Group Policy Objects phần 3

1. The Group Policy Object Editor will launch, and it will be focused on the selected GPO. Under the GPO name, you see two nodes: Computer Configuration and User Configuration
Nội dung trích xuất từ tài liệu:
Group Policy Objects phần 31. The Group Policy Object Editor will launch, and it will be focused on the selected GPO. Under the GPO name, you see two nodes: Computer Configuration and User Configuration. To demonstrate administrative templates, lets focus on the User Settings. Expand the User Configuration node, then expand the Administrative Templates node. Youll see a tree of folders representing the available areas for administrative template controls (Fig. 11.13). Figure 11.13: The Group Policy Object Editor focused on the Default Domain Policy2. What you see is a graphical representation of the ADM files that are loaded by this particular GPO. The ADM files dictate which folders, registry keys, and values are presented here. Each folder, such as Control Panel, Network, and System, represents ADM categories. Within each category are sets of policies that you can specify. For example, if you expand the System folder, you will see a subfolder named Power Management. After you expand a specific subfolder, the right pane of the Group Policy Object Editor window will expose the list of all available registry limitations that can be set in relation to the selected feature. For example, the Power Management folder contains the Prompt for password on resume from hibernate / suspend policy. (When you configure this policy, the appropriate setting will be created or modified in registry.)3. To configure a specific policy, simply double-click it to open the respective Properties window (Fig. 11.14). Previously in this section, when discussing the ADM file structure, I pointed out the new keywords appearing with each new Windows version. Now, notice the effect they have on the GPO Editor user interface. For example, the EXPLAIN keyword appears in the Properties windows Explain tab, which you can click to read Help text associated with the selected policy item. Also notice the Supported on: At least Windows XP Professional… string at the bottom of this dialog. It appeared because the SUPPORTED statement was included in the ADM file. Despite these changes to the GPO Editor user interface, the template offers familiar choices. For example, like in Windows NT 4.0 policies, policy items in Windows 2000, Windows XP, or Windows Server 2003 can have three different states (Fig. 11.14), as follows: o Not Configured — The particular registry value behind this policy item is not changed, regardless of its state. o Disabled — This particular policy item is disabled. That is, if the policy is Prompt for password on resume from hibernate / suspend — when it is disabled, each user can decide whether to automatically lock his or her computer after performing a resume operation. o Enabled — This policy item is enforced at all times. Figure 11.14: Policy items in Windows 2000, Windows XP or Windows Server 2003 can have one of three states: Not Configured, Enabled, or Disabled 4. If multiple GPOs are applied to a user or machine, two identical policy items from different GPOs could contradict each other (i.e., one enables an item and the other disables it). In this case, its the last-writer-wins approach that resolves the conflict. The last writer may not always be obvious because GPOs can reside at the site, domain, or OU levels, and each of level can have multiple GPOs. I already mentioned the order of precedence in the Directory (Local, Site, Domain, OU). In addition, a set of up/down buttons next to the list of available GPOs allows the order of precedence to be set within a container. The higher a GPO is in the list, the later it is processed. Later settings override previous ones.Once you set all of the policy items within a GPO, where is this information kept? Aspreviously mentioned, it is replicated in the SYSVOL directory in the Group PolicyTemplate for that GPO. Both machine- and user-based administrative template settingsare stored in a file called Registry.pol. However, each is stored in its own folder. Forexample, user-specific Registry.pol is located in %SystemRoot%sysvoldomainpolicies\User. Registry.pol replaces the Ntconfig.pol andConfig.pol files, which were used in Windows versions earlier than Windows 2000.However, unlike Ntconfig.pol, Registry.pol is not a valid registry hive file. You cant loadit into a temporary hive, nor can you view it. It is a text file, but it contains non-printablecharacters and cannot be edited using a text editor, such as Notepad.However, one drawback of Windows NT 4.0 policies was the effect of tattooing. Whenyou remove a policy from the domain, the entries are left in the registry for the affecteduser or machine. This is not the case in Windows 2000 and later. In these newer v ...