Win Connections Group Policy Changes ( Harold W)
Download as PPTX, PDF•0 likes•7 views
This document summarizes the key changes to group policy in Windows Server 2008 R2 and Windows 7. It discusses new features like group policy PowerShell cmdlets, starter GPOs, ADMX improvements, richer GP preferences, and updated ADMX policy settings. It provides deployment guidance for separating GPOs between different Windows versions and recommends replicating SYSVOL with DFS-R.
Win Connections Group Policy Changes ( Harold W)
- 1. Windows Server 2008 R2 / Windows 7 Group Policy ChangesHarold WongSr. IT Pro Evangelistblogs.technet.com/haroldwong
- 2. Session ObjectivesSession Objective(s): Quick review of new GP features in Windows Server 2008 & Windows Vista SP1.In depth understand what Group Policy changes have been made to Windows Server 2008 R2 / Windows 7How to get from Windows XP/2003 to Windows 7/R2TakeawayGP in Windows 7 / Windows Server 2008 R2 is incremental, not major change
- 3. BackgroundHow Group Policy works now...Windows Vista/Windows Server 2008Group Policy ServiceGP now runs in a shared serviceHardened Service, more reliableGroup Policy ProcessPart of WinlogonTemplatesADM templates difficult to manageGroup Policy TemplatesADM Templates now in ADMX files (ADMX, ADML)ADMADMADMADMADMADMADMXLocal GPOsLimited flexibility with a single local GPOMultiple Local GPOsLGPO’sLGPO’sSettings~1,800 policy settings in XPIncomplete coverage means missing key scenariosGroup Policy SettingsOver 800 new policy changes with Windows VistaExtended GP for new Windows Vista featuresLGPOLGPOLocal Computer PolicyLocal Computer PolicyAdminAdmin/Non-Admin Group PolicyUserUser Specified Group PolicyNetwork Limited awareness of changing network conditionsNetwork Location Awareness (NLA)NLA service provides the latest network informationApplications can query or register with NLA for network change indicationsTemplates and Replication Journal Wrap anyone? Bloated SYSVOL?Group Policy Central StoreCentralized repository for ADMXCreated in the Sysvol on DC in each domainNew Replicator with DFS-RADMXADMLTroubleshootingUser.env logGP ResultGroup Policy LoggingAdministrative logApplications and Services logXML based event logsNew Tools - GPOLogViewSysVolSysVolDCDC+Policies+GUID+ADMPolicy Definitions+FRS/DFS-RADMX, ADML Files
- 4. Creating a Central Storedemo
- 5. OverviewWhat is new in Windows Server 2008 R2 / Windows 7?GP PowerShell featuresAdding to GP scripts extensionsPowerShell cmdlets to perform GP operationsStarter GPOs in-box in Windows 7Best practices that map to the security guideADMX enhancementsGP Preferences enhancementsGP Preferences, new in Windows Server 2008New items added to support new OS functionality
- 6. Powershell In and OutPowerShell Scripting inside GPExtend current reach of GP Script Extension to include PowerShell for logon/logoff, startup/shutdown scriptsPowershellCmdlets for GPMC operationsFull lifecycle: create, link, rename, backup, copy, removeEnables interesting new scenarios for customersPowershellCmdlets that write and read registry settings to GPO(s)Values can be written to either Policy or PreferencesSettings can accept more value types
- 7. GPO Lifecycle With Cmdlets* Registry settingsGP Object
- 8. GP Powershell CmdletsImport-module GroupPolicyget-help *-gp*
- 10. Starter GPOsEasy experience out-of-the-boxEmbody best practices that map to Microsoft security guide8 System Starter GPOs:User and Computer caseAvailable for Vista and XP SP2Enterprise Client (EC) and Specialized Security Limited Functionality (SSLF)System vs CustomStatic / EditableADMX / Security Settings
- 11. ADMX ImprovementsNew UI: More intuitive, integrated help content, no more tabsSupport for:REG_MultiSZREG_QWORD
- 12. Starter GPOs and ADMX UIdemo
- 13. GP PreferencesPreference SettingsNot true “Policy”More control of desktop – more settings!Not limited to policy-aware applicationsEase of administration through rich UIBetter targetingNew in Windows Server 2008 R2 / Windows 7Support for new Power Plan settingsSupport for new Schedule task triggers, actions, etc.
- 14. Richer UIFamiliar ExperienceClearer to understand and findEasy to manageBetter control of individual settings – Red/GreenPowerful browsersAvoids typing errorsConfigure settings quicker
- 15. Better TargetingRobust targeting 29 types Boolean logic (And, Or, Not) CollectionsItem level targeting, not GPO levelIntuitive UI No need to learn query languages
- 17. What is new in ADMX3000 Total ADMX settings300 new ADMX settingsIE more than 90 newBitlockerTaskbarPowerTerminal Services rebranded “Remote Desktop Services”Settings Spreadsheet
- 18. What about Security Settings?12 settings added under Security OptionsRestrict NTLM (multiple)Kerberos encryption typesLocal System null session fallbackOnly supported on Windows 7 & Windows Server 2008 R2Settings Spreadsheet
- 19. Anything else?Wireless Network (IEEE 802.11) Policies
- 21. Certificate Services Client - Certificate Enrollment Policy
- 24. Enforcement Clients: Removed RAQ EC and TS Gateway
- 25. Enforcement Clients: Added RD Gateway QEC
- 26. Application Control Policies – AppLocker
- 27. More info
- 28. Advanced Audit Policy Configuration
- 29. More info
- 30. Name Resolution PolicyRecommendationsDFS-R replicating SYSVOLThe GP team recommends this stronglyFRS IssuesFile Based ReplicationDoes not self healDoes not tell you when its brokenDFS-R for SYSVOL requires:Windows 2008 Domain FunctionalAll Windows Server 2008 DC’s minimumhttp://blogs.technet.com/notesfromthefield/archive/2008/04/27/upgrading-your-sysvol-to-dfs-r-replication.aspx
- 31. RecommendationsExcessive GPOsHave heard up to 11,000 GPOsNot best practiceGPMC has perf issues loading Management difficultiesTroubleshooting difficultiesMigration difficultiesRecommendation:ConsolidateAGPM is tested up to 2000 GPOs
- 32. FAQ’sDC’s, Domains and ForestsAny impact for co-existence between Windows Server 2003 GP, Windows Server 2008 and R2 in the same domain?Are there any schema changes required?Are there any DomainPrep considerations?Does policy itself replicate any differently?Do you still use the same tools to diagnose replication issues like Ultrasound (FRS)?
- 33. FAQ’sADMX and AuthoringDoes ADMX make policy different?Is it stored any differently?What about the Vista Central Store?Will ADMX create an impact on my policies?Can I use ADM at all?Ok then, can I drop ADM files into the Central Store?
- 34. FAQ’sMiscellaneousWith the move from Winlogon to a service does this mean users can deny policy applying?Do we have plans to provide an updated GPMC/GPOE to support Windows XP administrative PC’s with ADMX and the Central Store?Is there any way to restrict editing GPOs from certain OS versions ? i.e.: restrict editing from anything below W2K3 ?Is it a good idea to separate Vista/W7 GPOs from the Windows XP GPO‘s
- 35. DeploymentGuidanceApplocker PolicyWill only apply on Windows 7 Ultimate and EnterpriseBest Practice: Separate Policy for Windows Vista/7 machinesSRP PolicyCan apply on Windows 7 and previousWhen W7 sees both SRP and Applocker it only applies ApplockerBest Practice: Separate Policy for Windows Vista machines and previousThree methods for policy separationGrouping (Read/Apply control)Separate OU with GPO linkWMI FilterSelect * FROM <WMI_CLASS> WHERE <WMI Property>=<value>Select * FROM Win32_OperatingSystem WHERE Caption="Microsoft Vista" AND CSDVersion="Service Pack 2"
- 36. DeploymentGuidanceFirewall PolicyWill apply the most permissive ruleBest Practice: Separate Policy for Windows Vista/7 machinesIPSEC PolicyOld UI for pre-VistaNew UI for VistaBest Practice: Separate Policy for Windows Vista machinesThree methods for policy separationGrouping (Read/Apply control)Separate OU with GPO linkWMI FilterSelect * FROM <WMI_CLASS> WHERE <WMI Property>=<value>Select * FROM Win32_OperatingSystem WHERE Caption="Microsoft Windows XP Professional" AND CSDVersion="Service Pack 2"
- 37. DeploymentGuidanceAuditing PolicyTotally different in XP to VistaFine Grained (Vista/W7) as opposed to clumsy and awful (XP)Separate itAuditing Differences between Vista and Windows 7Fundamentally the same (fine grained)No GP enablement in Windows VistaVista uses auditpol.exe
- 38. Community ToolsADMX Migrator (FullArmor)http://www.microsoft.com/downloads/details.aspx?familyid=0F1EEC3D-10C4-4B5F-9625-97C2F731090C&displaylang=enSysprosoft ADM Template Editorwww.sysprosoft.comPolicyPakEnhancements to GPwww.policypak.comILTEditorhttp://www.gruppenrichtlinien.de/tools/ILTEditor.zip
- 39. Learn More About Windows Server 2008 R2Technical ResourcesCommunity ResourcesGet Hands on TrainingThe New Efficiency Virtual Launch Experience www.thenewefficiency.com
- 40. Windows Server 2008 R2 evaluation www.microsoft.com/ws08eval
- 41. Windows Server TechCenterhttp://technet.microsoft.com/windowsserver
- 42. Windows Server Division blog http://blogs.technet.com/windowsserver/
- 43. Windows Virtualization Team blog http://blogs.technet.com/virtualization/
- 44. Windows Server forums http://social.technet.microsoft.com/Forums/en-US/category/windowsserver
- 45. Training Offers—Exclusive for Launch Attendees www.microsoft.com/learning/careeroffers
- 46. Windows Server 2008 Learning Resources www.microsoft.com/windowsserver2008/en/us/learning.aspx© 2009 Microsoft Corporation. All rights reserved. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.