Group Policy Settings in Visual Studio .NET

Generator Code-128 in Visual Studio .NET Group Policy Settings

7

Settings are configured in the template in the same way that settings are configured in a GPO. The Security Templates snap-in is used to configure settings in a security template. It is just an editor it does not play any role in actually applying those settings to a system. Configure security settings in a template by using the Security Templates snap-in. Although the template itself is a text file, the syntax can be confusing. Using the snap-in ensures that settings are changed using the proper syntax. The exception to this rule is adding Registry settings that are not already listed in the Local Policies\Security Option portion of the template. As new security settings become known, if they can be configured using a Registry key, you can add them to a security template. To do so, you add them to the Registry Values section of the template.

The article How to Add Custom Registry Settings to Security Configuration Editor helps you understand how to perform this task. You can find it at http://support.microsoft.com/ kbid=214752.

Be sure to save your changes to a security template by right-clicking the template and choosing Save.

When you install a server or promote it to a domain controller, a default security template is applied by Windows. You can find that template in the %SystemRoot%\Security\Templates folder. On a domain controller, the template is called DC security.inf. You should not modify this template directly, but you can copy it to your template search path and modify the copy.

In previous versions of Windows, a number of security templates were available to modify and apply to a computer. The new role-based configuration of Windows Server 2008 and the improved Security Configuration Manager have made these templates unnecessary.

Creating and modifying security templates does not improve security unless you apply those templates. To configure a number of computers in a single operation, you can import a security template into the Group Policy Object for a domain, site, or organizational unit object in Active Directory. To import a security template into a GPO, right-click the Security Settings node and choose Import Policy. In the Import Policy From dialog box, if you select the Clear This Database Before Importing check box, all security settings in the GPO will be erased prior to importing the template settings, so the GPO s security settings will match the template s settings. If you leave the Clear This Database Before Importing check box deselected, the GPO s security policy settings will remain and the templates settings will be imported. Any settings defined in the GPO that are also defined in the template will be replaced with the template s setting.

You can use the Security Configuration and Analysis snap-in to apply a security template to a computer interactively. The snap-in also provides the ability to analyze the current system security configuration and compare it to a baseline saved as a security template. This enables you to determine quickly whether someone has changed a computer s security settings and whether the system conforms to your organization s security policies. As with the Security Templates snap-in, Windows Server 2008 does not include a console with the Security Configuration and Analysis snap-in, so you must add the snap-in to a console yourself. To use the Security Configuration and Analysis snap-in, you must first create a database that will contain a collection of security settings. The database is the interface between the actual security settings on the computer and the settings stored in your security templates. Create a database (or open an existing one) by right-clicking the Security Configuration And Analysis node in the console tree. You can then import one or more security templates. If you import more than one template, you must decide whether to clear the database. If the database is cleared, only the settings in the new template will be part of the database. If the database is not cleared, additional template settings that are defined will override settings from previously imported templates. If settings in newly imported templates are not defined, the settings in the database from previously imported templates will remain. To summarize, the Security Configuration and Analysis snap-in creates a database of security settings composed of imported security template settings. The settings in the database can be applied to the computer or used to analyze the computer s compliance and discrepancies with the desired state.