Group Policy

Fundamentals, Security, and the Managed Desktop

Jeremy Moskowitz

• Publisher: Sybex
• Year: 2015
• ISBN:
  9781119035688
• Edition: 3
• Topic: Computer Science
• Subtopic: Computer Networking
• Index: Computer Science

Get up to speed on the latest Group Policy tools, features, and best practices

Group Policy, Fundamentals, Security, and the Managed Desktop, 3rd Edition help s you streamline Windows and Windows Server management using the latest Group Policy tools and techniques. This updated edition covers Windows 10 and Windows Server vNext, bringing you up to speed on all the newest settings, features, and best practices. Microsoft Group Policy MVP Jeremy Moskowitz teaches you the major categories of Group Policy, essential troubleshooting techniques, and how to manage your Windows desktops.

This is your complete guide to the latest Group Policy features and functions for all modern Windows clients and servers, helping you manage more efficiently and effectively.

• Perform true desktop and server management with the Group Policy Preferences, ADMX files, and additional add-ons
• Use every feature of the GPMC and become a top-notch administrator
• Troubleshoot Group Policy using tools, enhanced logs, Resource Kit utilities, and third-party tools
• Manage printers, drive maps, restrict hardware, and configure Internet Explorer
• Deploy software to your desktops, set up roaming profiles, and configure Offline Files for all your Windows clients—and manage it all with Group Policy settings
• Secure your desktops and servers with AppLocker, Windows Firewall with Advanced Security, and the Security Configuration Manager

This is your comprehensive resource to staying current, with expert tips, techniques, and insight.

Chapter 1
Group Policy Essentials

In this chapter, you’ll get your feet wet with the concept that is Group Policy. You’ll start to understand conceptually what Group Policy is and how it’s created, applied, and modified, and you’ll go through some practical examples to get at the basics.

The best news is that the essentials of Group Policy are the same in all versions of Windows 2000 on. So as I stated in the introduction, if you’ve got Windows XP, Windows 7, Windows 8, Windows 10—whatever—you’re golden.

Learn the basics here, and you’re set up on a great path.

That’s because Group Policy isn’t a server-driven technology. As you’ll learn in depth a little later, the magic of Group Policy happens (mostly) on the client (target) machine. And when we say “client,” we mean anything that can “receive” Group Policy directives: Windows 8, Windows XP, or even the server operating systems such as Windows Server 2016 or Windows Server 2008 R2; they’re all “clients” too.

So, if your Active Directory Domain Controllers are a mixture of Windows Server 2008, Windows Server 2012, and/or Windows Server 2016, nothing much changes. And it doesn’t matter if your domain is in Mixed, Native, or another mode—the Group Policy engine works exactly the same in all of them.

---

There are occasional odds and ends you get with upgraded domain types. When the domain mode is Windows 2003 or later schema, you’ll get something neat called WMI filters (described in Chapter 4, “Advanced Group Policy Processing”). Also note that in a Windows 2008 Functional mode domain level or later, the replication of the file-based part of a Group Policy Object (GPO) can be enhanced to use distributed file system (DFS) replication instead of system volume (SYSVOL) replication.

---

Regardless of what your server architecture is, I encourage you to work through the examples in this chapter.

So, let’s get started and talk about the essentials.

Getting Ready to Use This Book

This book is full of examples. And to help you work through them, I’m going to suggest a sample test lab for you to create. It’s pretty simple really, but in its simplicity we’ll be able to work through dozens of real-world examples to see how things work.

Here are the computers you need to set up and what I suggest you name them (if you want to work through the examples with me in the book):

1. DC01.corp.com This is your Active Directory Domain Controller. It can be any type of Domain Controller (DC). For this book, I’ll assume you’ve loaded Windows Server 2016 and later on this computer and that you’ll create a test domain called Corp.com.
2. In real life you would have multiple Domain Controllers in the domain. But here in the test lab, it’ll be okay if you just have one.
3. I’ll refer to this machine as DC01 in the book. We’ll also use DC01 as a file server and software distribution server and for a lot of other roles we really shouldn’t. That’s so you can work through lots of examples without bringing up lots of servers. Bringing up a modern DC requires the use of Server Manager. Check out the sidebar “Bringing Up a Windows Server as a Domain Controller” if you need a little guidance.
4. Win10.corp.com This is some user’s Windows 10 machine and it’s joined to the domain Corp.com. I’ll refer to this machine as WIN10 in the book. Sometimes it’ll be a Sales computer, other times a Marketing computer, and other times a Nursing computer. To use this machine as such, just move the computer account around in Active Directory when the time comes. You’ll see what I mean.
5. Win10management.corp.com This machine belongs to you—the IT pro who runs the show. You could manage Active Directory from anywhere on your network, but you’re going to do it from here. This is the machine you’ll use to run the tools you need to manage both Active Directory and Group Policy. I’ll refer to this machine as WIN10MANAGEMENT. As the name implies, you’ll run Windows 10 from this machine. Note that you aren’t “forced” or “required” to use a Windows 10 machine as your management machine—but you’ll be able to “manage it all” if you do.

You can see a suggested test lab setup in Figure 1-1.

Note that from time to time I might refer to some machine that isn’t here in the suggested test lab, just to illustrate a point. However, this is the minimum configuration you’ll need to get the most out the book.

---

To save space in the book, we’re going to assume you’re using a Windows 10 machine as your management machine. You can also use a Windows 8 or 7 management machine as well and be able to work through pretty much everything in the book, barring a few new things that got born in Windows 8.1 and are still present on a Windows 10 management machine. If you’re forced by some draconian corporate edict to use a Windows Vista or Windows XP (or earlier) machine as a management machine, you’ll have to refer to previous editions of the book to get the skinny about using them.

---

Figure 1-1: Here’s the configuration you’ll need for the test lab in this book. Note that the Domain Controller can be 2000 or above, but Windows Server 2016 is preferred to allow you to work through all the examples in this book.

For working through this book, you can build your test lab with real machines or with virtual hardware. Personally, I use VMware Workstation (a pay tool) for my testing. However, Microsoft’s Hyper-V is a perfectly decent choice as well. Indeed, Hyper-V is now available built into Windows 8 and later. So, you could bring up a whole test lab to learn Windows 10—on your Windows 10 box! What a mindblower! Here’s an (older) overview of Windows 8’s Hyper-V if you care to use it: http://tinyurl.com/3r99nr9. Note there are also other alternatives, such as Parallels Desktop and VMware Fusion ...

Table of contents

• Cover
• Titlepage
• Copyright
• Credits
• Dedication
• Acknowledgments
• About the Author
• About The Contributors
• Introduction
• Chapter 1: Group Policy Essentials
• Chapter 2: Managing Group Policy with the GPMC and via PowerShell
• Chapter 3: Group Policy Processing Behavior Essentials
• Chapter 4: Advanced Group Policy Processing
• Chapter 5: Group Policy Preferences
• Chapter 6: Managing Applications and Settings Using Group Policy
• Chapter 7: Troubleshooting Group Policy
• Chapter 8: Implementing Security with Group Policy
• Chapter 9: Profiles: Local, Roaming, and Mandatory
• Chapter 10: The Managed Desktop, Part 1: Redirected Folders, Offline Files, and the Synchronization Manager
• Chapter 11: The Managed Desktop, Part 2:Software Deployment via Group Policy
• Chapter 12: Finishing Touches with Group Policy: Scripts, Internet Explorer, Hardware Control, Printer Deployment, Local Admin Password Control
• Appendix A: Scripting Group Policy Operations with Windows PowerShell
• Appendix B: Group Policy and VDI
• Appendix C: Advanced Group Policy Management
• Appendix D: Security Compliance Manager
• Appendix E: Microsoft Intune and PolicyPak Cloud
• End-User License Agreement