Deploying Group Policy

Summary

In this chapter, we looked at the wide, wonderful world of Group Policies, and how they can make your life as an Active Directory administrator so much simpler by allowing you to specify security and usability settings for an entire site, OU, or domain from a single location. We started by looking at the Group Policy Management Console, which is a new Group Policy management tool that greatly simplifies the process of creating and managing Group Policy Objects. We then talked about the different configuration settings that you can control through Group Policy, including security settings like password policies and account lockout policies. You can also use a GPO to customize and control your users’ desktops, removing access to potentially harmful items like the Control Panel and the command prompt. To further control security in your environment, you can use security templates that will allow you to configure numerous machines with the same security settings without risking data entry errors from entering the same information multiple times. You can also use Group Policy to centrally deploy software applications to your users and computers, as well as controlling the software that’s allowed to run by using Software Restriction Policies. We closed out the chapter with a look at some more advanced Group Policy tricks, such as configuring permissions on Registry keys and NTFS files and folders, and controlling the startup behavior of Windows services.