Published: April 2003

Introduction

Through this Active Directory infrastructure and Group Policy, administrators can take advantage of policy-based management to do the following:

• 
  Enable one-to-many management of users and computers throughout the enterprise.
  
• 
  Automate enforcement of IT policies.
  
• 
  Simplify administrative tasks, such as system updates and application installations.
  
• 
  Consistently implement security settings across the enterprise.
  
• 
  Efficiently implement standard computing environments for groups of users.
  

The new Group Policy Management Console (GPMC) provides a unified, graphical user interface for deploying and managing Group Policy implementations and enables script-based management of Group Policy operations. In addition, Windows Server 2003 adds even greater administrative control to Group Policy, including more than 200 new policy settings for the operating system. Additionally, support for Windows Management Instrumentation (WMI) filters provides a greater degree of control over how Group Policy is applied to users and computers.

Group Policy and Active Directory are key components of the IntelliMirror® management technologies. Through these technologies, IT administrators can implement standard computing environments for groups of users and computers. As a result, IntelliMirror can significantly boost user productivity and satisfaction while increasing administrator efficiency and reducing IT costs.

This article is intended for IT administrators new to Group Policy. It provides an overview of Intellimirror, introduces Group Policy, and describes new Group Policy features introduced with Windows Server 2003.

Intellimirror Management Technologies

Administrators are tasked with helping to keep people productive as they use their computers for day-to-day work. Intellimirror eases this task. Intellimirror enables administrators to provide users with consistent access to their applications, application settings, and user data from any managed computer—even when users are disconnected from the network. Because users can maintain constant access to all their information and applications, they receive the assurance that their data is safely maintained and available from a server. For IT organizations, eliminating the need to manually configure user settings, install applications, and transfer user files reduces overhead.

IntelliMirror technologies combine the advantages of centralized computing with the performance and flexibility of distributed computing. Implemented as a set of Windows technologies, Intellimirror allows administrators to create standard computing environments for groups of users and computers. When fully deployed, IntelliMirror provides policy-based management of users’ desktops and servers. Through centrally defined policies based on users’ group memberships and location, machines running Windows–based server and client operating systems (Windows 2000 and later) are configured automatically to meet a specific user’s requirements each time he or she logs on to a network.

The following table highlights the benefits to users when Intellimirror is implemented and identifies the technologies that enable these features. IntelliMirror uses different features in both the server and client, and these features can be used either separately or together depending on the requirements of the environment.

Intellimirror Benefits and Technologies

Benefit	Description	Technologies
Consistent Environment	Users can work with a consistent computing environment from any computer, such as when their desktop or laptop computer is unavailable. Users profiles are stored on a server so that the profile is available from any machine. In cases where users are not assigned a specific computer, hardware and administration costs are reduced as well, because users can log on to any available Intellimirror–managed computer and work in a familiar environment.	Active Directory Group Policy Offline Folders Roaming User Profiles Redirected Folders Enhancements to the Windows Shell Group Policy Software Installation
Uninterrupted Access	Users can continue to work efficiently even when network connections are intermittent or even disconnected. Under these conditions, uninterrupted access to user and configuration data can be enabled. Intellimirror eases the IT task of implementing centralized backup of user files while satisfying need for these files to remain available on users’ computers.	Active Directory Group Policy Offline Folders Synchronization Manager Enhancements to the Windows Shell Redirected Folders Disk Quotas
Minimized Data Loss	IT organizations can enable centralized backup of user data and configuration files. Centralized backups ease the IT workload and satisfy users’ need for files to remain available on their computers.	Active Directory Group Policy Roaming User Profiles Redirected Folders Offline Folders
Minimized User Downtime	Administrators can enable automated installation and repair of applications, reducing support costs by using Windows Installer to repair application installations automatically.	Active Directory Group Policy Windows Installer Service Add/Remove Programs in Control Panel Group Policy Software Installation

Group Policy Overview

Administrators can manage computers centrally through Active Directory and Group Policy. Using Group Policy to deliver managed computing environments allows administrators to work more efficiently because of the centralized, one-to-many management it enables. Measurements of total cost of ownership (TCO) associated with administering distributed personal computer networks reveal lost productivity for users as one of the major costs for corporations. Lost productivity is frequently attributed to user errors, such as modifying system configuration files and rendering a computer unworkable, or to complexity, such as the availability of nonessential applications and features on the desktop. Because Group Policy defines the settings and allowed actions for users and computers, it can create desktops that are tailored to users’ job responsibilities and level of experience with computers.

Defining Group Policy

Administrators use Group Policy to define specific configurations for groups of users and computers by creating Group Policy settings. These settings are specified through the Group Policy Object Editor tool (formally known as GPedit) and contained in a Group Policy object (GPO), which is in turn linked to Active Directory containers, such as sites, domains, or OUs as Figure 1 shows. In this way, Group Policy settings are applied to the users and computers in those Active Directory containers. Administrators can configure the users’ work environment once and rely on the system to enforce the policies as defined.



Figure 1. GPOs are applied to sites, domains, and the OUs beneath them. Here, OU1 is affected by GPO1, GPO2, and GPO3. OU2 is affected by all four GPOs.

Download 0,64 Mb.