Anything about IT

One of the things to consider when deploying Windows 7 clients is to update the Central Store on your domain controllers. If you haven’t created a Central Store yet, I recommend you watch the video or read the documentation I have listed at the end of this post.

If you do have a Central Store already, updating it with the Windows 7 Group Policy Administrative templates is very straight forward. You simply copy the templates that are stored under C:\Windows\PolicyDefinitions on your Windows 7 client to the Central Store which is located at \\FQDN\SYSVOL\FQDN\policies\PolicyDefinitions (FQDN = fully qualified domain name)

A good alternative for copying the files manually is the Vista Central Store Creator Utility from Darren Mar-Elia which automates the whole process of creating and updating the Central Store.

 Related Content
Screencast: How-To Configure the Central ADMX Store
How to create a Central Store for Group Policy Administrative Templates in Window Vista
Group Policy Settings References for Windows and Windows Server

63EHNFN6ZWK8

Group Policies and Group Policy Preferences are great technologies to manage your enterprise desktops. But what if you want to go beyond the features Microsoft has build into the Group Policy Management Console?

With PolicyPak you can consistently manage ANY application’s settings using the Windows native Group Policy technology. have a look at the PolicyPak introduction video below to learn what PolicyPak can do and how it works.

Learn more about PolicyPak and watch the video tutorials.

Other resources

Group Policy Preferences Overview

Microsoft Group Policy site

TechNet Magazine – Expanded Control with Group Policy Preferences

Group Policy Settings Reference for Windows Server 2008 and Windows Vista SP1

Here’s another video from GPanswers explaining how to restrict the use of certain devices within your managed environment.

Well as you might notice Group Policy management currently is my favorite topic. I’ve been doing GPOs since the year 2000, then for a long while due to my job role I haven’t been doing a lot with GPOs, but that didn’t matter since there wasn’t too much changing in that space except that with each OS release the number of GPO settings has been growing.

But since the introduction of Windows Vista, there have been some bigger changes around GPO management. One of these changes is the use of the Central ADMX Store. The Central ADMX Store plays an important role, so it is important understanding the concept.

Watch the video from TechNetEdge presented by John Baker. By the way on the gpoguy website you can find the free Vista Central Store Creator utility that helps automating this task.

Additional resources are the Microsoft KB article “How to create a Central Store for Group Policy Administrative Templates in Window Vista” or the podcast “TechNet Radio: Group Policy: Windows Vista, Longhorn Server, ADMX and the Central Store”.

Jeremy Moskowitz from GPanswers.com has posted 2 free GPUniversity videos. 

Default Group Policy Objects

Group Policy Backup and Restore

Interested in more ? Check out the Group Policy Online University.

In January 2009 Jeremy Moskovitz launched the Online University for Group Policy Management. I wrote about that earlier in my blog post “Online Group Policy University”.

In the past weeks Jeremy has put an additional great amount of effort in reworking the offerings, so that now you have the possibility of selecting and ordering individual Modules and and options. Additionally there are some very attractive payment options as well that might be interesting for those that don’t get their company paying it for them, but want to invest in their personal knowledge.

There are now 3 different GPO Online University options:

• Build your own
• Silver Package
• Gold Package

The Build your own package allows you to select the individual options that just fit for your needs. So for those that already have bought the GPO books from Jeremy and don’t think they need pre-configured hard drive labs, they can just order the training and documentation material (labs, videos, slides).

Interested ? Then click here and get straight to the GPO Online University starting page or if you don’t want to read the details (because you already did) and can’t wait to place an order, then go here.

Get the latest news around Group Policy Management, subscribe to the GPAnswers Newsletter

Enjoy

Today Jeremy Moskowitz has launched the Group Policy Online University. Taking into account that many companies in these days have restrictive travel and training policies, the Online University seems to be an excellent way how you can further extend your knowledge around Group Policy Management without the need to attend a live training e.g. you can attend the training at any time, from everywhere.

The only thing you need to do now is to convince your manager that it is worth the money

Just came across this handy document from Microsoft called the “Group Policy Documentation Survival Guide“.

The guide contains all the links to the resources you need when dealing with Group Policies.

The document can be downloaded here

Reading the Group Policy Preferences Overview Whitepaper from SDM software, I just notice an interesting prerequisite for using GPO Preferences – XMLLite.

XmlLite Runtime Files

The XmlLite runtime file, Xmllite.dll, is integrated into the following operating systems and products:

• Windows Server 2008
• Windows Vista
• Windows Server 2003 with Service Pack 2 or later.
• Microsoft Internet Explorer 7.0 and later.

The XmlLite runtime is also available as a download from the XmlLite Update Page for the following operating systems:

• Windows Server 2003 (32-bit with Service Pack 1 or x64 Editions)
• Windows XP (32-bit with Service Pack 2 or x64 Editions)

So if you want to use GPO Preferences on a Windows XP SP2 client with Internet Explorer 6, you will need to install the XMLLite runtime package for XP.

I just connected to our fresh installed Windows 2008 server that we intend to use as a remote system management console. The server is a member of our Windows 2003 Active Directory domain, not a DC itself.

I wanted to launch the Active directory users and computers console, but did not find it under the Administrative tools. Okay, this must be something similar like with Windows Vista when you install the RSAT tools I thought, and yes it is, you must first enable that feature.

First, on the windows 2008 system open the server manager. Then select Features, Add features as shown in the picture below.

then select Remote Server Administration tools, Role Administration tools, and then enable Active Directory Domain Services Tools. (note the screen shot below was taken after installation, that is why it is shown as installed).

confirm the following message boxes and after a while (including a system reboot) the tools are installed and ready to use. Enjoy AD administration !

Also note that if you want to access the Group Policy Management Console, you must follow the same path, just look out for the GPMC console in the available features list.

Usually when you need a report for a given Group Policy object, you would launch the Group Policy Management Console, select the GPO and then select the settings tab that produces the report.

But what if you need a report for multiple or even all your GPOs you have within your Active Directory ? Going through each GPO and produce the report manually is going to take ages and is boring.

My colleague Rudi recently found a script that automatically creates GPO reports it finds within your AD. You can select them individually or simply report on all.

The script is stored on the Win32 Scripting site which is a usefull resource for admin scripts since many years. The GPO reporting script can be found here

Last week we have been doing some GPO troubleshooting. Instead of setting all GPO logging options manually the custom GPO logging ADM(x) files found on GPOGUY.COM appeared to be very handy.

You can download the cutom ADM files here.

In 2006 Microsoft acquired the company DesktopStandard known for its extending Group Policy products GPVault and PolicyMaker.

While GPVault has become part of Microsofts MDOP suite that is available only for Enterprise customers that have a Software Assurance contract, the Policy Maker features have been available to everyone.

The PolicyMaker GPO extensions are now called GP Preferences.

GPO Preferences can be managed directly from a Windows 2008 system that has the latest GPMC installed or through a Windows Vista client with RSAT installed.

With GP Preferences you can now manage Windows 2008 server, Windows Vista, Server 2003 SP1 and Windows XP SP2.

What can I do with these GP Preferences ? Well, GPO preferences go beyond what we used to do with Group Policy settings today, furthermore while GPO policies are being enforced, with GP Preferences a user might still have the possibility to change things.

With GP Preferences, you can now customize all those things that you would typically do through a logon script, software packaging or by putting the settings into an image.

The big advantage is that now you can do this all from the same management console where you manage your Group Policy settings.

To give you an idea of what GP Preferences can do:

• Configure Power Settings
• Drive Mappings
• Map local / network printer
• Create / Change Folders, Files and Registry settings
• Configure Applications through extensions.

Furthermore , and I found this an extremely useful feature, you can target the GP preferences. As an example, you can first define power settings or power schemes and then add a query so that the GP preference is only being applied if the query matches that device or user, let’s say, only apply the power settings if the system is a notebook.

Give it a try, if you already have a test environment available all you need to do is the following:

Install a Windows 2008 server or RSAT on Windows Vista SP1

Open the Group Policy Management Console and create a new GPO Object.

Within the GPO object create a new Preference, for example an environment variable that is set at system level

Link the Group Policy object you just created to the OU where you have your test machine computer objects stored

On the client machine run gpupdate /force to pull down the new GPO settings.

If you are using a Windows XP client, you will first need to install the client side extensions that can be downloaded from Microsoft.

Resources:

A Guide to Group Policy Preferences for Users of PolicyMaker Standard Edition

Group Policy Preferences Overview

Group Policies on TechNet

Group Policy Preference Client Side Extensions for Windows XP (KB943729)