Windows Group Policies Notes

Windows Group Policies

Introduction

• Configuration Management: Centrally manage systems, achieved through:

  • Group Policy: The main topic.

  • PowerShell.

  • System Center Configuration Manager.

Group Policy Basics

• Local Policies:

  • Applicable in a workgroup environment.

• Domain Policies:

  • Centrally managed.

  • More secure.

  • Suitable for large environments.

Tools

• gpedit.msc

  • Edits local policies only.

• mmc.exe with the Group Policy Object Editor snap-in

  • Edits local or remote policies.

  • Save as *.msc for later use.

GPMC Installation

• Windows Client:

  • Install RSAT (Remote Server Administration Tools).

  • Enable Group Policy Management Feature in 'Turn Windows Features on or off'.

  • Use Windows 8 for managing 2012 Server.

  • Use Windows 10 for managing 2016 Server.

• Windows Server:

  • Open Server Manager.

  • Add roles and features; select Group Policy Management Feature.

Accessing GPMC

• Via Server Manager in the Tools menu.

Other Tools

• gpupdate.exe

  • Used to update policies outside the normal refresh interval.

• Invoke-GPUpdate

  • PowerShell version of the tool, offering more capabilities.

• gpresult.exe

  • Displays active policy settings for a user or computer.

Default Policies

• All policies are stored in the Group Policy Objects container.

• Policies become active when linked to a Site, Domain, or Organizational Unit (OU).

Modifying Policies

• Policies and Preferences are configuration items available for both Computer and User.

• Located within Administrative Templates.

Three States of Policies

Most policies have three states:

• Not Configured

• Enabled

• Disabled

How Group Policy Is Applied

1. Computer Starts

   • Computer settings are applied.

   • Startup scripts run.

2. Refresh Interval

3. User Logs On

   • User settings are applied.

   • Logon scripts run.

   • Refresh Interval: Every 90 minutes.

• Override Schedule:

  • Invoke-GPUpdate server1 -RandomDelayInMinutes 0

  • GPUpdate.exe /force

  • Remote GPUpdate in the GPMC + random 0-30 min = 90-120 minutes

  • $90-120$ minutes is the default refresh interval.

Designing a Group Policy Infrastructure

The design and rollout involve four phases:

1. Planning:

   • Identify user types and security requirements.

   • Consider software deployment via MSI packages.

   • Determine if folder redirection and administrative templates are needed.

2. Designing:

   • Ensure network IP connectivity.

   • Establish domain/DNS.

   • Synchronize time.

3. Deploy:

   • Link policies to:

     • Local

     • Site

     • Domain

     • OU

4. Management:

   • Delegate Administration.

   • Utilize Starter GPOs to create a library of standard scenarios.

   • Add comments to policies.

   • Use AGPM (Advanced Group Policy Management) for role-based management control.

Process Order

Group Policy is processed from top to bottom:

1. Local

2. Site

3. Domain

4. OU

The last policy applied wins.

Multiple Local GPOs

• Local GPOs can be created for:

  • The machine itself (standard LGPO).

  • Admin or non-Admin local groups.

  • Individual local users.

• Application order:

  • Machine LGPO is processed first, followed by group and then individual user GPOs.

  • Individual user GPO takes precedence.

• A user receives either the Admin or Non-Admin LGPO, but not both.

• Domain-based GPOs still have precedence over LGPOs.

• New policy setting: “Exclude processing of all local GPOs”.

Policy Processing Order Customization

• Block Inheritance:

  • Prevents policies from higher levels from being inherited.

• Enforce option:

  • Prevents settings from being overridden at a lower level.

• Security Filtering:

  • Read and apply rights are default.

• GPO Link Order

• Loopback Processing

Loopback Processing

Loopback processing has two modes:

• Merge:

  • User Configuration settings are a combination of those defined in the user and computer GPOs.

• Replace:

  • Only the Computer Configuration settings are applied, ignoring User Configuration settings in the user's own GPOs.

Architecture

• Client pulls policy from the Sysvol folder on a Domain Controller (DC).

• Sysvol path: %systemroot%\sysvol.

• Contains the Group Policy Template (GPT) with scripts, GPO template files, and Registry.pol.

• The GPT has a version number, gpt.ini, and a GUID.

Management

• Sysvol Folder on a DC %systemroot%\sysvol

• Group Policy Template (GPT) with scripts, GPO template files and Registry.pol

• GPT has a version number, gpt.ini and a GUID.

Troubleshooting

Tools and techniques for troubleshooting:

• Event Log.

• Get-GPResultantSetOfPolicy (PowerShell cmdlet).

• GPResult.exe.

• GPMC Remote Update.

Troubleshooting Tools

• Get-GPResultantSetOfPolicy

  • Get-GPResultantSetOfPolicy -ReportType HTML -Path C:\Reports\Results.htm

• GPResult.exe

  • GPRESULT /r

  • GPRESULT /H GPReport.html

  • GPRESULT /USER targetusername /V

Group Policy Results & Modelling

• "Group Policy Modeling" simulates what happens when the policy is applied: "What if…"

Troubleshooting Group Policy Refresh

• Check refresh intervals for users and computers.

• Verify that the user has logged off and on, or that the computer has been restarted.

• Check for cached credentials.

• Check if the Loopback policy is enabled.

• Use gpupdate to:

  • Manually refresh updated Group Policy settings.

  • Force the refresh of all Group Policy settings.

  • Force a reboot or logoff, if required, to refresh the settings.

PowerShell Support

• 26 PowerShell cmdlets for Group Policy scripting.

• GPO operations: creation, removal, backup, and import.

• GPO link operations: creation, update, and removal.

• Setting inheritance flags and permissions on Active Directory organizational units (OUs) and domains.

• GPO Settings: Creating, update, retrieval, removal (Only registry-based policy settings - Administrative Templates).

• GPP Settings: Creating, update, retrieval, removal (No Item-Level Targeting).

• Starter GPOs operations: creation and update.

PowerShell Cmdlets

• Import-Module GroupPolicy -verbose

• New-GPO "My GPO" -comment "Created with PS"

• New-GPStartGPO "My StarterGPO"

• Set-GPRegistryValue …

• Set-GPPrefRegistryValue …

• Backup-GPO -all -path C:\GPO.Backups

• Discover Commands:

  • Get-Command *GP* -commandType cmdlet

  • Get-Help Set-GPRegistryValue –examples

Backup and Restore

• GPMC or PowerShell can be used for backup and restore.

• Backup-GPO -all -path C:\GPO.Backups

Administrative Templates

• Administrative Template files define the options available in the Group Policy Editor.

• Types of Administrative Template files:

  • ADM files: for Windows® XP or older clients, and Windows Server® 2003 or older servers.

  • ADMX files: for >=Windows Vista clients and >=Windows Server 2008 servers.

• For example: Office ADM/ADMX Templates to manage hundreds of settings. ADMX is XML and language-independent.

Security Templates

• Security templates:

  • Allow administrators to apply consistent security settings to multiple computers.

  • Can be designed based on server roles.

  • Can be applied via Group Policy.

ADMX Central Store

• Domain-wide location for storing ADMX/ADML files.

• Default behavior (without the Central Store):

  • ADMX files local to the administrative machine are used by GPMC/GPEdit.

• Creating and Using The Central Store:

  • Domain-wide location: [sysvol]\<domain>\policies\PolicyDefinitions

  • One-time creation and population of the central store per domain.

  • From then on, Windows Vista GPMC/GPEdit use ADMX files in the central store (and ignore the local store).

GPO Filtering

• Filters a list of settings based on:

  • Text search of setting title, explain text, and comments.

  • Platform and applications “supported on”.

  • Managed (true GP policy setting).

  • Configured (enabled or disabled).

• Results in a filtered view in the editor (hierarchical list or flat list).

• Only for Group Policies Administrative Template settings (Not Group Policy Preferences).

• Available through GPMC 2.0 Windows Server 2008 RSAT & Vista SP1 RSAT

Group Policy Preferences Functionality Overview

• Preference Setting(s)

  • Initial value

  • Not enforced

  • Not true “Policy”

  • Not limited to policy aware applications

• Greatly extends number of settings

  • Computer and User settings

    • Using Control Panel and Windows settings

• New functionality for new settings

  • Rich UI for easier administration

  • Better (item-level) targeting

• Shipped with Windows Server >= 2008

Policy versus Preference

Group Policy Preferences Settings

• Control Panel Settings

  • Data Sources

  • Devices

  • Folder Options

  • Internet Options

  • Local Users and Groups

  • Power Options

  • Printers

  • Scheduled Tasks

  • Start menu

  • Services

• Windows Settings

  • Drive Mappings

  • Environment

  • Folders/Files

  • Ini files

  • Shares

  • Shortcuts

  • Registry

  • Applications (Extensible!)

Group Policy Preferences Rich User Interface

• Familiar experience

  • Makes it easy to find

  • Easy to manage

  • Better control of individual settings – Red/Green

• Powerful browsers

Group Policy Preferences Better Targeting

• Item-level targeting, not GPO level

• Robust targeting

  • 29 types

  • Boolean logic (And, Or, Not)

  • Grouping

• Windows APIs – not WMI based

• Intuitive UI

  • No need to learn query languages

• Powerful browsers

Group Policy Preferences Cycle

• By default, (re)set at GP refresh cycle

  • Manual (gpupdate)

  • Automatic

    • Computer Configuration. DC: 5 min

    • User Configuration. User: 90 min + 30 min

      • Min: 90 min – Max: 120 min (2h)

    • Non-DC: 90 min + 30 min

      • Min: 90 min – Max: 120 min (2h)

Processing Order Policies versus Preferences

• It Depends!

  • Alphabetical order, based on their GUID HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\GPExtensions

  • Last writer wins

Group Policy Preferences Action Modes

• Create (once, if not exists)

• Replace: Delete & re(create)

• Update (default): Modify (attribs), if not exists “Create”

• Delete