The Top 10 Group Policy Myths Debunked

Transcription

1 Whitepaper The Top 10 Group Policy Myths Debunked Filling the Gaps in GP Management & Preventing User Security Breaches

2 Introduction On the surface, Group Policy is an extremely useful technology, facilitating a basic level of control over what Windows users can and cannot do on their computers from password setup to access of files or folders within a network. When it comes to enforcement and control of Windows environments, it's hard to imagine life without Group Policy. However, out of the box, there is a critical area where Group Policy is lacking: management and control of user settings for third-party applications. This gap in Group Policy management is a major barrier to achieving a truly secure environment in compliance with IT security and corporate policies. The truth is, without permanent control over users' application settings, there is no true operating system lockdown. Administrators are essentially left "out of the loop" once third-party applications -- even with preconfigured settings -- are deployed to end users. When users take control of third-party applications, there is nothing built into Group Policy to stop them from modifying or working around the desired settings approved and preconfigured by the administrator. This paper exposes the top ten false assumptions system administrators make about Group Policy management that pose risks to corporate security. Learn how to close the gaps in Group Policy that undermine corporate security by reading The Top 10 Group Policy Myths Debunked: Filling the Gaps in GP Management & Preventing User Security Breaches.

3 GP Myth #1 Preconfigured application settings can be locked down within gold images and application MSIs Truth: It really can't be done easily in a flexible, usable manner, and your settings aren't actually "locked down." One problem with preconfiguring settings into applications is that everyone in the organization gets those settings. There is no way to assign different settings to different users, and often, that is a requirement or desire. One option is to implement multiple images and applications, but that involves extra time to create and manage; a definite drain on resources. Furthermore, while preconfigured settings and gold images establish initial settings, users can alter these settings after an application has been deployed. Even standard users can easily manipulate their preferences to circumvent settings and bypass corporate/it policies and security settings. GP Myth #2 Group Policy environments can be secured by making all users Standard and not giving them Admin Rights Truth: When users run WinZip, Acrobat Reader, Internet Explorer, Chrome or just about any other desktop application as a standard user (that is, with no admin rights), they can simply go to "Tools Options" or "Edit Preferences" and manipulate the settings that are on the machine.

4 GP Myth #3 Group Policy allows system administrators to completely lock down their Windows environments Truth: Group Policy contains over 3,000 settings to lock down significant components of your Windows environment. However, applications running on users' desktops -- a critical component of a system administrator's and help desk's purview -- is not under Group Policy control and security. Even standard users can easily manipulate their preferences to circumvent settings and bypass corporate and IT policies and security settings. GP Myth #4 Group Policy and Group Policy Preferences provide the ability to manage application settings, lock down user interfaces and auto-remediate settings Truth: Group Policy's CSEs (Client Side Extensions) provide for the management of various settings, including security and firewall settings, deployment, admin templates, folder redirection and more. However, neither Group Policy nor the Group Policy CSEs provide management of application settings, perform user interface lockdown or auto-remediate settings. With only Group Policy and Group Policy Preferences, you are not able to achieve complete administrative lockdown.

5 GP Myth #5 ADM and ADMX files can be used to ensure application settings are completely locked down Watch Video: How to Overcome Limitations of Group Policy ADM / ADMX File Settings Management (8:10) Truth: ADM and ADMX files provide decent lockdown for some application settings. However, many applications do not ship with ADM or ADMX files, or they don't ship with robust files. For example, Microsoft Office ships with incomplete ADM and ADMX files, which do not contain important elements (e.g. Excel and Outlook). Another example is Chrome, which does not store all configurable items in the registry, meaning they cannot be controlled via Google's ADMX files. As a final example, the popular Acrobat Reader's ADMX file covers just 15 out of over 900 settings, significantly reducing the effectiveness of how much you can control with its ADMX file. Creating your own ADM and ADMX files to lock down settings is not the answer. In order to be completely locked down, an application has to be specifically designed and shipped with the ability to lock settings down. If it's not designed that way, creating an ADM or ADMX file won't securely lock down the settings. Users can still work around system administrator settings and Group Policy cannot prevent that from occurring. There are numerous popular applications -- including Java, Flash, Firefox, OpenOffice, LibreOffice, AutoCAD

6 and FileZilla -- that are unable to even use AMD or ADMX files. This is because these applications do not use the registry for their settings storage, which is required by ADM and ADMX files. ADM and AMDX files can only deliver settings to the registry. Also, with ADM and ADMX files, settings can never be reapplied. Once the settings are deployed to a user or computer, they can be modified by users and the ADM and ADMX file settings will never get reapplied or corrected, even on a reboot. Group Policy will not reapply them either. Finally, when a GPO is deleted or a person changes jobs, the Group Policy engine cannot remove ADM and ADMX settings automatically. This means that when the policy with the ADM or ADMX file no longer applies, the user maintains the old settings, resulting in a policy set that is not valid...and cannot be changed. GP Myth #6 Group Policy Preferences are sufficient for extending Group Policy settings and managing applications Watch Video: Why Managing Settings with GPPrefs Registry Extension is Not Enough (7:33) Truth: Group Policy Preferences deliver drive maps, shortcuts, printers and more. But they do not manage applications. Limitations of the GPPrefs registry extension include: It cannot deliver settings to non-registry based applications (Java, Flash, Firefox, OpenOffice, LibreOffice, AutoCAD, FileZilla and more). It cannot deliver bit-specific changes to Reg_Binary values. It cannot deliver user-side configuration changes to everyone on groups of computers. After a Group Policy Preferences value is set, users can work around the established settings. When a Group Policy Preferences item no longer applies, the setting is deleted or simply left there. There is no "reverting" back to a default setting.

7 Group Policy Preferences falls short in managing applications and leaves an organization exposed to the risk of users working around established settings and rules. GP Myth #7 Login scripts are sufficient to deliver various settings at login time Truth: Login scripts work adequately, however they have important shortcomings with regard to application settings lockdown: Maintaining and modifying login scripts, like most scripts, is resource intensive. Login scripts are not flexible; any changes required for unique settings cannot be done quickly and easily. Additionally, any settings established in login scripts can be worked around by users right after the script runs, bypassing IT, corporate settings and security policies. GP Myth #8 Group Policy Change Management tools provide complete management of the Group Policy infrastructure Truth: Tools such as Microsoft AGPM, NetIQ GPA and Quest GPOADmin are designed to manage the workflow of GP management, including managing multiple administrators. These tools do not extend the capabilities of what Group Policy (the engine) can do, and, as such, do not provide additional capability to lock down application settings of your users. They do not enhance Group Policy's built-in limitations with managing application settings.

8 GP Myth #9 "Reboot to recover" products eliminate all desktop problems Truth: Disk restoration solutions (e.g. Deep Freeze) solve a wide range of problems which can regularly occur on networks, including user modifications and deletions, desktop and configuration changes, registry hacks or other security risks - even viruses and malware. When you restore, the previous state of the disk is delivered to the user and the problem is solved. But disk protection products are not meant to correct all kinds of problems. They are designed to protect disk drives, not user sessions. And while they correct these problems, they don't prevent them. GP Myth #10 "Least privilege" user management tools provide the necessary safeguards to control user privileges and setting issues Truth: "Least privilege" tools (e.g. PowerBroker Windows, Avecto Privilege Guard, Viewfinity Privilege Management or Quest Privilege Authority) provide the ability to remove admin rights for users so they run as 'standard users.' In this scenario, when applications prompt for credentials (UAC prompts), these applications dynamically inject credentials such that the UAC prompt is not shown and the application runs successfully. However, users with standard user rights can still wreak havoc to an IT environment. Just because users are running with standard user rights now, it doesn't mean they cannot manipulate application settings and it doesn't mean an organization is any more secure. IT and security settings hit the application and users can still manipulate them.

9 The Truth About Group Policy User Management and Control As you can see, there are many myths surrounding the topic of Group Policy and just how much control and security it provides, particularly regarding settings lockdown. PolicyLock is desktop management software that quickly delivers settings and locks down users' operating systems and applications. PolicyLock ensures that users' settings are preconfigured, unchangeable and are always applied, no matter which desktop they utilize -- even when the computer is offline. With PolicyLock, there is no way for a user to misconfigure, manipulate, work around or change the policies system administrators set. Together with the tools you already have, such as the Group Policy Management Console, SCCM and others, PolicyLock will help you overcome the 10 user management issues outlined in this paper. Learn More about PolicyLock or Download a 30-Day Free Trial Call Raxco Sales: (301) , (800) (Toll-Free in the U.S.)