winforms code 128 Lesson 3 in VB.NET

Drawer Data Matrix 2d barcode in VB.NET Lesson 3

9-33

Tip Although Active Directory objects inherit group policy settings from their parent objects by default, it is possible to block the inheritance. Display the Properties dialog box for an object, click the Group Policy tab, and then select the Block Policy Inheritance check box to prevent that object from inheriting group policy settings from its parent objects.

Instead of manually linking your GPOs to the various organizational unit objects in your Active Directory tree, you can also create a hierarchy of organizational unit objects, as shown in Figure 9-13. In this figure, you see the Members organizational unit, with the role-specific organizational units beneath it.

As with most tree hierarchies in Windows operating systems, the properties of a parent object are passed down to the child objects beneath it. Therefore, when you create a GPO and link it to the Members container, not only the computer objects in Members receive the policy settings from the GPO; all the computers in the role-specific organi zational units receive these settings.

The one exception to the rule of group policy inheritance is that subdomains do not inherit group policy settings from their parent domains.

Tip If you plan to create a hierarchy of organizational units that includes domain controllers in one of the role-specific containers, you will not be able to move the Domain Controllers organizational unit object that Windows Server 2003 creates automatically at domain cre ation to another location in the tree. However, you can create a new organizational unit object in the hierarchy and move the computer objects there from the Domain Controllers container.

9-34

9

To create security configurations for the servers in the role-specific organizational units, you create a new GPO for each container. When you do this, the policy settings in the GPOs linked to the role-specific containers take precedence over the settings for the same policies in the parent container s GPO. The rules governing the combination of inherited and direct policy settings are as follows:

If the parent container s GPO contains a policy setting, and the same policy is undefined in the child container s GPO, the objects in the child container use the setting from the parent GPO. If the child container s GPO contains a policy setting, and the same policy is unde fined in the parent container s GPO, the objects in the child container use the set ting from the child GPO. If the parent container s GPO contains a policy setting, and the same policy has a different setting in the child container s GPO, the objects in the child container use the setting from the child GPO.

When you apply multiple GPOs to a container, whether with multiple links or with a hierarchical GPO arrangement, it is important to understand the difference between an undefined policy and an explicit policy setting. An undefined policy is not necessarily the same as a Disabled setting. When you leave a policy unde fined in the GPO, the computers to which that GPO applies use the operating sys tem s default setting, which might be Enabled, Disabled, or something else, depending on the policy. If you define a policy with an Enabled value in the par ent container s GPO, you must explicitly define the same policy in the child con tainer s GPO to assign it a different value, even if that value is the same as the Windows Server 2003 default setting.

In this practice, you use two different methods to combine the policies in the GPOs you created for the Member Servers and Domain Controllers organizational units in the practices for Lessons 1 and 2 of this chapter. First, you link both GPOs to a single con tainer and modify the order in which the system applies them. Then, you create a hier archy of organizational units and use group policy inheritance to combine policy settings.