Welcome back to IT Free Training. In this video we will look at Group Policy and how
to go about configuring settings to suit your organization. With Group Policy having over
three thousand settings, it is important to understand how to find the settings that are
right for you. After watching this video you will be able to configure Group Policy more
effectively allowing you to meet the needs of your business. Without further ado, let’s
look at Windows Server 2008 R2 to look at how to configure Group Policy.
First of all, I will open Group Policy Management from Administrative Tools under the start
menu. At the top of Group Policy Management, notice the Group Policy Default Domain Policy.
This Group Policy is created when the domain is first created.
This Group Policy is required to define the security settings for the domain. It defines
password settings in the domain, such as how long and complex a password must be when setup
for a user. The next Group Policy that is created by default
with the domain can be found under Domain Controllers. Notice that when I select the
Group Policy Default Domain Controllers Policy I get a warning message.
This message informs the administrator that this is a link to another Group Policy. This
essentially works the same way as a hyperlink or shortcut would link to an electronic document.
Just like a document can have many shortcuts that link to the same document, Group Policy
can have many links that refer to the same Group Policy object.
To illustrate this point a bit better, I will close this message and select the Group Policy
called Test that I created earlier. If I right click the Group Policy test and select delete,
notice that once I confirm I want to delete the Group Policy test it will appear be have
been deleted. However, just like a shortcut on your hard disk, the original Group Policy
object is still present in Active Directory. Notice that when I expand Group Policy objects,
you can see the two default Group Policies created when the domain was created and also
the test Group Policy that I created.
You can tell if the Group Policy is the object or a link by looking closely at the icon.
Notice the linked Group Policy has a blue arrow at the bottom left hand corner, not
unlike a shortcut on a desktop. The benefit of this method is that you can create a Group
Policy and link it to multiple OU’s. For example, you could create a Group Policy with
the typical office Group Policy settings and link it to the London and New York OU’s.
This saves you having to create two Group Policies, one for each site.
If I now right click on the Group Policy Object test and select the option Delete, this time
the Group Policy Object Test will be removed from Active Directory. If the Group Policy
Object is not linked to any OU’s it will not have any effect on the domain. For this
reason, if you are not one hundred percent sure that the Group Policy is required, there
is no harm in leaving it in here for a while before deleting it.
I will now create a new Group Policy at the top of the domain. To do this, right click
the domain or the OU you want to create the Group Policy in and select the option “Create
a GPO in this domain, and link it here…” This terminology may sound a little complex,
but what it is essentially saying is that a new GPO or Group Policy object will be created
under Group Policy Objects and that a link to that new Group Policy Object will also
be created. In the name of the Group Policy, I will enter
in Domain Wide Group Policy, as this Group Policy will have an effect on the entire domain.
Notice that a Group Policy Object called Domain Wide Group Policy will be created under Group
Policy Objects. At the top, a link to Domain Wide Group Policy will all also be created.
Now that the Group Policy has been created, it can be edited by right clicking Edit the
Link or the object and selecting Edit. The Group Policy Management Editor will now
open and Display the Settings for this Group Policy. In this case, I will configure settings
in the user configuration section. The Group Policy Management Editor will
now open and display the settings for this Group Policy. In this case I will
configure settings in the user configuration section.
Since this Group Policy is located at the top of the
domain, the settings that I configure in here will affect all users in the domain.
In the last video I talked about the new ADMX files that were introduced in Windows Server
2008. Notice that when I cursor over Administrative Templates it states that “Policy Definitions
(ADMX files) were retrieved from the local machine”. Later in the course I will show
you how to centralize these ADMX files. You will notice that the bulk of these settings
are found under Administrative Templates. The layout of the settings is quite logical;
however it can still be difficult to find the setting you want, simply because there
are so many. If you select the option at the bottom All
Settings, notice that all the Group Policy settings found under Administrative Templates
are shown. If I scroll through them you can see there are quite a few, 1460 to be exact.
To make it easier to find a particular setting, I can right click any of the folders and select
the option Filter On. Once the filter is on, select the option Filter Options, to configure
what Group Policy Settings you want to show. Notice at the top you have a number of options,
the first one is managed. If a Group Policy setting is managed, this means that if it
is later removed, any changes made by that Group Policy setting will be reversed. If
the Group Policy Settings are unmanaged this will mean that once the Group Policy settings
are removed, the change will not be and must be removed manually.
When Group Policy was first developed, all the settings were unmanaged. As Group Policy
was further developed, settings that were added to Group Policy were managed rather
than unmanaged. In this domain I can only find one setting that is unmanaged. If you
are working with older Group Policy you may still find some that are unmanaged, but these
should be rare. The next two options let you filter based
on if the Group Policy setting has been configured and if comments have been added to the Group
Policy Setting. I will leave these options configured to any so no Group Policy settings
will be filtered out based on these criteria. The next option allows a keyword to be entered
in. In this case I want to configure the wallpaper for all users, so I will enter in the keyword
Desktop Wallpaper. Once I press OK, the Group Policy settings
will be filtered out to those that contain Desktop Wallpaper. Notice that there are still
a lot of Group Policy settings to choose from. If I go back into Filter Options, I will untick
the options for Help Text and Comment. This option will search the Help Text that is associated
with the Group Policy as well as any comments. If you want to further filter the results,
select the option at the bottom ‘Enable Requirements Filters.’ This allows you to
reduce the results based on the Group Policy being configured for certain requirements,
for example requiring a particular version of Internet Explorer.
Once I exit filter options, the list is now a lot smaller. The Group Policy Setting that
I am looking for is called Desktop Wallpaper. Before configuring any Group Policy Settings,
you should read the Help Text on the left. In particular, notice at the top is listed
which Operating System this Group Policy Setting will work with. Also it is worth the time
to read the rest of the text to see what the Group Policy setting does. Some Group Policy
settings rely on other Group Policy Settings to work and others may not work when other
Group Policy settings are configured. To edit the Group Policy setting, double click
it. In this case I will enable the Group Policy setting and below this enter in the filename
for the wallpaper. Notice that I can use a path to a server, the file does not need to
be on the local computer. For the wallpaper style, I will change this
to stretch so that if the wallpaper does not match the resolution the user is using, the
wallpaper will adjusted to fit the resolution that they are using.
Once the Group Policy setting has been configured, I can close the Group Policy Management Editor.
Notice that I am not prompted to save the Group Policy Setting, it is saved for you
automatically. To show that the Group Policy setting has
worked, I will log into a computer running Windows 7. When the user logs in, the User Group
Policy Settings that will affect that user will be configured. Notice the wallpaper for
the user has changed. I have added the text,’ Configured from
Domain Wide Group Policy User Configuration’ to the wallpaper. This has been done to show
which Group Policy Setting is changing the wallpaper. This will be useful to know later
on in the course when I start using multiple Group Polices in the same domain.
This has been a short look at how to start creating and using Group Policy, created as
part of the free Active Directory course. Thanks for watching and see you in the next
video.