Dell GPOADmin 5.7 December 2013 These release notes provide information about the Dell GPOADmin release. About Dell GPOADmin 5.7 New features Resolved issues s System requirements Product licensing Getting started with GPOADmin 5.7 About Dell About Dell GPOADmin 5.7 GPOADmin gives organizations control of Group Policy Objects (GPOs) across the enterprise. Built to augment the Microsoft GPMC, GPOADmin provides comprehensive GPO management with additional features such as offline editing, reporting, archival and restoration, version control, test framework, change notification and approval, and quick rollback in the event that an object change has unexpected results. New features New features in GPOADmin 5.7: Expanded PowerShell commands: In an effort to support administrators and their management and automation needs, GPOADmin has expanded its command line capabilities. GPOADmin now has over 100 PowerShell commands. Custom Workflow Actions: You can extend GPOADmin s version control system to incorporate customized actions based on your organizations existing workflow. This allows you to customize and control the deployment of controlled objects (such as GPOs, SOMs, and WMI filters) to meet your individual needs. The metadata on the version controlled item can be passed to custom scripts enabling integration with helpdesk applications and other solutions. Support of IPv6: GPOADmin now supports the IPv6 address family. See also: Resolved issues 1
Resolved issues The following is a list of issues addressed in this release. NOTE: Defects with leading zeros (0) are from the Clarify system. Table 1. General resolved issues Resolved issue Users can move objects they have the Register right on to containers where they do not have 291260 rights. GPOADmin will accept a file name for the log file directory. 246848 Users without the Workflow Enable/Disable right can enable or disable the workflow on a GPO 273835 through the Export wizard. The Get-Unregistered command does not show object in nested Organizational Units. 324942 s NOTE: Defects with leading zeros (0) are from the Clarify system. The following is a list of issues, including those attributed to third-party products, known to exist at the time of release. Table 2. Installation GPOADmin 5.7 is not compatible with ChangeAuditor version 6.0 or higher. You must use 322032 ChangeAuditor version 5.9 or below. GPOADmin 5.7 is compatible only with MobileIT version 1.2 or version 1.3. 322234 When you connect to an ADAM version control server without proper access to it, you may 0229307 receive the error "The object is not on the server" instead of "Access Denied." When you install GPOADmin, the installation architecture must match the architecture of the N/A GPMC. For example, if you choose to install GPOADmin on a 64-bit Windows 2003 Operating System that is running a 32-bit GPMC, the GPOADmin x86 installer must be used. If you upgrade to GPOADmin 5.7 and use a custom port number, the GPOADmin Service has to be 64307 manually restarted before you can connect to the GPOADmin server. If you are running GPMC during an upgrade, you must close and re-open it before the GPO N/A Management tab will display. After upgrading, to access reports from the previous version you must change the reports folder N/A path in the User Preferences to point to the old folder. GPOADmin may log you in as the previous user if you do not log in with new credentials. 194197 Table 3. ADM files Since ADM files have been replaced by ADMX files in Windows Server 2008, Windows Server 2008 R2, Vista, and Windows 7, the ADM file cache will be empty in these operating systems. To view ADM files in the Template Editor or the ADM cache, you need to search for the ADM files and add them after installing GPOADmin 5.7. 40817 2
Table 4. Cross-forest support If you create a SOM backup in one forest and import it to another, the links will appear as 0228454 deleted GPOs if those GPOs cannot be accessed from the second forest. When editing a GPO cross-forest, the native GPO editor does not create the ADM folder in Sysvol. 0229227 Table 5. Error messages If the system time is not synchronized between client and server, it can cause misleading error messages. 0228332 Table 6. Version Control system Compliance actions may result in an unhandled exception in the GPMC Extension. Workaround: To avoid this issue, you can either perform the compliance actions in the client or by running the Check compliance wizard. If you have multiple accounts configured as approvers in your approval workflow, a Mobile IT client will only receive one (the initial) request for approval notification during each approval process. If users do not have the User role assigned on the Version Control root, they may not have the required rights to successfully execute the User Activity report. If an object is renamed or deleted within Active Directory, the Approvals tab does not reflect the change. Some GPO settings are not backwards compatible between operating systems. For example, you can't import GPO settings from a Microsoft Windows Server 2008 version control system into a GPO in a Microsoft Windows Server 2003 version control system. When you edit GPOs, you are notified of persistent registry values through a flashing icon on the Registry Cleanup button in the GPO Editor. For this notification to display, you must first close and then open the GPO Editor once again. 322839 320590 238909 246579 122825 240689 The Watcher Service needs to be restarted after changing Configuration Stores. 65408 Deploying a GPO containing existing Software Installation packages may cause each of those 0222515 packages to be reinstalled on target workstations. MMC snap-in may become unresponsive when rolling back changes on 15 or more GPOs in the 108919 Check Compliance wizard. Times displayed in GPOADmin reports will be in the local time zone of the client machine. Any 0135484 times displayed in the GPMC settings reports will appear in the time zone of the GPOADmin server. When checking for compliance, GPOADmin will not perform a backup if the unauthorized changes result in an object in the same state as the currently stored version. If you do not have the appropriate language packs installed, GPOs created using Japanese characters on a Japanese OS will not display on an English OS. After changing storage locations, the individual version information is not transferred from the old storage location to the new. You must keep the old storage server online if you want to still access those individual versions. When using the SeizeVCRole.exe utility, if a port is specified with the new server name, the utility assumes that the new server is ADAM. When using an Active Directory Version Control server, the default port of 389 does not need to be specified. 106505 0229308 0229309 0229311 3
Table 6. Version Control system GPOADmin will not delete the information stored in the directory when it is uninstalled. The Version Control information may be deleted manually if it is no longer required. GPOADmin uses "working copies" of objects for editing purposes. If the Version Control information is deleted from the server, while objects are still pending creation or in a minor version, these working copies may be seen as "Unregistered" if a new instance of the version control information is instantiated. Working with large (3-5MB) GPOs in the GPMC Extension has the potential for the GPOADmin Service or Watcher Service to become unresponsive. When you are editing a GPO with both the GPOADmin console and the GPMC Extension open, closing the Group Policy Object Editor may not return you to the expected interface. When a registered OU is moved in Active Directory, the OU Distinguished Name will not be updated in the GPOADmin Version Control system. 0229312 108921 91914 81397 Table 7. Templates Once you have upgraded from GPOADmin version 5.4 or version 5.5 to GPOADmin 5.7, you can no longer import templates. The template conflict report lists the templates in alphabetical order, sorted by GUID. This is not the same as the order in which the templates will be applied. The conflict data in the body of the report is unaffected and is correct. On German language computers, applying a template to a GPO may not apply the ADM settings correctly. Specifically, settings that were enabled in the template may not be enabled in the resulting GPO. Creating a template from a GPO as a user requires the Register right instead of the Create right. To workaround, give the user the Register right for that container. 240809 0228985 0215478 0229280 Table 8. Reports For Difference reports to run properly, Quest Authentication Services must be installed on the 284883 GPOADmin client. In the Difference Report, filters are not supported for GPO Preference settings. 151065 When running the Difference Report for a GPO that contains Scheduled Task Preference settings, the date and time options displayed in the report may not be as expected. If the Service Account does not have the correct access to generate Group Policy Results reports, you may receive miscellaneous errors throughout the Report Wizard. To properly generate Group Policy Results reports for a user or computer, the Service Account must have Read Group Policy Results data permission on the domain or OU that contains the user or computer, or the Service Account must be a member of a local Administrator's group on the targeted computer. 151232, 151435 0104882, 0106937 The MMC snap-in may become unresponsive when running the Group Policy Object Consistency 108930 Report with 5000 or more GPOs. The Group Policy Object Settings Search Report does not report on policy settings from Dell 108289 Authentication Services. In the Group Policy Settings and Resultant Set of Policies reports, some dates (for example, 102486 Created, Modified and Applied date) will display with the time zone of the GPOADmin Server. Pre-existing GPO settings are being displayed in the ChangeAuditor Working Copies report. 194922 When viewing Preference settings in the Difference Report, the values displayed for text entries 150634 may have a capital letter when the actual value is a lower-case letter. This may cause some date settings to be incorrect. 4
Table 9. User Account Control When installing the GPOADmin service on a system with User Account Control turned on, the installer must be launched using elevated privileges. To do this, run the 'Dell GPOADmin.msi' file from an elevated command prompt. 41286 Table 10. Third Party Information about new Group Policy preferences in Windows Server 2008. "Object reference not set to an instance of an object" error message when you view the GPO backup settings in the Group Policy Management Console. You cannot read the GPO in the SYSVOL directory in Windows 7 or in Windows Server 2008 R2 if you enable the "Deny write" permission of the GPO. http://support.microsoft.com/kb/943729 http://support.microsoft.com/kb/2379592 http://support.microsoft.com/kb/2275315 5
System requirements Before installing GPOADmin 5.7, ensure that your system meets the following minimum hardware and software requirements. Requirements Table 11. Component requirements Requirement Client Installation Server Installation Details 1 GHz processor 4Gb RAM 1Gb hard disk space Windows XP Service Pack 2, Windows Server 2003, Windows Server 2003 R2, Windows Vista, Windows Server 2008, Windows Server 2008 R2, Windows 7, Windows 8, Window 8.1, Windows Server 2012, and Windows Server 2012 R2 operating systems MMC 3.0.NET Framework 4.0 Microsoft Group Policy Management Console with Service Pack 1 or Remote Server Administration Tools 2Ghz (prefer 2Ghz) CPU 4Gb (prefer 8Gb) RAM 500Gb hard disk space Windows XP Service Pack 2, Windows Server 2003, Windows Server 2003 R2, Windows Vista, Windows Server 2008, Windows Server 2008 R2, Windows 7, Windows 8, Window 8.1, Windows Server 2012, and Windows Server 2012 R2 operating systems MMC 3.0.NET Framework 4.0 Microsoft Group Policy Management Console with Service Pack 1 or Remote Server Administration Tools Either ADAM/AD LDS or Active Directory must be available on the network to be used for the application's configuration storage. 6
Table 11. Component requirements Requirement GPMC Extension Watcher Service Details 1Ghz CPU 4Gb RAM 1Gb hard disk space Windows XP Service Pack 2, Windows Server 2003, Windows Server 2003 R2, Windows Vista, Windows Server 2008, Windows Server 2008 R2, Windows 7, Windows 8, Window 8.1, Windows Server 2012, or Windows Server 2012 R2 operating systems MMC 3.0.NET Framework 4.0 Microsoft Group Policy Management Console with Service Pack 1 or Remote Server Administration Tools 2Ghz (prefer 2Ghz) CPU 4Gb (prefer 8Gb) RAM 500Gb hard disk space Windows XP Service Pack 2, Windows Server 2003, Windows Server 2003 R2, Windows Vista, Windows Server 2008, Windows Server 2008 R2, Windows 7, Windows 8, Window 8.1, Windows Server 2012, or Windows Server 2012 R2 operating systems.net Framework 4.0 Microsoft Group Policy Management Console with Service Pack 1 or Remote Server Administration Tools Either ADAM/AD LDS or Active Directory must be available on the network to be used for the application s configuration storage Upgrade and compatibility Note the following when upgrading to GPOADmin version 5.7: When you upgrade the Server, you must also upgrade the Client, GPMC Extension, and Watcher Service to version 5.7. The supported upgrade paths are from versions 5.6 and 5.6.1. To view Unix settings in GPOADmin, Quest Authentication Services must be installed after GPOADmin is installed. See solution article SOL82849. Administrative Template (.adm file) Compatibility Note: GPOADmin does not support the use of templates on Windows 7, Windows Server 2008, and later. The support on earlier Windows operating systems is also limited. Product licensing To activate a new installation 1 Launch the GPOADmin client. 2 Right-click the GPOADmin node and select Connect To. 3 Select an existing connection or create a new one using the New button. 4 Click Connect. 7
5 When the Invalid License dialog box displays, browse to and select your GPOADmin license file and click OK. To update your existing license for a given server 1 Launch the GPOADmin client and connect to the server where you want to update the license. 2 Right-click the forest for that connection and select Properties. 3 Click the License tab. 4 Check the Update License check box and browse to and select your updated license. 5 Click Apply or OK. Getting started with GPOADmin 5.7 Installation instructions Additional resources Installation instructions Refer to the Dell GPOADmin Quick Start Guide for installation instructions. Additional resources Additional information is available from the following: Online product documentation http://documents.quest.com/gpoadmin/ GPOADmin community http://gpm.inside.quest.com/index.jspa. Globalization This section contains information about installing and operating this product in non-english configurations, such as those needed by customers outside of North America. This section does not replace the materials about supported platforms and configurations found elsewhere in the product documentation. This release is Unicode-enabled and supports any character set. It supports simultaneous operation with multilingual data. This release is targeted to support operations in the following regions: North America, Western Europe and Latin America, Central and Eastern Europe, Far-East Asia, Japan. 8
About Dell Dell listens to customers and delivers worldwide innovative technology, business solutions and services they trust and value. For more information, visit www.software.dell.com. Contacting Dell Technical Support: Online Support Product Questions and Sales: (800) 306-9329 Email: info@software.dell.com Technical Support Resources Technical support is available to customers who have purchased Dell software with a valid maintenance contract and to customers who have trial versions. To access the Support Portal, go to https://support.software.dell.com/gpoadmin. The Support Portal provides self-help tools you can use to solve problems quickly and independently, 24 hours a day, 365 days a year. In addition, the portal provides direct access to product support engineers through an online Service Request system. The site enables you to: Create, update, and manage Service Requests (cases) View Knowledge Base articles Obtain product notifications Download software. For trial software, go to Trial Downloads. View how-to videos Engage in community discussions Chat with a support engineer Third-party contributions This product contains the third-party components listed below. For third-party license information, go to http://software.dell.com/legal/license-agreements.aspx. Source code for components marked with an asterisk (*) is available at http://opensource.dell.com. Table 12. List of third-party contributions Component License or Acknowledgement SharpZipLib 0.85.1.271 SharpZipLib 0.85.1 Windows Installer XML Copyright 2004, Outercurve Foundation. All rights reserved. toolset (aka WIX) For copies of the source code see: http://rc.quest.com/. 3.6.3303.0 Log4Net 1.2.10 Apache 2.0 9
2013 Dell Inc. ALL RIGHTS RESERVED. This guide contains proprietary information protected by copyright. The software described in this guide is furnished under a software license or nondisclosure agreement. This software may be used or copied only in accordance with the terms of the applicable agreement. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording for any purpose other than the purchaser s personal use without the written permission of Dell Inc. The information in this document is provided in connection with Dell products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of Dell products. EXCEPT AS SET FORTH IN THE TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, DELL ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL DELL BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF DELL HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Dell makes no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and product descriptions at any time without notice. Dell does not make any commitment to update the information contained in this document. If you have any questions regarding your potential use of this material, contact: Dell Inc. Attn: LEGAL Dept 5 Polaris Way Aliso Viejo, CA 92656 Refer to our web site (software.dell.com) for regional and international office information. Trademarks Dell and the Dell logo are trademarks of Dell Inc. and/or its affiliates. Other trademarks and trade names may be used in this document to refer to either the entities claiming the marks and names or their products. Dell disclaims any proprietary interest in the marks and names of others. Legend CAUTION: A CAUTION icon indicates potential damage to hardware or loss of data if instructions are not followed. WARNING: A WARNING icon indicates a potential for property damage, personal injury, or death. IMPORTANT NOTE, NOTE, TIP, MOBILE, or VIDEO: An information icon indicates supporting information. 10