Software

Ask something
Question Locked

Group Policy Windows 2003 Domain

0 helpful
21 replies

by rboklewski

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I am in a Windows 2003 domain environment. I am having trouble understanding how to edit the local group policy for all my machines on my network. If I open up the gpedit.msc from my machine I go into computer configuration-->Windows Settings-->Security Settings-->Local Policies-->Security Options. Now when that is open for instance I see that only Administrators & Power Users have access to allow format and eject removable media. Now, if I go on my domain controller and edit the domain policy and go into the same area, everything in Security Options says not defined. How can this be? Why are these different, they should be same if my machine is properly getting applied the local policy.

21 replies

by Former member

When you run gpedit.msc on your PC, it brings up the Local Computer Policy, not the domain policy.

Remember there are multiple policy objects in a domain, Applied in the order Local Computer, Site, Domain, and OU (traversing from parent to child in order).

While the settings you are looking at are defined in the Local Computer Policy, they have not been defined in the Domain Policy (Few things are defined int he Domain Policy by default, and as a matter of best practice, it is generally a good Idea NOT to define anything there. Instead create a new policy at the domain level and make your changes there, that way the MS "Default" is left intact).

To make it easier to see what is going on with group policy, I strongly recommend that you download and install the Group Policy Management Console from Microsoft (google: gpmc should find it)

by rboklewski

Okay so you are saying that gpedit only edits the local policy of that particular machine and the same when i go into the mmc and add the group policy object snap in correct? I just don't understand where is the local policy settings on these workstations coming from then? Is it just the standard template that is applied when the os is installed?

by Former member

That is a feature of the OS allowing you to control specific behaviors on the PC(run gpedit on a computer which has never been joined to a domain, to confirm this).

When you say group policy object snap-in, I assume you have NOT installed gpmc and are therefore referring to "Group Policy Object Editor". When you add that snap-in, you are promted for the policy you want to edit. The default is the local computer policy. The problem with this tool is that it only allws you to see one policy object. You don't see the object heirarchy. Install gpmc, and then use it ( > administrative tools > Group POlicy Management) to view group policy objects. From there you will be able to see all the Domain level objects in an explorer-like view.

by Former member

To try and explain the behavior. When you log in to a PC, the PC looks at several group policy objects, starting withthe local PC policy, then moving to the Domain policies in the order I mentioned previously. It Combines those into a single resultatnt set of policy, which is ultimately applied to teh system. The settings in later policy objects override those set in previous objects (ie if I apply a setting in the Local Computer Policy Object, and then set a different value for the same setting in the default domain policy, the setting in the default domain policy will be the setting that is actually applied to the computer as the default domain policy is applied after the Local Computer Policy).

That is a very simplified explanation, there is much more to it thatn that, but hopefully that will give you a general ideas as to what is going on.

by rboklewski

Also, I was wondering if you could show me exactly how to create a new policy, we have just the domain policy that was the default like you said and if i do create another policy how is it going to interact with the default policy?

by rboklewski

Right, yeah i know every machine has a local policy, I just was confused as to why the local policy here didn't match up to the local policy when i went to the default domain policy on my domain controller. I am right in my thinking right? As in, when i go on my domain controller and go to group policy management and right click the default domain policy and then windows settings under computer configuration then navigate to local policy that is in fact where i could make changes that would replicate to all machines on my network, correct? But like you say it isn't good practice to edit the default policy, so just create a new one.

by Former member

You are on track there. My post below hopefully helps explain the application of group policy a bit, which explains the reason for the apparent difference.

by rboklewski

Okay so your saying that if i make a change in the local policy and then alter it in the domain policy, the domain policy has priority so whatever its settings are will in fact be what actually gets applied, correct. But what if i make a change just on the local policy and not the domain policy? Then the local policy will get applied right? Now when you make a change in the default domain policy, you will actually see the change on the local policy if i edited using gpedit, right?

by rboklewski

Ah, one last question...Now if i have stuff defined on the local policy but isn't defined on the domain controller, then the local policy takes over? But if there is something defined in the domain policy then it takes over? I think i got it.

by cg it

local, site, domain, OU

that is how group policy is processed.

local is the local machine, if user only log on locally, the machine group policy applies.

site refers to subnet in a domain environment. Group Policy Objects can be applied at the site level. When a user logs on to a domain AND are at a site, if there is a group policy object applied at the site, the site GP overrides any GP at the local machine level, unless the no override is in effect.

If you create a GPO at the domain level, all users logging into the domain get that Group Policy regardless if there are local or site GPs. No Override takes precedence so if there is a local machine GP you want applied in a domain environment, you use the no override.

Organizational Unit [OU] are Active Directory containers in which you can collect Active Directory objects like users and computers and apply GPOs to them. This is handy when you want users in Accounting to have particular settings and you want users in manufacturing to have a different set.

GPOs at the OU level are applied last.

by rboklewski

You guys are good, now i just really need to figure out how to create a new policy at the domain level, really i just need to be able to create a new gpo right? For instance if i don't want to alter my default domain policy and want to create a new one to alter would i just open up group policy management and right click on the domain and select create and link a new gpo? Now if i do this can i have both the default gpo and new gpo together? If so will it combine both policies when they are applied or does one have preference over the other? And if i wanted to create a new gpo and lets say i didn't want it later on, could i just delete it and the default gpo would then take over?

Also, i tried to install the gpmc, but it won't install on my xp machine, it complains about .net, which is in fact installed on my machine. I checked around and can't seem to find an answer, i know some people had issues with 64 bit os's trying to get it installed, but im on the 32 bit version. Argh!

Thanks you guys, you guys are great!

by Former member

Good question about the adjacent policy objects. I am afraid I don't know the answer in that case, what will happen as far as precedence. Generally speaking, you won't be changing anything that is set in the Default Domain policy. What shows up there are essentially security fixes from MS. There are only a couple entries in there (and that is really the reason to leave it alone - so you can easily tell the difference between changes you have made and changes MS has made).

Again the nice thing about GPMC, there is a settings view which will show you what settings are configured in a GPO, in report form, so you will be able to quickly and clearly see the changes.

There is also a group policy results view, which allows you to select a computer and user, and it will generate a report of the resultant set of policy, identifying the winning setting, and which GPO is responsible for that setting.

by cg it

your question : I got it....But how does this work
You guys are good, now i just really need to figure out how to create a new policy at the domain level, really i just need to be able to create a new gpo right? For instance if i don't want to alter my default domain policy and want to create a new one to alter would i just open up group policy management and right click on the domain and select create and link a new gpo? Now if i do this can i have both the default gpo and new gpo together? If so will it combine both policies when they are applied or does one have preference over the other? And if i wanted to create a new gpo and lets say i didn't want it later on, could i just delete it and the default gpo would then take over? Thanks you guys, you guys are great!

Well it works almost like you said... if your doing testing, first things first. decide what you want, who you want it to apply to.

then create the GPO to do what you want to do.

you apply the new GPO to who you want that GPO to apply to. typically if your at the domain level, the best way to taylor GPOs is to apply them to OUs. Collect those users you want to GPO to apply to into a OU. The link the GPO to that OU.

OUs are containers and they can contain users, computers, printers, anything that Active Directory defines as objects. see this Wikipedia explaination http://en.wikipedia.org/wiki/Active_Directory

Group Policy is used to have a central management of users and computers. It typically is used to control the user experience though user or computer settings.

So create an OU for users called Test GPO, collect those users you want to have the user or computer settings into that OU. Apply the GPO to that OU. normally the GP default refresh is 90 minutes. To force a refresh, use secedit/refreshpolicy command or reboot the computer.

note: you can collect users or computers in OUs by groups.

The trickly thing about GPOs is that you can have a LOT of them doing a lot of things to a lot of different users and computers. This can make GPOs quite complicated.

When using GPOs and OUs, my suggestion is document document document and diagram it out.

Also, you can use the RSoP MMC snap in to test your GPO to see what they will do before you apply them. Here's a technet article.

http://technet2.microsoft.com/windowsserver/en/library/abc2890d-f3f1-408c-bafc-ac9e4e5b0e831033.mspx?mfr=true

by rboklewski

This is good, now exactly where do i create the gpo? We have one domain in one forest and thats it. If i open up the gpmc on my domain controller i have my domain and it has the default domain policy, so do i just right click on the domain and say create and link a new GPO here? I just want to test this out and i don't want to screw up the existing default policy, just want to make sure im doing this right. Thanks a ton!

by cg it

I would say STOP do nothing on a production network until you know what your doing.

get a computer that meet windows server 2003 minimum hardware requirements, one workstation that uses the same O/S on the production network and an elcheapo 4 port switch. Make up a test network that you can use to practice with. [note: all major companies have a test network that admins use to test any changes out before it's deployed to the production network. you want to do the same]

You can get Windows Server 2003 trial software for free which will work for 180 days and you can setup a test network with 1 server and one workstation that can mimic your production network. Then play to your hearts content until your sure what you are doing.

by rboklewski

Yeah this is a production environment, unfortunately we are rather small company and we really don't have the resources for a test environment. I do have a few workstations to play with that is for sure. But i am right as far as creating that gpo right?

by cg it

if you have spare workstations, use those. stick Windows Server 2003 on it [minimum requirements are http://technet.microsoft.com/en-us/windowsserver/bb430827.aspx

seriously!

and your almost right...

read this article:

http://technet.microsoft.com/en-us/library/bb418825.aspx

and read this article:

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/directory/activedirectory/stepbystep/gpfeat.mspx

It's best to read the articles [better yet get a self paced training book and read the articles] then try to create OUs, GPOs apply the GPOs to OUs then see if what you want to have happen happens [or use RSoP] in a Test Environment!! all the while documenting what you do on paper.

if all goes well, you then just go to your production environment and do the same thing. Thus your documentation is already created and you know it will work all without mucking with the production environment. If you muck with the production network and get it wrong, users tend to get a little bit upset. Paperwads, boos and dirty looks usually come one's way when what is planned messes up the users computers.

Can't tell you if your understanding is right or wrong. Only you can tell yourself whether you know enough or not to start implementing GPOs, unless of course your mad at some computer admin and what to muck up the network to get even.

by rboklewski

Yeah i have a windows group policy book that im going to have to read a bit more. I get some of the basics but your right i shouldn't try this on my production environment until i test. So i should probably just create another domain for the test environment or bring one of these machines home to test with, which should even be easier for me. Thanks for the help, I appreciate it.

by vsharma

hi
i am vijay

actually there are two types of policies in domain
1. domain poliy

2. domain controller policy

domain policy effect the same domain(all the user i that domain)

domain controller policy effect all the domain controllers in the forest.

u are accessing domain controllers policy which is not defined . so check the domain policy in ur servr.

here u will get all which is in ur client machine

This discussion is closed to new replies.