Appendix C: Group Policy Storage

Do Group Policies override User Profile settings?

Where is the System Policy Editor (Poledit.exe) located, and why would I need to use it?

To create a properly formatted .pol file for Windows 95 or Windows 98, Poledit.exe must be run on a Windows 95 or Windows 98 client. For more details about this process and Windows NT 4.0 System Policy, see the white paper called “Implementing Profiles and Policies for Windows NT 4.0,” available at http://www.microsoft.com/ntserver/management/deployment/planguide/prof_policies.asp.

For Windows NT 4.0 and Windows 2000, Poledit.exe may be run on either system. The resultant .pol file must then be copied to the domain controller's Netlogon share.

Is there a programmatic way to add, edit, or delete GPOs?

Some of these functions can be performed with the Windows 2000 Server Resource Kit command line tool called GPOTool.exe. You can use GPOTool.exe to do the following:

• 
  Perform Group Policy object checks for consistency, including reading directory services properties (version, friendly name, extension, SYSVOL data (Gpt.ini), and GUIDs), comparing directory services and SYSVOL version numbers, and performing other consistency checks.
  
• 
  Check Group Policy object replication. The tool reads the Group Policy object instances from each domain controller and compares them (selected GPC properties and full recursive compare for GPT).
  
• 
  View Group Policy object information, including such properties as functionality version and extension GUIDs.
  
• 
  Browse Group Policy objects based on friendly name or GUID. A partial match is also supported for both name and GUID.
  
• 
  Set options for preferred domain controllers. By default, all available domain controllers in the domain are used; this can be overwritten with the supplied list of domain controllers from the command line.
  
• 
  Viewing policies in different domains by using a command-line option.
  
• 
  Run in verbose mode. A command-line option can turn on verbose information about the policies being processed.
  

The Windows 2000 directory service that stores information about all objects on the computer network and makes this information easy for administrators and users to find and apply. With the Active Directory, users can gain access to resources anywhere on the network with a single logon. Similarly, administrators have a single point of administration for all objects on the network, which can be viewed in a hierarchical structure.

Template files that provide settings pertaining to Windows 2000, Windows NT version 4.0, and Windows 95 and Windows 98 operating system and registry structure. The .adm file specifies the registry settings that can be modified through the Group Policy snap-in user interface. The .adm file consists of a hierarchy of categories and subcategories that together define how the options are displayed through the Group Policy snap-in user interface. It also indicates the registry locations where changes should be made if a particular selection is made, specifies any options or restrictions (in values) that are associated with the selection, and in some cases, specifies a default value to use if a selection is activated.

A Group Policy snap-in extension that includes all registry-based Group Policy, which you use to define settings that control the behavior and appearance of the desktop, including the operating system and applications.

The Administrative Templates snap-in extension includes functionality for managing disk quotas.

application assignment

In Windows 2000, you can use the Software Installation snap-in extension of the Group Policy snap-in to assign applications to users so that the applications appear to be installed and available on the user's desktop whenever a user logs on.

You assign applications to a particular Group Policy Object (GPO), which is, in turn, associated with a selected directory container (site, domain, or organizational unit). When you assign applications, the application is advertised to every user managed by the GPO. This installs only enough information about the application to make application shortcuts appear on the Start menu and the necessary file associations appear in the registry. When users managed by the GPO log on to a computer running Windows 2000, the application appears on their Start menu. When users select the application from the Start menu for the first time, the application is installed. Advertised applications can also be installed by clicking on a document managed by the application (either by file extension or by COM-based activation).

application publishing

In Windows 2000, you can use the Software Installation snap-in extension of the Group Policy snap-in to publish applications to users. Published applications are those that the administrator makes available for on-demand use.

Published applications have no presence on the users' computers. That is, no shortcuts or Start menu references to the application are present on the desktop. A published application is advertised to the Active Directory. The advertised attributes are used to locate the application and all the information required for installing it. After the application is advertised in the Active Directory, users can activate it by document association, just as an assigned application. Users can also set up the program using the Add/Remove Programs Control Panel tool on their desktop.

.cab file

A .cab file contains one or more files, all of which are downloaded together in a single compressed cabinet file. Included in the cabinet is an .inf file that provides further installation information. The .inf file may refer to files in the .cab and to files at other uniform resource locators (URLs).

A part of the security descriptor that specifies the groups or users that can access an object, as well as the types of access (permissions) granted to those groups or users. See also security descriptor.

Within the Administrative Templates node of the Group Policy snap-in are policy options for managing disk quotas, which administrators can use to monitor and limit disk space use for NTFS volumes formatted as NTFS version 5.0. After you enable disk quotas, you can set options for disk quota limits and warnings.

A grouping of servers and other network objects under a single name. Domains provide the following benefits:

• 
  You can group objects into domains to help reflect your company’s organization in your computer network.
  
• 
  Each domain stores only the information about the objects located in that domain. By partitioning the directory information this way, the Active Directory scales up to as many objects as you need to store information about on your network.
  

You can combine multiple domains into structures called domain trees. The first domain in a tree is called the root of the tree, and additional domains in the same tree are called child domains. A domain immediately above another domain in the same tree is referred to as the parent of the child domain.

All domains within a single domain tree share a hierarchical naming structure. Domains that share a common root share a contiguous namespace. Domains in a tree are joined together through two-way, transitive trust relationships. These trust relationships are two-way and transitive, therefore, a domain joining a tree immediately has trust relationships established with every domain in the tree.

Folder Redirection snap-in extension

A Group Policy snap-in extension that you use to place the Windows 2000 special folders in network locations other than their default location (%systemroot%/Documents and Settings) on the local computer.

A 128-bit integer that identifies a particular object class and interface. GUIDs are virtually guaranteed to be unique. A GUID can be generated using either the uuidgen.exe utility from the Platform Software Development Kit, or the guidgen tool included in the Microsoft Visual C++® development system. For more information about GUIDs, see the OLE Programmer’s Reference, Volume One; the Platform Software Development Kit documentation; and Inside OLE, 2d ed. by Kraig Brockschmidt, Redmond, Wash.: Microsoft Press, 1995.

A component used in Windows 2000 to define options for managed desktop configurations for groups of users and computers. To specify Group Policy options, you use the Group Policy MMC snap-in.

The part of Group Policy that runs in the Winlogon process.

The Group Policy settings that you create by using the Group Policy snap-in are contained in a Group Policy object (GPO), which is in turn associated with selected Active Directory containers: sites, domains, and organizational units (OUs).

To create a specific desktop configuration for a particular group of users and computers, you use the Group Policy MMC snap-in.

You can specify Group Policy settings for the following:

• 
  Registry-based policies—Includes Group Policy for the Windows 2000 operating system and its components and for applications. To manage these settings, use the Administrative Templates node of the Group Policy snap-in.
  
• 
  Security settings—Includes options for local computer, domain, and network security settings.
  
• 
  Software Installation and Maintenance options—Used to centrally manage application installation, updates, and removal.
  
• 
  Script options—Includes scripts for computer startup and shutdown and user logon and logoff.
  
• 
  Folder Redirection options—Allows administrators to redirect users’ special folders to the network.
  
• 
  Internet Explorer Maintenance—Used to manage and customize Internet Explorer on Windows 2000-based computers.
  
• 
  Remote Installation Services—Used to control the behavior of the Remote Operating System Installation feature as displayed to client computers
  

Administrators use Internet Explorer Maintenance to manage and customize Microsoft Internet Explorer on Windows 2000-based computers.

A common console framework for system-management applications. The primary goal of the Microsoft Management Console is to support simplified administration and lower cost of ownership through tool integration, task orientation, support for task delegation, and overall interface simplification. The MMC console hosts the administrative tools (these are called MMC snap-ins); the console itself provides no management functionality.

Tools that extend the MMC console and provide administrative functionality. A snap-in functions independently from other snap-ins.

A tool that enhances the functionality of a parent snap-in. An extension depends on a parent snap-in for contextual data.

A type of directory object contained within domains. OUs are logical containers into which you can place users, groups, computers, and even other organizational units.

A database in which Windows NT internal configuration information and computer- and user-specific settings are stored.

A section of the registry that is saved as a file. The registry subtree is divided into hives (named for their resemblance to the cellular structure of a beehive). A hive is a discrete body of keys, subkeys, and values.

A new optional component included in Windows 2000 Server that administrators can use to remotely install a local copy of the Windows 2000 Professional operating system on supported computers throughout their organization. Administrators can deploy a new version of an operating system upgrade to large numbers of clients at one time from a centralized location.

Administrators can use Group Policy to specify the client installation options that groups of users can access. These options are determined by the specific Remote OS Installation Group Policy settings that administrators define for the site, domain, or OU to which the users belong, in conjunction with the specific security group or user account.

schema

The formal definition of all object classes, and the attributes that make up those object classes, that can be stored in the directory. The Active Directory includes a default schema, which defines many object classes, such as users, groups, computers, domains, organizational units, and security policies. The Active Directory schema is dynamically extensible; this means that you can modify the schema by defining new object types and their attributes and by defining new attributes for existing objects. You can do this either programmatically with the Schema Manager snap-in tool included with Windows NT Server.

Batch files (.bat) or executable (.exe) files that run when a computer starts up or shuts down or when a user logs on or off at any type of workstation on the network. Windows 2000 supports Windows Scripting Host Visual BasicScripting Edition (VBScript) and Jscript, while continuing to support MS-DOS command scripts and executable files.

A set of access-control information attached to every container and object on the network. A security descriptor controls the type of access allowed to users and groups. Administrators assign security descriptors to objects stored in the Active Directory in order to control access to resources or objects on the network.

A security descriptor lists the users and groups that are granted access to an object (a file, printer, or service, for example), and the specific permissions assigned to those users and groups. See also discretionary access control list and system access control list.

Security Settings extension snap-in

A Group Policy extension snap-in that you use to define security configuration for computers within a Group Policy object. A security configuration consists of settings applied to each security area supported for Windows 2000 Professional or Windows 2000 Server. This configuration is included within a GPO.

In Windows 2000 you register your network’s physical topology by defining sites. A site is defined as one or more IP subnets. Windows 2000 uses site information to direct requests from one computer to be fulfilled by another computer at the same site. For example, when a workstation logs on, the Active Directory uses the TCP/IP address of the workstation, along with the site information you have entered, to locate a domain controller on the local site. This local controller is used to service the workstation’s requests.

A Group Policy extension snap-in that you use to assign scripts to run at computer startup or shutdown or upon user logon or logoff.

A Group Policy extension snap-in that you use to centrally manage software distribution in your organization.

Part of a security descriptor that specifies which user accounts or groups to audit when accessing an object, the access events to be audited for each group or user, and a Success or Failure attribute for each access event, based on the permissions granted in the object’s DACL.

Refers to the administrative costs associated with computer hardware and software purchases, deployment and configuration, hardware and software updates, training, maintenance, and technical support.

Packages that contain all the information necessary to describe to the Windows Installer how to set up an application in every conceivable situation: various platforms, different sets of previously installed products, earlier versions of a product, and numerous default installation locations. The Software Installation extension snap-in to the Group Policy snap-in uses .msi packages.

Microsoft’s solution for lowering the total cost of ownership is an initiative called Zero Administration Windows. The broad goals for Zero Administration Windows are to significantly lower the cost of initial configuration from today’s levels and to decrease administrative overhead when the network is running in a steady state. After initial computer configuration, a combination of automatic application setup, scripting, and desktop policies significantly lowers the costs associated with managing workstations.

For More Information