AnOverviewofGroupPolicyPreferencesByJerryHoneycuttPublishedNov
ember2007AbstractGroupPolicypreferencesenableITprofessional
stoconfigure,deploy,andmanageoperatingsystemandapplicati
onsettingstheypreviouslywerenotabletomanageusingGroupP
olicy.Examplesincludemappeddrives,scheduledtasks,andStart
menusettings.Formanytypesofsettings,usingGroupPolicypr
eferencesisabetteralternativetoconfiguringtheminWindows
imagesorusinglogonscripts.Thiswhitepaperintroducesthisn
ewMicrosoft?WindowsServer?2008feature,anddescribeshowyou
canuseGroupPolicypreferencestobetterdeployandmanagecom
puteranduserpreferences.Theinformationcontainedinthisdocu
mentrepresentsthecurrentviewofMicrosoftCorporationonthe
issuesdiscussedasofthedateofpublication.BecauseMicrosoft
mustrespondtochangingmarketconditions,itshouldnotbeint
erpretedtobeacommitmentonthepartofMicrosoft,andMicroso
ftcannotguaranteetheaccuracyofanyinformationpresentedaft
erthedateofpublication.Thiswhitepaperisforinformational
purposesonly.MICROSOFTMAKESNOWARRANTIES,EXPRESSORIMPLIED,
INTHISDOCUMENT.Complyingwithallapplicablecopyrightlawsis
theresponsibilityoftheuser.Withoutlimitingtherightsunde
rcopyright,nopartofthisdocumentmaybereproduced,storedi
norintroducedintoaretrievalsystem,ortransmittedinanyfo
rmorbyanymeans(electronic,mechanical,photocopying,recordi
ng,orotherwise),orforanypurpose,withouttheexpresswritte
npermissionofMicrosoftCorporation.Microsoftmayhavepatents,
patentapplications,trademarks,copyrights,orotherintellectu
alpropertyrightscoveringsubjectmatterinthisdocument.Exce
ptasexpresslyprovidedinanywrittenlicenseagreementfromMi
crosoft,thefurnishingofthisdocumentdoesnotgiveyouanyli
censetothesepatents,trademarks,copyrights,orotherintellec
tualproperty.?2007MicrosoftCorporation.Allrightsreserved.
Microsoft,ActiveDirectory,Windows,WindowsServer,WindowsVis
ta,andtheWindowslogoandareeitherregisteredtrademarksor
trademarksofMicrosoftCorporationintheUnitedStatesand/oro
thercountries.Thenamesofactualcompaniesandproductsmention
edhereinmaybethetrademarksoftheirrespectiveowners.Micro
softCorporation?OneMicrosoftWay?Redmond,WA98052-6399?U
SAContentsContents2Overview3Preferencesvs.PolicySettings4Group
PolicyPreferenceItems7WindowsSettings8ControlPanelSettings1
1GroupPolicyPreferencesFeatures17CommonOptions17TargetingCon
trol18ProcessVariables20SettingsReport22DeployingGroupPolicy
Preferences23WindowsDeploymentStrategies24ThickImaging25ThinI
maging25BenefitsofGroupPolicyPreferences27Summary29Glossary30
OverviewDuringyourcareerasanITprofessional,you’velikelym
appednetworkdrivesforusers.Youprobablyconfiguredthemusin
glogonscripts.Thisrequiredyoutowriteanddebugthelogons
cript,storethescriptinacentrallocation,andthenrunthes
criptbyconfiguringUserobjectsinActiveDirectory?directory
serviceorbycreatingaGroupPolicyobject(GPO).Thinkabouta
lltheothersettingsyou’veconfiguredusinglogonscriptsorsi
milarmethods.Asimple,centralsystemtoconfigureanddeployt
hesesettingswithoutrequiringyoutomakescatteredchangestha
tareeasilyforgottenandseldomdocumentedwouldcertainlyhelp
reducecostsandmakeyourjobeasier,wouldn’tit?Organizations
typicallydeploytwotypesofsettings:managedandunmanaged.M
anagedsettingsarepolicysettingsthatyouenforce.Youdon’ta
llowuserstochangepolicysettings.Policysettingsreducesupp
ortcostsbyenforcingstandardconfigurations,helppreventprod
uctivityloss,andprotectanorganization’sassets.GroupPolicy
isthebesttechnologyfordeliveringpolicysettingstocompute
rsrunningMicrosoftWindows?,andifyourorganizationislikem
ostwithMicrosoftinfrastructures,you’vealreadyadoptedGroup
Policy.Unmanagedsettingsarepreferences.Incontrasttopolicy
settings,youallowuserstochangepreferencesafteryou’vedepl
oyedthem.Byexplicitlydeployingpreferencesratherthanaccept
ingthedefaultoperatingsystemsettings,youcreateconfigurati
onsthataremorecompatiblewithyourITenvironmentandarespe
cificallytailoredtoyourorganizationandhowitspeopleuseth
eircomputers.Additionally,deployingsomepreferencesforusers
isanecessityinlocked-downenvironments,whereuserscan’tch
angemanysettings.Organizationsdeploypreferencesavarietyof
ways,butthemostcommonaredefaultuserprofiles,registratio
nentry(.reg)files,andlogonscripts.Includingpreferencesin
Windowsimagesisalsocommon.Inanycase,mostmethodsfordep
loyingpreferencesaredecentralizedandunwieldy.Incontrastto
thelessIT-friendlymethodsfordeployingpreferences,GroupPol
icypreferencesaddtoGroupPolicyacentralizedsystemfordepl
oyingpreferences.Itprovidesthemeanstosimplifydeployment,
reduceconfigurationerrors,andreduceITcosts.Ratherthanusi
ngthestepsdescribedearliertodeploymappeddrives,forexamp
le,yousimplycreateaGroupPolicyobjectandedititsDriveMa
pspreferenceitem.ThiswhitepaperdescribesGroupPolicyprefe
rences—itsfeatures,thedifferencesbetweenpolicysettingsand
preferences,andthemanybenefitsofusingthisnewtechnology.P
referencesvs.PolicySettingsWindowsServer2008includesthene
wGroupPolicypreferencesbuilt-intotheGroupPolicyManagemen
tConsole(GPMC).Additionally,administratorscanconfigurepref
erencesbyinstallingtheRemoteServerAdministrationTools(RSA
T)onacomputerrunningWindowsVistaServicePack1(SP1).?RSA
T,currentlyinbetaandexpectedtoreleaseshortlyafterWindow
sServer2008,includestheupdatedGPMC.Themostcommonquestion
aboutGroupPolicypreferencesis,“Howarepreferencesdifferen
tfrompolicysettings?”Understandingthisconceptiscrucialto
takingfulladvantageofGroupPolicypreferences.Table1summa
rizesthedifferencesbetweenthem,andthe“Glossary”sectionde
finesmoreterminologyusedthroughoutthisandotherGroupPolic
ywhitepapersthatcoverpreferences.Table1.Preferencesvs.Se
ttingsGroupPolicyPreferencesGroupPolicySettingsEnforcementPre
ferencesarenotenforcedUserinterfaceisnotdisabledCanberef
reshedorappliedonceSettingsareenforcedUserinterfaceisdisa
bledSettingsarerefreshedFlexibilityEasilycreatepreferenceite
msforregistrysettings,files,andsoonImportindividualregis
trysettingsorentireregistrybranchesfromalocaloraremote
computerAddingpolicysettingsrequiresapplicationsupportand
creatingadministrativetemplatesCannotcreatepolicysettingsto
managefiles,folders,andsoonLocalPolicyNotavailableinloc
alGroupPolicyAvailableinlocalGroupPolicyAwarenessSupportsn
on-GroupPolicy-awareapplicationsRequiresGroupPolicy-awareapp
licationsStorageOriginalsettingsareoverwrittenRemovingthepre
ferenceitemdoesnotrestoretheoriginalsettingOriginalsettin
gsarenotchangedStoredinregistryPolicybranchesRemovingthe
policysettingrestorestheoriginalsettingsTargetingandFilter
ingTargetingisgranular,withauserinterfaceforeachtypeof
targetingitemSupportstargetingattheindividualpreferenceite
mlevelFilteringisbasedonWindowsManagementInstrumentation(
WMI)andrequireswritingWMIqueriesSupportsfilteringataGPO
levelUserInterfaceProvidesafamiliar,easy-to-useinterfacefor
configuringmostsettingsProvidesanalternativeuserinterface
formostpolicysettingsThekeydifferencebetweenpreferencesan
dpolicysettingsisenforcement.GroupPolicystrictlyenforces
policysettings.First,GroupPolicywritesthosesettingstothe
Policybranchesoftheregistry,andtheaccesscontrollists(A
CLs)onthosebranchespreventStandardusersfromchangingthem.
WhenaGroupPolicy-awareapplicationoroperatingsystemfeatur
elooksforapotentiallymanagedsetting,itfirstlooksforthe
policysetting.Ifthepolicysettingdoesn’texist,itlooksfo
rthesettingelsewhereintheregistry.Second,GroupPolicy-awa
reapplicationsandoperatingsystemfeaturestypicallydisablet
heuserinterfaceforsettingsthatGroupPolicyismanaging,whi
chpreventsusersfromchangingthem.Finally,GroupPolicyrefre
shespolicysettingsataregularinterval,whichisevery90min
utes,bydefault,butwhichisconfigurablebyaGroupPolicyadm
inistrator.IncontrasttoGroupPolicysettings,GroupPolicydoe
snotstrictlyenforcepreferences.GroupPolicydoesnotstorep
referencesinthePolicybranchesoftheregistry.Instead,itwr
itespreferencestothesamelocationsintheregistrythatthea
pplicationoroperatingsystemfeatureusestostorethesetting.
Theimplicationofthisistwofold.First,GroupPolicypreferen
cessupportapplicationsandoperatingsystemfeaturesthataren’
tGroupPolicy-aware.Second,GroupPolicypreferencesdonotcau
setheapplicationoroperatingsystemfeaturetodisabletheuse
rinterfaceforthesettingstheyconfigure.Theresultisthata
fterdeployingpreferencesusingGroupPolicy,userscanstillch
angethosesettings.Additionally,GroupPolicyrefreshesprefere
ncesusingthesameintervalasGroupPolicysettingsbydefault.
However,youcanpreventGroupPolicyfromrefreshingindividual
preferencesbychoosingtoapplythemonlyonce.Thisconfigures
thepreferenceonetimeandallowstheusertochangeitpermane
ntly.GroupPolicyfilteringissubstantiallydifferentfromGroup
Policypreferenceitem-leveltargeting.YoufilterGPOsusingWM
Ifilters,andthosefiltersdeterminewhetherGroupPolicyappli
estotheentireGPO.Youcannotfilterindividualpolicysetting
swithinaGPO.Ofcourse,youcancreateGPOsbaseduponyourfi
lteringrequirementstoworkaroundthislimitation,butthatmig
htleadtoalargesetofGPOstomanage.Ontheotherhand,Grou
pPolicypreferencessupportitem-leveltargeting—youcantarget
individualpreferenceitemswithinaGPO.Forexample,asingleG
POcancontaintwopreferenceitems,bothofwhichconfigurepowe
rpolicies.YoucantargetthefirstpreferenceitematdesktopP
CsandthesecondatmobilePCs.Additionally,whileGroupPolicy
filteringrequiresyoutowritesometimescomplexWMIqueries,i
tem-leveltargetingprovidesafriendlyuserinterface.Figure1p
rovidesadecisionpathforchoosingwhethertodeployanitemus
ingGroupPolicysettingsorpreferences.Themostimportantfact
oriswhetherornotyouwanttoenforcetheitem.Toconfigurea
nitemwithoutenforcingit,usepreferences.Thenextfactoris
whethertheapplicationorfeatureisGroupPolicy-aware.Toenfo
rceitemsforwhichnopolicysettingisavailable,youcandeplo
ythemaspreferenceitemsandthendisabletheApplyonceanddo
notreapplyoption.Formoreinformation,see“CommonOptions.”F
igure1.Preferencesvs.policysettingsGroupPolicyPreferenceI
temsFigure2showsthecomputeranduserGroupPolicypreference
extensions.WithineachGPOyoucanaddmultiplepreferenceitems
toeachpreferenceextension,andtargetthemindividually.With
inasingleGPO,forinstance,youcanaddmultiplepreferenceit
emstotheDriveMapspreferenceextension,andthentargeteach
preferenceitematdifferentdepartments.preferenceextensionsFig
ure2.PreferenceextensionsNoticeinFigure2thatsomepreferen
ceextensionsareintheWindowsSettingsfolderwhileothersare
intheControlPanelSettingsfolder.PreferencesintheWindows
Settingsfoldercontainsettingsthatyoumostlikelywrotescri
ptstoconfigureinthepast.Theseincludemanagingenvironment
variables,files,folders,andregistrysettings.Preferencesin
theControlPanelSettingsfoldercontainsettingsthatuserscan
configurethroughControlPanel.Examplesincludefolderoptions
,powerpolicies,andscheduledtasks.Ingeneral,theComputerCo
nfigurationandUserConfigurationnodescontainmostlythesame
preferenceextensions.However,thesamepreferenceextensionin
theComputerConfigurationnodemightcontaindifferentpropertie
sthanthesameextensionintheUserConfigurationnode.Unique
totheComputerConfigurationnodearetheNetworkSharesandSer
vicespreferenceextensions.UniquetotheUserConfigurationnod
earetheApplications,DriveMaps,InternetSettings,RegionalO
ptions,andStartMenunodes.Thefollowingsectionsdescribeeach
preferenceextensioninmoredetail.WindowsSettingsTable2desc
ribeseachGroupPolicypreferenceextensioninWindowsSettings.
Thefirstcolumncontainsasamplepreferenceitemforeachexte
nsion,andthesecondcolumnprovidesanoverviewoftheextensio
n.Table2.PreferenceExtensionsinWindowsSettingsDriveMapsThe
DriveMapspreferenceextensionprovidestheabilitytocreate,
replace,update,anddeletenetworkdrivemappings.Thisextensio
nenablesyoutomapnetworkdriveswithoutwritinglogonscripts
.Additionally,mappednetworkdrivesdeployedusingtheDriveMa
pspreferenceextensionworkmoreconsistentlythanthosedeploye
dusinglogonscripts.YoucandeploymultipleDriveMapspreferen
ceitemswithinasingleGPO.YoucanalsotargetindividualDriv
eMapspreferenceitemstospecificdepartments,locations,ands
oon.UsingGroupPolicypreferencestodeploymappednetworkdri
vesprovidesjustasmuchflexibilityasscriptingbutwithless
workandwithfewerproblems.EnvironmentTheEnvironmentpreferenc
eextensionenablesyoutomanageuserandsystemenvironmentvar
iablesorupdatethepath.Combinedwithitem-leveltargeting,th
eEnvironmentpreferenceextensionprovidesapowerfulwaytocon
figurevariablesfordifferentscenariosusingasingleGPO.Apow
erfulexamplefortheEnvironmentpreferenceextensionistodefi
nevariablesthatotherpreferenceitemsuse.Forexample,youca
ndefinethelocationofafilerepositoryusingtheEnvironment
preferenceextension;then,youcanusethevariableinotherpre
ferenceitemsratherthanhard-codingthepath.Thisleavesyoua
singleGPOtoupdatewhenthepathchanges,ratherthanhavingt
ofindthepathinotherlocations.Formoreinformationaboutvar
iableexpansioninGroupPolicypreferences,seethesection“Pro
cessVariables.”FilesTheFilespreferenceextensiongivesyouthe
abilitytocreate,replace,update,anddeletefilesonthedest
inationcomputer.Thisextensionsupportswildcardsinfilepaths
,soyoucaneasilycopygroupsoffilesusingasingleGPO.Its
upportsenvironmentvariables,too,allowingyoutocreateapref
erenceitemthatiseasiertomaintainthanonecontaininghard-c
odedpaths.AcommonscenarioforusingtheFilespreferenceexten
sionistocopyconfigurationfilestousers’profilefolders.Fo
rexample,youcancopyacustomdictionaryorapplicationfiles
totheAppDatafolderwithineachuserprofile.Copyingshortcuts
usingtheFilespreferenceextensionisnotrecommended,however
,becausetheShortcutsextensionprovidesauserinterfacefort
hispurposeandismoreflexible.FoldersTheFolderspreferenceex
tensionissimilartotheFilesextension,butitallowsyoutoc
reate,replace,update,delete,andevencleanupfoldersontarg
etedcomputers.LiketheFilespreferenceextension,itsupports
environmentvariables.Itdoesnotsupportwildcardsinfolderpa
ths,however.Asanexample,youcanusetheFolderspreferenceex
tensiontoregularlycleanuptemporaryfolders.Theextensionis
flexibleandcanhandlemostrequirements.Youcanrecursivelyr
emovesubfolders,allowordisallowremovalofread-onlyfilesan
dfolders,andchoosewhetherornottoremovetherootfolderor
justitscontents.Forexample,youcanusethisextensiontore
movetemporaryfoldersthatsomeapplicationscreateintheroot
ofthesystemdriveortocleanuptheWindowstemporaryfoldero
naregularbasis.IniFilesTheIniFilepreferenceextensionprov
idestheabilitytocreate,update,replace,anddeleteindividua
lpropertiesfrom.iniflies.NetworkSharesAlthoughWindowsdoes
notprovideawaytocentrallymanagenetworksharesonmultiple
computers,theNetworkSharespreferenceextensionsupportsmanag
ingnetworksharesonmultiple,targetedcomputers(seethesecti
on“TargetingControl”).Additionally,theNetworkSharesextensi
onallowsyoutomanageAccess-basedEnumeration(ABE),whichpre
ventsusersfromseeingsubfoldersforwhichtheylackpermission
toaccess,andconfigureuserlimits.RegistryTheRegistryprefer
enceextensionprovidesaflexibleandeasy-to-usewaytocreate,
replace,update,anddeleteregistrysettingsonmultiplecomput
ers.TouseGroupPolicysettingstoconfigurearbitraryregistry
settings,youmustcreateanAdministrativetemplate.WiththeR
egistryextension,youcanusethreedifferentpreferencetypest
oaddRegistrypreferenceitemstoaGPOandorganizethem:Regist
ryItem.Configureanindividualregistrysetting,includingthe
REG_SZ,REG_DWORD,REG_BINARY,REG_MULTI_SZ,andREG_EXPAND_SZty
pes.CollectionItem.CreateafolderinwhichtoorganizeRegistr
yitems,similartohowWindowsorganizessettingsinthem.Howev
er,youdon’thavetoorganizethesefoldersinthesamehierarch
yastheregistrykeysandsubkeys.Instead,youcanorganizeset
tingsbydepartment,location,andsoon.RegistryWizard.Import
oneormoreregistrysettingsfromthelocalcomputerorfromar
emotecomputer.Youcanselectindividualregistrysettingsoren
tireregistrybranches.UsingtheRegistrypreferenceextensionis
agreatwaytodeploysettingswithouthavingtowritescripts.
Forexample,youcandeploysettingsforathird-partyapplicatio
noranapplicationthatisn’tGroupPolicy-aware.However,using
theRegistryextensiontodeploysettingsforwhichGroupPolicy
preferencesalreadyprovideauserinterfaceisdiscouraged.Shor
tcutsUsingtheShortcutspreferenceextension,youcancreate,re
place,update,anddeletethreetypesofshortcutsonmultiple,t
argetedusersandcomputers(seethesection“TargetingControl”)
:FileSystemObject.Traditionalshortcutsthatlinktoprograms
anddocuments.Forexample,youcanaddacustomshortcutforan
applicationtotheStartmenu.URL.ShortcutstoWebpages.Forex
ample,youcanaddashortcuttoadepartmentalintranetsiteto
theuser’sFavoritesmenu.ShellObject.Objectsthatappearsint
heshellnamespace,includingControlPanel,RecycleBin,andso
on.Forexample,youcanaddtheControlPaneltotheuser’sdesk
top.TheShortcutspreferenceextensionsupportscreatingshortcut
sinnumerouslocations,includingthedesktop,Startmenu,Favor
itesfolder,QuickLaunchtoolbar,andsoon.Youcanalsospecif
ythefullpathandnameofafolderinwhichtocreatetheshort
cut.ControlPanelSettingsTable3describeseachGroupPolicypre
ferenceextensioninControlPanelSettings.Thefirstcolumnsho
wsasamplepreferenceitemforeachextension,andthesecondco
lumnprovidesanoverviewoftheextension.Table3.PreferenceEx
tensionsinControlPanelSettingsDataSourcesGroupPolicyprovid
esasettingfordistributingapplications,butitdoesnotprovi
deasettingforconfiguringtheOpenDatabaseConnectivity(ODBC
)datasourcesusedbymanyofthem.TheDataSourcespreference
extensionprovidesawaytocreate,replace,update,anddeleted
atasourcesforusersandcomputers.Additionally,userdatasour
cesroamwithusersfromcomputertocomputer,furthersimplifyin
gtheirdeployment.UsingtheDataSourcesextensionreducesthe
complexityandcostofmanagingbusinessapplicationsforwhichy
oumustconfiguredatasources.DevicesOrganizationswithhigh-sec
urityorcompliancerequirementsoftenmustrestricttheuseofr
emovablemedia.TheDevicespreferenceextensionprovidesatarge
tedmethodfordisablingspecificdeviceclassesforusersorcom
puters.Forexample,youcandisabletheUSBports,floppydrives
,andotherremovablemediaforuserswhoworkwithsensitiveinf
ormation,suchascustomerrecordsorintellectualproperty.Stan
darduserscannotchangethesesettings.Thispreferenceextensio
ngivesyoumorecontrolovertheinformationthatleavesyouror
ganization.TheDevicesextensiondoesnotpreventusersfrominst
allingdevices.Rather,itenablesordisablesdevicesafterthey
arepresentonthecomputer.Ontheotherhand,GroupPolicycan
preventusersfrominstallingspecifictypesofdevices.Additio
nally,theDevicesextensionworksonallsupportedplatforms.Fol
derOptionsTheFolderOptionspreferenceextensionsupportstwot
ypesofitems:FolderOptions.ConfigureWindowsExplorerfoldero
ptionsforWindowsXPorWindowsVista.Folderoptionsincludewh
etherornotWindowsExplorershowshiddenfiles,displaysfilee
xtensionsforknownfiletypes,andsoon.Thefigureintheleft
columnshowstheFolderOptionspreferenceitemforWindowsVist
a.OpenWith.Configureassociationsbetweenfileextensionsandf
iletypes.Twoscenariosarecommon.First,youcanbreakfileas
sociationstopreventprogramsfromrunningaccidentallyormalic
iously(manye-mailvirusesrelyonfileassociationstorun).Se
cond,youcanassociatefileextensionswithdifferentprograms,
dependingontheuser’srequirements.InternetSettingsTheInterne
tSettingspreferenceextensionallowsyoutoconfigureInternet
ExploreroptionsforWindowsInternetExplorer5,InternetExplor
er6,andInternetExplorer7(shownintheleftcolumn).Youcan
configuremostofthesettingsthatareavailableintheInterne
tOptionscontrolpanel.Forexample,youcanconfiguredifferent
homepagesforusersindifferentdepartments,andyoucanconfi
gureahighsecuritylevelforuserswhoworkwithsensitiveinfo
rmation.TheInternetSettingsextensionalsoallowsyoutoconfi
gureadvancedoptions.ManyofthesesettingsareavailableasGro
upPolicysettingsthatarestrictlyenforced.UsingtheInternet
Settingspreferenceextension,youcancreateadefaultInternet
Explorerconfigurationthatuserscanlaterchange.Additionally
,youcanconfigureindividualsettingsusingthispreferenceext
ensionratherthanconfiguringentiregroupsofsettings.LocalUs
ersandGroupsTheLocalUsersandGroupspreferenceextensionsup
portsconfiguringlocaluseraccountsandgroupsformultiple,ta
rgetedcomputers(seethesection“TargetingControl”).Itsuppor
tsthesepreferencetypes:LocalUser.Youcancreate,update,rep
lace,ordeleteusersaccountfromlocalcomputers.Forexample,
youcanchangethepasswordforordisablethelocalAdministrato
raccount.LocalGroup.Youcancreate,update,replace,ordelete
groupsfromthelocalcomputer.TheLocalGrouppreferencetype
providesanumberofoptionsforconfiguringlocalgroups,too.F
orexample,youcanaddorremovealogged-onusertoorfromthe
group.Usefully,youcanaddorremovespecificdomainaccounts
toandfromlocalgroups,asshowninthefigureintheleftcolu
mn.NetworkOptionsTheNetworkOptionspreferenceextensionenable
syoutoconfigurethefollowingtypesofnetworkconnections:VPN
Connections.ConfigureVirtualPrivateNetwork(VPN)connections
,includingtheiroptions,securitysettings,andconnectiontype
.TheleftcolumnshowsaVPNconnection.DUNConnections.Configu
rebasicDial-UpNetworking(DUN)connectionsforasingleusero
rallusers.Forexample,youcancreateaVPNConnectionsprefere
nceitemtoconnecttothecorporatenetwork.Then,youcantarge
tthatitemspecificallyatmobilePCswithinaspecificdepartme
nt.PowerOptionsUsethePowerOptionspreferenceitemtoconfigur
epoweroptionsandpowerschemesforcomputersrunningWindowsX
P.Poweroptionsincludesettingslikewhathappenswhenuserscl
osethelidontheirmobilePCs.Powerschemesincludetimingsfo
rwhenWindowsturnsofthemonitorandharddisksandwhentheo
peratingsystemputsthecomputertosleeporhibernation.Althoug
hWindowsVistasupportspoweroptionssettingsinGroupPolicy,
thosesettingsarestrictlyenforced.Byconfiguringpoweroption
susingthePowerOptionsextension,youcancreateadefaultcon
figurationthatuserscanlaterchangeasnecessary.PrintersLike
configuringmappednetworkdrives,configuringprinterconnection
sisacommontaskthatadministratorstypicallyperformbywriti
nglogonscripts.ThePrinterspreferenceextensionenablesyout
oeasilycreate,update,replace,ordeletesharedprinters,TCP/
IPprinters,andlocalprinterstomultiple,targetedusersorco
mputers(seethesection“TargetingControl”).Thefigureinthe
leftcolumnisanexampleofconfiguringasharedprinterusinga
SharedPrinteritem.Usingpreferencetargeting,youcandeploy
printerconnectionsbasedonlocation,department,computertype,
andsoon.WindowsVistaGroupPolicyprovidesnativesupportfor
deployingprinters.However,itonlysupportssharedprintersan
drequiresActiveDirectoryschemaextensions.Incontrast,using
thePrintersextensionsupportsshared,local,andTCP/IPprinte
rsonWindowsXPwithSP2andWindowsVista.Italsoallowsyout
osetthedefaultprinterandmapsharedprinterstolocalports.
RegionalOptionsUsetheRegionalOptionspreferenceextensionto
configuretheuserlocale,includingnumber,currency,time,and
dateformats.ScheduledTasksTheuserinterfaceforScheduledTask
spreferenceitemsmatchesScheduledTasksinWindows.TheSchedu
ledTaskspreferenceextensionprovidesacentralizedmechanismf
orschedulingtasksfortargetedusersandcomputers(seethesec
tion“TargetingControl”).Theexampleintheleftcolumnshowsa
scheduledtaskthatrunstheDiskCleanupWizard.Thealternative
istoruncommand-linetoolsorscriptsthatscheduletasks.Thi
spreferenceextensionmakesitveryeasytomanagescheduledtas
ksusingWindowsVista’spowerfulnewTaskScheduler.ServicesThe
Servicespreferenceextensionenablesyoutoconfigureservicest
hefollowingways:Startup.Optionallychangethestartuptypeto
Automatic,Manual,orDisabled.Serviceaction.Optionallystart,
stop,orrestartaservice.Logonas.Configuretheaccountthat
theserviceuses.Recovery.Configuretheservice’srecoveryoptio
ns.Forexample,youcanusetheServicespreferenceextensionto
ensurethatcertainservicesaredisabledandstopped,andensure
thatotherservicesrunautomatically,andstartthemifrequire
d.StartMenuTheStartMenupreferenceextensionenablesyoutoco
nfigureStartmenuoptionsforusers.ItsupportsbothWindowsXP
andWindowsVistaStartMenupreferenceitems.Forinstance,you
canconfiguretheStartmenuformobilePCssothatitalwaysdi
splaystheConnectTomenu.EasilyconfiguretheStartmenutore
flecthowyourorganization’semployeesusetheircomputers.Group
PolicyPreferencesFeaturesMostGroupPolicypreferenceextensio
nssupportthefollowingactionsforeachpreferenceitem:Create.
Createanewitemonthetargetedcomputer.Delete.Removeanexi
stingitemfromthetargetedcomputer.Replace.Deleteandrecreat
eanitemonthetargetedcomputer.TheresultisthatGroupPoli
cypreferencesreplaceallexistingsettingsandfilesassociated
withthepreferenceitem.Update.Modifyanexistingitemonthe
targetedcomputer.ThefollowingsectionsdescribeadditionalGrou
pPolicypreferencesfeatures.ThesefeaturesincludetheCommon
tab,whicheachpreferenceextensionsupports.Targetingisafea
turethatmakespreferencesaparticularlypowerfulwaytodeploy
configurations.ThefollowingsectionsalsodescribeGroupPolic
ypreferencessupportforprocessvariablesandreporting.Common
OptionsEveryGroupPolicypreferenceitemhasaCommontab,shown
inFigure3,whichyoucanusetoconfigureadditionaloptionst
hatcontrolthebehavioroftheitem.Documentpreferenceitem,in
cludingitspurposeConfiguretargetingitems,likelocation,appl
icationpresence,andsoonAllowusertochangewithoutrefreshin
gChoosewhethertocontinueaftererrorsRuntheitemusingtheus
er’scredentialsFigure3.CommontabforpreferenceitemsThefoll
owinglistdescribestheoptionsontheCommontab:Stopprocessin
gitemsinthisextensionifanerroroccursBydefault,errorsdo
notpreventGroupPolicypreferencesfromprocessingtheremaini
ngpreferenceitemsinthesameextension.Ifyouwantpreference
stostopprocessingadditionalitemsifanerroroccurs,enable
thisoption.Ifyouenablethisoptionandanerroroccurs,proce
ssingstopsforthecurrentGPOonly.OtherGPOscontinuetoproc
essnormally.Runinlogged-onuser''ssecuritycontext(userpolic
yoption)Bydefault,GroupPolicypreferencesprocesspreference
itemsusingthelocalSystemaccount.Asaresult,theseitemsca
nonlyaccesssystemenvironmentvariablesandlocalresources.T
oaccessuserenvironmentvariablesandnetworkresources,includ
ingnetworkdrives,youmustenablethisoptiontoprocesstheit
emusingthelogged-onuser’saccount.Removethisitemwhenitis
nolongerappliedUnlikepolicysettings,GroupPolicydoesnotr
emovepreferenceswhentheGPOisremovedfromtheuserortheco
mputer.Choosingthisoptionchangesthedefaultbehavior:whent
heGPOisremovedfromtheuserorthecomputer,GroupPolicyrem
ovesthepreferenceitemsitcontainsfromtheuserorthecomput
er.ApplyonceanddonotreapplyGroupPolicyrefreshespreference
itemsduringtheregularrefreshinterval,whichisevery90min
utes,bydefault.Asaresult,GroupPolicyeventuallyrestoresp
referenceitems,eventhoughuserscanchangethesettingstheyc
reate.ChoosetheApplyonceanddonotreapplyoptiontorunthe
itemonetimewithoutrunningitagain.ThisoptionpreventsGro
upPolicyfromrefreshingtheitem,allowinguserstochangesett
ingswithoutlosingthosechanges.Inuserconfigurations,Group
Policypreferenceswillapplythesesettingsonceoneachcompute
rtheyuse.Incomputerconfigurations,GroupPolicypreferences
willapplythesesettingsonceforthecomputer,regardlessofho
wmanyuserssharethecomputer.Item-leveltargetingTargetingdet
erminestowhichusersandcomputersapreferenceitemapplies.E
nablethisoption,andthenclicktheTargetingbuttontoconfigu
retargetingitemsforthepreferenceitem.Formoreinformation
abouttargeting,see“TargetingControl.”TargetingControlYoucan
filterGPOsusingWMIfilters;however,filtersaffecttheentir
eGPO.IfyouwanttofilterindividualpolicysettingsinaGPO,
thework-aroundisusuallytocreateseparateGPOsforindividua
lsettings,andthentofiltereachGPO.Inmanyorganizations,t
hisleadstohundreds,ifnotthousands,ofGPOsthatbecomeunwi
eldytomaintainandhavesignificantperformanceimpact.Ontheo
therhand,GroupPolicypreferencessupportsitem-leveltargeting
.Item-leveltargetingdeterminestheusersandcomputerstowhic
hGroupPolicyappliesindividualpreferenceitemswithinaGPO.
YoucantargetdifferentpreferencesitemswithinasingleGPOat
computersindifferentlocations,forexample.Whenyouclickthe
TargetingbuttonontheCommontab,youseetheTargetingEditor
showninFigure4,includingalistoftargetingitemsavailable
.Youcanapplyoneormoretargetingitemstoapreferenceitem.
Youcanalsochoosealogicaloperationtouseforjoiningtarge
tingitems,asshowninthefigure.Addcollections,whicharees
sentiallyparenthesesthatgrouptargetingitems,andyoucancre
atefairlycomplexlogictodeterminetheusersandcomputersto
whichapreferenceitemapplies.Targetingitemsandtheirrelatio
nshipsSecurityGrouptargetitemFigure4.TargetingEditorGroupP
olicypreferenceitemsprovidethemuscletoconfigureusersand
computers,buttargetingitemsprovidetheintelligencetochoose
alimitedselectionofusersandcomputers.Thefollowingarere
al-worldexamplesofhowyoucanuseGroupPolicytargetingitems
:Mobilecomputers.YouwanttoconfigureVPNconnectionsformobi
leusers,butyouwanttoapplythoseVPNconnectionsonlytomob
ilePCs.YoucanlimitthepreferenceitemtoonlymobilePCsby
usingthePortableComputertargetingitem.Performance-basedconf
iguration.Youhavearequirementtoconfigurecertainsettingsb
asedontheperformancecharacteristicsofeachcomputer.Faster
computerswithplentyoffreediskspacereceiveonepreferencei
tem,whileslowercomputersorthosewithlowamountsoffreedis
kspacereceiveanother.YoucanusetheCPUSpeedandDiskSpace
targetingitemtotargeteachpreferenceitemasrequired.Operat
ingsystemversion.YouidentifyasettingthatWindowsVistasto
resinadifferentlocationthanWindowsXP.Createtwopreferenc
eitems,oneforeachoperatingsystem.Then,filtereachprefere
nceitemusingtheOperatingSystemtargetingitem.Softwareprere
quisites.Youwanttoconfigureanapplication’ssettings,butyo
uwanttoensurethattheapplicationisinstalledonthecompute
rbeforeconfiguringit.YoucanuseacombinationoftheFileMa
tchandRegistryMatchtargetingitemstocheckforaspecificve
rsionofabinaryfileoranentryintheUninstallregistrykey
tocreatearobustwaytoverifythattheapplicationisinstalle
d.ProcessVariablesGroupPolicypreferencessupportenvironmentv
ariables.Infact,itaddsnumerousenvironmentvariablestothe
processenvironment.Forexample,itaddsenvironmentvariablest
hatidentifythelocationofspecialfolders,suchasthedesktop
,Favorites,andStartmenufolders.Youcanuseanyoftheseorp
rocessenvironmentvariablesinanypreferenceitemortargeting
itemthatcontainstextproperties,andGroupPolicypreferences
willresolvethemwhenapplyingthesettingtotheuserorcomput
er.Althoughyoucanmanuallytypevariablenamesintextpropert
ies,theeasiestwaytousevariablesthatGroupPolicypreferenc
esdefinesistopressF3todisplaytheSelectaVariabledialog
box,showninFigure5.Thecombinationofenvironmentvariables
andtargetingenablesyoutocreatehighlydynamicconfiguration
sbycreatingtargetingitemsthatuseenvironmentvariables,and
useenvironmentvariablesinpreferenceitems.Figure5.Selecta
variableSettingsReportGroupPolicypreferencesfullysupportse
ttingsreportsintheGroupPolicyManagementConsole(GPMC).Fig
ure6showsasamplesettingsreportthatcontainsaGroupPolicy
preference.Figure6.SettingsreportDeployingGroupPolicyPrefe
rencesGroupPolicypreferencesdonotrequireyoutoinstallany
servicesonservers.WindowsServer2008includesGroupPolicypr
eferencesbydefaultaspartoftheGroupPolicyManagementConso
le(GPMC).Administratorswillalsobeabletoconfigureanddepl
oyGroupPolicypreferencesinaWindowsServer2003environment
byinstallingtheRemoteServerAdministrationTools(RSAT)ona
computerrunningWindowsVistawithSP1.BothRSATandWindowsVi
staSP1willbeavailableinthefirstquarterof2008.Althoughy
oudon’thavetoinstallanyservicestocreateGPOsthatcontain
GroupPolicypreferences,youmustdeploytheGroupPolicyprefe
rencesclient-sideextension(CSE)toanyclientcomputertowhic
hyouwanttodeploypreferences.TheCSEwillbeavailableasa
separatedownloadfromMicrosoft.ItsupportsthefollowingWindo
wsversions:WindowsXPwithSP2WindowsVistaWindowsServer2003w
ithSP1WindowsServer2008alreadyincludestheCSE.WindowsDeplo
ymentStrategiesMostcompaniesshareacommongoal:createastan
dardPCconfigurationbasedonacommonoperatingsystemimage.T
heywanttoapplythisimagetoanycomputerinanygeographical
regionatanytime,andthencustomizethatimagequickly.Inreal
ity,mostorganizationsbuildandmaintainmanyimages—sometimes
evenhundredsofthem.Bymakingtechnicalandsupportcompromise
sanddisciplinedhardwarepurchases,andbyusingadvancedscrip
tingtechniques,someorganizationshavereducedthenumberofim
agestheymaintaintobetweenoneandthree.Theseorganizations
tendtohavethesophisticatedsoftwaredistributioninfrastructu
resnecessarytodeployapplications—oftenbeforefirstuse—andk
eepthemupdated.Businessrequirementsusuallydrivetheneedto
reducethenumberofimagesthatanorganizationmaintains.Ofco
urse,theprimarybusinessrequirementistoreduceownershipcos
ts.Thefollowinglistdescribescostsassociatedwithbuilding,
maintaining,anddeployingdiskimages:DevelopmentCosts.Develop
mentcostsincludecreatingawell-engineeredimagetolowerfutu
resupportcostsandimprovesecurityandreliability.Theyalso
includecreatingapredictableworkenvironmentformaximumprodu
ctivitybalancedwithflexibility.Higherlevelsofautomationlo
werdevelopmentcosts.TestCosts.Testcostsincludetestingtime
andlaborcostsforthestandardimage,theapplicationsthatmi
ghtresideinsideit,andapplicationsappliedafterdeployment.
Testcostsalsoincludethedevelopmenttimerequiredtostabiliz
ediskimages.StorageCosts.Storagecostsincludestorageofthe
distributionpoints,diskimages,migrationdata,andbackupima
ges.Storagecostscanbesignificant,dependingonthenumberof
diskimages,thenumberofcomputersineachdeployment,andso
on.NetworkCosts.Networkcostsincludemovingdiskimagestodis
tributionpointsandtodestinationcomputers.Asthesizeofima
gefilesincreases,costsincrease.Largeimageshavemoreupdati
ng,testing,distribution,network,andstoragecostsassociated
withthem.Eventhoughyouonlyupdateasmallportionoftheima
ge,youmustdistributetheentirefile.Ofthetwoimagestrategi
esdescribedinthefollowingsections,Microsoftrecommendsthe
thin-imagestrategytocombatandlowerthesecosts.Thesection
“ThinImaging”describesthisstrategyandhowGroupPolicyprefe
rencesmakeimplementingitmucheasier.Figure7providesanove
rviewofthetwostrategies.Figure7.ImagingstrategiesThickIma
gingThickimagesaremonolithicimagesthatcontaincoreapplicat
ionsandotherfiles.Partoftheimage-developmentprocessisin
stallingcoreapplicationspriortocapturingthediskimage,as
showninFigure7.Mostorganizationsthatusediskimagingtode
ployoperatingsystemsarebuildingthickimages.Theadvantageof
thickimagesissimplicity.Youcreateadiskimagethatcontain
scoreapplicationsandpreferencesandthushaveonlyasingles
teptodeploythediskimageandcoreapplicationstothedestina
tioncomputer.Thickimagescanalsobelesscostlytodevelopin
itially,becauseadvancedscriptingtechniquesarenotoftenrequ
iredtobuildthem.Infact,youcanbuildthickimagesusingMic
rosoftDeploymentwithlittleornoscripting.Finally,inthick
images,coreapplicationsareavailableonfirststart.Thedisadv
antagesofthickimagesaremaintenance,storage,andnetworkcos
ts.Thesecostsrisequicklywiththickimages.Forexample,upda
tingathickimagewithanewversionofanapplicationorchangi
ngpreferencesrequiresyoutorebuild,regression-test,andredi
stributetheimage.Thickimagesrequiremorestorageandusemor
enetworkresourcesinashortspanoftimetotransfer.Addition
ally,ifyouhavedifferentconfigurationrequirementsfordiffer
entgroupsofusers,youoftenmustbuildcustomimagesforeach
group.ThinImagingThekeytoreducingimagecount,size,andcost
iscompromise.Themoreyouputintoanimage,thelesscommona
ndbiggeritbecomes.Bigimagesarelessattractivetodeployov
eranetwork,moredifficulttoupdateregularly,moredifficult
totest,andmoreexpensivetostore.Bycompromisingonwhatyou
includeinimages,youreducethenumberofimagesyoumaintain
andyoureducetheirsize.Ideally,youbuildandmaintainasing
le,worldwideimagethatyoucustomizepost-deployment.Thinimage
scontainfewifanycoreapplicationsorpreferences.Youinstal
lapplicationsandconfigurepreferencesseparatelyfromthedisk
image,asshowninFigure7.Installingapplicationsandconfigu
ringpreferencesseparatelyfromtheimageusuallytakesmoretim
eatthePCandpossiblymoretotalbytestransferredoverthene
twork,butspreadoutoveralongerperiodoftimethanasingle
largeimagetransfer.Youcanmitigatethenetworktransferbyus
ingtrickle-downtechnologythatmanysoftwaredistributioninfra
structuresprovide,suchasBackgroundIntelligentTransferServi
ce(BITS).Thinimageshavemanyadvantages.First,theycostless
tobuild,maintain,andtest.Second,networkandstoragecosts
associatedwiththediskimagearelower,becausetheimagefile
isphysicallysmaller.Theprimarydisadvantageofthinimagesis
thatpost-installationconfigurationcanbemorecomplextodeve
lopinitially,butthisisoffsetbythereductionincoststoma
intainimagesandbuildsuccessiveimages.Deployingapplications
andpreferencesoutsideofthediskimageoftenrequiresscripti
ngandusuallyrequiresasoftwaredistributioninfrastructure.A
notherdisadvantageofthinimagesisthatcoreapplicationsaren
’tavailableonfirststart,whichmightbenecessaryinhigh-sec
urityscenarios.Ifyouchoosetobuildthinimagesthatdonotin
cludeapplicationsandpreferences,youshouldhaveasystems-man
agementinfrastructure,suchasMicrosoftSystemsManagementServ
er(SMS)orMicrosoftSystemCenterConfigurationManager(SCCM),
inplacetodeployapplications.Touseathin-imagestrategy,y
ouwillusethisinfrastructuretodeployapplicationsafterinst
allingthethinimage.Youshouldalsohaveaninfrastructurefor
deployingpreferences,andGroupPolicypreferencesareaperfect
fitforthispurpose.Insteadofconfiguringpreferencesinthe
diskimage,youcancreategenericimagesthatyoudon’thaveto
updatewhenyouneedtoupdatepreferences.Additionally,ifdiff
erentusergroupsrequiredifferentconfigurations,youdon’thav
etocreatecustomimagesforeachgroup.Instead,youcandeploy
agenericimagetoeachgroup,andthenuseitem-leveltargeting
toconfigureeachgroup’susersandcomputersindependently,ach
ievingthesameresultascreatingmultiplediskimages.Benefits
ofGroupPolicyPreferencesThefollowinglistsummarizesthebene
fitsofusingGroupPolicypreferencesinyourenvironment:Improv
ingITProductivityGroupPolicypreferencesextendstheGroupPol
icyfeaturesetwithover20newextensions,helpingyougetmore
donewithtoolsthatarealreadyveryfamiliartoyou.Italsoe
nablesyoutoconfigureanddeploysettingsatacentralsource,
ratherthanrepackagingandredeployingthesettingswhenyouupd
ateconfigurations.YousimplyedittheGPOthatcontainsthepre
ferenceitemsyouwanttoupdate.Preferencesprovideacentrall
ocationfromwhichyoucancompletelymanageuserandcomputerco
nfigurations.ReducingNeedforLogonScriptsAlthoughGroupPolicy
preferencesmightnoteliminatetheneedforlogonscripts,its
ignificantlyreducestheirneed.Themostcommontasksperformed
bylogonscriptsareinstallingprinters,mappingnetworkdrives,
configuringregistrysettings,andcopyingfilesandfolders.Of
ten,thesetasksrequirecomplexscripting,testing,anddebuggin
g.LimitingConfigurationErrorsConfigurationerrorsduringandaf
terdeploymentareoftenasignificantsourceofsupportcallsan
descalationsthatleadtohigherdeploymentcosts.GroupPolicy
preferencessignificantlyhelpreducethesecosts.First,prefere
ncesallowyoutoconfigureitemswithahigherlevelofprecisio
nthanothertools.Forexample,youcanconfigureasingleInter
netExploreroptionwithouttouchingothersettings.Otherdeploy
mentmethodsoftenchangemoreoptionsthanyouintend.Second,y
oucanconfigureitemswithoutknowingtheirdetails—wheretofin
dthemintheregistryorwhattheyrepresent.Instead,GroupPol
icypreferencescollectspreferenceitemsusingclear,familiar,
easy-to-usedialogboxesthatpreventyoufromneedingtoknowho
wWindowsstoresthevalueintheregistry.YoucanconfigureaS
tartmenusettingbyselectinganoptioninapreferenceitemins
teadofhavingtoknowwhatvaluetostoreintheregistryandwh
eretostoreit.And,GroupPolicypreferencesallbuteliminate
theneedtousedefaultuserprofilestodeploysettings.Ofteny
oudeployfarmorewithadefaultuserprofilethanyouneedtod
eploy,andthiscanleadtounreliableconfigurations.EnhancingE
nd-UserSatisfactionMoreconsistent,reliableconfigurationsmake
usershappybymaintainingorevenincreasingtheirproductivity
.Additionally,usingGroupPolicypreferencestoconfigureusers
andcomputers,youcanmakeusingStandarduseraccountsmorepa
latabletousers.GroupPolicypreferencesusethelocalSystema
ccountbydefault,enablingittoconfiguresettingsthatusersc
an’tconfigure.Byconfiguringthesesettingsonbehalfofusers,
youcanoftenavoidtheissuealtogether—whichisproactiveIT.M
inimizingImageMaintenanceUsingGroupPolicypreferenceswitha
thin-imagestrategy,youcansignificantlyreducethetimeandco
stofmaintainingdiskimages.Insteadofupdatingimagestorefl
ectconfigurationchanges,youcandeployagenericimageandthe
nupdateGroupPolicypreferences.Thisapproachreducesengineer
ingandtestingtime—andcosts—significantly.ReducingOverallIma
geCountGroupPolicypreferences,incombinationwithathin-imag
estrategy,helpsyoureducethenumberofdiskimagesyoumustd
evelopandmaintain.Ifyoubuildthickimages,youoftencreate
uniqueimagesfordifferentgroupsofusersintheorganization.
Instead,youcanbuildanddeployagenericimageforeachgroup,andthenconfigureusersandcomputersuniquelybytargetingpreferenceitems.SummaryUsingGroupPolicypreferencescomesatnoaddedcostbutprovidesinnumerableadvantagesforanyorganization.ItimprovesITproductivity.Itreducesdeploymentcostsbyhelpingorganizationsreduceimagecountandreducethecostofmaintainingimages.Itreducesconfigurationerrorsduringandafterdeployment.Itreduces,ifnoteliminatestheneedforcomplexlogonscripts.Itallowsyoutofine-tunesettingsforusersandcomputersthroughoutyourorganization.Importantly,mostITprofessionalscanbeginusingGroupPolicypreferenceswithabsolutelynoadditionaltraining.TolearnmoreaboutGroupPolicypreferences,visithttp://www.microsoft.com/grouppolicy/http://www.microsoft.com/grouppolicy/.DownloadtheWindowsServer2008ReleaseCandidate1(RC1)ortheRemoteServerAdministrationTools(RSAT)betafromtheConnectWebsiteathttp://connect.microsoft.com/http://connect.microsoft.com/.EvaluateGroupPolicypreferencesandbeginplanningforitnow.GlossaryactionInGroupPolicy,theoperationperformedbyapreferenceitem,eithercreating,replacing,updating,deleting,ormigratingconfigurationsettingsforusersorcomputers(sometypesofpreferenceitemsdonothaveachoiceofactions).AdministrativetemplatesProvidepolicysettinginformationfortheitemsthatappearundertheAdministrativeTemplatesfolderintheconsoletreeoftheLocalGroupPolicyEditorandwheneditingaGroupPolicyobjectusingtheGroupPolicyManagementConsole.GroupPolicyclient-sideextensionAcomponentresponsibleforprocessingaspecificportionofGroupPolicy.GroupPolicyManagementConsole(GPMC)Theadministrativetoolusedtomanageandeditdomain-basedGroupPolicyobjects.TheGPMCisaMicrosoftManagementConsole(MMC)snap-in.GroupPolicyManagementEditorTheeditorwindowusedtoeditdomain-basedGroupPolicyintheGroupPolicyManagementConsole.GroupPolicyobject(GPO)AcollectionofGroupPolicysettings.GroupPolicypreferencesGroupPolicyextensionsthatappearunderthePreferencesnodeintheGroupPolicyManagementEditorwindowoftheGroupPolicyManagementConsole.GroupPolicysettingsComputer-specificanduser-specificsettingsthatadministratorscanapplyusingGroupPolicy.GroupPolicysettingsreferenceAspreadsheetthatcontainsacompletelistofalloftheGroupPolicysettingsforeveryWindowsSKU.localGroupPolicyobject(LGPO)Anon-networkGPOthatcanbeusedtoconfigurealimitedarrayofGroupPolicysettings.preferenceextensionAnyGroupPolicyextensionthatappearsunderthePreferencesnodeintheGroupPolicyManagementEditorwindowoftheGroupPolicyManagementConsole.preferenceitemAnobjectcontainingGroupPolicysettingsrelatedtoapreferenceextensioninaGroupPolicyobject(GPO).Eachpreferenceextensionallowsyoutocreateoneormoretypesofpreferenceitem.Eachtypehasdifferentproperties.AGPOcancontainmultiplepreferenceitemsforeachpreferenceextension.preferenceitem-leveltargetingUsingtargetingitemstochangethescopeofapreferenceitem,sothatitappliesonlytoselectedusersorcomputers.preferencepropertiesOptionswithinanindividualpreferenceitem.targetingitemAnobjectthatchangesthescopeofapreferenceitemsothatitappliesonlytoselectedusersorcomputers.28GroupPolicyPreferences |
|
