Group Policy – Tips, Tricks and Best Practices John Howard IT Pro Evangelist, Microsoft UK.
-
Upload
abigail-butler -
Category
Documents
-
view
219 -
download
2
Transcript of Group Policy – Tips, Tricks and Best Practices John Howard IT Pro Evangelist, Microsoft UK.
Group Policy – Tips, Tricks and Group Policy – Tips, Tricks and Best PracticesBest Practices
John HowardJohn Howard
IT Pro Evangelist, Microsoft UK.IT Pro Evangelist, Microsoft UK.
AgendaAgenda
Planning / Building / Testing / DeployingPlanning / Building / Testing / Deploying
Specific Group Policy “Features”Specific Group Policy “Features”
TroubleshootingTroubleshooting
Recommended ReadingRecommended Reading
Group Policy, Profiles and IntellimirrorGroup Policy, Profiles and IntellimirrorFor Window Server 2003, Windows 2000 and Windows XPFor Window Server 2003, Windows 2000 and Windows XP
By Jeremy MoskowitzBy Jeremy Moskowitz
http://http://www.GPAnswers.comwww.GPAnswers.com
Quick RefreshQuick Refresh
By default, how often does Group Policy initiate By default, how often does Group Policy initiate a refresh after a user has logged on?a refresh after a user has logged on?
Does the version number between the AD and Does the version number between the AD and Sysvol parts of the GPO need to match in order Sysvol parts of the GPO need to match in order for Group Policy to apply?for Group Policy to apply?
What is the biggest .adm file?What is the biggest .adm file?
PlanningPlanningOU DesignOU Design
Why create OU’sWhy create OU’s
Segment by roleSegment by role
Domain controllersDomain controllers
ComputersComputers
UsersUsers
Redirect default OU for new accountsRedirect default OU for new accounts
redirusr.exe and redircmp.exe redirusr.exe and redircmp.exe 11
Use delegation of administrationUse delegation of administration
Create/Update/Link GPOsCreate/Update/Link GPOs
PlanningPlanningGPO DesignGPO Design
Normalise GPOs – GP Common Scenarios Normalise GPOs – GP Common Scenarios 22
Naming conventionsNaming conventions
Clear purpose and intentClear purpose and intent
3-token string: Scope/Purpose/Managed By3-token string: Scope/Purpose/Managed By
e.g. e.g. WW-Outlook-OTGWW-Outlook-OTG
What about the number of GPOs?What about the number of GPOs?
MYTH: Fewer GPOs=Better performanceMYTH: Fewer GPOs=Better performance
FACT: Number of settings is more importantFACT: Number of settings is more important
PlanningPlanningGPO DesignGPO Design
Avoid Cross-Domain GPO linksAvoid Cross-Domain GPO links
Performance overheadPerformance overhead
Alternative - GPMC scriptsAlternative - GPMC scripts
Use the following sparinglyUse the following sparingly
Enforce (no override)Enforce (no override)
Block InheritanceBlock Inheritance
LoopbackLoopback
Keep it simpleKeep it simple
PlanningPlanningGPO Design – WMI FiltersGPO Design – WMI Filters
XP and Windows Server 2003 OnlyXP and Windows Server 2003 Only
Performance hitPerformance hit
Limit to known lifetime if possibleLimit to known lifetime if possible
Scriptomatic Scriptomatic 33
Planning: DeploymentPlanning: DeploymentTest, Stage, Production, ValidateTest, Stage, Production, Validate
The right thing to doThe right thing to do
Pilot significant changesPilot significant changes
……but not just with IT Staff!but not just with IT Staff!
Use GPMC features to assist Use GPMC features to assist 44
Sample scripts eg CreateXMLFromEnvironment and Sample scripts eg CreateXMLFromEnvironment and CreateEnvironmentFromXMLCreateEnvironmentFromXML
Documentation – HTML or XML reportsDocumentation – HTML or XML reports
Backup/Copy/Import functionsBackup/Copy/Import functions
ModellingModelling
Planning: DeploymentPlanning: DeploymentTest, Stage, Production, ValidateTest, Stage, Production, Validate
PlanningPlanningDisaster RecoveryDisaster Recovery
Group Policy can affect Group Policy can affect everyevery computer and user computer and user
Authoritative Restore is not nice! Authoritative Restore is not nice!
GPMC Backup and Restore is GPMC Backup and Restore is
Consider scripted solutionConsider scripted solution
Secure your backup locationSecure your backup location
Test your restoreTest your restore
PlanningPlanningDisaster RecoveryDisaster Recovery
What is not backed up and whyWhat is not backed up and why
Are characteristics of other objects in Active DirectoryAre characteristics of other objects in Active Directory
IPSec SettingsIPSec Settings
WMI FiltersWMI Filters
GPO LinksGPO Links
Active Directory Backup or Scripted SolutionActive Directory Backup or Scripted Solution
DCGPOFix – Never use!DCGPOFix – Never use!
PlanningPlanningGroup Policy DependenciesGroup Policy Dependencies
DNS misconfiguration DNS misconfiguration 55
File Replication Service File Replication Service 66
SonarSonar
UltrasoundUltrasound
Policies directory – sysvolPolicies directory – sysvol
Don’t change ACLs or contents manuallyDon’t change ACLs or contents manually
Don’t delete “my disk was full”Don’t delete “my disk was full”
Only use supported toolsOnly use supported tools
PlanningPlanningGroup Policy DependenciesGroup Policy Dependencies
ICMPICMP
Checking if a DC contactableChecking if a DC contactable
Slow Link DetectionSlow Link Detection
If ICMP blocked, disable slow link detectionIf ICMP blocked, disable slow link detection
So Many Policy SettingsSo Many Policy SettingsWhere Do I Start?Where Do I Start?
Policy Settings Reference Spreadsheet Policy Settings Reference Spreadsheet 77
Consider the common scenariosConsider the common scenarios
Think small – iterative deploymentThink small – iterative deployment
SecuritySecurity
OS/Application ConfigurationOS/Application Configuration
IE MaintenanceIE Maintenance
Software InstallationSoftware Installation
Windows 2000 DomainsWindows 2000 DomainsFixing Mismatched ACL’sFixing Mismatched ACL’s
Windows 2000 domains created prior to SP4Windows 2000 domains created prior to SP4
Just let GPMC fix it for youJust let GPMC fix it for you
Relax – is very minor problem!Relax – is very minor problem!
Domain UpgradesDomain UpgradesUpgrading To Windows Server 2003Upgrading To Windows Server 2003
Impact to FRS replication trafficImpact to FRS replication traffic
For Cross-domain GP Modelling, ACE on GPO’sFor Cross-domain GP Modelling, ACE on GPO’s
Only if GPO existed before WS2003 upgradeOnly if GPO existed before WS2003 upgrade
To manage use GrantPermissiononGPO orTo manage use GrantPermissiononGPO orGrantPermissionOnAllGPOsGrantPermissionOnAllGPOs
Alternative in Windows Server 2003 SP1Alternative in Windows Server 2003 SP1
Cross Forest Logon Cross Forest Logon 88
Forest is security boundaryForest is security boundary
User from Forest A logs onto Machine in Forest BUser from Forest A logs onto Machine in Forest B
Differences in behaviour depending on OS Differences in behaviour depending on OS
Windows Server 2003, Windows XP From SP1, Windows Windows Server 2003, Windows XP From SP1, Windows 2000 From SP4:2000 From SP4:
User policy settings come from Forest B (similar to User policy settings come from Forest B (similar to loopback)loopback)
““Allow Cross-Forest User Policy and Roaming User Allow Cross-Forest User Policy and Roaming User Profiles” policy settingProfiles” policy setting
Group Policy “Features”Group Policy “Features”
Administrative TemplatesAdministrative Templates
SecuritySecurity
Machine and User ScriptsMachine and User Scripts
Folder RedirectionFolder Redirection
Resultant Set of Policy (RSoP)Resultant Set of Policy (RSoP)
Software InstallationSoftware Installation
GPMC ScriptingGPMC Scripting
FeaturesFeaturesAdministrative TemplatesAdministrative Templates
What is an “adm” file?What is an “adm” file?
Zero role for a clientZero role for a client
Only for administrative User InterfaceOnly for administrative User Interface
KB 816662 – “Recommendations for Managing Group KB 816662 – “Recommendations for Managing Group Policy Administrative Template Files”Policy Administrative Template Files”
Superset principle from WS2003 RTM onwardsSuperset principle from WS2003 RTM onwards
Historical .adm files available onlineHistorical .adm files available online
Never Never edit the OS-shipped .adm filesedit the OS-shipped .adm files
FeaturesFeaturesAdministrative TemplatesAdministrative Templates
Know the benefits of a “true policy” (as Know the benefits of a “true policy” (as compared to preferences)compared to preferences)
Security (local administrators)Security (local administrators)
Cleanup (if GPO is out of scope)Cleanup (if GPO is out of scope)
IE changes in XP SP2IE changes in XP SP2
FeaturesFeaturesSecurity SettingsSecurity Settings
Not always highest security settingsNot always highest security settings
In XP SP2 “Dangerous” settings warnings In XP SP2 “Dangerous” settings warnings 99
FeaturesFeaturesSecurity SettingsSecurity Settings
FeaturesFeaturesSecurity SettingsSecurity Settings
Domain Level PoliciesDomain Level Policies 1111
Account PoliciesAccount Policies
Rename or Disable Admin/Guest AccountRename or Disable Admin/Guest Account
KerberosKerberos
From W2K SP4 and XP SP2, you can add a From W2K SP4 and XP SP2, you can add a domain group to a local group on a computerdomain group to a local group on a computer 1212
FeaturesFeaturesSecurity SettingsSecurity Settings
Avoid modifying default GPOsAvoid modifying default GPOs
Unfortunately, some applications may expect it Unfortunately, some applications may expect it
User Rights and Password policyUser Rights and Password policy
Applications may update these when installed on DCsApplications may update these when installed on DCs
Replication to all DCsReplication to all DCs
Domain Controller ConsistencyDomain Controller Consistency
OU Selection (don’t change)OU Selection (don’t change)
Don’t use security filteringDon’t use security filtering
FeaturesFeaturesMachine/User ScriptsMachine/User Scripts
Async logon/off scripts finish orderAsync logon/off scripts finish order
Startup scripts security contextStartup scripts security context
Access to both script and referenced resourcesAccess to both script and referenced resources
Local only copy of script Local only copy of script
Consider environment variables Consider environment variables
HKLM update rights for user scriptsHKLM update rights for user scripts
Event logs event sourcesEvent logs event sources
Processing GPO -> UserEnvProcessing GPO -> UserEnv
Running of a script -> UserInitRunning of a script -> UserInit
FeaturesFeaturesFolder RedirectionFolder Redirection
Don’t pre-create foldersDon’t pre-create folders
On Windows 2000…On Windows 2000…
Do not use folder redirection to same machine used for roaming Do not use folder redirection to same machine used for roaming user profilesuser profiles
Fixed in Windows 2003Fixed in Windows 2003
Application data folder redirectionApplication data folder redirection
Recommend not to.Recommend not to.
Cannot redirect to mapped driveCannot redirect to mapped drive
Folder redirection before mapping of drivesFolder redirection before mapping of drives
FeaturesFeaturesRSoPRSoP
No Group Policy Results data available forNo Group Policy Results data available for
IPSec, Wireless, and Disk QuotaIPSec, Wireless, and Disk Quota
Windows 2000 (can simulate)Windows 2000 (can simulate)
Always simulatedAlways simulated
Slow links status, WMI Filters, LoopbackSlow links status, WMI Filters, Loopback
Modelling doesn’t know about the LGPOModelling doesn’t know about the LGPO
EstimationEstimation
FeaturesFeaturesSoftware InstallationSoftware Installation
Async Policy ProcessingAsync Policy Processing
Multiple rebootsMultiple reboots
Wait For Network At Computer Startup and Logon?Wait For Network At Computer Startup and Logon?
Machine assignment of softwareMachine assignment of software
Requires rebootRequires reboot
Gotcha for MMCsGotcha for MMCs
Limit security filteringLimit security filtering
Remember the application administratorsRemember the application administrators
FeaturesFeaturesGPMC ScriptingGPMC Scripting
The 32 sample scriptsThe 32 sample scripts
Building BlocksBuilding Blocks
GPMC API SamplesGPMC API Samples
HTML or XML reports for documentationHTML or XML reports for documentation
FeaturesFeaturesMiscellaneous …Miscellaneous …
Wireless: Need to be on wired network to get Wireless: Need to be on wired network to get certificates for wireless policy (for 802.1x)certificates for wireless policy (for 802.1x)
GPMC: Drag a GPO across domains to an OU or GPMC: Drag a GPO across domains to an OU or domain and you get a cross-domain link (not a domain and you get a cross-domain link (not a copy of the GPO); Instead, drag to Group Policy copy of the GPO); Instead, drag to Group Policy Objects node (note: No links will exist at Objects node (note: No links will exist at this point)this point)
TroubleshootingTroubleshooting
Know your reporting optionsKnow your reporting options
Group Policy Modeling, Group Policy Results - ProactiveGroup Policy Modeling, Group Policy Results - Proactive
Know your toolsKnow your tools
With Operating System: GPUpdate (/force)With Operating System: GPUpdate (/force)
WS 2003 Resource Kit: GPOTool, GPMonitor (push)WS 2003 Resource Kit: GPOTool, GPMonitor (push)
Download Center: GPInventory (gather WMI/RSoP)Download Center: GPInventory (gather WMI/RSoP)
Help and SupportHelp and Support
Group Policy Troubleshooting Whitepaper Group Policy Troubleshooting Whitepaper 1313
Consider the GP Management Pack (GPMP) for MOMConsider the GP Management Pack (GPMP) for MOM
TroubleshootingTroubleshooting
Using the Local GPO (LGPO)Using the Local GPO (LGPO)
A good option if you don’t have access to change GPOs in a domain (not all settings A good option if you don’t have access to change GPOs in a domain (not all settings will be available – software installation and folder redirection, for example)will be available – software installation and folder redirection, for example)
Updating the LGPO on a domain-joined PC has no impact when using cached Updating the LGPO on a domain-joined PC has no impact when using cached credentialscredentials
Read the Explain Text for Admin Templates and Help for Read the Explain Text for Admin Templates and Help for Security SettingsSecurity Settings
Remember the /force switchRemember the /force switch
If you move a user/computer to a new OU, the change will not take place If you move a user/computer to a new OU, the change will not take place immediately (GetUserNameEx caches the location of a user/computer for 30 immediately (GetUserNameEx caches the location of a user/computer for 30 mins); Reboot/Logon to resolvemins); Reboot/Logon to resolve
Consider using a Virtual PC - especially helpful for tattooing security settings; Consider using a Virtual PC - especially helpful for tattooing security settings; Undo when done!Undo when done!
We Want To Hear From You…We Want To Hear From You…
Please visit the new Windows Server Feedback site:Please visit the new Windows Server Feedback site:
http://www.windowsserverfeedback.com/http://www.windowsserverfeedback.com/
““Help us improve Windows Server by providing us with your suggestions and Help us improve Windows Server by providing us with your suggestions and ideas; All feedback submitted will be sent to the Windows Server Development ideas; All feedback submitted will be sent to the Windows Server Development Team for review and analysis Your ideas can impact Windows Server in many Team for review and analysis Your ideas can impact Windows Server in many
ways, and might even be incorporated into new Service Packs, Feature Packs, or ways, and might even be incorporated into new Service Packs, Feature Packs, or the next Windows Server release “the next Windows Server release “
ReferencesReferences
1.1. Redirecting the Users and Computers Containers in Windows Server 2003 Redirecting the Users and Computers Containers in Windows Server 2003 KB 324949KB 324949
2.2. Group Policy Common Scenarios Using GPMC http://go.microsoft.com/fwlink/?Group Policy Common Scenarios Using GPMC http://go.microsoft.com/fwlink/?LinkId=14951LinkId=14951
3.3. Scriptomatic Tool http://www.microsoft.com/technet/scriptcenter/tools/wmimatic.mspxScriptomatic Tool http://www.microsoft.com/technet/scriptcenter/tools/wmimatic.mspx
4.4. Staging Group Policy Deployments (Chapter 3, Windows Server 2003 Deployment Kit - Staging Group Policy Deployments (Chapter 3, Windows Server 2003 Deployment Kit - Designing a Managed Environment Book) Designing a Managed Environment Book) http://www.microsoft.com/downloads/http://www.microsoft.com/downloads/details.aspx?familyiddetails.aspx?familyid=b671967b-ef65-4ccf-9d00-89d6ae428edc&displaylang=en=b671967b-ef65-4ccf-9d00-89d6ae428edc&displaylang=en
5.5. Monitoring and Troubleshooting the File Replication Support Webcast: DNS In the Monitoring and Troubleshooting the File Replication Support Webcast: DNS In the Active Directory Part 2: Best Practices, Common Problems and Troubleshooting Active Directory Part 2: Best Practices, Common Problems and Troubleshooting http://support.microsoft.com/default.aspx?scid=/servicedesks/webcasts/wc030601/http://support.microsoft.com/default.aspx?scid=/servicedesks/webcasts/wc030601/wcblurb030601.asp wcblurb030601.asp
6.6. File Replication Service (FRS) – includes Sonar and Ultrasound File Replication Service (FRS) – includes Sonar and Ultrasound http://www.microsoft.com/windowsserver2003/technologies/fileandprint/file/dfs/http://www.microsoft.com/windowsserver2003/technologies/fileandprint/file/dfs/tshootfrs.mspxtshootfrs.mspx
7.7. Group Policy Settings Reference Spreadsheet (with history) Group Policy Settings Reference Spreadsheet (with history) http://go.microsoft.com/fwlink/?linkid=22031 http://go.microsoft.com/fwlink/?linkid=22031
8.8. Cross Forest Logon, Loopback and User Policy Logon Cross Forest Logon, Loopback and User Policy Logon KB 823862 KB 823862
9.9. Recommendations for Managing Group Policy Administrative Template Files Recommendations for Managing Group Policy Administrative Template Files KB 816662 KB 816662
ReferencesReferences
10.Client, Service and Program Incompatibilities That May 10.Client, Service and Program Incompatibilities That May Occur When Modifying Security Settings and User Rights Occur When Modifying Security Settings and User Rights Assignments Assignments KB 823659 KB 823659
11 Threats and Countermeasures: Security Policy Settings 11 Threats and Countermeasures: Security Policy Settings in WS 2003 and XP in WS 2003 and XP http://www.microsoft.com/downloads/details.aspx?http://www.microsoft.com/downloads/details.aspx?FamilyID=1b6acf93-147a-4481-9346-FamilyID=1b6acf93-147a-4481-9346-f93a4081eea8&displaylang=en#filelistf93a4081eea8&displaylang=en#filelist
12 Adding Domain Groups to Local Machine Groups on 12 Adding Domain Groups to Local Machine Groups on Member Computers Member Computers KB 810076 KB 810076
13 Troubleshooting Group Policy with Windows Server 2003 13 Troubleshooting Group Policy with Windows Server 2003 http://go.microsoft.com/fwlink/?LinkId=14949http://go.microsoft.com/fwlink/?LinkId=14949
© 2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only.© 2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only.MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.