Microsoft Press Windows Vista Administrator's Pocket Consultant ebook

by MS

  Note

  You upgrade GPOs using a computer running Windows Vista or a later version of the Windows operating system. Once you've performed the update and made any necessary changes, you can perform basic management, such as policy linking or blocking, using any computer. However, it is recommended that the actual policy editing be done on a computer running Windows Vista or later.

  You update the domain GPO by following these steps:

  Using an account with domain administrator privileges, log on to a computer running Windows Vista or a later release of Windows.

  Click Start, type mmc, and then press Enter. Alternatively, you can type mmc at a command prompt. This starts the Microsoft Management Console (MMC).

  On the File menu, click Add/Remove Snap-In. This opens the Add/Remove Snap-In dialog box.

  In the Add Or Remove Snap-Ins dialog box, click Group Policy Management Console. Click Add and then click OK.

  In MMC, when you expand the Group Policy Management node, you'll see a Forest node representing the current forest to which you are connected. When you expand the Forest node, you'll then see Domains and Sites nodes. Use these nodes to work your way to the Group Policy Object (GPO) you want to work with.

  When you find the GPO you want to work with, right-click it and then select edit to open the Group Policy Object Editor.

  In the Group Policy Object Editor, select the Computer Configuration node by clicking it, and then select the User Configuration node by clicking it. When you select these nodes, the current administrative templates are read in, and applied to, the GPO you've selected. Once Group Policy is refreshed, you can modify policy settings as necessary, and the changes will be updated as appropriate in the selected site, domain, or OU.

  Repeat this procedure to update the GPO for other sites, domains, or OUs.

  Configuring Policies

  To manage users and computers, you'll want to configure the administrative template policies. These policies provide easy access to registry-based policy settings that control the operating system, Windows components, and programs. Although earlier versions of Windows that support Group Policy use Administrative Template (.ADM) files with a proprietary markup language to store registry-based policy settings, Windows Vista uses a standards-based Extensible Markup Language (XML) file format called ADMX. Unlike .ADM files, which are stored in the GPO to which they relate, .ADMX files are stored in a central repository. In domains, central storage of .ADMX files makes them easier to work with and manage.

  Viewing Policies and Templates

  As shown in Figure 8-2, you can view the currently configured templates in the Group Policy Object Editor's Administrative Templates node, which contains policies that can be configured for local systems, OUs, domains, and sites. Different sets of templates are found under Computer Configuration and User Configuration. You can add templates containing new policies, both manually in the Group Policy console and when you install new Windows components.

  Figure 8-2: Set user and computer policies through administrative templates.

  Any changes you make to policies available through the administrative templates are saved in the registry. Computer configurations are saved in HKEY_LOCAL_MACHINE, and user configurations are saved in HKEY_USER. Browsing the Administrative Templates node in the Group Policy Object Editor is the best way to become familiar with available administrative template policies. As you browse the templates, you'll find that policies are in one of three states:

  Not Configured The policy isn't used, and its settings do not impact the existing configuration on the computer.

  Enabled The policy is active, and its settings are saved in the registry.

  Disabled The enabled behavior of the policy is not on. The policy may have a specific disabled behavior that is contrary to its enabled setting. This setting is saved in the registry.

  Enabling, Disabling, and Configuring Policies

  In the Group Policy Object Editor, you'll find administrative templates in two nodes: Computer Configuration and User Configuration. In most cases, the policies in these areas don't overlap or conflict with each other. If there is a conflict, however, computer policies have precedence, which means that the computer policy is the one that is enforced. Later in this chapter, you'll find details on commonly used policies and how to employ them.

  You can enable, disable, and configure policies by completing the following steps:

  Access the Group Policy Object Editor for the resource you want to work with. Then in the Computer Configuration or User Configuration node, whichever is appropriate for the type of policy you want to set, access the Administrative Templates folder.

  In the left pane, click the subfolder containing the policies you want to work with. The related policies are displayed in the right pane.

  Double-click or right-click a policy and select Properties to display its Properties dialog box.

  Click the Explain tab to see a description of the policy, if one is available.

  To set the policy's state, click the Setting tab and then use the following buttons to change the state of the policy:

  q Not Configured The policy is not configured.

  q Enabled The policy is enabled.

  q Disabled The policy is disabled.

  If you enabled the policy, set any additional parameters specified on the Setting tab and then click Apply.

  Use the Previous Setting and Next Setting buttons to manage other policies in the current folder. Then configure them as discussed in steps 4–6.

  Click OK when you're finished managing policies.

  Adding or Removing Templates

  You can add or remove template folders in the Group Policy Object Editor. To do this, complete the following steps:

  Access the Group Policy Object Editor for the site, domain, or OU you want to work with.

  In the Computer Configuration or User Configuration node, whichever is appropriate for the type of template you want to add or remove, right-click the Administrative Templates folder and select Add/Remove Templates. This displays the Add/Remove Templates dialog box, shown in Figure 8-3.

  Figure 8-3: Use the Add/Remove Templates dialog box to add more templates or remove existing ones.

  To add new templates, click Add. Then, in the Policy Templates dialog box, select the template you want to add and click Open.

  To remove an existing template, select the template to remove and then click Remove.

  When you're finished adding and removing templates, click Close.

  Working with File and Data Management Policies

  Every system administrator should be familiar with file and data management policies, which affect the amount of data a user can store on systems, how offline files are used, and whether the System Restore feature is enabled.

  Configuring Disk Quota Policies

  Policies that control disk quotas are applied at the system level. You access these policies through Computer ConfigurationAdministrative TemplatesSystemDisk Quotas. The available policies are summarized in Table 8-1.

  Table 8-1: Disk Quota Policies

  Policy Name

  Description

  Apply Policy To Removable Media

  Determines whether to extend quota policies to NTFS volumes on removable media. If you do not enable this policy, quota limits only apply to fixed media drives.

  Default Quota Limit And Warning Level

  Sets a default quota limit and warning level for all users. This setting overrides other settings and only affects new users of a volume.

  Enable Disk Quotas

  Turns disk quotas on or off for all NTFS volumes of the computer and prevents users from changing the setting.

  Enforce Disk Quota Limit

  Specifies whether quota limits are enforced. If quotas are enforced, users are denied disk space if they exceed the quota. This overrides settings on the Quota tab on the NTFS volume.

  Log Event When Quota Limit Exceeded

  Determines wh
ether an event is logged when users reach their limit and prevents users from changing their logging options.

  Log Event When Quota Warning Level Exceeded

  Determines whether an event is logged when users reach the warning level.

  Whenever you work with quota limits, you'll want to use a standard set of policies on all systems. Typically, you won't want to enable all the policies. Instead, selectively enable policies and then use the standard NTFS features to control quotas on various volumes. If you want to enable quota limits, use the following technique:

  Access Group Policy for the system, site, domain, or OU you want to work with. Next, access the Disk Quotas node through Computer ConfigurationAdministrative TemplatesSystemDisk Quotas.

  Double-click Enable Disk Quotas. On the Setting tab, select Enabled and then click Next Setting. This displays the Enforce Disk Quota Limit Properties dialog box.

  If you want to enforce disk quotas on all NTFS volumes residing on this computer, select Enabled. Otherwise, select Disabled and then set specific limits on a per volume basis, as discussed in Chapter 11, "Configuring Advanced Windows Explorer Options, Offline Files, and Disk Quotas." Click OK.

  Double-click Default Quota Limit And Warning Level. The Default Quota Limit And Warning Level Properties dialog box, shown in Figure 8-4, appears. Select Enabled.

  Figure 8-4: Use the Default Quota Limit And Warning Level Properties dialog box to establish disk quota values.

  Under Default Quota Limit, set a default limit that is applied to new users when they first write to the quota-enabled volume. The limit does not apply to current users and doesn't affect current limits. On a corporate share, such as a share used by all members of a team, a good limit is between 1 gigabyte (GB) and 3 GB. Of course, this depends on the size of the data files the users routinely work with. Graphic designers and data engineers, for example, might need much more disk space.

  Scroll down in the subwindow provided on the Setting tab to set a warning limit as well. A good warning limit is about 90 percent of the default quota limit, meaning that if you set the default quota limit to 1 GB, you'd set the warning limit to 900 MB. Click OK.

  Double-click Log Event When Quota Limit Exceeded. The Log Event When Quota Limit Exceeded Properties dialog box appears. Select Enabled so that limit events are recorded in the application log. Click OK.

  Double-click Log Event When Quota Warning Exceeded. The Log Event When Quota Warning Exceeded Properties dialog box appears. Select Enabled so that warning events are recorded in the application log. Click OK.

  Double-click Apply Policy To Removable Media. The Apply Policy To Removable Media Properties dialog box appears. Select Disabled so that the quota limits only apply to fixed media volumes on the computer.

  Click OK.

  Configuring System Restore Policies

  System Restore is designed to save the state of system volumes and enable users to restore a system in the event of a problem. It is a helpful feature for the average user, but it can use a tremendous amount of disk space. As you learned in Chapter 2, "Managing Windows Vista Systems," you can turn System Restore off for individual drives or for all drives on a computer.

  In the Group Policy console, you'll find the System Restore policies under Computer ConfigurationAdministrative TemplatesSystemSystem Restore. Through System Restore policies, you can override and disable management of this feature. The following policies are available:

  Turn Off System Restore If you enable this policy, System Restore is turned off and can't be managed using the System utility or the System Restore Wizard. If you disable this policy, System Restore is enforced and cannot be turned off.

  Turn Off Configuration If you enable this policy, you prevent configuration of the System Restore feature. Users can't access the Settings dialog box but can still turn off System Restore. If you disable this policy, users can access the Settings dialog box but can't manipulate it, and they can still turn off System Restore.

  To configure System Restore policies, follow these steps:

  Access Group Policy for the system, site, domain, or OU you want to work with. Next, access the System Restore node by expanding Computer ConfigurationAdministrative TemplatesSystemSystem Restore.

  To enable or disable System Restore, double-click Turn Off System Restore. On the Setting tab, select either Enabled or Disabled as appropriate. Click OK.

  To enable or disable configuration of System Restore, double-click Turn Off Configuration. On the Setting tab, select either Enabled or Disabled as appropriate. Click OK.

  Configuring Offline File Policies

  Offline file policies are set at both the computer and the user level, and there are identically named policies at each level. If you work with identically named policies at both levels, keep in mind that computer policies override user policies and that these policies may be applied at different times.

  The primary policies you'll want to use are summarized in Table 8-2. As the table shows, most offline policies affect access, synchronization, caching, and encryption. You'll find Offline File policies under Computer Configuration Administrative TemplatesNetworkOffline Files and User Configuration Administrative TemplatesNetworkOffline Files.

  Table 8-2: Offline File Policies

  Policy Type

  Policy Name

  Description

  Computer

  Allow Or Disallow Use Of The Offline Files Feature

  Forces enabling or disabling of the Offline Files feature and prevents overriding by users. Enables administrative control of Offline File settings for a system.

  Computer

  At Logoff, Delete Local Copy Of User's Offline Files

  At logoff, cleans up the offline file cache on the local computer.

  Computer

  Configure Slow-Link Mode

  Controls how slow links are used. Enabled: slow link values for each shared folder used with Offline Files are configured. Disabled: offline files will not use slow link mode.

  Computer

  Default Cache Size

  Limits size of automatically cached offline files and prevents users from changing related options. Enabled: you can set a cache size. Disabled: the limit is 10 percent of drive space.

  Computer

  Encrypt The Offline Files Cache

  Determines whether offline files are encrypted to improve security.

  Computer

  Files Not Cached

  Lists types of files, by file extension, that cannot be used offline.

  Computer

  Subfolders Always Available Offline

  Makes subfolders available offline when a parent folder is available offline.

  Computer

  Turn On Economical Application Of Administratively Assigned Offline Files

  Determines how administratively assigned files and folders are synced at logon. Enabled: only new files and folders are synced at logon. Disabled: all files and folders are synced at logon.

  ComputerUser

  Action On Server Disconnect

  Specifies how the system responds when a server becomes unavailable. The Work Offline action ensures offline files are available.

  ComputerUser

  Administratively Assigned Offline Files

  Using Universal Naming Convention (UNC) path, specifies files and folders that are always available offline.

  ComputerUser

  Event Logging Level

  Ensures offline file events are logged in the application log.

  ComputerUser

  Prevent Use Of Offline Files Folder

  Prevents users from accessing the Offline Files folder. Users copies of cached files, but they can work offline.

  ComputerUser

  Prohibit "Make Available Offline" For These Files And Folders

  Prohibits users from making specific files and folders available offline. Enter UNC paths to resources.

  ComputerUser

  Prohibit User Configuration
Of Offline Files

  Prevents users from enabling, disabling, and configuring Offline Files. This locks down the default settings for Offline Files.

  ComputerUser

  Remove "Make Available Offline"

  Prevents users from making files available offline.

  ComputerUser

  Synchronize All Offline Files Before Logging Off

  Forces full synchronization before users log off and prevents them from changing synchronization timing.

  ComputerUser

  Synchronize All Offline Files When Logging On

  Forces full synchronization when users log on and prevents them from changing synchronization timing.

  ComputerUser

  Synchronize Offline Files Before Suspend

  Forces synchronization before a computer goes into standby or hibernate mode. You can specify quick or full synchronization.

  User

  Do Not Automatically Make Redirected Folders Available Offline

  By default, if Folder Redirection is configured, these folders are available offline automatically. Enabled: automatic redirection turned off. Users can, however, enable offline use of the redirected folders.

  Setting Offline File Configuration Policies

  Offline file configuration can be easily controlled through policy. You can allow users to specify which files and folders should be available offline, prevent them from configuring offline file features on their own, and allow them to work offline but not access other cached resources. Follow these steps to set offline file configuration policies:

  Access Group Policy for the system, site, domain, or OU you want to work with. Most offline file policies can be configured in either computer or user policy (with user policies having precedence by default) by using the Offline Files node. You can access the policies for offline files either by expanding Computer ConfigurationAdministrative TemplatesNetworkOffline Files or User ConfigurationAdministrative TemplatesNetworkOffline Files unless specifically noted otherwise.