Administrators who want to plan their Windows 2003 Group Policy.
Experienced network managers who wish to lockdown their users' Start menu.
Network Architects who need to turn a desktop vision into reality.
Those interested in an overview of XP policies.
‡
What are Windows 2003 Group Policies?
With planning, Microsoft's Group Policies can control every aspect of a computer desktop. Whilst the
master plan is to control the configuration of both the user and the computer
settings, the technique is to define each setting once in an
Active Directory Group Policy. For example, if you need to change everyone's proxy
server, the add the IP addresses to a Group Policy rather than edit every
Internet Explorer manually.
It may help to remember that Group
Policies manipulate registry values, consequently, if the
item that you want to control is in the registry, then it can be set by a policy.
Where registry keys do not have ready-made policies, it is possible to create
your own policy templates.
However, designing your own templates would be a specialist job for your developers.
Group Policy Contents
Some say Microsoft has created 700+ group polices for XP, while others tell me that there are over 850. What
ever the exact total, the point is that Group Policies are here to stay, and that each new version of
Windows will
bring yet more settings to organize the desktop. Here are the commonest
policy categories for XP / Windows Server 2003. Incidentally Windows Server 2003 SP1 added hundreds more Group Policies, particularly to the Inetres (Internet Explorer) section.
Settings which dictate the operating system behaviour, for example, disable
unnecessary services such as IIS or telnet.
Guy
Recommends: Permissions Analyzer - Free Active Directory Tool
I like the
Permissions Monitor because it enables me to see quickly WHO has permissions
to do WHAT. When you launch this tool it analyzes a users effective NTFS
permissions for a specific file or folder, takes into account network share
access, then displays the results in a nifty desktop dashboard!
Think of all the frustration that this free utility saves when you are
troubleshooting authorization problems for users access to a resource.
Give this permissions monitor a try - it's free!
My mission is to bring each Group Policy category or folder to life. I want to
save you time by concentrating on what I consider are the best settings in each
Group Policy folder.
Look out for 'Guy's top selections' on each page. Occasionally, I
express an opinion that a policy is
of limited use - no sitting on the fence! However, even if a policy is
only needed for specialist configurations, I still point out its purpose,
just in case it applies to your situation.
Before you begin evaluating policies, I urge you to decide on the security rating of
your organization. It is important to have a reference point,
otherwise it will be difficult to gain a perspective of
what makes sense for your users. My advice is aimed at those
who need medium security setting for their domains; therefore, if you are a
high or low security company then make the necessary adjustments when
assessing my selections.
Remember, that the more security that you enforce, the more work there
will be for you. For instance, do not insist on 14 letter, complex
passwords, just because they are the highest settings. However, if
there is a good business case for this level of security, then fair enough,
but does take on extra help desk staff to cope with the resultant password
lockouts.
Pre-requisites
for Creating Policies
The advice and screen shots in this section are designed for Windows
Server 2003.
You have installed the GPMC (Group Policy Management Console), available as a free download from Microsoft's site.
You create a test OU. (Not essential, but safer than using the
default domain policy.)
right-click your OU, Properties, Group Policy. Click on Open.
right-click on your OU, and select 'Create and Link a GPO Here..'
right-click your policy, then edit.
Next step
If you are itching to start configuring Group Policies, the best place to
begin is here at User Configuration,
Administrative Templates.
Guy Recommends:
SolarWinds' NPM - Network Performance Monitor
SolarWinds' performance monitor is designed for detecting network outages,
making it easy to see what's working, and what needs your attention.
This utility guides you through creating network maps; it also helps
identifying whether the
root cause is faulty equipment, or resource overload. Give NPM a try.
