White Paper Abstract

Managing Group Policy Links for a Site, Domain, or OU

To manage GPO links to a site, domain, or OU, you must have read and write access to the gPLink and gPOptions properties. By default, domain administrators have this permission for domains and OUs, and only Enterprise Administrators and Domain Administrators of the forest root domain can manage links to sites.

The Active Directory supports security settings on a per-property basis. This means that a non-administrator can be given read and write access to specific properties. In this case, if non-administrators have read and write access to the gPLink and gPOptions properties, they can manage the list of GPOs linked to that site, domain, or OU. To give a user Read and Write access to these properties, use the Delegation Wizard and select the Manage Group Policy links predefined task.

Example 1

1. 
   In the Active Directory Users and Computers snap-in, right-click the Organizational Unit that you want to delegate, and select Delegate Control.
   
2. 
   In the Delegate Control Wizard, press Next to go past the introduction page.
   You will be asked to confirm the OU that you want to delegate.
   
3. 
   Press Next.
   You will be prompted for the names of the users and groups to which you want to delegate control.
   
4. 
   Select a previously defined user or group, and press Next.
   
5. 
   In the list of Predefined Tasks, select Manage Group Policy links, and press Next.
   
6. 
   Press Finish to complete the changes.
   

Creating Group Policy Objects

By default, only domain administrators, enterprise administrators, Group Policy Creator Owners, and the operating system can create new Group Policy objects. If the domain administrator wants a non-administrator or group to be able to create GPOs, that user or group can be added to the Group Policy Creator Owners security group. When a non-administrator who is a member of the Group Policy Creator Owners group creates a GPO, that user becomes the creator and owner of the GPO; therefore, the user can edit the GPO. Being a member of the Group Policy Creator Owners group gives the non-administrator full control of only those GPOs that the user creates or those explicitly delegated to that user; it does not give the non-administrator any additional rights over other GPOs for the domain—these users are not granted rights over GPOs they didn’t create.

Note that when an administrator creates a GPO, the Domain Administrators group becomes the Creator Owner of the Group Policy Object.

When delegating to non-administrators, you should also consider delegating the ability to manage the links for a specific OU. The reason is that by default, non-administrators cannot manage links, and this will prevent them from being able to use the Active Directory Users and Computers snap-in to even create a Group Policy object. There is a work-around whereby these users can create a custom MMC console, and they can create a GPO when they select the All tab.

Example 2

In this example, control of an organizational unit is delegated to a non-administrator user so that the user or group of users can select from existing Group Policy objects and also create new Group Policy objects.

1. 
   First, complete all the steps in Example 1 above.
   
2. 
   To allow for creation of new Group Policy objects, you need to add the user or group of users to the Group Policy Creator Owners group. In the Active Directory Users and Computers tools, navigate to the Users container in the root of the domain.
   
3. 
   Double-click Group Policy Creator Owners.
   
4. 
   In the Properties page, select the Members tab.
   
5. 
   Press Add, and add the group of users (or user) selected above to the security group.
   

The user or group of users will be able to create new Group Policy objects. The user who creates each object becomes the Creator Owner of that GPO.

Editing Group Policy Objects

To edit a GPO, the user must have both read and write access to the GPO. For the current release of the product, read-only support for opening a GPO is not provided. To edit a GPO, the user must be one of the following:

• 
  An administrator.
  
• 
  A Creator Owner.
  
• 
  A user with delegated access to the GPO. That is, an administrator, or the Creator Owner, must have provided to this user both read and write access to the GPO by using the Security tab in the GPO Properties page.
  

By default, Domain Administrators, Enterprise Administrators, the operating system, and the GPO Creator Owner can edit GPOs because they have full control of GPOs without the Apply Group Policy attribute.

Example 3

In this example, control of a Group Policy object is delegated to a non-administrator user or group of users.

1. 
   Open a Group Policy object in the Group Policy snap-in.
   
2. 
   Right-click on the root node, select Properties, and click Security.
   
3. 
   Press Add to add the user or group of users, and give them read and write access. At this point, decide whether the users should also have the policy applied to them or just be able to edit it. If they do not need the policy applied to them, clear the Apply Group Policy option.
   
4. 
   Press OK to save the changes.
   

The user or group of users () will be able to edit the Group Policy object.

Specifying Group Policy to Control the Behavior of MMC extensions

Windows 2000 Group Policy includes several policy settings designed to control the behavior of MMC snap-ins. For example, you can use Group Policy to manage the rights to use MMC snap-ins.

Restricting Access to a List of Permitted Snap-ins

Administrators can specify which MMC snap-ins may be run by the affected user and which may not. This may be specified to be inclusive, which only allows a set of snap-ins to run, or it may be set as exclusive, which does not allow a set of snap-ins to run.

To create a list of permitted snap-ins for users, enable the Restrict users to the explicitly permitted list of snap-ins policy. When this policy is enabled, only permitted snap-ins can be run. If this policy is disabled or not configured, all snap-ins are permitted, except those you explicitly prohibit.

This policy is available in the Group Policy console under the User Configuration\Administrative Templates\Windows Components\Microsoft Management Console node. For more information on this policy setting, double-click the policy in the details pane, and click the Explain tab.

Controlling Access to a Snap-in

To restrict or explicitly permit access to a particular snap-in, navigate to User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy in the console tree. In the details pane, double-click the snap-in that you want to permit or restrict, and then select an option. For more information on these policy settings, double-click the desired policy in the details pane, and click the Explain tab, as shown in Figure 5, below.
F
igure 5. Controlling access to a snap-in

Preventing Use of MMC in Author Mode

Administrators can enable the Restrict the user from entering author mode policy in order to prevent users from using MMC in author mode. This policy is available in the Group Policy console under the User Configuration\Administrative Templates\Windows Components\Microsoft Management Console node.

For more information on these policy settings, double-click the policy in the details pane, and then click the Explain tab in the policy Properties dialog box.

Creating Custom Group Policy Snap-in Consoles

You can create custom Group Policy MMC consoles (.msc files), which include only a subset of the Group Policy snap-in extensions. You can combine this with the use of the policy settings above to provide a customized tool. For example, you could create a custom Group Policy console that includes only the Security Settings extension. This allows you to define Group Policy settings in a modular fashion.

To start Group Policy as a stand-alone snap-in

1. 
   Click Start, click Run, type MMC, and then press Enter.
   
2. 
   In the MMC window, on the Console menu, click Add/Remove Snap-in.
   
3. 
   On the Standalone tab, click Add.
   
4. 
   In the Add Standalone Snap-in dialog box, click Group Policy, and then click Add.
   
5. 
   In the Select Group Policy Object dialog box, click Browse to find the GPO you want to manage, and then click OK.
   
6. 
   Click Finish in the Select Group Policy Object dialog box, and then click Close in the Add Standalone Snap-in dialog box.
   
7. 
   Select the Extensions tab, and select the extension snap-ins you want to use.
   
8. 
   Click OK. The Group Policy snap-in opens with focus on the GPO you specified.
   
9. 
   After you specify the policies you want to use, click Save As on the Console menu to save your settings (in a .msc file).
   

To set access permissions, use the Security tab on the Properties page of the selected GPO. These permissions allow or deny specified groups access to the GPO.

Download 4,15 Mb.