Welcome to IT Free Training. In this video I will look at the new features available
for Group Policy in Windows Server 2008 and Windows Server 2008 R2.
The features that I will look at in this video are Comments for Group Policy, Starter Group
Policy Objects, Network Location Awareness, Preferences, PowerShell and the new ADMX format.
Although Windows Server 2008 R2 does offers improvements and additional Group Policy settings
as does every new operating system, the only new feature it adds to Group Policy is the
ability for Group Policy to be used with PowerShell scripts.
The first new feature is comments. This feature allows you to add a comment to any Group Policy
setting that is configured. Adding comments to Group Policy helps other administrators
later on understand why the Group Policy setting was configured the way it was. Being able
to add comments to Group Policy setting like this will assist the administrator in the
management of Group Policy. The next new feature is Starter Group Policy
Objects. Starter Group Policy Objects are essentially a template that is used to create
a new Group Policy. Like a Microsoft Word template, or any other template, once you
copy the Starter Group Policy Object to a new Group Policy you are free to change it
anyway that you want. This is useful if you are creating a lot of
Group Polices with simpler settings. It is hard to know what Microsoft was thinking when
they named it Starter Group Policy but I would say that since anther part of Group Policy
is called “Administrative Templates” they may have not wanted to use the term templates again.
The next new feature is Group Policy now works with the Network Location Awareness service.
This means that Group Policy can now detect network changes. To understand how this works
consider an isolated computer that connects to the main office using a VPN connection.
In this example, the remote user connects up to head office only to check their e-mail.
This means the VPN connect is only in use for short periods of time. Given that the
default refresh time for Group Policy is 90 minutes, this means that this user may never
have Group Policy refreshed on their computer. With Windows Server 2008 Group Policy now
integrates with the Network Location Awareness service. This means that when the changes
in network state are detected, Group Policy is notified of this change. In this example,
when the VPN connection is establish, Group Policy will be informed and will download
any new Group Polices from the network. The Network Location Awareness service detects
any network changes, this include the computer coming out of hibernation, a network cable
being plugged in or a wireless network becoming available. This helps ensure that your Group
Policy settings are sent out to all clients and as soon as possible.
The next new feature of Group Policy introduced in Windows Server 2008 is preferences. This
was originally a 3rd party product called PolicyMaker. PolicyMaker was purchased by
Microsoft and added to Windows Server 2008. Preferences help reduce the need for login
scripts. It does this by allowing you to configure drive mapping, registry settings, Services,
files and folders and local users and groups. With preferences you can also target who you
want the preference to be applied to. For example, you could target particular types
of computers or users for particular preferences. The next new feature is PowerShell support
for Group Policy. In order to run PowerShell scripts that can administrator Group Policy,
the PowerShell scripts need to be run on a computer running Windows Server 2008 R2 or
Windows 7. PowerShell support includes the ability to
manage Group Policy objects in Active Directory. Configuring flags in Group Policy. This includes
settings like the block inheritance and enforce which we will learn more about later in the
course. Support is also included for creating and
modifying starter Group Policy Objects using a PowerShell script. Having PowerShell support
means another dimension of Group Policy administration for Group Policy.
The last feature and one of the most noticeable changes in Group Policy in Windows Server
2008 is the file format has changed. Before Windows Sever 2008 Group Policy were stored
in an ADM file. The ADM file holds all the settings found under Administrative Templates.
Sometimes the Administrative Templates are also referred to as registry based settings
since they make changes to the registry. Since Group Policy has a file based component
there needs to be a way to replicate Group Policy around the domain. For this reason,
the ADM file is stored in the SysVol share. The SysVol share is a file share that is found
on all Domain Controllers and is replicated to all Domain Controllers in that domain.
The ADM file contains all the settings that can be configured in Group Policy under Administrative
Templates as well as the interface which presents the first problem. What this means is for
every Group Policy that is defined, the ADM file must be copied into the SysVol folder.
It does not matter if you configure one setting or a hundred of settings, the complete ADM
file is copied in the SysVol each time. Because of this, ADM based Group Policy does
not scale well. In a large company that has a lot of Group Policies, the SysVol folder
can become quite large. The next problem with having Group Policy in the one file is that
a small change will mean that complete ADM file will need to be replicated again. Windows
Server 2008 does offer improvements for replication of the SysVol share, but in most cases the
Administrator will want to try and keep the size of the SysVol share as small as possible
and thus limit the amount of data that needs to be replicated.
The last limitation of ADM files is that they are Language Specific. Once you create the
Group Policy in a certain language, anyone who edits that Group Policy will have to modify
the Group Policy using that language. This makes it difficult when you have multiple
administrators in different countries trying to make changes to the same Group Policy settings.
In order to address some of these problems, Windows Server 2008 introduced a new Group
Policy format called ADMX. The first difference with the new file format
is that it is XML based rather than the in-house format that ADM used. This makes it is easier
to understand and also means that it can also be read with existing XML editing software.
This is useful if you want to create your only custom ADMX files.
The format is designed to work alongside the existing ADM format used before Windows Server
2008, but as you will see in a moment, it is also compatible with existing clients.
The next big advantage of the ADMX file format is that it supports multiple languages. This
means that Group Policy can be displayed in any language that there are language files
available for. To understand how ADMX works, let’s have a closer look at it.
The ADMX file itself is a language neutral file. The language neutral file defines how
the Group Policy settings are configured, but it is not created with any particular
language in mind.
To make the AMDX file more useful, it is used together with a language file which has the
file extension ADML. These are combined together to provide the settings and interface. Since
the ADML file is independent of the ADMX file, it can be changed at any time to allow the
administrator to choose the language they want to edit the group Policy in. Both of
these files can be stored on the local computer or in a central store, this brings up the
question what is stored in the SysVol folder?
In the SysVol folder is stored the Group Policy settings. Notice how only the settings themselves
are stored in the SysVol folder which are very small compared to the files that define
the settings and interface.
You may be wondering how the old ADM files fit into all this. The ADM file are stored
in the SysVol folder however the output from the ADM file is the same setting file that
is generated using the ADMX and ADML files. This is why ADM and ADMX files can be used
in the same domain without any issue. Both systems essentially output the same output
setting file that can be read by any Group Policy client. A lot of Administrators may
already be using the new ADMX file format and not even know it.
To compare the two formats, ADMX uses less space in the SysVol folder as the files defining
the settings, language and interface do not need to be stored in the SysVol folder. The
only information that needs to be stored in the SysVol folder is the setting file.
ADMX files also support multiple languages. ADM files only support one language at a time.
ADMX allows different administrators to use different ADML files which means that each
administrator can edit the Group Policy in the language of their choice.
ADMX files are in XML format rather than the in house format used by ADM. This makes them
easier to understand and also makes it easier to create custom ADMX files if required.
Since both file formats output the same setting file, this means that both ADM and ADMX files
will work with you existing Group Policy clients. For example, you could create a Group Policy
using ADMX which will work on Windows XP. The choice of file format does not affect
which clients it will work on. Thanks for watching this free video on the
new features of Group Policy. There are many great features that have been added to Group
Policy making it more versatile than ever before. This in only one of the free videos
for Group Policy all part of the free Active Directory course. Hope to see you in the next
video.