Group Policy is a feature of Microsoft Windows NT family of operating systems that provides centralized management and configuration of computers and remote users in an Active Directory environment. Windows XP has been released in several editions since its original release in 2001 Microsoft Windows is a series of Software Operating systems and Graphical user interfaces produced by Microsoft. Active Directory ( AD) is a technology created by Microsoft that provides a variety of network services including LDAP -like Directory It is part of Microsoft's IntelliMirror technologies which aim to reduce the overall cost of supporting users of Windows. These technologies relate to management of disconnected machines or roaming users and include Roaming user profiles, Folder redirection and Offline Files. A roaming user profile is a concept in the Microsoft Windows NT family of Operating systems that allows a user with a Computer joined to a In Computing, and specifically in the context of Microsoft Windows Operating systems Microsoft refers to Folder Redirection when automatically Windows Vista, Microsoft 's current Windows Operating system as of 2008 includes a number of new I/O functions
Although Group Policy is usually used in enterprise environments, its usage is also common in schools, businesses, and other small organizations to restrict certain actions that may pose potential security risks: for instance, blocking the Windows Task Manager, restricting access to certain folders, disabling downloaded executable files and so on. Windows Task Manager is a Task manager application included with Microsoft Windows NT family of Operating systems that provides detailed information about
Contents |
Overview
Group Policy can control a target object's registry, NTFS security, audit and security policy, software installation, logon/logoff scripts, folder redirection, and Internet Explorer settings. The Windows registry is a directory which stores settings and options for the Operating system for Microsoft Windows 32-bit versions 64-bit versions and NTFS (New Technology File System Is the standard File system of Windows NT, including its later versions Windows 2000, Windows XP, Windows A computer security audit is a manual or systematic measurable technical assessment of a system or application Installation (or setup) of a program (including drivers is the act and the effect of putting the program in a computer system so that it can be In Computing, and specifically in the context of Microsoft Windows Operating systems Microsoft refers to Folder Redirection when automatically Windows Internet Explorer (formerly Microsoft Internet Explorer abbreviated MSIE) commonly abbreviated to IE, is a series of graphical The policy settings are stored in Group Policy Objects (GPOs). A GPO is internally referenced by a Globally Unique Identifier (GUID). A Globally Unique Identifier or GUID (ˈguːɪd or /ˈgwɪd/ is a special type of identifier used in Software applications in order to provide a reference number Each one may be linked to multiple websites, domains or organizational units. This allows for multiple machines or users to be updated via a change to a single GPO in turn reducing the administrative burden and costs associated with managing these resources.
Group Policies use Administrative Templates (ADM/ADMX) files to describe where registry-based policy settings are stored in the registry. Administrative Templates are a feature of Group Policy, a Microsoft technology for centralised management of machines and users in an Active Directory environment Administrative Templates essentially describe the user interface that administrators see in the Group Policy Object Editor snap-in. On a single workstation, administrative templates are stored in the %WinDir%\Inf folder, while on a domain controller, they are stored for each domain GPO in a single folder called the Group Policy Template (GPT) in the Sysvol folder. On Windows Server Systems a domain controller (DC is a server that responds to security authentication requests (logging in checking permissions etc ADMX is the new XML-based file format introduced in Windows Vista which contain configuration settings for individual GPOs. Windows Vista (ˈvɪstə is a line of Operating systems developed by Microsoft for use on Personal computers including home and business desktops
User and computer objects may only exist once in the Active Directory but often fall into the scope of several GPOs. Active Directory ( AD) is a technology created by Microsoft that provides a variety of network services including LDAP -like Directory The user or computer object applies each applicable GPO. Conflicts between GPOs are resolved at a per attribute level.
Group Policies are analyzed and applied at startup for computers and during logon for users. The client machine refreshes most of the Group Policy settings periodically, the period ranging from 60-120 minutes and controlled by a configurable parameter of the Group Policy settings.
Group Policy is supported on Windows 2000, Windows XP Professional, Windows Vista, Windows Server 2003 and Windows Server 2008. Windows 2000 (also referred to as Win2K) is a preemptive, interruptible graphical and business-oriented Operating system designed to work with Windows XP is a family of 32-bit and 64-bit Operating systems produced by Microsoft for use on Personal computers including home and Windows Vista (ˈvɪstə is a line of Operating systems developed by Microsoft for use on Personal computers including home and business desktops Windows Server 2003 (also referred to as Win2K3 is a server Operating system produced by Microsoft. Windows Server 2008 is the most recent release of Microsoft Windows ' server line of Operating systems Released to manufacturing on 4 February Windows XP Media Center Edition and Windows XP Professional computers not joined to a domain can also use the Group Policy Object Editor to change the group policy for the individual computer. Windows XP has been released in several editions since its original release in 2001 Windows XP is a family of 32-bit and 64-bit Operating systems produced by Microsoft for use on Personal computers including home and This local group policy however is much more limited than GPOs for Active Directory.
In June 2006 Centrify Corporation announced Group Policy support for Mac OS X using their DirectControl software. Mac OS X (mæk oʊ ɛs tɛn is a line of computer Operating systems developed marketed and sold by Apple Inc, the latest of which is pre-loaded on all currently
The three phases of using Group Policy
Group Policy can be considered in three distinct phases - GPO creation, targeting of the GPO and application of the GPO.
Creating and editing GPOs
GPOs are created and edited through two tools - the Group Policy Object Editor (Gpedit. msc) and the freely downloadable Group Policy Management Console (GPMC). GPEdit is used to create and edit single Group Policy Objects one at a time. Prior to GPMC, administrators wanting to document or inventory previously deployed GPOs would have to use Active Directory Users and Computers (ADUC) to interrogate each organizational unit individually, a very time-consuming and error-prone task. The GPMC simplified GPO management by providing tools to manage large numbers of group policies collectively. GPMC provides a number of features including GPO settings summarization, a simplified security pane for group filtering, GPO backup/restoration/cloning and more within a GUI that mimics ADUC. Editing a GPO from within GPMC still launches GPEdit. The friendly name of a GPO can also be determined from its GUID by using GPOTool. exe. This tool outputs all GPO GUIDs and their corresponding friendly name.
Targeting GPOs
After a GPO has been created it can be linked to an Active Directory site, domain or OU (Organizational Unit). Active Directory ( AD) is a technology created by Microsoft that provides a variety of network services including LDAP -like Directory In Computing, an Organizational Unit (OU provides a way of classifying objects located in directories, or names in a Digital certificate Hierarchy It is most common for GPOs to be linked to Organizational Units.
GPO application
The Group Policy client operates on a "pull" model - every so often (a randomized delay of between 60 and 120 minutes, although this offset is configurable via Group Policy) it will collect the list of GPOs appropriate to the machine and logged on user (if any). The Group Policy client will then apply those GPOs which will thereafter affect the behavior of policy-enabled operating system components and applications.
Local group policy
Local group policy (LGP) is a more basic version of the group policy used by Active Directory. In versions of Windows before Windows Vista, LGP can configure the group policy for a single local computer, but unlike Active Directory group policy, can not make policies for individual users or groups. It also has many fewer options overall than Active Directory group policy. The specific-user limitation can be overcome by using the Registry Editor to make changes under the HKCU or HKU keys. The Windows registry is a directory which stores settings and options for the Operating system for Microsoft Windows 32-bit versions 64-bit versions and LGP simply makes registry changes under the HKLM key, thus affecting all users; the same changes can be made under HKCU or HKU to only affect certain users. Microsoft has more information on using the Registry Editor to configure group policy available on TechNet. Microsoft Technet is a Microsoft program and resource for technical information news and events for IT professionals [1]. LGP can be used on a computer on a domain, and can it be used on Windows XP Home Edition.
Windows Vista supports Multiple Local Group Policy Objects which allows setting local group policy for individual users.
Security
A problem with the per-user policies is that they're only enforced voluntarily by the targeted applications. A malevolent user can interfere with the application so that it cannot successfully read its Group Policy settings (thus enforcing potentially lower security defaults) or even return arbitrary values. The user can also create a copy of the application at a writable location, and modify it such that it ignores the settings. One should rather see it that the Group Policy helps the user provide some safe defaults to help him enforce security for himself.
See also
External links
- Microsoft Group Policy page
- The Group Policy Management Console (GPMC)
- Step-by-Step Guide to Managing Multiple Local Group Policy Objects
- Group Policy Settings (in Excel format) and registry key equivalents, from Microsoft
Dapyx Software network: MP3 Explorer | Ebook Manager | Zenithic