POLICIES AND PREFERENCES in VS .NET

Creator QR Code ISO/IEC18004 in VS .NET POLICIES AND PREFERENCES

Beneath the Computer Configuration and User Configuration nodes, you find two secondlevel headings: Policies and Preferences. The Policies nodes contain the Group Policy settings that have been present since Active Directory directory service was first introduced. Microsoft first added the Preferences nodes in Windows Server 2008 and Windows Vista. Group Policy preferences include settings that were previously configurable only by using scripts, such as drive mappings and printer connections. In contrast, Preferences do not permanently lock down settings so that users cannot change them. Preferences enable administrators to deploy settings without enforcing them. With the introduction of Preferences, administrators can now deploy a complete workstation configuration using GPOs, which allow them to avoid scripting entirely.

Also new in Windows Server 2008 and Windows Vista are starter GPOs, which you can use to create your own custom GPOs. Starter GPOs are special Group Policy objects that contain only Administrative Templates settings, as shown in Figure 4-6. When you create a new GPO from a starter GPO, the new GPO automatically receives all of the settings in the starter GPO. You can therefore create a starter GPO containing baseline settings and use it to create individual GPOs containing settings for specific workstation configurations.

The GPMC implementations for Windows 7 and Windows Server 2008 R2 include eight preconfigured starter GPOs, as shown in Figure 4-7, four for Windows Vista (which you can also apply to Windows 7 workstations) and four for Windows XP R2.

These starter GPOs contain Computer Configuration and User Configuration settings for two preconfigured workstation environments: Enterprise Client (EC) and Specialized Security Limited Functionality (SSLF), as defined in the Windows 7 Security Guide. The EC environment is a standard configuration for AD DS based networks, while SSLF is a highly restrictive environment that provides additional security by limiting user access to operating system functions.

The Windows 7 Security Guide is part of the Security Compliance Management Toolkit for Windows 7, available from the Microsoft Download Center at http:// www.microsoft.com/downloads/details.aspx FamilyID=5534bee1-3cad-4bf0-b92ba8e545573a3e&displaylang=en.

When you create your own GPOs for your workstation configurations, you can choose from two basic approaches: monolithic or functional. A monolithic GPO is one that contains all of the settings a workstation needs, including Computer Configuration and User Configuration settings, Policies and Preferences settings, and Administrative Templates settings. As with the thick images discussed in 3, monolithic images are easier to manage because everything is in one place. However, in a complex administration environment, monolithic GPOs could cause problems because you cannot delegate administration of specific parts of a GPO. Functional GPOs, by contrast, are more numerous, contain relatively few settings, and are dedicated to a specific area or type of setting. For example, you might consider creating separate GPOs for your Computer Configuration and User Configuration settings. In the same way, you can separate Policies and Preferences settings. Administrators typically create divisions like these to accommodate an AD DS design. For example, if your domain hierarchy separates computer objects and user objects into separate organizational units, it makes sense to assign a GPO containing Computer Configuration settings to one OU and a User Configuration GPO to another. Administrative delegation is another reason for creating functional GPOs. By placing all of your security-related settings in a separate GPO, for example, you can delegate responsibility for it to a security administrator. As with image files, the more functional GPOs you create, the more difficult it is to manage them all. The ultimate solution, in which each configuration setting has its own individual GPO, is in almost every case not practical, but some administrators do create large numbers of GPOs containing only a few settings each. When you create functional GPOs, it is often necessary to link multiple GPOs to a single AD DS object, which complicates the deployment process and can result in performance problems.