programming4us
programming4us
DESKTOP

Windows Server 2012 : Planning, implementing, and managing Group Policy (part 1) - Understanding policies vs. preferences

- How To Install Windows Server 2012 On VirtualBox
- How To Bypass Torrent Connection Blocking By Your ISP
- How To Install Actual Facebook App On Kindle Fire

1. Planning for Group Policy

Planning for an implementation of Group Policy in an enterprise environment involves a number of different tasks and considerations, including the following:

  • Understanding policies vs. preferences

  • Designing an OU structure that supports Group Policy

  • Configuring a central store for policy definition files

  • Creating and using Starter GPOs

  • Understanding how to remotely refresh Group Policy


Understanding policies vs. preferences

Before you implement Group Policy in your Active Directory environment, you need to understand the difference between policies and preferences. Group Policy allows administrators to deploy two types of settings:

  • Managed settings These are configuration settings that the organization considers mandatory and that must be strictly enforced. Managed settings are pushed out to targeted user accounts or computers, and they are periodically refreshed to ensure they remain enforced.

    An example of a managed setting might be a corporate-branded desktop background that the company requires to be enforced on all employees’ computers.

    A standard user (a user without administrative rights) cannot modify a managed setting. And although users who are local administrators on their computers might be able to temporarily change a managed setting, the setting will be reapplied either the next time the user logs on, the next time the computer restarts, or during a periodic background refresh of Group Policy.

  • Unmanaged settings These are configuration settings that the organization does not consider mandatory but might consider recommended or advisable. Unmanaged settings are pushed out to targeted user accounts or computers, but unlike managed settings, which are always enforced, unmanaged settings can be modified by users if they want to do so.

    An example of an unmanaged setting is a mapped drive. Because this setting is unmanaged, a user (even a standard user) can delete the mapped drive. The mapped drive might or might not reappear when the user next logs on, depending upon how the administrator has configured the unmanaged setting.

In Group Policy, managed settings are called policies and unmanaged settings are called preferences. Figure 1 shows that a Group Policy Object (GPO) has several types of policies and preferences, some of them per-machine and the others per-user.

A Group Policy Object has both managed and unmanaged settings (policies and preferences).
Figure 1. A Group Policy Object has both managed and unmanaged settings (policies and preferences).

Some of the other differences between policies and preferences include the following:

  • A policy disables its associated user interface item on the user’s computer; a preference does not.

  • A policy is removed when the GPO goes out of scope—that is, when the user or computer is no longer targeted by the GPO. A preference, however, remains configured for the targeted user or computer even when the GPO goes out of scope. Another way of saying this is that preferences tattoo the registry on the client computer, while policies do not tattoo the registry on the client computer.

  • When a policy is applied, the original registry settings on the client computer are not changed. Instead, the policy is stored in a special policy-aware section of the registry on the client. If the policy is later removed, the client’s original registry settings are restored. Another way of saying this is that a policy supersedes the corresponding configuration setting in the user interface on the client. With preferences, however, the original registry settings on the client are overwritten and removing the preference does not restore the original setting. In other words, a preference actually modifies the corresponding configuration setting in the user interface on the client. Because of this difference, policies can be effective only for features of Windows operating systems and applications that are Group Policy–aware, while preferences can be effective for any features of Windows operating systems and applications as long as the appropriate preference extension is loaded.

  • Policies can be configured in both domain and local GPOs; preferences can be configured only in domain GPOs.

  • A preference can be applied only once if desired; policies are always periodically refreshed.

Windows 8 and Windows Server 2012 include over 350 new policies administrators can use to manage the new features of these platforms. Some of the new types of policies for these new platforms include policies for managing the following:

  • BitLocker Volume Encryption

  • BranchCache (for example, to configure peer-to-peer caching)

  • Credential provider (for example,to configure Picture Password sign-in)

  • Desktop personalization (for example,to configure Lock screen and Start screen background)

  • Device driver setup and compatibility settings

  • DNSClient settings (for example, to configure smart protocol reordering and response preferences)

  • External boot options for Windows-to-Go

  • File History settings

  • Hotspot authentication

  • Internet Explorer 10 customization (includes over 150 new settings)

  • Kerberos armoring

  • Managing enterprise installation of Windows 8 apps

  • Folder Redirection (for example, to configure redirection only on a user’s primary computer)

  • Remote DesktopServices(for example, to configure RDP 8.0 and RemoteFX)

  • Windows Explorer user-interface settings

  • Printing (for example, to configure the new v4 simplified print-provider architecture)

  • Start-screen customization (for example, to configure whether to show Run As Different User on the Start screen)

  • Sync Your Settings (for example, to sync to SkyDrive)

  • TCPIP (for example, to configure Internet Protocol version 6 (IPv6) stateless autoconfiguration)

  • The Trusted Platform Module (TPM)(for example, to configurea backup of TPM to Active Directory)

  • User interfacecustomization (for example, to turn off switching between recent apps)

  • User profile roaming (for example, to allowroaming only on a user’s primary computer)

  • VSS Provider Shadow Copies (for the File Server role service)

  • Windows PowerShell execution policy

  • Windows Store (to turn it on or off)

  • Wireless WAN (for example, to configure cost policies for 3G/4G networks)


Other  
  •  Windows 8 : Monitoring, optimizing, and troubleshooting system health and performance (part 5) - Monitoring system resources by using Performance Monitor
  •  Windows 8 : Monitoring, optimizing, and troubleshooting system health and performance (part 4) - Configuring and analyzing event logs
  •  Windows 8 : Monitoring, optimizing, and troubleshooting system health and performance (part 3) - Using Windows Action Center
  •  Windows 8 : Monitoring, optimizing, and troubleshooting system health and performance (part 2) - App history, Startup, Services
  •  Windows 8 : Monitoring, optimizing, and troubleshooting system health and performance (part 1) - Processes, Performance
  •  Windows Server 2008 and Windows Vista : Common GPO Troubleshooting Tools (part 3) - GPResult, GPOTool
  •  Windows Server 2008 and Windows Vista : Common GPO Troubleshooting Tools (part 2) - GPMC
  •  Windows Server 2008 and Windows Vista : Common GPO Troubleshooting Tools (part 1) - GPLogView
  •  Windows Server 2008 and Windows Vista : Using Event Logging for Troubleshooting (part 4) - Summary of Group Policy Event IDs
  •  Windows Server 2008 and Windows Vista : Using Event Logging for Troubleshooting (part 3) - Divide the Custom View of the Log into Three Phases
  •  
    Top 10
    - Microsoft Visio 2013 : Adding Structure to Your Diagrams - Finding containers and lists in Visio (part 2) - Wireframes,Legends
    - Microsoft Visio 2013 : Adding Structure to Your Diagrams - Finding containers and lists in Visio (part 1) - Swimlanes
    - Microsoft Visio 2013 : Adding Structure to Your Diagrams - Formatting and sizing lists
    - Microsoft Visio 2013 : Adding Structure to Your Diagrams - Adding shapes to lists
    - Microsoft Visio 2013 : Adding Structure to Your Diagrams - Sizing containers
    - Microsoft Access 2010 : Control Properties and Why to Use Them (part 3) - The Other Properties of a Control
    - Microsoft Access 2010 : Control Properties and Why to Use Them (part 2) - The Data Properties of a Control
    - Microsoft Access 2010 : Control Properties and Why to Use Them (part 1) - The Format Properties of a Control
    - Microsoft Access 2010 : Form Properties and Why Should You Use Them - Working with the Properties Window
    - Microsoft Visio 2013 : Using the Organization Chart Wizard with new data
    REVIEW
    - First look: Apple Watch

    - 3 Tips for Maintaining Your Cell Phone Battery (part 1)

    - 3 Tips for Maintaining Your Cell Phone Battery (part 2)
    programming4us programming4us
    programming4us
     
     
    programming4us