Explore topic-wise InterviewSolutions in Current Affairs.

Group Policies can be applied at multiple levels (Sites, domains, organizational Units) and multiple GP’s for each level. Obviously it may be that some policy settings conflict hence the application order of Site – Domain – Organization Unit and within each LAYER you set order for all defined policies but you may want to force some polices to never be overridden (No Override) and you may want some containers to not inherit settings from a parent container (Block Inheritance).

A good definition of each is as follows:

No Override – This prevents child containers from overriding policies set at higher levels

Block Inheritance – Stops containers inheriting policies from parent containers

No Override takes precedence over Block Inheritance so if a child container has Block Inheritance set but on the parent a group policy has No Override set then it will get applied.

ALSO the highest No Override takes precedence over lower No Override’s set.

To block inheritance perform the following:

1. Start the Active Directory Users and Computer snap-in (Start – Programs – Administrative Tools – Active Directory Users and Computers)
2. RIGHT CLICK on the container you wish to stop inheriting settings from its parent and SELECT
3. Select the ‘Group Policy’ tab
4. Check the ‘Block Policy inheritance’ option
5. Click Apply then OK

To set a policy to never be overridden perform the following:

1. Start the Active Directory Users and Computer snap-in (Start – – Administrative Tools – Active Directory Users and Computers)
2. Right click on the container you wish to set a Group Policy to not be overridden and select Properties
3. Select the ‘Group Policy’ tab
4. Click Options
5. Check the ‘No Override’ option
6. Click OK
7. Click Apply then OK

Group Policies can be applied at multiple levels (Sites, domains, organizational Units) and multiple GP’s for each level. Obviously it may be that some policy settings conflict hence the application order of Site – Domain – Organization Unit and within each layer you set order for all defined policies but you may want to force some polices to never be overridden (No Override) and you may want some containers to not inherit settings from a parent container (Block Inheritance).

A good definition of each is as follows:

No Override – This prevents child containers from overriding policies set at higher levels

Block Inheritance – Stops containers inheriting policies from parent containers

No Override takes precedence over Block Inheritance so if a child container has Block Inheritance set but on the parent a group policy has No Override set then it will get applied.

Also the highest No Override takes precedence over lower No Override’s set.

To block inheritance perform the following:

To set a policy to never be overridden perform the following:

Make SURE you check Block inheritance AMONG the options when CREATING the POLICY.

Make sure you check Block inheritance among the options when creating the policy.

Group Policy in Windows Server 2003 DETERMINES a users right to modify network and dial-up TCP/IP PROPERTIES. Users may be selectively restricted from modifying their IP address and other network configuration PARAMETERS.

Group Policy in Windows Server 2003 determines a users right to modify network and dial-up TCP/IP properties. Users may be selectively restricted from modifying their IP address and other network configuration parameters.

It’s now gpupdate.

It’s now gpupdate.

90 MINUTES GIVE or TAKE.

90 minutes give or take.

make sure USER not be member of loopback POLICY as in loopback policy it doesn’t effect user settings only computer policy will applicable. if he is member of GPO filter grp or not.

You may also want to CHECK the computers event logs. If you find event ID 1085 then you may want to download the patch to FIX this and reboot the computer.

make sure user not be member of loopback policy as in loopback policy it doesn’t effect user settings only computer policy will applicable. if he is member of gpo filter grp or not.

You may also want to check the computers event logs. If you find event ID 1085 then you may want to download the patch to fix this and reboot the computer.

Group Policy OBJECT (GPO) COMPUTER=Computer CONFIGURATION, User=User ConfigurationName some GPO settings in the computer and user PARTS.

Group Policy Object (GPO) computer=Computer Configuration, User=User ConfigurationName some GPO settings in the computer and user parts.

CREATE the FILE in.zap EXTENSION.

create the file in.zap extension.

Administrative Templates are a feature of Group Policy, a Microsoft technology for centralised management of MACHINES and users in an Active Directory environment. Administrative Templates facilitate the management of registry-based policy. An ADM file is used to describe both the user interface presented to the Group Policy administrator and the registry keys that should be updated on the target machines.

An ADM file is a TEXT file with a specific syntax which describes both the interface and the registry values which will be changed if the policy is enabled or disabled.

ADM FILES are consumed by the Group Policy Object Editor (GPEdit). Windows XP Service PACK 2 shipped with FIVE ADM files (system.adm, inetres.adm, wmplayer.adm, conf.adm and wuau.adm). These are merged into a unified “namespace” in GPEdit and presented to the administrator under the Administrative Templates node (for both machine and user policy).

Administrative Templates are a feature of Group Policy, a Microsoft technology for centralised management of machines and users in an Active Directory environment. Administrative Templates facilitate the management of registry-based policy. An ADM file is used to describe both the user interface presented to the Group Policy administrator and the registry keys that should be updated on the target machines.

An ADM file is a text file with a specific syntax which describes both the interface and the registry values which will be changed if the policy is enabled or disabled.

ADM files are consumed by the Group Policy Object Editor (GPEdit). Windows XP Service Pack 2 shipped with five ADM files (system.adm, inetres.adm, wmplayer.adm, conf.adm and wuau.adm). These are merged into a unified “namespace” in GPEdit and presented to the administrator under the Administrative Templates node (for both machine and user policy).

Assign Users :The SOFTWARE application is advertised when the user logs on. It is installed when the user CLICKS on the software application icon VIA the start menu, or accesses a file that has been associated with the software application.

Assign Computers :The software application is advertised and installed when it is safe to do so, such as when the computer is next restarted.

PUBLISH to users : The software application does not appear on the start menu or desktop. This means the user may not know that the software is available. The software application is made available via the Add/Remove Programs option in control panel, or by clicking on a file that has been associated with the application. Published applications do not reinstall themselves in the event of accidental deletion, and it is not possible to publish to computers.

Assign Users :The software application is advertised when the user logs on. It is installed when the user clicks on the software application icon via the start menu, or accesses a file that has been associated with the software application.

Assign Computers :The software application is advertised and installed when it is safe to do so, such as when the computer is next restarted.

Publish to users : The software application does not appear on the start menu or desktop. This means the user may not know that the software is available. The software application is made available via the Add/Remove Programs option in control panel, or by clicking on a file that has been associated with the application. Published applications do not reinstall themselves in the event of accidental deletion, and it is not possible to publish to computers.

• GO to Start->programs->Administrative tools->Active Directory Users and COMPUTERS
• Right Click on Domain->click on preoperties
• On New windows Click on Group Policy
• Select Default Policy->click on EDIT
• on group Policy console
• go to USER Configuration->Administrative Template->Start menu and Taskbar.
• Select each property you want to MODIFY and do the same.

• Begin the process by logging on to a Windows Server 2008 domain controller, and opening the Group Policy Management console. Now, navigate through the console tree to Group Policy Management | Forest: | Domains | | Group Policy Objects.
• When you do, the details pane should display all of the group policy objects that are ASSOCIATED with the domain. In Figure A there are only two group policy objects, but in a production environment you may have many more. The Group Policy Objects container stores all of the group policy objects for the domain.
• Now, right-click on the Group Policy Objects container, and choose the Back Up All command from the shortcut menu. When you do, Windows will open the Back Up Group Policy Object dialog box.
• As you can see in Figure B, this dialog box requires you to provide the path to which you want to STORE the backup files. You can either store the backups in a dedicated folder on a local drive, or you can place them in a folder on a mapped network drive. The dialog box also contains a Description field that you can use to provide a description of the backup that you are creating.
• You must provide the path to which you want to store your backup of the group policy objects.
• To initiate the backup process, just click the Back Up button. When the backup process completes, you should see a dialog box that tells you how many group policy objects were SUCCESSFULLY backed up. Click OK to close the dialog box, and you’re all done.
• When it comes to restoring a backup of any Group Policy Object, you have two options. The first option is to right-click on the Group Policy Object, and choose the RESTORE From Backup command from the shortcut menu. When you do this, Windows will remove all of the individual settings from the Group Policy Object, and then implement the settings found in the backup.
• Your other option is to right-click on the Group Policy Object you want to restore, and choose the Import Settings option. This option works more like a merge than a restore.
• Any settings that presently reside within the Group Policy Object are retained unless there is a contradictory settings within the file that is being imported.

Group Policy settings are processed in the following ORDER:

1. Local Group Policy OBJECT : Each COMPUTER has exactly one Group Policy object that is stored locally. This processes for both computer and user Group Policy processing.
2. Site : Any GPOs that have been LINKED to the site that the computer belongs to are processed next. Processing is in the order that is specified by the administrator, on the Linked Group Policy Objects tab for the site in Group Policy Management Console (GPMC). The GPO with the lowest link order is processed last, and therefore has the highest precedence.
3. Domain: Processing of multiple domain-linked GPOs is in the order specified by the administrator, on the Linked Group Policy Objects tab for the domain in GPMC. The GPO with the lowest link order is processed last, and therefore has the highest precedence.
4. Organizational UNITS : GPOs that are linked to the organizational unit that is highest in the Active Directory hierarchy are processed first, then POs that are linked to its child organizational unit, and so on. Finally, the GPOs that are linked to the organizational unit that contains the user or computer are processed.

At the level of each organizational unit in the Active Directory hierarchy, one, many, or no GPOs can be linked. If several GPOs are linked to an organizational unit, their processing is in the order that is specified by the administrator, on the Linked Group Policy Objects tab for the organizational unit in GPMC.

The GPO with the lowest link order is processed last, and therefore has the highest precedence.

This order means that the local GPO is processed first, and GPOs that are linked to the organizational unit of which the computer or user is a direct member are processed last, which overwrites settings in the earlier GPOs if there are conflicts. (If there are no conflicts, then the earlier and later settings are merely aggregated.)

Group Policy settings are processed in the following order:

At the level of each organizational unit in the Active Directory hierarchy, one, many, or no GPOs can be linked. If several GPOs are linked to an organizational unit, their processing is in the order that is specified by the administrator, on the Linked Group Policy Objects tab for the organizational unit in GPMC.

The GPO with the lowest link order is processed last, and therefore has the highest precedence.

This order means that the local GPO is processed first, and GPOs that are linked to the organizational unit of which the computer or user is a direct member are processed last, which overwrites settings in the earlier GPOs if there are conflicts. (If there are no conflicts, then the earlier and later settings are merely aggregated.)

Group Policy objects, other than the LOCAL Group Policy object, are virtual objects. The policy setting information of a GPO is actually stored in two LOCATIONS: the Group Policy container and the Group Policy template.

The Group Policy container is an Active Directory container that stores GPO properties, including information on version, GPO status, and a list of COMPONENTS that have settings in the GPO.

The Group Policy template is a folder structure WITHIN the file system that stores Administrative Template-based policies, security settings, script files, and information REGARDING applications that are available for Group Policy Software Installation.

The Group Policy template is located in the system volume folder (Sysvol) in the Policies subfolder for its domain.

Group Policy objects, other than the local Group Policy object, are virtual objects. The policy setting information of a GPO is actually stored in two locations: the Group Policy container and the Group Policy template.

The Group Policy container is an Active Directory container that stores GPO properties, including information on version, GPO status, and a list of components that have settings in the GPO.

The Group Policy template is a folder structure within the file system that stores Administrative Template-based policies, security settings, script files, and information regarding applications that are available for Group Policy Software Installation.

The Group Policy template is located in the system volume folder (Sysvol) in the Policies subfolder for its domain.

The following should be considered for designing group POLICIES:

• Minimize linking: Because there may be a chance deleting the original one with seeing who ELSE are using this GPO. Minimizing linking for simplicity.
• Minimum number of GPO’s: Microsoft suggests that one GPO with 100 settings will process faster than 100 GPO’s each with one setting. This is for performance.
• Delegate
• Minimize FILTERING: To KEEP simple your environment, try to minimize filtering.

If you have more number of GPO’s for a container, whatever GPO is on top will be applied first. If you want, you can move GPO’s up and down.

If there is conflict between two GPO’s of same container, the last applied GPO will be effective. i.e., the bottom one will be effective.

The following should be considered for designing group policies:

If you have more number of GPO’s for a container, whatever GPO is on top will be applied first. If you want, you can move GPO’s up and down.

If there is conflict between two GPO’s of same container, the last applied GPO will be effective. i.e., the bottom one will be effective.

• Local SECURITY POLICY: This is group policy applied to local machine
• DOMAIN Security Policy: Group Policy applied at domain level
• Domain Controller Security Policy: Group Policy applied at domain controller level.

MICROSOFT Installer Service runs on the client MACHINES in the Windows 2000 domain. It INSTALLS the minimum AMOUNT of an application, as you extend functionality it installs the remaining part of application. It is responsible for installing software in the client. It is also responsible for modifying, upgrading, applying service packs.

Microsoft Installer Service runs on the client machines in the Windows 2000 domain. It installs the minimum amount of an application, as you extend functionality it installs the remaining part of application. It is responsible for installing software in the client. It is also responsible for modifying, upgrading, applying service packs.

WINDOWS INSTALLER PACKAGES (.MSI FILES)

Windows installer packages (.msi files)

• Group Policy: Within GP we specify that this SOFTWARE application GETS installed to this particular computer or to this particular user.
• Active Directory: Group Policy will be applied somewhere in Active Directory.
• Microsoft Installer service
• Windows installer packages: The TYPE of PACKAGE that can be used by Group Policy to deploy applications is .msi packages i.e., Microsoft Installer packages.

START –>programs –>Administrative tools –>Active Directory users and computers –>Right click on the container –>click on Group policy tab –>Click on edit –>click on COMPUTER settings –>click on Administrative templates –>system –>Group policy –>click on User group policy loop BACK processing mode –> click OK –> SELECT enable

Start –>programs –>Administrative tools –>Active Directory users and computers –>Right click on the container –>click on Group policy tab –>Click on edit –>click on Computer settings –>click on Administrative templates –>system –>Group policy –>click on User group policy loop back processing mode –> click OK –> Select enable

• To DECREASE support TIME
• Eliminate potential for problems
• One STANDARD ENVIRONMENT to support
• Eliminate distractions
• To increase productivity

REFRESH interval for DOMAIN Controllers is 5 MINUTES, and the refresh interval for all other computers in the NETWORK is 45 minutes (this one doubt).

Refresh interval for Domain Controllers is 5 minutes, and the refresh interval for all other computers in the network is 45 minutes (this one doubt).

LOCAL ADMINISTRATOR or DOMAIN Administrator

Local Administrator or Domain Administrator

DOMAIN ADMIN

Domain Admin

DOMAIN ADMIN

Domain Admin

ENTERPRISE ADMIN

Enterprise Admin

• LOCAL policy
• Site Policy
• DOMAIN Policy
• OU Policy
• Sub OU Policy (If any are there)

You will SEE two major portions, and under those you have sub portions, they are:

• Computer CONFIGURATION
• Software SETTINGS
• Software installations
• Windows settings
• Administrative templates
• User configuration
• Software settings
• Software installations
• Windows settings
• Administrative templates

Note: Administrative templates are for MODIFYING the registry of windows 2000 clients.

You will see two major portions, and under those you have sub portions, they are:

Note: Administrative templates are for modifying the registry of windows 2000 clients.

• General
• Disable computer configuration settings (The settings those are set under computer configuration of this GPO will not take effect.)
• Disable user configuration settings (The settings those are set under User configuration of this GPO will not take effect.)
• LINKS (DISPLAYS the containers which have links to this GPO)
• SECURITY (With security option you can set level of permissions and settings to the individual users and groups. Ex: If you WANT to disable this GPO to a particular user on this container, on security tab select that user and select the deny check box for apply the Group Policy. Then the GPO will not take effect to that user even though he is in that container.)

If you have set both then No override wins over the BLOCK INHERITANCE. So No override will take EFFECT.

If you have set both then No override wins over the Block inheritance. So No override will take effect.

The Block inheritance GPO option blocks the group policies inheriting from the top level, and takes EFFECT of this PRESENT GPO.

Right CLICK on the container –> click on Group Policy –ègo to PROPERTIES >on the bottom of the General tab you will find Block inheritance check box

Ex: If you select Block inheritance at OU level then no policy from the Domain level, or Site level or local policy will not applied to this OU.

The Block inheritance GPO option blocks the group policies inheriting from the top level, and takes effect of this present GPO.

Right click on the container –> click on Group Policy –ègo to properties >on the bottom of the General tab you will find Block inheritance check box

Ex: If you select Block inheritance at OU level then no policy from the Domain level, or Site level or local policy will not applied to this OU.

GENERALLY the policies SET at one level will be OVERRIDDEN in other level, so if don’t WANT to override this policy under the SUB levels of this one you can set this.

Ex: If you set No override at Domain level then that GPO will be applied through out the Domain, even though you have the same policy differently at OU level.

Generally the policies set at one level will be overridden in other level, so if don’t want to override this policy under the sub levels of this one you can set this.

Ex: If you set No override at Domain level then that GPO will be applied through out the Domain, even though you have the same policy differently at OU level.

• New (Creates new GPO)
• ADD (LINKS a GPO to this container which has created already)
• Edit (Edits the existing GPO)
• DELETE Deletes the GPO
• Options (here you get the following check BOXES): (i) No override – Prevent other GPO from overriding policy set in this one; and(ii) Disabled – This GPO is not APPLICABLE to this container
• Properties

Note: When you are deleting a GPO it asks two things:

• Remove the link from this list
• Remove the link and delete the GPO permanently

Note: When you are deleting a GPO it asks two things:

There are TWO STEPS, ONE is creating Group policy and linking to the container. Generally we create the group policy at container only so when you click on New it creates and links the GPO to that container at a time. SUPPOSE if you want to link a group policy object to a container which is already CREATED click on Add select the group policy.

There are two steps, one is creating Group policy and linking to the container. Generally we create the group policy at container only so when you click on New it creates and links the GPO to that container at a time. Suppose if you want to link a group policy object to a container which is already created click on Add select the group policy.

Start –>Programs –>Administrative tools ->Active DIRECTORY Users and computers ->Right click on the container on which you want to apply Group POLICY->Select PROPERTIES-> Click on Group Policy tab->Click on New

Start –>Programs –>Administrative tools ->Active Directory Users and computers ->Right click on the container on which you want to apply Group Policy->Select properties-> Click on Group Policy tab->Click on New

GROUP Policy template STORED in SYSVOL folder.

Group Policy template stored in sysvol folder.

When you create a group POLICY container AUTOMATICALLY a template will be CREATED in the hard drive, in sysvol folder of the DOMAIN Controller that is CALLED Group Policy template.

When you create a group policy container automatically a template will be created in the hard drive, in sysvol folder of the Domain Controller that is called Group Policy template.

It is the container in the Active Directory where the GROUP Policy can be APPLIED. (i.e., EITHER Organizational unit or Domain or SITE)

It is the container in the Active Directory where the Group Policy can be applied. (i.e., either Organizational unit or Domain or Site)

We call the actual unit that we are creating, deleting, managing, working with is CALLED Group Policy OBJECT.

Group Policy objects have two components:

• Group Policy CONTAINER
• Group Policy TEMPLATE

We call the actual unit that we are creating, deleting, managing, working with is called Group Policy object.

Group Policy objects have two components:

• For deploying software
• We can apply security
• For controlling USERS environment, settings, PER computer settings
• To MANAGE DESKTOP environment (To standardize environment)
• To MODIFY the registry