Group Policy: Fundamentals, Security, and the Managed Desktop, 2nd Edition

Jeremy Moskowitz, Group Policy MVP, is the founder of GPanswers.com and PolicyPak Software. He is a nationally recognized authority on Windows Server, Active Directory, Group Policy, and other Windows management topics. Jeremy is one of fewer than a dozen Microsoft MVPs in Group Policy. He runs the GPanswers.com, ranked by ComputerWorld as a "Top 20 Resource for Microsoft IT Professionals." Jeremy is a sought-after speaker at many industry conferences and, in his training workshops, helps thousands of administrators every year do more with Group Policy. Contact Jeremy by visiting GPanswers.com.

Introduction xxv

Chapter 1 Group Policy Essentials 1

Getting Ready to Use This Book 2

Getting Started with Group Policy 7

Group Policy Entities and Policy Settings 7

The Categories of Group Policy 9

Active Directory and Local Group Policy 13

Understanding Local Group Policy 14

Group Policy and Active Directory 17

Linking Group Policy Objects 20

Final Thoughts on Local GPOs 25

An Example of Group Policy Application 26

Examining the Resultant Set of Policy 27

At the Site Level 28

At the Domain Level 29

At the OU Level 29

Bringing It All Together 29

Group Policy, Active Directory, and the GPMC 31

Implementing the GPMC on Your Management Station 32

Creating a One-Stop-Shop MMC 36

Group Policy 101 and Active Directory 38

Active Directory Users and Computers vs. GPMC 38

Adjusting the View within the GPMC 39

The GPMC-centric View 41

Our Own Group Policy Examples 43

More about Linking and the Group Policy Objects Container 44

Applying a Group Policy Object to the Site Level 47

Applying Group Policy Objects to the Domain Level 50

Applying Group Policy Objects to the OU Level 52

Testing Your Delegation of Group Policy Management 58

Understanding Group Policy Object Linking Delegation 59

Granting OU Admins Access to Create New Group Policy Objects 61

Creating and Linking Group Policy Objects at the OU Level 61

Creating a New Group Policy Object Affecting Computers in an OU 66

Moving Computers into the Human Resources Computers OU 67

Verifying Your Cumulative Changes 69

Final Thoughts 71

Chapter 2 Managing Group Policy with the GPMC 73

Common Procedures with the GPMC 74

Raising or Lowering the Precedence of Multiple Group Policy Objects 78

Understanding GPMC’s Link Warning 79

Stopping Group Policy Objects from Applying 80

Block Inheritance 87

The Enforced Function 88

Security Filtering and Delegation with the GPMC 90

Filtering the Scope of Group Policy Objects with Security 91

User Permissions on Group Policy Objects 100

Granting Group Policy Object Creation Rights in the Domain 102

Special Group Policy Operation Delegations 103

Who Can Create and Use WMI Filters? 104

Performing RSoP Calculations with the GPMC 106

What’s-Going-On Calculations with Group Policy Results 107

What-If Calculations with Group Policy Modeling 113

Searching and Commenting Group Policy Objects and Policy Settings 116

Searching for GPO Characteristics 116

Filtering Inside a GPO for Policy Settings 118

Comments for GPOs and Policy Settings 129

Starter GPOs 135

Creating a Starter GPO 136

Editing a Starter GPO 136

Leveraging a Starter GPO 137

Delegating Control of Starter GPOs 139

Wrapping Up and Sending Starter GP...