Managing Group Policy in Visual C#.NET

Drawer DataMatrix in Visual C#.NET Managing Group Policy

In addition to these two categories, the default Starter GPOs in RSAT for Windows 7 can also be categorized by whether they do the following:

Apply only to clients running Windows XP SP2 or later or Windows Vista SP1 or later . Apply to users or to computers .

The result of this categorization is the following eight types of Starter GPOs included in RSAT for Windows 7:

Windows Vista EC Computer Windows Vista EC User Windows Vista SSLF Computer Windows Vista SSLF User Windows XP EC Computer Windows XP EC User Windows XP SSLF Computer Windows XP SSLF User

For more information concerning the default configuration of policy settings in Starter GPOs designed for Windows Vista SP1 or later, see the Windows Vista Security Guide at http://go.microsoft.com/ linkID=5744573. For more information concerning the default configuration of policy settings in Starter GPOs designed for Windows XP SP2 or later, see the Windows XP Security Compliance Management Toolkit at http://go.microsoft.com /fwlink/ LinkId=14839. Updated information on Starter GPOs should also be available; search for Windows 7 Security Guide on the Microsoft Download Center . Before you can use Starter GPOs, you must prepare your environment by creating a separate folder for these GPOs in the SYSVOL share on your domain controllers . If your forest has more than one domain, you must create a separate Starter GPOs folder in each domain of your forest . To create the Starter GPOs folder, perform the following steps:

1. 2. 3.

Open the GPMC and select the Starter GPOs node in the console tree for the domain . Click the Create Starter GPOs Folder button in the details pane (see Figure 14-3) . Repeat for each domain in your forest .

After you create your Starter GPOs folder, you can use the default Starter GPOs as templates when you create new GPOs, as described in the next section . You can also create and manage your own Starter GPOs by right-clicking the Starter GPOs node in the console tree of the GPMC .

To create and configure a GPO using the GPMC, follow these steps:

1. 2.

Log on to an administrative workstation running Windows 7 with RSAT using a user account that is a member of the Domain Admins built-in group . Right-click Start and then click Properties . On the Start Menu tab, click Customize . Then in the Customize Start Menu dialog box, scroll down to System Administrative Tools, select Display On The All Programs Menu And The Start Menu, and click OK . Click Start, then Administrative Tools, and then Group Policy Management . (Alternatively, you can type gpmc.msc in the Start Search box and then click gpmc .msc when it appears under Programs in your search results .) Expand the console tree to select the domain or OU to which you will link the new GPO when you create it . Right-click this domain or OU and select Create A GPO In This Domain And Link It Here . Type a descriptive name for your new GPO, such as Seattle Computers gPO, and (optionally) select a Starter GPO as a template for it . Then click OK . Expand the domain or OU to display the GPO link for your new GPO beneath it, as shown in the following image .

4. 5. 6. 7.

8. 9.

Right-click the GPO link and then select Edit to open the GPO . Configure policy settings and preference items in the GPO as desired for the computers and/or users targeted by the GPO .

to log on to the network, the computer will log on using cached credentials and will use the local copies of the aDMX template files to surface aDM policy settings in the Local Group policy Editor. also, if an administrator uses a computer running Windows 7 with RSaT to start GpMC or the Local Group policy Editor and no central store is found, local copies of the aDMX template files will be used to surface aDM policy settings in the Local Group policy Editor.