MCSA Guide to Administering Microsoft Windows Server 2012/R2, Exam Chapter 10 Managing Group Policies

Transcription

1 MCSA Guide to Administering Microsoft Windows Server 2012/R2, Exam Chapter 10 Managing Group Policies

2 Objectives Configure group policy scope, precedence, and inheritance Configure group policy client processing Configure the Group Policy Results and Group Policy Modeling tools Manage GPOs 2012/R2, Exam

3 Configuring Group Policy Processing An administrator should have a solid understanding of how GPOs are processed, how settings are inherited, and the exceptions to normal processing and inheritance This section discusses the following: GPO scope and precedence GPO inheritance GPO filtering Loopback processing 3

4 GPO Scope and Precedence GPO scope - defines which objects are affected by settings in a GPO GPOs are applied in this order: local computer, site, domain, and OU Policies that aren t defined or configured are not applied at all and the last policy applied is the one that takes precedence A GPO linked to a domain affects all computers and users in the domain, but settings in a GPO linked to an OU override the settings in a GPO linked to the domain if there are conflicts 4

5 GPO Scope and Precedence When OUs are nested, the GPO linked to the OU nested the deepest takes precedence over all other GPOs If two GPOs are applied to an object, and a certain setting is configured on one GPO but not the other, the configured setting is applied 5

6 Understanding Site-Linked GPOs GPOs linked to a site object affect all users and computers physically located at the site Can be used to set up different policies for mobile users In a singular site and domain environment, it is better to use domain GPOs Site GPOs can be confusing for users if policy changes are drastic enough between sites 6

7 Understanding Domain-Linked GPOs GPOs at the domain level should contain settings that apply to all objects in the domain Account policies can be defined only at the domain level Active Directory folders, such as Computers and Users, are not OUs and can t have a GPO linked to them Best practices suggest setting account policies and a few critical security policies at the domain level 7

8 Understanding OU-Linked GPOs Fine-tuning of group policies should be done at the OU level OU-linked policies are applied last They take precedence over site and domain policies Users and computers with similar policy requirements should be located in the same OU Since OUs can be nested, so can GPOs GPOs applied to nested OUs should be used for exceptions to policies set at a higher level 8

9 Group Policy Inheritance GPO inheritance is enabled by default To see where policies are inherited from, select a container in the left pane of GPMC and click the group policy inheritance tab in the right pane There are several ways to affect GPO inheritance: Blocking inheritance GPO enforcement 9

10 Blocking Inheritance Blocking inheritance prevents GPOs linked to parent containers from affecting child containers To block GPO inheritance, in GPMC, right click the child domain or OU and click Block Inheritance If blocking is enabled, the OU or domain object is displayed with a blue exclamation point Inheritance blocking should be used sparingly Frequent blocking implies a possible flawed OU design 10

11 GPO Enforcement GPO enforcement forces inheritance of settings on all child objects in the GPO s scope, even if a GPO with conflicting settings is linked to a container at a deeper level A GPO that s enforced has the strongest precedence of all GPOs in its scope If multiple GPOs are enforced, the GPO at the highest level is enforced in a conflict Example: If a GPO linked to an OU and a GPO linked to a domain are both set to be enforced, the GPO linked to the domain has stronger precedence 11

12 GPO Filtering GPO filtering - a method to alter the normal scope of a GPO and exclude certain objects from being affected by its settings Two types of GPO filtering: Security filtering Windows Management Instrumentation (WMI) filtering Security filtering uses permissions to restrict objects from accessing a GPO Use the Security Filtering dialog box in the GPMC to add or remove security principals from the GPO access list 12

13 GPO Filtering Figure 10-1 Viewing security filtering settings 13

14 GPO Filtering Another way to use security filtering is to edit the GPO s DACL directly In the GPMC, click the GPO in the Group Policy Objects folder, and click the Delegation tab in the right pane to see a complete list of access control entries (ACEs) for the GPO You can add security principals to the DACL or click the Advanced button to open the Advanced Security Settings dialog box You can assign Deny permissions as well as Allow permission 14

15 GPO Filtering Figure 10-2 The Delegation tab for a GPO 15

16 WMI Filtering WMI filtering uses queries to select a group of computers based on certain attributes, and then applies or doesn t apply policies based on the query s results You need to have a solid understanding of the WMI query language before creating WMI filters Example of using a WMI filter to select only computers running Windows 8 Enterprise: Select * from Win32_OperatingSystem where Caption = Microsoft Windows 8 Enterprise 16

17 WMI Filtering The next example uses Version and ProductType (differentiates between client and server OSs): Select * from Win32_OperatingSystem where Version like 6.2% and ProductType = 1 A client OS has a ProductType of 1 and a server OS has a ProductType of 3 You create WMI filters in the WMI Filters node of the GPMC Only one WMI filter can be selected per GPO, but you can use the same WMI filter in multiple GPOs 17

18 Loopback Policy Processing Loopback policy processing - a Group Policy setting that applies user settings based on the GPO whose scope the logon computer falls into Example: You have an OU named ConfRoomComputers containing all computer accounts of computer in conference rooms You want standardized desktops so the computers will have a consistent look for visitors Follow the steps starting on page 380 to use a loopback policy for the conference room example 18

19 Configuring Group Policy Client Processing When Group Policy determines that a GPO should be downloaded, the client activates client-side extensions Client-side extension (CSE) - an extension to the standard group policy client that applies specific types of group policy settings to the client computer Example: the Security CSE applies policy settings defined in a GPO s Security node CSEs are also used to apply group policy preferences 19

20 Configuring Group Policy Client Processing Foreground processing - group policy processing that occurs when the system boots or a user logs on Background processing - periodic group policy processing that occurs after a computer is running or a user is logged on You can change the way the client behaves Three ways to change the default processing: Slow link processing, background processing, process even if the Group Policy objects haven t changed 20

21 Configuring Slow Link Processing Many types of policies aren t processed across a slow network link by default, including: Disk quota Folder redirection Internet Explorer maintenance Scripts Software installation Wireless network policies Wired network policies Most preferences 21

22 Configuring Slow Link Processing Ways to change the default behavior of slow link processing: Configure the slow link detection policy - you can configure the threshold value of what s considered a slow link; 0 indicates that no links are to be considered slow and all policies are processed without attempting to detect whether the link is slow Allow slow link processing for selected policies - the policies that aren t processed b default when a slow link is detected can be configured to allow processing 22

23 Configuring Slow Link Processing Figure 10-5 Configuring slow link detection 23

24 Changing Background Processing Computer and User Configuration node of GPOS is refreshed every 90 minutes with a random offset between 0 and 30 minutes The random offset prevents computers that turned on at the same time from refreshing policies together For the full list of policies and preferences that can have background processing disabled, look in the Computer Configuration\Policies\Administrative Templates\System\Group Policy node The Set Group Policy refresh interval for computers policy lets you set the refresh interval for computers 24

25 Changing Background Processing Figure 10-8 Setting the group policy refresh interval 25

26 Processing Unchanged Policies By default, the Group Policy client downloads and processes only policies that have changed You can force unchanged policies and preferences to be processed Select the Process even if the Group Policy objects have not changed check box (see Figure 10-7 on the following slide) If this option is set for a preference, it overrides the Apply once and do not reapply option in the Common tab of the preference s Properties dialog box 26

27 Processing Unchanged Policies Figure 10-7 Disabling group policy background processing for disk quotas 27

28 Synchronous and Asynchronous Processing Synchronous processing - forces group policy processing to finish before other system tasks can be performed Computer Configuration polices are processed during system boot and user logon prompt isn t displayed until all processing is finished Asynchronous processing - allows displaying the user logon prompt while Computer Configuration policies are still being processed When a slow link is detected, you can force asynchronous processing 28

29 Group Policy Caching Group policy caching - a client-side feature that loads policy information from a cache on the local computer instead of from a domain controller Enabled by default on Windows Server 2012 R2 and Windows 8.1 computers Configure Group Policy Caching policy setting found in the Computer Configuration\Administrative Templates\System\Group Policy path Allows you to disable caching and configure some parameters 29

30 Group Policy Caching Figure 10-9 Configuring group policy caching 30

31 Group Policy Caching If you enable caching, you can change two time parameters: Slow link value - specifies the threshold for the response time from a domain controller to consider a link slow Timeout value - the maximum time the Group Policy client waits for a response from a DC before determining there s no network connection to the DC 31

32 Forcing Group Policy Updates To update group policies use the gpupdate.exe command with the following options: No options - the command s default behavior takes place /force - all settings from all applicable GPOs are reapplied, even if unchanged /wait: value - specifies the number of seconds the command should wait for policy processing to finish before returning to the command prompt /logoff - the user is logged off after policy processing is finished 32

33 Forcing Group Policy Updates To update group policies use the gpupdate.exe command with the following options (cont d): /boot - the computer restarts after policy processing is finished /sync - causes synchronous processing during the next computer restart or user logon /target: Computer or User - specify that you want only computer or user policy settings to be updated 33

34 Remote Group Policy Updates Remotely cause a group policy refresh on Windows Vista and later clients by: Using the GPMC or use the PowerShell cmdlet Invoke-GPUpdate Use a pipe with the Get-ADComputer command to update several computers at once The following updates all computers in the Computers folder: Get-ADComputer -filter * -Searchbase cn=computers, dc=411dom1, dc=local foreach { Invoke-GPUpdate -computer $_.name -force} 34

35 Configuring the Firewall for Remote Group Policy Updates Target client computers must have the following inbound firewall rules enabled on the domain profile for a remote group policy update to be successful: Remote Scheduled Tasks Management (RPC) Remote Scheduled Tasks Management (RPC- EPMAP) Windows Management Instrumentations (WMI-In) A Starter GPO named Group Policy Remote Update Firewall Ports is available that has firewall settings configured correctly 35

36 Group Policy Results and Modeling Group Policy Results - a wizard built into the GPMC that creates a report to show which policy settings apply to a user, computer, or both After the wizard finishes, the report has three tabs: Summary - information about which GPOs affect the specified computer and user Details - displays information about the computer and Group Policy components Policy Events - displays all events in Event Viewer that are generated by group policies 36

37 Group Policy Results and Modeling Figure The Details tab in Group Policy Results 37

38 Group Policy Results and Modeling Other troubleshooting tools: Gpresult.exe - command-line version of Group Policy Results Wizard Group Policy Modeling - a what-if tool for group policies The report shows which policy settings are in effect for a user whose account is placed in a particular OU and whose computer is placed in a particular OU Resultant Set of Policy (RSoP) snap-in - has two modes: logging and planning Planning mode is similar to Group Policy Modeling 38

39 Managing GPOs The following sections discuss: GPO backup and restore GPO import and copy GPO migration GPO delegation 39

40 GPO Backup and Restore Backing up a GPO: 1. In the GPMC, right-click the GPO in the Group Policy Objects folder and click Back Up 2. Select (or create) a folder where the GPO should be stored 3. Enter a descriptions of the GPO and click Back Up Multiple GPOs can be stored in the same folder The folder should be secure and backed up by a regular system backup routine 40

41 GPO Backup and Restore The procedure for restoring a GPO varies: Restore a previous version - right-click the GPO in the Group Policy Objects folder and click Restore from Backup Restore a deleted GPO - right-click the GPO folder and click Manage Backups to open the Manage Backups dialog box Select which GPO you want to restore, view a backed up GPO s settings, or delete a backed-up GPO Import settings - You can import settings from a backed-up GPO by right-clicking the GPO and clicking Import Settings 41

42 GPO Backup and Restore You can also copy the settings of a GPO into a new GPO Follow steps outlined on page 394 If you make changes and need to revert to the original settings, you can reset settings for either or both default GPOs Use the dcgpofix.exe command-line program 42

43 GPO Migration GPOs can be migrated across domains in the same or different forests by adding the domain to the GPMC When you have multiple domains in the GPMC, you can copy and paste a GPO from the source domain s Group Policy Objects folder to the target domain s Group Policy Objects folder When you click Paste in the target folder, the Cross- Domain Copying Wizard starts Another method for migrating GPOs uses the backup and import procedure 43

44 Configuring a Migration Table Migration table - a list of security principals and UNC paths in a GPO that can be mapped to the security principals and UNC paths in the destination domain Create a migration table by right-clicking the Domains node in the GPMC and click Open Migration Table Editor Click Tools and then choose Populate from GPO or Populate from Backup 44

45 Configuring a Migration Table Figure The Migration Table Editor 45

46 GPO Management Delegation Eight permissions can be applied to GPOs and container objects they re linked to through delegation: Create GPOs Link GPOs Perform Group Policy Modeling analyses Read Group Policy Results data Read Read (from Security Filtering) Edit settings, delete, modify security Edit Settings 46

47 PowerShell Cmdlets for Managing GPOs Table 10-2 PowerShell cmdlets for managing GPOs 47

48 PowerShell Cmdlets for Managing GPOs Table 10-2 (cont d) PowerShell cmdlets for managing GPOs 48

49 Summary Group policy processing can be confusing because there are so many exceptions to normal processing and inheritance behavior GPO scope defines which objects are affected by the settings in a GPO There are two main ways to change default GPO inheritance: blocking inheritance and using GPO enforcement There are two types of GPO filtering: security filtering and Windows Management Instrumentation (WMI) filtering 2012/R2, Exam

50 Summary If you enable loopback policy processing, all settings are in the User Configuration node of the GPO apply to all users who log on to the computer Group Policy is a client/server system After Windows is started, the Computer Configuration node of GPOs affecting the client is refreshed every 90 minutes with a random offset of 0 to 30 minutes Group policy processing can be synchronous or asynchronous Group policy caching is a client-side feature that loads policy information from a cache on the local computer instead of always having to download it from a DC 2012/R2, Exam

51 Summary Using the GPMC, you can force a group policy refresh for all computers in an Active Directory OU and all logged-on users of those computers Group Policy Results is a wizard built into the GPMC that creates a report to show administrators which policy settings apply to a user, computer, or both When you back up a GPO, the policy settings, security filtering settings, delegation settings, and WMI filter links are backed up Eight possible permissions can be applied to GPOs and the container objects they are linked to through delegation 2012/R2, Exam