Group Policy Infrastructure in Visual Studio .NET

Encoder USS Code 128 in Visual Studio .NET Group Policy Infrastructure

6

Group Policy settings are presented as GPOs in Active Directory user interface tools, but a GPO is actually two components: a Group Policy Container (GPC) and Group Policy Template (GPT). The GPC is an Active Directory object stored in the Group Policy Objects container within the domain naming context of the directory. Like all Active Directory objects, each GPC includes a globally unique identifier (GUID) attribute that uniquely identifies the object within Active Directory. The GPC defines basic attributes of the GPO, but it does not contain any of the settings. The settings are contained in the GPT, a collection of files stored in the SYSVOL of each domain controller in the %SystemRoot%\SYSVOL\Domain\Policies\GPO GUID path, where GPO GUID is the GUID of the GPC. When you make changes to the settings of a GPO, the changes are saved to the GPT of the server from which the GPO was opened. By default, when Group Policy refresh occurs, the CSEs apply settings in a GPO only if the GPO has been updated. The Group Policy client can identify an updated GPO by its version number. Each GPO has a version number that is incremented each time a change is made. The version number is stored as an attribute of the GPC and in a text file, GPT.ini, in the GPT folder. The Group Policy client knows the version number of each GPO it has previously applied. If, during Group Policy refresh, it discovers that the version number of the GPC has been changed, the CSEs will be informed that the GPO is updated.

Describe the default Group Policy processing behavior, including refresh intervals and CSE application of policy settings.

Quick Check Answer Every 90 120 minutes, the Group Policy Client service determines which GPOs are scoped to the user or computer and downloads any GPOs that have been updated, based on the GPOs version numbers. CSEs process the policies in the GPOs according to their policy processing configuration. By default, most CSEs apply policy settings only if a GPO has been updated. Some CSEs also do not apply settings if a slow link is detected.

The two parts of a GPO are replicated between domain controllers by using distinct mechanisms. The GPC in Active Directory is replicated by the Directory Replication Agent (DRA), using a topology generated by the Knowledge Consistency Checker (KCC). You will learn more about these services in 11, Sites and Replication. The result is that the GPC is replicated within seconds to all domain controllers in a site and is replicated between sites based on your intersite replication configuration, which will also be discussed in 11.

The GPT in the SYSVOL is replicated using one of two technologies. The File Replication Service (FRS) is used to replicate SYSVOL in domains running Windows Server 2008, Windows Server 2003, and Windows 2000. If all domain controllers are running Windows Server 2008, you can configure SYSVOL replication, using Distributed File System Replication (DFS-R), a much more efficient and robust mechanism. Because the GPC and GPT are replicated separately, it is possible for them to become out of synch for a short time. Typically, when this happens, the GPC will replicate to a domain controller first. Systems that obtained their ordered list of GPOs from that domain controller will identify the new GPC, will attempt to download the GPT, and will notice the version numbers are not the same. A policy processing error will be recorded in the event logs. If the reverse happens, and the GPO replicates to a domain controller before the GPC, clients obtaining their ordered list of GPOs from that domain controller will not be notified of the new GPO until the GPC has replicated. You can download from the Microsoft Download Center the Group Policy Verification Tool, Gpotool.exe, which is part of Windows Resource Kits. This tool reports the status of GPOs in the domain and can identify instances in which, on a domain controller, the GPC and the GPT do not have the same version. For more information about Gpotool.exe, type gpotool / at the command line. Exam Tip

Gpotool.exe is used to troubleshoot GPO status, including problems caused by the replication of GPOs, leading to inconsistent versions of a GPC and GPT.