This video will look at the Group Policy settings enforced and blocked.
By the end of the video you will be able to not only understand how
to enforce and block Group Policy, but also have a better understanding of how to effectively
deploy Group Policy in a hierarchy that matches the needs of your business.
To review what we have covered in the previous videos, a computer will obtain an ordered
list of Group Policy and apply it to the computer in that order.
First of all Group Policy is retrieved from the local computer.
This will be the first Group Policy to be processed.
The rest of the Group Policies are retrieved from the
domain.
These are sorted so that they are in the order of Site, Domain, OU’s followed
by child OU’s.
In some cases you may have multiple Group Policies linked at the same level in Active
Directory.
In this example there are two Group Policies linked at the domain level.
If I open Group Policy Management and make sure the domain is selected, notice that there
are two Group Polices linked at the domain level.
On the right hand side, notice there is a link order for each of the Group Polices.
The Link Order determines the order in which the Group Policies will be applied when there
is more than one.
The Group Policy with a high link number will take preference over
the other Group Policy.
For this reason, they are processed in the reverse order.
To understand why, if I go back to the diagram, notice what happens if I add the link numbers
to the Group Policy diagram.
The Domain Group Policy with Link Order 2 will be applied first.
After this, the Domain Group Policy with the Link Order 1 is applied next.
This means the Group Policy with the Link Order 1 will overwrite
any settings applied from the Group Policy with Link Order 2.
It may seem a bit confusing which order Group Policy is applied first, but if you think
of higher priority Group Policy needs to overwrite lower priority it makes sense that Group Policy
with a lower priority must be processed first.
This is why local Group Policy is applied first.
Local Group Policy has the lowest priority and thus any other Group Policies that have
been applied have the capacity to overwrite any settings that are configured in the local
Group Policy.
In most situations, this works well, but let us consider a situation where this can cause
problems.
If you had a testing computer or a kiosk computer you may want the computer
configured a certain way.
Let us consider a Group Policy which configures the wallpaper
and the Windows Firewall.
The result will be that the wallpaper and Windows Firewall
will be configured on the client computer.
Now consider that a second Group Policy is created which changes the wallpaper.
Notice how the firewall settings have been kept.
To make sure firewall settings do not get applied from the previous Group Policy you
would need to configure the firewall settings in the second Group Policy.
These settings would replace the original settings.
This works well when you first configure Group Policy, but let’s say later on additional
Group Policy settings were configured, in this case a wireless setting.
If you had a computer configured as a kiosk for example,
you may not want new group policy settings appearing on the computer.
To get around this problem, Group Policy allows an option to be configured called Block Inheritance.
This setting is configured at the OU level.
As shown here, there are four OU’s that will be processed in order.
If blocked Inheritance was to be applied on the second OU, notice
that now the Group Policy before this is no longer applied.
Blocking Inheritance will allow you to have a clean slate, so to speak.
Configuring Block Inheritance allows you to configure the Group
Policy setting for an OU without having to worry about any settings that are applied
above it.
Notice also that the OU under the blocked OU, the third OU, is able to inherit the settings
from the above OU.
Blocking inheritance will prevent any settings configured previously
from being applied, but will not prevent any settings after this from being applied.
In some cases an administrator may have settings that they want all computers to have.
They do not want an administrator to have the option
to block settings that they have configured.
To allow this, Group Policy has the option to enforce settings.
The enforce setting option can be configured per Group Policy, unlike
block inheritance which is configured per OU.
To understand how Enforced works, consider a typical list of Group Policy settings that
are waiting to be applied.
These are in the order of Local, Site, Domain and OU’s.
At the domain level there are two Group Policies.
The second Group Policy will be applied first so the first Group Policy overrides any settings
it configures.
Now like before, let’s say an administrator on one of the OU’s, configures the OU to
Block Inheritance.
As before, the previous OU’s will not be applied.
If you plan to enforce a Group Policy, it is best to create a Group Policy that contains
settings that you only want to enforce.
Settings that you are not too worried about being overwritten
should be put into a different Group Policy.
Notice that when the domain Group Policy is set to enforce it is moved to the end of the
processing order.
Since this Group Policy is being applied last now, this means that
it will override any other settings configured before this.
You may be wondering what would happen if an OU was configured to Enforce.
Would this OU now override the settings configured by
the Enforced Group Policy at the domain level?
The answer is no.
Notice that if an OU is configured with enforce , once again this
Group Policy will be moved to the end but will be processed before the Enforced Domain
Group Policy.
This ensures that an enforce OU does not override a group Policy Enforce
at the domain.
Notice also, that if the Group Policy were enforced at the site level, the site Group
Policy would also be moved to the end but would be the last Group Policy to be applied.
In other words, any enforced Group Polices are applied in the order OU’s, Domain and
Site.
This is the reverse order that they would be applied in if they were not enforced.
This ensures that the when Group Policy Settings are enforced the Group Policy setting are
still applied in the correct hierarchical order.
Now that you understand how the Group Policy order is determined, let us now have a look
at how this works with the user and computer side of group Policy.
As shown here, when the computer starts up the Group Policy is obtained from the local
computer and domain and then sorted so that it can be processed.
All the settings found in the computer side of the Group Policies
are applied when the computer starts up.
These are in the order shown.
When a user logs in, the user side of Group Policy is applied in the same order that the
computer side was applied in.
This allows the user side of Group Policy to override
what was applied in the Computer side of Group Policy.
There are not that many Group Policy settings that overlap between the User and
Computer side, so any occurrence of Computer Side settings overwriting User Side settings
should be rare.
I will now change to my Windows Server 2008 R2 Domain Controller to have a look at how
to configure the Block Inheritance and enforce options in Group Policy.
If you have watched our previous videos on Group Policy, you will remember we created
a Group Policy at the Domain Level that configured the desktop wallpaper for all users in the
domain.
You can see that the wallpaper on this Domain Controller is currently being
set from this Group Policy, settings configured for the user do not effecting servers like
Domain Controllers.
To fix this problem, I will use block Inheritance.
To configure it, open Group Policy Management from administrative tools under the start
menu.
At the top, you can see the Domain Wide Group Policy.
This Group Policy was originally created to configure settings for users and
computers, so should not be apply to Domain Controllers.
To prevent this from happening, it is a simple matter of selecting the Domain Controller
OU, right clicking it, and then selecting the option Block Inheritance.
Notice that when I select this option the icon for the
OU changes to an exclamation mark to indicate that Block Inheritance has been enabled.
Blocking Inheritance will prevent the Domain Wide Group Policies from affecting the computer
accounts in the Domain Controllers OU, however this this is only half of the work required.
Remember that Group Policy is divided into a User part
and a Computer part.
So far, only the Computer part of Group Policy has been fixed.
To fix the User part, I will open Active Directory Users and Computers.
The user that is being used to perform administration on the server
needs to be separated from the other users so that the Group Policy settings do not get
applied to them.
To do this, I will create an Organization Unit and call it, IT Support
staff.
The user that I will use to perform administration on the server is the Administrator account.
This account is currently located in the Users OU.
It is a simple matter of dragging the Administrator user from the Users OU and dropping
it into the IT Support Staff OU.
I will get a message telling me that moving objects in
Active Directory will affect the system in particular
Group Policy.
Since this is what I want, I can choose yes and move on.
Now that I have moved the administrator into their own OU, I can close Active Directory
Users and Computers and go back to Group Policy Management.
Since I have just created the OU it will not appear.
In order to have it appear in Group Policy Management I need to
press F5.
Once the OU appears, I can right click it and select Block Inheritance.
This will prevent the domain Group Policy setting affecting
the Administrator account.
To show that it has worked, I will now log off and quickly
log back in.
Once logged back in, Group Policy for the user will be reapplied.
You will notice that once applied, the desktop Wallpaper has gone
back to the default blue.
The writing that was visible at the top was applied from the
Domain Wide Group Policy which is now being blocked and thus having no effect.
Unfortunately, blocking Inheritance like this is not a solution to everything.
I will open Group Policy Management again to show you
why.
If I expand down to New York, Computers and the Test OU, a computer can be placed in here
for testing and Group Policy settings once again may wanted to be blocked.
Just like the other OU’s, I can right click and select
Block Inheritance.
This will prevent the Domain Wide Group Policies from being applied.
In this case, there may be some settings that are in the Domain Wide
Group Policy that you want applied to everyone.
You do not want an administrator in charge of an OU down the domain tree deciding to
block your setting.
To get around this, you can right click on the Group Policy that you want settings to
always be applied and select the option enforced.
If you use the Enforce option it is recommend that you create two Group Polices.
One Group Policy contains the settings that need to
be enforced and the other Group Policy contains the options that do not need to be enforced.
This way, you are not enforcing Group Policy settings that you do not mind being overwritten.
Once again I will log off and log back on to see what the results are.
Once I have logged back in and group policy for this user has been applied, notice that
the desktop wallpaper has once again changed back to the wallpaper that was configured
in the Domain Wide Group Policy so the desired result has not been achieved.
I will once again open Group Policy Management to see if there is a better way of doing this.
You can start to see that even having a few OU’s with Block Inheritance and Group Policy
with the Enforce option on can start to make Group Policy management in your domain a lot
more complex.
You can understand why Microsoft recommends that Block Inheritance and Enforce
only be used when absolutely needed.
To go back to simple Group Policy administration, I will go through and clear the Enforce and
Block Inheritance options.
Now that these options have been cleared, let’s think about what we want to achieve.
We essentially want Group Policy setting to be applied to all Users and Computers in the
Domain, but not to the Servers or IT staff.
To achieve this, I will right click on the London OU and select the option Link an Existing
GPO and then select the Group Policy Object Domain Wide Group Policy.
I will also do this with the New York OU so that is also using
the Domain Wide Group Policy Object.
As you can see, the Group Policy is being applied to both OU’s so there is no need
to have the Domain Wide Group Policy being applied at the domain level.
For this reason, I will delete it.
Notice that by doing this I have had the same effect as blocking Inheritance
had before.
I have ensured that the settings are now being applied to Users and Computers
in the Domain, but no longer being applied to IT users or the Domain Controllers.
If I look under Group Policy Objects, notice the Group Policy is still referred to as a
Domain Wide Group Policy.
This is a little misleading so I will rename this Group Policy
Object to Default Company Policy.
This name is a little bit more descriptive of what the
Group Policy does now.
Notice on the right hand side, you can see which OU’s this Group Policy has been applied
to, in this case London and New York.
If you have a lot of OU’s it is worth looking here
to see if all the OU’s in your domain have Group Policy being applied to them.
You could also click on the OU to see which Group Policy are being applied to them.
Now that I have made some changes, I will once
again log off and log back on to see the results of this changes.
Notice that when I log back in, the Desktop Wallpaper has once again gone
back to the default Wallpaper, giving an indication that no Group Policy setting has been applied.
All this was achieved without using the Block Inheritance or Enforce options.
You can start to see that in a lot of cases the Block Inheritance
and Enforce options can be avoided with careful planning.
Thanks for watching anther video from IT Free Training.
For more free videos for this course and others, please feel free to subscribe