qr code generator c# Linking GPOs to a Domain in Visual C#

Making QR Code JIS X 0510 in Visual C# Linking GPOs to a Domain

GPOs linked to a domain apply to all users and computers in the domain. This is a powerful policy, so you should keep GPOs at this level to a minimum. The typical use for GPOs at the domain level is to implement corporate standards. For example, a com pany might have a standard requirement that all users and computers use the same password and authentication policy company-wide. This would be a perfect applica tion of a domain-based GPO.

Very few GPOs are linked to sites, mostly because it is more efficient to link GPOs to geographically-based OUs. However, there are circumstances in which linking a GPO to a site is an appropriate choice. If you have requirements for settings that are com mon to all computers in a particular physical location and that location is defined by a site, then linking a GPO to that site might make sense. For example, computers in a particular branch office might need a particular network configuration applied for Internet connectivity. A site-based GPO would be ideal for that situation.

For the most part, it s better to link GPOs to a well-thought-out OU structure than to sites or domains. OUs provide the most flexibility because you can, at least in part, design the structure to facilitate Group Policy. Also, OUs offer more administrative flex ibility. You can move users and computers between OUs easily and also rearrange or rename the OUs themselves.

4-38

4

By default, new user and computer accounts are created in the Users and Com puters containers, respectively. You cannot link a GPO to either of these built-in containers. Even though the built-in containers inherit GPOs linked to the domain, you may have a situation that requires user accounts and computer accounts to be stored in an OU to which you can link a GPO. Windows Server 2003 includes two new tools that let you redirect the target loca tion for new user and computer accounts. You can use redirusr.exe to redirect user accounts and redircomp.exe to redirect computer accounts. Once you choose the OU for redirection, new user and computer accounts are created directly in the new target OU, where the appropriate GPOs are linked. For exam ple, you could create an OU named New Users, link an appropriate GPO to the OU, and then redirect the creation of new-users accounts to the New Users OU. Any new users created would immediately be affected by the settings in the GPO. Administrators could then move the new user accounts to a more appropriate location later. You can find both of these tools in the %windir%\system32 folder on any com puter running Windows Server 2003. You can learn more about using these tools in Knowledge Base article 324949, Redirecting the Users and Computers Con tainers in Windows Server 2003 Domains, in the Microsoft Knowledge Base at http://support.microsoft.com.

An important aspect of planning Group Policy for a company is creating a plan for the management of Group Policy following the initial deployment. Part of this manage ment plan will be determining who manages Group Policy within an organization. Another part is making sure that the client computers on the network can accept set tings imposed by a GPO.

Most likely, the creation and management tasks involved with GPOs will need to be delegated to different administrators in an organization. Based on your organization s administrative model, you need to determine which aspects of configuration manage ment can best be handled at the site, domain, and OU levels. You also need to determine how responsibilities at each site, domain, and OU level might be further subdivided among the available administrators or administrative groups at each level.