Local Group Policy objects (part 2) : Managing the Local GPOs & GPOs in Active Directory

Managing the Local GPOs

As stated earlier, only users who have membership in the local Administrators group can manage the local GPOs. This includes user from the local SAM or from Active Directory. In either case, if User Account Control (UAC) is enabled, the security dialog box from UAC will appear, forcing users with administrative privileges to agree to the privileges that opening the MMC snap-in requires.

Another new feature is the option to disable local GPOs. Through Active Directory–based GPOs, local GPOs can be disabled, and thus excluded from the evaluation of overall Resultant Set of Policy (RSoP). The policy that you would set is “Turn off Local Group Policy objects processing.” This policy setting is located under Computer Configuration\Administrative Templates\System\Group Policy, as shown in Figure 4.

Figure 4. Local GPOs can be disabled by using the “Turn off Local Group Policy objects processing” setting in an Active Directory–based GPO.

GPOs in Active Directory

Although GPOs that are created in Active Directory can total into the hundreds or even thousands, they all follow the same regimen. To go a step beyond that, all GPOs in Active Directory are created, managed, and controlled through a central console. It is this centralization that gives Group Policy such power and control over the entire network of computers.

All GPOs that are stored in Active Directory have the same structure. You must use the GPMC to access one of these GPOs. Within the GPMC, you can expand the console to see the list of GPOs that are in Active Directory. To access this list, follow these steps:

You should see a list of GPOs, as shown in Figure 5.

Figure 5. All of the GPOs that are stored in Active Directory can be seen by expanding the Group Policy node in the GPMC.

From this list, you can edit any of the GPOs to see the policy settings that are already set, or you can configure more settings. To edit a GPO, right-click it, and then click Edit. This launches the Group Policy Management Editor with your selected GPO active in the interface, as shown in Figure 6.

Figure 6. All Active Directory–based GPOs are edited with the Group Policy Management Editor.

All of the GPOs that are stored in Active Directory are available in this list through the GPMC. Note, however, that if you have multiple Active Directory domains, you will need to ensure that you are viewing the correct domain in the GPMC to see your GPO. GPOs are stored in only one domain. There is no mechanism to synchronize the settings between two GPOs in different domains.

For example, suppose that you wanted all domain controllers in all domains to have the same set of user rights. These settings would be established in the Default Domain Controllers Policy in each domain. If you made a configuration to the User Rights in DomainA, the Default Domain Controllers Policy in DomainB would not be updated. You would need to manually make this change in the DomainB GPO if you wanted the domain controllers in that domain to be updated.

After the creation and configuration of GPOs in Active Directory, one step remains before the GPO can perform any actions on computers or users on the network: you must link the GPO to an Active Directory node. Without this final linking step, the GPO is stored in Active Directory and on domain controllers, but it does not perform any action.

GPOs in Active Directory can be linked to the following nodes:

• Domain (for example, to the fabrikam.com node)

• Organizational Units

• Sites

It should be obvious that if a GPO is linked to the domain it will affect all computer and user accounts located in the domain by default. This is important to remember, because linking GPOs to the domain node or site nodes can potentially affect too many objects.

The design and implementation of your organizational units is critical to a successful GPO deployment for two reasons: because the majority of GPOs in Active Directory will be linked to Organizational Units, and because there is only one organizational unit in a default installation of Active Directory.

More Info