Group Policy related changes in Windows Server 2008 - Part 4: Group Policy Preferences continued

Taking a closer look at Group Policy Preferences, including Actions, Item level Targeting, Export/Import, Common options, Shortcuts and more.


If you would like to read the other parts in this article series please go to:

• Group Policy related changes in Windows Server 2008 - Part 1: What are Starter GPOs?
• Group Policy related changes in Windows Server 2008 - Part 2: GPMC Version 2
• Group Policy related changes in Windows Server 2008 - Part 3: Introduction to Group Policy Preferences

In part 1 of this article series "Starter GPOs" were discussed. In part 2 we dealt with Group Policy Management Console (GPMC) version 2 and its new search, filtering and comment options. Part 3 introduced you to Group Policy Preferences and part 4 will take a closer look at Group Policy Preferences, including Actions, Item level Targeting, Export/Import, Common options, Shortcuts and more.
Please note that some of the information in this article series is based on information from the Beta versions of Windows Server 2008 (Beta 3, RC0 and RC1). So, some features and dialog boxes may change a bit before the final release. Group Policy Preferences is part of the Release Candidate 1 (RC1) beta release of Windows Server 2008.

Actions

For each Group Policy Preference (GPP) setting you can normally choose between 4 different actions (see Figure 1). These actions will determine how the Client Side Extension (CSE) will process the preference item.

 Figure 1: the General tab of Environment Properties

This is a quick introduction to the available actions:

1. Create = Create a new setting if it doesn't exist on the targeted machine.
2. Replace = Delete the setting if it exists and then set with the new settings ("recreate").
3. Update (default) = The default action which modifies existing settings. If the settings don't exist they will be set.
4. Delete = Remove the preference setting on the targeted machine.

Note:
We will most likely see the Migrate action when Microsoft releases some of the additions to the Applications node (more on this later in this article).
Selecting the correct action is crucial, but in most cases the default option (Update) will be perfectly fine.

The Common tab and processing order

Let's take a look at the Common tab of GPP settings. This is where we can specify how the CSE will process the particular preference setting (or "item").

 Figure 2: the Common tab of Environment Properties

If you click on any GPP Common tab, they all have exactly the same options, and they are as follows (though irrelevant options can be greyed out as shown in Figure 2):
"Stop processing items in this extension if an error occurs" changes the default error handling. If any error should occur during GPP processing the default action is to continue with the next preferences in line. To change that behaviour this option can be selected - this will stop processing of remaining preference items in the same extension/category inside the current GPO.
"Run in logged-on user's security context (user policy option)" changes the default user context. Normally preferences are processed using the Local System account (SYSTEM), selecting this option will make sure the user context is used instead. Network Drive and Printer Mappings ignore this setting as they always use the user context anyway.
"Remove this item when it is no longer applied" can remove preference settings when the user or computer falls out of scope of management. But you have to be extremely careful with this option as it may, depending on what actions you take, remove the setting entirely (ex. a registry value), and not just nicely replace with the original value as you might think. When selecting this option the "Update" action will be forced on.
Example (a small warning)
Let's say you have an application which is hardcoded to look into the following part of the registry to determine a particular user setting during start-up (ex. to retrieve the user's chosen visual theme):
Current User > Software > Windowsecurity.com > MyTheme = "Default"
An admin then decides to give all users a particular visual theme in the application by creating a Registry preference that assigns the "MyTheme" key a value of "DeepPurple". He/she also selects the "Remove this item when it is no longer applied" option for the registry preference. Everything works fine for a couple of months and then it is decided that the GPO should be unlinked - the intention is to get the original value back. But, what will happen is that the registry string value "MyTheme" will be deleted entirely - in the worst case leaving the application in a broken state. Therefore it is recommended to test the behaviour of this option thoroughly before using it in a production environment. So, watch out!
 "Apply once and do not reapply" changes the default behaviour, which generally is to process the preference setting with every background refresh. It must be said however, that some preferences are only processed during log on by default (ex. Network Drive and Printer Mappings). With this option, the CSE applies the particular preference item once and never again. From that point the user can do whatever he or she wants with the User Configuration preference setting - or, if it is a Computer Configuration preference, the computer will never process the preference setting again.
"Item-Level Targeting" is kind of like WMI filters, but only for the selected preference setting and not the entire GPO (like with WMI filters) or other preferences for that matter. There's more information on ILT later in this article.
Processing order and menu options The processing order of preference items can be decided manually by an admin - or you can go with the default order, which is normally fine.
The green Up and Down arrows (See Figure 3) offers a method to manually define the processing order of the preferences within a particular category.

 Figure 3: Processing order and menu options (for the "Local Users and Groups" category)

This is a quick introduction to the menu options we have in Figure 3:
The "question mark" icon offers help for the open preference category. The help file is actually pretty good and covers most common situations.
The "documents" icon offers a method for displaying the XML data for the selected item(s).
The red "Stop sign" icon offers the option to disable the currently selected preference item. That means that the CSE will not process the item at all. The icon changes to a green "Stop sign" when a preference item is disabled. Clicking the green icon will re-enable the preference.

SYSVOL

You might wonder how GPPs actually work - and you may already have guessed it. Preferences work kind of the same way as normal Group Policy technology, the CSE takes what it needs from SYSVOL and makes sure to apply the settings on the client (in most cases in context of the SYSTEM account).

 Figure 4: The different Group Policy Preferences categories

GPPs are actually "just" folders and files - yes, you guessed it: XML formatted files - added to SYSVOL. A "Preferences" folder is created below either the "\User" (for User Configuration preferences) or the "\Machine" (for Computer Configuration preferences) folder within a GPO in SYSVOL. And for each preference category (see Figure 4) a folder is created below the "Preferences" folder (see Figure 5).

 Figure 5: A folder is created for each enabled Group Policy Preference category

Below each category folder you will find an XML file for each Preference setting you have, containing the relevant configuration options etc. - simple and very efficient!

Item Level Targeting

Item Level Targeting (ILT) is an additional "filter" to those you have on the GPO itself (WMI and security group filters), which applies to the particular GP Preference item within the GPO only - not the entire GPO as with the existing filtering options. So, for instance, if you create a GPO which has a GPP item creating a share on client you can set a kind of filter on that particular item alone, to make sure you only hit computers/users that apply to the ILT setting(s) you have defined. Within a single GPO you can have multiple preference items, each with its own targeting option(s).
With ILT you can use logical functions, like And/Or and Is/Is Not. You can create Collections of logical functions to make it all very flexible and in an extremely user friendly way. ILT is slightly faster than WMI filters as they use built-in APIs of the operating system instead of WMI.
This is a complete list of conditions you can use in ILT "filters":
Battery Present, Computer Name, CPU Speed, Date Match, Dial-Up Connection, Disk Space, Domain
Environment Variable, File Match, IP Address Range, Language, LDAP Query, MAC Address Range, MSI Query, Operating System, Organizational Unit, PCMCIA Present, Portable Computer, Processing Mode, RAM, Registry Match, Security Group, Site, Terminal Session, Time Range, User and/or a custom WMI Query. Impressive, right?
Additionally you can add both labels and comments to collections or ILT items for better overview - targeting can get pretty complex in larger environments.
Figure 6 shows the "Targeting Editor" with 2 collections, each collection with multiple Boolean ILT items (or 'queries') - one of the collections must come out true for the particular preference setting to apply to the user or the computer object.

 Figure 6: The Targeting Editor

ILT provides us with ultimate control of who gets what preference item.

Exporting & Importing Group Policy Preferences

Your GPPs can be exported to XML very easily. Just right click a preference, choose Copy and then Paste to your desktop or some other folder - and an XML document will be created. This document includes everything you need to import the GPP into another GPO (or environment for that matter). To import an XML document all you have to do is to Copy and Paste the document info the Preference area in the Group Policy Management Editor. Even Drag & Drop works for importing and exporting - it is almost too easy.
Tip:
If you open the XML document (by using Notepad, XML Notepad, Internet Explorer or whatever) you will quickly be able to spot the preference settings - including ILT configuration. If you're up for it, just copy the ITL section to other policies where you need the exact same "filter" - it's very easy to work with actually. This tip might be helpful if you have a certain ILT "filter" which must apply to a lot of different preference items.

Shortcuts, colors & variables

Some "hidden" (maybe too hidden?) options are available in different locations within the GPPs GUI. You may have wondered what the green lines (see Figure 7 below) or circles (see Figure 8 further down) represent.

 Figure 7: Folder Options Properties and colored lines

A green line below a setting, ex. "Hide extensions for known file types" on the Folder Options preference shown above, indicates that it must be processed by the CSE. A stippled red line means that the setting will not be processed by the CSE, no matter what the configured value is. Below Internet Explorer Properties you'll find the same use of colors - however this time it is not lines, but circles - the meaning of the colors is exactly the same.

 Figure 8: Internet Explorer Properties and colored circles

Here's a quick introduction to some shortcuts that make it easy to set whether or not a preference item (or all items) should be processed by the CSE:
F5: Define all settings in this dialog box - Enable the processing of all settings in the dialog window. Very useful if you have disabled some settings and you then want to "reset" the form.
F6: Define the currently selected setting - Enable the processing of a single setting in the dialog windows. Useful if you disabled one setting using F7 and you want to re-enable the item.
F7: Don't define the currently selected setting - Disables the processing of a single setting in the dialog window. Useful if you want to "bypass" one setting from being updated or changed on the client
F8: Don't define any setting in this dialog box - Disables the processing of all settings in the dialog window. Useful if you want to prevent all settings on one tab from being set on the client.
VariablesIn many cases it's very useful to be able to use variables for setting different/individual values per user/computer, etc. Hitting the F3 button brings up a list of available common variables (see Figure 9). The option "Resolve Variable" should normally be checked as this will translate the variable when the preference is processed on the client side - or else it will just represent the variable name, ex. "%AppDataDir%", which is rarely what you would need.

 Figure 9: Selection dialog with common Variables (F3 key)

Additional possibilities

Unfortunately I cannot cover the entire GPP technology in these articles, but let me briefly mention some additional possibilities:
Logging & tracingIt is possible to set up detailed logging of CSE behavior - each preference category has its own logging options (ex. "Data Sources Policy Processing", "Environment Policy Processing", "Registry Policy Processing" etc.). A group policy (or a registry hack) can be applied to make the different CSEs log what is going on behind the scenes. Sometimes troubleshooting inside log files is the only way to success, but by default logging is not turned on. You will find the logging and tracing policy settings below:
Computer Configuration | Policies | Administrative Templates | System | Group Policy | Logging and tracing
Events
The Windows Application log includes event information for each GPP category, too. Each category has its own event source, making Event log filtering easy.
Settings & results reports A great effort has been made to allow administrators to generate settings reports within GPMC as with "old style" group policies. This keeps documentation tasks very simple and offers a great overview of what each policy does.
The same goes for Group Policy Results reports - they will include preferences, however Item-Level Targeting configurations are not calculated (probably because they use local APIs instead of WMI).
 Applications
At this point in time there is no official statement from Microsoft about Application preference, which we also had with DesktopStandard PolicyMaker (see Figure 10). Content for the Application preference, which is empty by default, will most likely be available as a separate download sometime in the future.

 Figure 10: Application preferences with PolicyMaker

Encryption
If you are worried about how passwords for user accounts, service accounts, scheduled task logon accounts, etc, are stored (knowing that simple XML files are used for preferences), I can tell you that they are encrypted. I do not know the algorithm used (yet), but I can tell you that "password" translates to "wWHIrHyXsbFpBhpQ/fMKbwEEg3Ko0Es+RskCj/W6F8I" and "Password" translates to "VPe/o9YRyz2cksnYRbNeQmFQgz60no44B/3YywYtmYU" - who would have guessed that?
I'll try to get the detailed information and post it later - so far all I can say is that it is a good sign that a small change in the clear text string (lower case "p" changed to upper case "P") gives a huge change in the encryption string.
Policy and preference overlaps As you may have seen we have some overlaps between regular policies and preferences. For instance overlaps exist for Internet Explorer settings, Printer deployment, Power Options, File Security, Device Restrictions and Service settings - but don't panic! Look at this as new opportunities instead of trouble - customizing your environment, exactly the way you want it, will be even more flexible with these technologies side by side.

How do I get this stuff?

The most incredible thing, when it comes to Group Policy Preferences, is perhaps the fact that it's provided to you close to FREE from Microsoft.
All you need is a Windows Server 2003 or 2008 domain environment, a single Windows Vista with Service Pack 1 and the Remote Server Administration Toolkit (RSAT) loaded. You can then use the Vista SP1 machine to edit GPOs and include preferences of your choice. A Windows Server 2008 can of course be used as Group Policy management station as well.
To make preferences work on corporate computers they need to have the CSE client installed. Such a client will be available for download for Windows XP and up (the CSE is built-in to Windows Server 2008). The CSE client (a small MSI file) can be installed by using Group Policy Software Installation (GPSI). Windows 2000 does not support the use of Microsoft GPPs. Also note that preferences are not available in local policies.

Conclusion

Windows Server 2008 and GPMC version 2 does bring some wonderful new features related to Group Policy. Some are tiny improvements, others are huge improvements. A large part of it can definitely be very useful for administrators in most environments out there.
Group Policy Preferences should give us simpler configuration via common user interfaces, reduced need to create and maintain complex configuration scripts, flexibility (an administrator can initially configure a preference item, but allow the end user to change the settings later), you will need fewer images and of course additional configuration and security options (mentioned in part 3 of this article series) - and we do not even have to spend a lot of money to get it!
External links

• Group Policy Preferences Frequently Asked Questions
• Group Policy

Update

Since this article was published Microsoft has released the required Group Policy Preference Client Side Extensions. These are the links:

• GPP CSEs for Windows Vista (KB943729)
• GPP CSEs for Windows Vista x64 Edition (KB943729)
• GPP CSEs for Windows Server 2003 (KB943729)
• GPP CSEs for Windows Server 2003 x64 Edition (KB943729)
• GPP CSEs for Windows XP (KB943729)
• GPP CSEs for Windows XP x64 Edition (KB943729)

 If you would like to read the other parts in this article series please go to:

• Group Policy related changes in Windows Server 2008 - Part 1: What are Starter GPOs?
• Group Policy related changes in Windows Server 2008 - Part 2: GPMC Version 2
• Group Policy related changes in Windows Server 2008 - Part 3: Introduction to Group Policy Preferences

Read more...

Group Policy related changes in Windows Server 2008 - Part 3: Introduction to Group Policy Preferences

The upcoming Windows Server 2008 operating system brings a lot of new goodies. This article series will focus on the Group Policy related features which will bring both easier manageability and better security.


If you would like to read the other parts in this article series please go to:

• Group Policy related changes in Windows Server 2008 - Part 1: What are Starter GPOs?
• Group Policy related changes in Windows Server 2008 - Part 2: GPMC Version 2
• Group Policy related changes in Windows Server 2008 - Part 4: Group Policy Preferences continued

In part 1 of this article series the so called “Starter GPOs” were discussed. In part 2 we dealt with the Group Policy Management Console (GPMC) version 2 and its new search, filtering and comment options. This part 3 will deal with a new kid in town called “Group Policy Preferences”.
The next article in this series will take a closer look at Group Policy Preferences, how they work and how to use them.
Note:Some of the information in this article series is based on information from the Beta versions of Windows Server 2008 (Beta 3, RC0 and RC1). So, some features and dialog boxes may change a bit before the final release. Group Policy Preferences is part of the Release Candidate 1 (RC1) beta release of Windows Server 2008.

Group Policy Preferences

Back in October 2006 Microsoft acquired the company DesktopStandard. One of their great products, PolicyMaker, has now moved into the Microsoft product line as part of Windows Server 2008 and actually also the Remote Server Administration Toolkit (RSAT) which I’ll get back to later in this article.
The PolicyMaker software includes the ability to control and configure a great deal more, from a central point, than regular Group Policies can. Some preference settings actually overlap with “real” policy settings, but in that case you have a choice between a policy and a preference. So, you might ask: what’s the difference? Well, a “policy” is something you enforce and which cannot be changed by the user – a “preference” is a setting you would prefer the user takes on, but the user can still change it.
Preference can be set to apply only once and from that point in time the user is free to do whatever he/she wants – or to apply every time the Group Policy is refreshed (default ever 90 to 120 minutes on clients). I’ll get back to the pros and cons of this behavior in the next article in this series.
In Figure 1 you will see the new view from the Group Policy Management Editor tool, notice my policy called “GP Preferences” is split into Computer Configuration and User Configuration as is normal, but each of these nodes are split into two additional nodes: “Policies” (red color), which is the good old Group Policy stuff we all know, and “Preferences” (green color) which is for Group Policy Preference (Windows or Control Panel) settings.

Figure 1: Policies vs. Preferences

The reason why Group Policy preferences work and offer more functionality than existing Group Policy settings is a small piece of client extension software, a Client Side Extension (CSE). This small piece of software must be present on the managed clients for Group Policy Preferences to work. The required CSE is a built-in part of Windows Server 2008 – but must be downloaded for and installed on Windows XP SP2, Windows Server 2003 SP1 and Windows Vista (Windows 2000 and earlier Windows operating systems are not supported). The CSE package will be available for both 32 and 64 bit operating systems.

What can we do with it?

Group Policy Preferences offer lots of goodies for administrators around the world. A lot of it is actually stuff we would have liked there from the beginning of the Active Directory days, but hey: better late than never, right! Many of the possibilities Group Policy Preferences offer are settings people have created more or less complex scripts - or custom administrative templates (ADM/ADMX/ADML files) - to master, like drive and printer mapping, file copy tasks, desktop shortcuts, creation of ODBC data source and perhaps most importantly: custom registry tweaks for non-Group Policy aware applications! But, Group Policy preferences offers even more – the following 4 tables give a “quick view” on what this technology has to offer.
Table 1 gives an idea of what Group Policy Preferences offer in regards to Windows Settings at the Computer Configuration level.
Table 1: Computer Configuration - Windows Settings

Environment	Allows you to set Environment variables for User or System. You can Create/Replace/Update or Delete variables - even the important PATH variable.
Files	Create/Replace/Update or Delete files on clients. By defining source file(s) and destination you get a “copy” like functionality. Additionally you can set attributes (Read-Only, Hidden & Archive) on the files.
Folders	Allows you to Create/Replace/Update or Delete folders on clients. When replacing or deleting folders you get more options to make sure everything happens the way you want it to. Additionally you can set attributes (Read-Only, Hidden & Archive) on the folders.
INI Files	Create/Replace/Update or Delete INI files. You can specify INI file Section and Property names – and Property Values.
Registry	This allows you to modify registry settings on the clients – you select from Registry Items, Collection Items, and a Registry Wizard to guide you through the process. The wizard allows you to browse the registry on remote computers to select a key path you want to Create/Replace/Update or Delete. You can select from the following value types: REG_SZ, REG_DWORD, REG_BINARY, REG_MULTI_SZ, and REG_EXPAND_SZ – a huge improvement compared to the process of creating custom ADM files (which didn’t support all registry value types).
Network Shares	Allows you to Create/Replace/Update or Delete shares on clients. You choose the Share name, Folder path, Comment, User limit and even the Access-based Enumeration status. You can also choose to update all regular shares, all hidden non-administrative shares and all administrative drive-letter shares.
Shortcuts	Create/Replace/Update or Delete shortcuts on clients. You define the Target Type (File System Object, URL or Shell Object), Location, Path, Arguments, “Start in”, Shortcut Keys, Icon etc.

Table 2 gives an idea of what Group Policy Preferences offer in regards to Control Panel Settings at the Computer Configuration level.
Table 2: Computer Configuration - Control Panel Settings

Data Sources	Create/Replace/Update or Delete User or System Data Sources. Choose from available Data Source Names (DSN), choose a Data Source Driver (eg. Excel, Access, SQL Server), set Username/Password, Attributes etc. So, this is the simple way to create Open Database Connectivity (ODBC) on clients.
Devices	Control Devices on client by Enabling or Disabling the usage of a given Device Class (GUID) or Device Type (GUID). This is close to the same functionality we have with Windows Vista.
Folder Options	Define File Types and associated classes (eg. Text Document, VBScript Script File, Windows Installer Package etc.). Additionally you can configure Class settings, like Icon, Actions and more.
Local Users and Groups	Handle Local Users and Groups by Creating/Replacing/Updating or Deleting Users or Groups. You can change passwords, disable local users, control local group membership, set password options, set account expires date, delete all members of a group (users and/or groups), add/remove the current user to/from a group, rename users or groups etc.
Network Options	Create/Replace/Update or Delete a Virtual Private Network (VPN) or Dial-Up Network (DUN) connection - as a “user” or “all users” connection. You can define Dialing Options, Security (encryption/authentication etc.), Networking options etc.
Power Options	Configure Power Options and Schemes for Windows XP machines. Power Options include settings like: “Prompt for password when computer resumes from standby”, “Enable hibernation” and Power button settings. Power Schemes can be Created, Replaced, Updated or Deleted. So you can create your own perfect scheme, deploy it to your clients and make it the active Power Scheme.
Printers	Create/Replace/Update or Delete local Printers – even TCP/IP printers. You define things like Name, Port (LPT/COM/USB), IP address, Port Settings (RAW/LPR/SNMP), Printer Path, Location, Comment.
Scheduled Tasks	Create/Replace/Update or Delete Scheduled or Immediate Tasks. For Scheduled Tasks you select the Name, the File (typically a script or executable) to launch, any Arguments, “Start in”, Comments, “Run as” properties (specify domain/local user account & password), whether the task should be Enabled or not, the actual Schedule (even multiple schedules) and some of the more advanced task settings. An Immediate Task offers almost the same settings as mentioned above, except for the actual Schedule – Immediate Tasks run as soon they are loaded with the policy and only then.
Services	Set properties on Services, like Startup option (No change, Automatic, Manual or Disabled), choose an Action (No change, Start/Stop/Restart service), set a timeout in case the service is locked, set Logon and Recovery properties etc.

Table 3 gives an idea of what Group Policy Preferences offer in regards to Windows Settings at the User Configuration level.
Table 3: User Configuration - Windows Settings

Applications	I'll get back to this part of Group Policy Preferences in a later article…
Drive Maps	Create/Replace/Update or Delete mapped network drives (like NET USE). You can choose to map to a specific drive letter or just the next available drive letter. An option is available to “Connect As” another user – just provide the credentials (username/password) needed. Furthermore you can choose to Hide the mapped drive or all drives.
Environment	Allows you to set Environment variables for User or System. You can Create/Replace/Update or Delete variables - even the important PATH variable.
Files	Create/Replace/Update or Delete files on clients. By defining source file(s) and destination you get a “copy” like functionality. Additional you can set attributes (Read-Only, Hidden & Archive) on the files.
Folders	Allows you to Create/Replace/Update or Delete folders on clients. When replacing or deleting folders you get more options to make sure everything happens the way you want it to. Additional you can set attributes (Read-Only, Hidden & Archive) on the folders.
INI Files	Create/Replace/Update or Delete INI files. You can specify INI file Section and Property names – and Property Values.
Registry	This allows you to modify registry settings on the clients – you select from Registry Items, Collection Items, and a Registry Wizard to guide you through the process. The wizard allows you to browse the registry on remote computers to select a key path you want to Create/Replace/Update or Delete. You can select from the following value types: REG_SZ, REG_DWORD, REG_BINARY, REG_MULTI_SZ, and REG_EXPAND_SZ – a huge improvement compared to the process of creating custom ADM files (which didn’t support all registry value types).
Shortcuts	Create/Replace/Update or Delete shortcuts on clients. You define the Target Type (File System Object, URL or Shell Object), Location, Path, Arguments, “Start in”, Shortcut Keys, Icon etc.

Table 4 gives an idea of what Group Policy Preferences offer in regards to Control Panel Settings at the User Configuration level.
Table 4: User Configuration - Control Panel Settings

Data Sources	Create/Replace/Update or Delete User or System Data Sources. Choose from available Data Source Names (DSN), choose a Data Source Driver (eg. Excel, Access, SQL Server), set Username/Password, Attributes etc. So, this is the simple way to create Open Database Connectivity (ODBC) on clients.
Devices	Control Devices on client by Enabling or Disabling the usage of a given Device Class (GUID) or Device Type (GUID). This is close to the same functionality we have with Windows Vista.
Folder Options	Allows you to set Folder Options for Windows XP or Windows Vista – or to set “Open With” associations for given file extensions (eg. Notepad for .TXT files etc.). Setting Folder Options for Windows XP/Vista includes the possibility to enable or disable settings like: “Show hidden files and folders”, “Hide extensions for known file types”, “Hide protected operating system files”, “Show encrypted or compressed NTFS files in color”, “Use simple file sharing” and much more in the same category.
Internet Settings	Allows you to set Internet Settings for Internet Explorer 5 and 6 and/or Internet Explorer 7. Some of these overlap with regular group policy settings, it’s up to you to choose what to use. Internet Settings include things like Home Page(s), Browsing History, Tabbed Browsing, Accessibility, Security levels for specific zones, Pop-up blocker, Programs, Dial-up/LAN settings etc.
Local Users and Groups	Handle Local Users and Groups by Creating/Replacing/Updating or Deleting Users or Groups. You can change passwords, disable local users, control local group membership, set password options, set account expires date, delete all members of a group (users and/or groups), add/remove the current user to/from a group, rename users or groups etc.
Network Options	Create/Replace/Update or Delete a Virtual Private Network (VPN) or Dial-Up Network (DUN) connection – as a “user” or “all users” connection. You can define Dialing Options, Security (encryption/authentication etc.), Networking options etc.
Power Options	Configure Power Options and Schemes for Windows XP machines. Power Options include settings like: “Prompt for password when computer resumes from standby”, “Enable hibernation” and Power button settings. Power Schemes can be Created, Replaced, Updated or Deleted. So you can create your own perfect scheme, deploy it to your clients and make it the active Power Scheme.
Printers	Create/Replace/Update or Delete local Printers – even TCP/IP printers. You define things like Name, Port (LPT/COM/USB), IP address, Port Settings (RAW/LPR/SNMP), Printer Path, Location, Comment. For users you can even choose what should be the default printer.
Regional Options	Allows you to set Regional Option Properties – like User Locale, Numbers, Currency, Time format and Date format.
Scheduled Tasks	Create/Replace/Update or Delete Scheduled or Immediate Tasks. For Scheduled Tasks you select the Name, the File (typically a script or executable) to launch, any Arguments, “Start in”, Comments, “Run as” properties (specify domain/local user account & password), whether the task should be Enabled or not, the actual Schedule (even multiple schedules) and some of the more advanced task settings. An Immediate Task offers almost the same settings as mentioned above, except for the actual Schedule – Immediate Tasks run as soon they are loaded with the policy and only then.
Start Menu	Tweak the Start Menu of Windows XP or Windows Vista. This includes all the well know settings like Large/Small icons, Number of programs on Start menu, Display Run, Display Log off etc.

As you can see in the above 4 tables we get a lot of possibilities with Group Policy Preferences – settings that most of us have been missing for a long time… Imagine if we could get all of this for free – well, you don’t have to imagine anymore.

Who can get this stuff?

This part is the best – so please listen carefully… You would expect that cool stuff like StarterGPOs, Comments, Search/Advanced Filtering and Group Policy Preferences, should cost you something, right? Well, it actually doesn’t have to be expensive, you won’t have to install Windows Server 2008 on all your Domain Controllers or anything like that – all you need to do is to have a single Windows Vista SP1 with the upcoming, and freely downloadable, “Remote Server Administration Tools” (RSAT) toolkit installed and you have it all for close to nothing! RSAT will include GPMC version 2 and updated versions of the administrative tools we had in the “Administration Tools Pack” for earlier Windows Server systems.
The CSE packages will be freely downloadable from the Microsoft website, just deploy the software client to your Windows XP SP2, Windows 2003 SP1 and/or Windows Vista computers (eg. by using Group Policy Software Installation) – and it’s party time… You almost can’t stop shouting “Yippee-ki-yay”, right?
Really, I didn’t get it first – why would Microsoft give away cool stuff like this, DesktopStandard was not free, I can tell you. The best answer I have for you is from my good friend Jeremy Moskowitz: “People”. Microsoft didn’t just buy the technology, they wanted the Human Beings behind the cool software – those clever people are next in line to make Microsoft Group Policy even better than it is right now!
Note:
The final versions of both RSAT and Windows Server 2008 will be available in the first quarter of 2008.

Conclusion

Windows Server 2008 and GPMC version 2 does bring some wonderful new features related to Group Policy. Some are tiny improvements, others are huge improvements. A large part of it can definitely be very useful for administrators in most environments out there… Group Policy Preferences brings us new and very useful features we never had before – and you don’t even have to spend a lot of money to get it!
External links

• Group Policy preferences announced at IT Forum
• Group Policy Preferences Overview

Update

Since this article was published Microsoft has released the required Group Policy Preference Client Side Extensions. These are the links:

• GPP CSEs for Windows Vista (KB943729)
• GPP CSEs for Windows Vista x64 Edition (KB943729)
• GPP CSEs for Windows Server 2003 (KB943729)
• GPP CSEs for Windows Server 2003 x64 Edition (KB943729)
• GPP CSEs for Windows XP (KB943729)
• GPP CSEs for Windows XP x64 Edition (KB943729)

If you would like to read the other parts in this article series please go to:

• Group Policy related changes in Windows Server 2008 - Part 1: What are Starter GPOs?
• Group Policy related changes in Windows Server 2008 - Part 2: GPMC Version 2
• Group Policy related changes in Windows Server 2008 - Part 4: Group Policy Preferences continued

Read more...

Group Policy related changes in Windows Server 2008 - Part 2: GPMC Version 2

The new Group Policy related features which will bring both easier manageability and better security.
If you would like to read the other parts in this article series please go to:

• Group Policy related changes in Windows Server 2008 - Part 1: What are Starter GPOs?
• Group Policy related changes in Windows Server 2008 - Part 3: Introduction to Group Policy Preferences
• Group Policy related changes in Windows Server 2008 - Part 4: Group Policy Preferences continued

In part 1 of this article series we discussed “Starter GPOs”. Part 2 will deal with the Group Policy Management Console (GPMC) version 2 and its new search, filtering and comment options.
The next articles in this series will deal with all the new possibilities available with the fresh policy settings for Windows Server 2008, Group Policy Preferences Extensions and much more…
Note:
Please note that some of the information in this article series is based on information from the Beta versions of Windows Server 2008 (Beta 3, RC0 and RC1). So, some features and dialog boxes may change slightly before the final release.

These are my comments

You probably know the problem – the name of a given Group Policy Object (GPO) does not really say what the GPO does, who ordered it to do whatever it does, why it should do whatever it does and stuff like that. The “what it does” part can be seen in the Settings tab in the Group Policy Management Console (GPMC) you could argue (this is where you can print or save a detailed report), but the other questions are still unanswered.
With GPMC version 2.0 you get 2 different types of comments. These comments can be used for the exact situations I mentioned above – and more depending on your needs, of course.
The first type of comment we will look at is the primary GPO comment – you can have one of these “general” comments per GPO only.
There’s only one official way to edit this type of comment, and that is by right clicking the policy object within the Group Policy Management Editor (GPME) and choosing “Properties” (see Figure 1).

 Figure 1: Selecting GPO Properties

In the properties of the selected GPO you will notice a new tab called “Comment”, see Figure 2.

 Figure 2: The new Comment tab on a GPO

In the text field you can type in whatever comment you want. You could create a company syntax that must be used, to make sure that all relevant information is included (Ex. “who requested this GPO”, “who created this GPO”, “contact information,” etc).
The GPO comment can be viewed from GPMC on the Details tab - together with GUID information, create data, last modification date, etc, which has been there since the first version of GPMC (see Figure 3).

 Figure 3: The GPO comment viewed from GPMC Details tab

The second type of comment is available on the individual Group Policy settings – not just the GPO itself, but each setting within it! That’s good news - however the bad news is that this is only true for Administrative Template policy settings (both User and Computer Configuration). Figure 4 shows an example of a Security Setting/Password Policy – and as you can probably see there’s no Comment tab, unfortunately.

 Figure 4: No Comment tab, just the same old tabs

The Comment tab shows up on policy settings within the Administrative Template settings only (see Figure 5) – leaving a lot of stuff out. It could have been extremely nice to get the comment feature on other policy settings as well, but I guess there must be a good reason why these were left out for now.

 Figure 5: The Comment tab is present

As with the GPO comment, policy setting comments (like the one in Figure 5) could include underlying company syntax of some kind. In my example I included a reference number for the internal Request-for-Change or Support system, a date for when this setting was set the first time, who requested the change, who authorized the change and who implemented it. I think you get the point and hopefully you will find this feature very useful.
The policy setting comments can also be seen in the report you get in GPMC under the “Settings” tab, a new column has been added for this purpose (both when printing and saving the report).
To start off with I stated “There’s only one official way to edit this comment” – by that I also say that there must be an “undocumented” way of doing it – and there is. In part 1 of this article series I mentioned some files that are placed in SYSVOL when commenting a Starter GPO. The same is the case for normal GPOs, this time you just have to look below \\domain.com\SYSVOL\domain.com\Policies\{GUID} – where GUID is the unique ID of the GPO (see Figure 3). The whole point is that these files of course can be edited and/or created manually, or by a script, if you wish so.
The files mentioned in Table 1 are the reason why commenting on a GPO, and individual policy settings, is now possible. The files are not present until a comment is made, see table for more information.

Filename	Contents
\Machine\Comment.cmtx	Contains comments made on settings within the CC part of the Starter GPO (XML format). This file is only present if a minimum of one CC settings has a comment linked to it.
\User\Comment.cmtx	Contains comments made on settings within the UC part of the Starter GPO (XML format). This file is only present if a minimum of one UC settings has a comment linked to it.
GPO.cmt	Contains the GPO comment (flat text file). This file is only present if the GPO has a comment linked to it.

Table 1: Comment files
That rounds up the commenting part of the improvements we will get with Windows Server 2008 - and GPMC version 2.0. Next we’ll take a look at some cool news related to the Group Policy search functionality – or to be more exact: Filtering.

Filtering to search

If you’ve been administering Group Policies for just a short period of time you have probably asked yourself “Why can’t I search for specific policy settings?”, or “Can other people remember 2400 policy settings?”, a number of times. It’s just one of those “should have been there all the time” functions that you can’t live without, but you have had to until now…
Search is not referred to as “search” within GPME, it’s still called “filtering” like the limited functionality we had in previous versions – but it’s much more advanced now. You’ll be able to see that as soon as you select the “Filter Options” from the View menu, or as done in Figure 6.

 Figure 6: Selecting the Filter Options

Important!
As with comments, filtering is only available within Administrative Templates… Leaving room for improvement, you could say! This means that you have to select “Administrative Templates” (either below the Computer Configuration or the User Configuration part of the chosen policy) for the “Filter Options” choice to show up.
Expanding the search functionality to include the possibility to search other parts of the GPO, especially the “Security Settings”, would have been extremely nice, let’s hope it will be part of the Group Policy team’s upcoming tasks… But for now you will have to live with the “Group Policy Settings Reference for Windows Vista“ Excel sheet (see External Links section) to search for those other settings.
The Filter Options dialog, see Figure 7, is divided into 3 chunks. From the top we have some dropdown boxes to select from, then we have “Keyword Filters” and at the bottom “Requirements Filters”.

 Figure 7: The Filter Options dialog

Let’s start off from the top – or the first chunk that is…
The first dropdown box (see Figure 8) gives you the choice to show only Managed policies (those that do not “tattoo” the registry) – this is done by selecting ‘Yes’. You can also choose ‘No’, meaning you don’t want to see any Managed policies. Or you could choose ‘Any’ to get both Managed and un-Managed policies.

 Figure 8: Filter by “Managed”

The second dropdown box (see Figure 9) gives you the choice to show only Configured policy settings (those that are set) – this is done by selecting ‘Yes’. By selecting ‘No’ you get only policy settings that are left untouched – and finally ‘Any’ leaves you with both Configured and un-Configured policy settings.

 Figure 9: Filter by “Configured”

The third dropdown box (see Figure 10) gives you the choice to show only Commented policy settings (those that have a linked comment) – this is done by selecting ‘Yes’. By selecting ‘No’ you get only policy settings that are not commented – and finally ‘Any’ leaves you with both Commented and un-Commented policy settings.

 Figure 10: Filter by “Commented”

The selections you make in the 3 dropdown boxes are of course combined to narrow down the search.
The second chunk is for Keyword Filers, see Figure 11 – this is what you could actually call “Search”, yeah!
First, click “Enable Keyword Filters” and then type in some words to search for in the search field, ex. “Wait network” like in Figure 11. Then select what you want to search within by checking/un-checking the checkboxes below the search field. You can search for matches within the “Policy Setting Title”, the “Explain Text” or the “Comment” field (the stuff you have written yourself) – very cool I think!

 Figure 11: Keyword Filters

The dropdown box to the right in Figure 11 has 3 possible settings:

• ‘All’ – all the words you have typed into the search field must be present in the policy setting title, explain text or comment – depending on your checkbox choices (see above).
• ‘Any’ – if just one of the words is present it will be considered as a good match.
• ‘Exact’ – the words must be present in the exact order you typed them in, ex. “wait network” would leave you without any hits, but “wait for the network” should give you “Always wait for the network at computer startup and logon” and other policies with the exact words (in that exact order) in them.

The last chunk is for Requirements Filters, see Figure 12 – click “Enable Requirements Filters” to set these filters. Some policy settings apply to the “Windows Vista” platform only, others “Windows Vista Service Pack 1” only etc. – by using these filters you are able to see exactly what is possible when you have a given operating system/Internet Explorer/Media Player version etc.
You can select from two criteria:

• Include settings that match any of the selected platforms’– will return policy settings that any of the selected platforms are capable of handling (not all platforms must comply here).
• Include settings that match all of the selected platforms – will return policy settings that all of the selected platforms are capable of handling – so if you select “Microsoft Windows 2000” and “Windows Vista” it should return only policy settings that BOTH of these platforms comply with*.

 Figure 12: Requirements Filters

Note:
This feature has some known bugs in Windows Server 2008 RC0 that are fixed in later BETA versions, so don’t worry if it doesn’t work in your BETA test lab.
When you are done configuring and tweaking your Filter Options, hit “OK” and voila… Now what you see is what you wanted (WYSIWYW, just kiddin’). Click the new and shiny “All Settings” node, shown in Figure 13.

 Figure 13: The “All Settings” node

The “All Settings” node is so great – there‘s one for the Computer Configuration part and one for the User Configuration part of the policy. Note that when the Filter Options are enabled the filtering is done for both the Computer and the User Configuration. You can also browse through the hierarchy of policy containers like we used to (see Figure 14), but I think we’ll all get to like the “All Settings” node a lot. Notice the icons have changed where the filter takes effect.

 Figure 14: The old fashion filter browsing

If you should change something within a policy while the filter is active, let’s say you configured a previously un-configured policy setting, and you think is might have an influence on what the filter should show, you will have to “refresh” the view manually, known as “Re-Apply Filter” (see Figure 15). This is actually just like turning off the filter and then back on again.

 Figure 15: Selecting Re-Apply Filter

When you don’t want to use the filter anymore you can switch if off by removing the checkmark next to “Filter On”, see Figure 16. One thing to notice is that your Filter Options are “remembered” by GPME, so the next time you boot GPME you can switch on the last used filter right away.

 Figure 16: Filter On/Off

The last thing I want to show is the “All Settings” node in all its glory – even without filters activated this view is really nice to have. This view gives us an alphabetical view of everything below either the Computer Configuration (see Figure 17) or the User Configuration (see Figure 18) part of the policy.

 Figure 17: Computer Configuration: “All Setting” node

Click the “Setting”, “State”, “Comment” or “Path” column to order the shown policy settings if you want to find something quickly, ex. see all policy settings that have comments defined – or all that are in the state ‘Enabled’. Notice that at this point (Windows Server 2008 RC0) we have 1375 Computer Configuration settings below “Administrative Templates” alone, and 1307 for the User Configuration part, see Figure 18 – that’s a lot to remember!

 Figure 18: User Configuration: “All Setting” node
Search functionality – or filtering I should say – is going to be a huge advantage for all of us. We are not that far from the release of GPMC version 2.0 for Windows Vista – the Group Policy team once promised to release this as a separate download when Windows Vista Service Pack 1 is released (because as you know, if you read part 1 at least, the built-in GPMC will be removed during the Service Pack 1 installation). So, hang in there…

Conclusion

Windows Server 2008 and GPMC version 2 does bring some wonderful new features related to Group Policy. Some are tiny improvements, others are huge improvements. A large part of it can be very useful for administrators in most environments out there. The search functionality has been asked for, for many, many years now – and finally it has (partly) arrived. Thank you, Microsoft.

Update

Since this article was published Microsoft has released the required Group Policy Preference Client Side Extensions. These are the links:

• GPP CSEs for Windows Vista (KB943729)
• GPP CSEs for Windows Vista x64 Edition (KB943729)
• GPP CSEs for Windows Server 2003 (KB943729)
• GPP CSEs for Windows Server 2003 x64 Edition (KB943729)
• GPP CSEs for Windows XP (KB943729)
• GPP CSEs for Windows XP x64 Edition (KB943729) 

If you would like to read the other parts in this article series please go to:

• Group Policy related changes in Windows Server 2008 - Part 1: What are Starter GPOs?
• Group Policy related changes in Windows Server 2008 - Part 3: Introduction to Group Policy Preferences
• Group Policy related changes in Windows Server 2008 - Part 4: Group Policy Preferences continued

Read more...

Group Policy related changes in Windows Server 2008 - Part 1: What are Starter GPOs?

This article series will focus on the Group Policy related features which will bring both easier manageability and better security.

If you would like to read the other parts in this article series please go to:

• Group Policy related changes in Windows Server 2008 - Part 2: GPMC Version 2
• Group Policy related changes in Windows Server 2008 - Part 3: Introduction to Group Policy Preferences
• Group Policy related changes in Windows Server 2008 - Part 4: Group Policy Preferences continued

In this article we will discuss “Starter GPOs”. With Starter GPOs you get the ability to save baseline templates to use when creating new Group Policy Objects (GPO). These templates can actually be exported to other domain environments, giving you enhanced flexibility.
The next articles in this series will deal with the new features of Group Policy Management Console (GPMC) version 2.0, new policy settings for Windows Server 2008, Group Policy Preferences Extensions and much more…
Please note that some of the information in this article series is based on information from the Beta versions of Windows Server 2008 (Beta 3, RC0 and RC1). So, some features and dialog boxes may change a bit before the final release.

GPMC – in and out?

Built into Windows Server 2008 is the new and shiny Group Policy Management Console (GPMC) version 2.0. The look and feel is pretty much like the older versions, but some nice features have been added.
As you probably know, Service Pack 1 for Windows Vista will uninstall the version of GPMC that comes as part of the operating system – leaving you without a tool to manage you domain GPOs… But don’t get too disappointed now: around the release of SP1 for Vista GPMC version 2.0 will be available as a separate download from the Microsoft website.
So, to use GPMC version 2 you need one of the following:

1. Microsoft Windows Vista Service Pack 1 with the GPMC 2.0 download, or
2. Microsoft Windows Server 2008 with the Group Policy Management feature added.

Source Starter GPOs

When opening GPMC 2.0 you will probably notice a new (empty) container called "Starter GPOs". This new container can hold what I would call "templates" for creating new GPOs - with the limitation that only “Administrative Templates” settings are available – from both ‘Computer Configuration’ and ‘User Configuration’. Settings like “Software Settings” (software installation) and “Windows Settings” (scripts, account policies, user rights, software restriction policies, etc.) are NOT available in Starter GPOs, see Figure 1.

Figure 1: Only settings from “Administrative Templates”

 When creating new GPOs you can choose to use a Starter GPO as the Source Starter GPO (read: template) - which makes it easy to create multiple GPOs with the same baseline configuration, see Figure 2.

 Figure 2: Source Starter GPOs

The new GPO will contain all “Administrative Templates” policy settings from the Starter GPO which was used as a template during creation and the additional features we normally have within GPOs (like “Security Settings”, etc.). Everything other than “Administrative Templates” policy settings must then be created from scratch, just as it is today. This is where Advanced Group Policy Management (AGPM) templates show their worth. However, that product is not part of the scope for this article series, but my colleague Derek Melber has a great article on the AGPM product right

A new folder in SYSVOL

The first time you want to test - or use - Starter GPOs, you must enable the feature in the relevant domain(s). This is done by clicking the “Create Starter GPOs Folder” button, or just right clicking the “Starter GPOs” container and selecting “New…” (see Figure 3). The latter option actually creates the Starter GPOs folder too. After clicking the “Create Starter GPOs Folder” button you will have to right click the “Starter GPOs” container anyway and choose “New…”. So, if you want to save a click (hey, maybe someday you’ll need it elsewhere), just forget about the fancy button and instead select “New…” as the first thing you do (unless you have a really good reason not doing so).

Figure 3: First time use

The “New Starter GPO” dialog should pop up, asking you to leave a name and a comment up front, see Figure 4.

 Figure 4: Creating a new Starter GPO

Note that anything you type into the “Comment” field will be inherited to any GPO created with this particular Starter GPO as source. The text will be written as the GPO comment – a new feature which we will get back to in another part of this article series.
When you 'enable' Starter GPOs in the domain for the first time, a folder called "StarterGPOs" is created inside the SYSVOL folder at this path: “\\domain.com\SYSVOL\domain.com\StarterGPOs” - this is where all the "magic" is done (see Figure 5).

 Figure 5: The StarterGPOs folder in SYSVOL

For each new Starter GPO you create, you will see a new folder below this folder - each will have a unique GUID (just like regular GPOs). So, when you create a new GPO with a Starter GPO as source, a nice and simple COPY process is actually performed behind the scenes. The subfolders and files below the Starter GPOs GUID folder is just copied into the \\domain.com\SYSVOL\domain.com\Policies\[SomeNewGUID] folder (a new unique GUID is created on the fly) - and ‘presto’, you are ready to deploy a fresh GPO.

 Figure 6: Ready to create a new GPO, but not from “scratch” anymore

When right-clicking a Starter GPO, see Figure 6, you have the option to create a “New GPO From Starter GPO…”. This will give almost the same dialog as when you choose to create a new GPO from the “Group Policy Objects” container (see Figure 4) - or when right clicking an Organizational Unit (OU), or the domain itself, and selecting the option: ”Create a GPO in this domain, and Link it here...” – only this time the “Source Starter GPO” dropdown box is grayed out and static.

 Figure 7: Source Starter GPO is grayed out

The cabinet and what’s inside

The very cool thing is that you can now "export" those GPO templates (Starter GPOs) to a Cabinet file (.CAB) and then import this cabinet into another environment - completely independent of the source domain/forest! These Group Policy Objects are ‘airborne’ so to speak – finally you might add…
So, you can now create the PERFECT Starter GPO, export it (see “Save as Cabinet…” button in Figure 8) and then bring it around the world, share it with friends, on your website, deploy it on all systems you can get a hold on, etc. After the import process, which is extremely easy (see “Load Cabinet…” button in Figure 8), you are ready to create new GPOs with the Starter GPO as a baseline.

 Figure 8: Load or Save Cabinet file

If you are just as nosy as I am, you are probably dying to know what’s inside the .CAB file… Let me release you from your pain: Each file contains a minimum of 2 (if nothing is configured) and up to 6 compressed files, depending on what settings you have configured in the particular Starter GPO:

Filename	Contents
StarterGPO.tmplx	Contains GUID, version information, name, description and more (XML format). This file is always inside the CAB file.
Report.html	The settings report is generated and included as an HTML file for every “export”. This is probably done for easy reference & documentation. This file is always inside the CAB file.
Machine_Registry.pol	The ‘Computer Configuration’ (CC) part of the GPO. This file is only present if any CC settings are present in the Starter GPO.
User_Registry.pol	The ‘User Configuration’ (UC) part of the GPO. This file is only present if any UC settings are present in the Starter GPO.
Machine_Comment.cmtx	Contains comments* made on settings within the CC part of the Starter GPO (XML format). This file is only present if a minimum of one CC setting has a comment linked to it.
User_Comment.cmtx	Contains comments* made on settings within the UC part of the Starter GPO (XML format). This file is only present if a minimum of one UC setting has a comment linked to it.

Table 1
* I’ll get back to “comments” in another part of this article series.
One limitation with the Cabinet export is that you can only export a single Starter GPO per Cabinet file. So, this procedure does not take over from a regular backup procedure, which is covered next.

Backup Starter GPOs separately

The way things look right now you will have to create a separate backup process for Starter GPOs. This is because they are not backed up through the GPMC "Backup All" method you have for the regular GPOs – but they have a separate backup procedure.
If you right click the “Starter GPOs” container you have the “Back Up All…” option. This will backup all of your Starter GPOs in one go (see Figure 9).

 Figure 9: Back Up All Starter GPOs at once

If you just right click a single Starter GPO in the right pane of the GPMC you will see the “Back Up…” option. This will create a backup of that particular Starter GPO only.

 Figure 10: Select a backup location

So far there's no script for backing up the Starter GPOs, but I'm pretty sure it will show up (just like the "BackupAllGPOs.wsf” script from the GPMC Sample Scripts package).

Delegate the power

As with many other Windows features, you can delegate permissions to other users and/or groups. In this case you can delegate the permissions to create Starter GPOs in the domain. This is done from the “Delegation” tab which is visible only when the “Starter GPOs” container is selected in the tree view to the left, inside the GPMC (see Figure 11).

 Figure 11: The Delegation tab for Starter GPOs

Behind the scenes this tab reflects the NTFS security permissions on the “StarterGPOs”-folder below SYSVOL (see above); only users and groups with the adequate permissions will show up in this view.

Conclusion

Starter GPOs are templates to be used as baselines for new Group Policy Objects – making it fast and easy to create, export and import “Administrative Templates” policy settings. They may not include the same features as the GPO Templates we got with AGPM - but, even if you don't have the required DOP/SA license you still get a few cookies for "free" with Starter GPOs...
The only thing I personally don’t like about Starter GPOs is the name – to me it is a plain old ‘template’, just for GPO settings. But, my guess is that the word “template” is reserved for the more “feature complete” functionality: AGPM templates, but more on those some other time.

Update

Since this article was published Microsoft has released the required Group Policy Preference Client Side Extensions. These are the links:

• GPP CSEs for Windows Vista (KB943729)
• GPP CSEs for Windows Vista x64 Edition (KB943729)
• GPP CSEs for Windows Server 2003 (KB943729)
• GPP CSEs for Windows Server 2003 x64 Edition (KB943729)
• GPP CSEs for Windows XP (KB943729)
• GPP CSEs for Windows XP x64 Edition (KB943729)

 If you would like to read the other parts in this article series please go to:

• Group Policy related changes in Windows Server 2008 - Part 2: GPMC Version 2
• Group Policy related changes in Windows Server 2008 - Part 3: Introduction to Group Policy Preferences
• Group Policy related changes in Windows Server 2008 - Part 4: Group Policy Preferences continued

 

Read more...