can be thought of as the folder structure you can see when modifying a Group Policy object from an MMC snap-in, such as is shown later in Figure 8.6. REFINING GROUP POLICY INHERITANCE In addition to inheritance order, several other rules control which users and computers are assigned group policies. These rules allow the administrator to refine policy application: • Policy inheritance • Blocking policy inheritance • Enforcing policy inheritance • Using security groups to filter group policies 3930 P-08 3/12/03 10:26 AM Page 297 Understanding Group Policies 297 Policy Inheritance The LSDOU model discussed earlier generally describes how Group Policy inheritance is implemented in Windows Server 2003. A clear example may shed light on how it works. In Figure 8.1 the Engineering Policies GPO applied to the Engineer- ing OU is also inherited by the Sustaining and Development OUs. This shows that whereas child Active Directory containers inherit group policies, Group Policy inheritance does not flow upward to parent containers. Let’s dissect the example in Figure 8.2 to illustrate this flow in greater detail. Poli- cies inherited by the Marketing OU from its parents are applied to members of the Channel Marketing OU. Users and computers in the Channel Marketing OU also apply the Marketing Policies GPO and Public Docs GPO to their systems upon boot- up and logon. The Distribution Centers GPO is applied last and may override group Inherit policies from a higher-level domain, site, or local computer GPO. Marketing OU Market Policies GPO Not Enforced Public Docs GPO Not Enforced All policies are inherited and applied to child OUs. Channel Market OU No Blocking Distribution Centers GPO FIGURE 8.2 An Example of Policy Inheritance 3930 P-08 3/12/03 10:26 AM Page 298 298 CHAPTER 8 GROUP POLICIES policies previously applied to the Channel Marketing OU. Thus, the lowest-level Ac- tive Directory container has the last opportunity to override inherited policies. NOTE As levels are added to the Active Directory hierarchy, more GPOs are applied to a user account when a user logs on to the network. A vertical domain container structure generally results in additional policies applied to the user, so it will take slightly longer to log on. Also, more GPOs make it more complex to determine which policies apply to a user. A very horizontal Active Directory structure may elim- inate some of this complexity and logon delay, illustrated in Figure 8.3. Blocking Policy Inheritance and Enforcement The inheritance hierarchy can be modified by use of the Override or Enforce func- tion, which blocks inherited features associated with parent GPOs.

Load more