Good day, Cloud Gurus,
and welcome back for this lesson
where we're going to take a look at
Implementing Group Policy.
Let's take a look at what we're going to cover.
First up, we'll answer the question,
what is Group Policy?
And then we'll take a look at how you can organize
your Active Directory.
We'll take a look at Group Policy Objects
and then we'll take a look at
Group Policy configuration settings.
We'll go through the Group Policy management tools
and then finally, we'll do a demo
where we will implement some Group Policy.
So what is Group Policy?
Well, it's a powerful tool
used to centrally apply settings to users
and domain-joined Windows computers,
and this includes both servers and desktop computers.
But one important point to make here
is that even though it's named Group Policy,
Group Policy never applies to groups.
And Group Policy has been around for a long time.
And because of this, it's extremely powerful and flexible.
It can be used to apply security settings,
operating system settings,
and it can also be used to deploy software
and manage that software settings.
And it can be extended to configure
just about anything on a Windows PC,
and the way in which settings can be applied
is highly flexible.
You can control the application of settings
down to very specific things
using things like filtering and inheritance.
And with the power of filtering and inheritance,
it also means
that Group Policy is a fairly complicated concept.
I've seen IT operations engineers
with decades of on the job experience
that still don't properly understand Group Policy.
That won't be you.
Let's get a good grasp of Group Policy during this lesson
and the subsequent lessons in this section.
Now we've talked a bit throughout this course
about defining your Active Directory structure.
We've even taken a bit of a look
at the default structure you get
in Active Directory Domain Services.
When you deploy Active Directory Domain Services
and create a new domain,
you get a default structure
that is a mixture of 2 object types.
And these object types are used to create the hierarchy
within your Active Directory domain
and store other objects
like users, groups, and computers.
The first of these objects are containers
and there are a few containers created by default
including the built-in container, the user's container
and the computer's container.
And for the most part,
containers are meant to be used by the system.
The other object type you can use to create your hierarchy
are organizational units,
which is something we've touched on briefly
in previous lessons.
Both containers and organizational units
can be used to delegate administrative control
so that you can grant access to users
to manage the objects in those containers
or organizational units.
There are some exceptions to this, though.
For example, there is a built-in container
that you can't delegate administrative control on.
Where containers and organizational units differ
is that only organizational units
can be used to apply Group Policy.
And this is done by linking a Group Policy object
to the organizational unit.
And organizational units aren't the only object
that you can link a Group Policy object to,
but it's important to know
that you cannot link Group Policy objects to containers.
Now to modify the structure of Active Directory,
by default you need to be a member of the administrators,
domain admins or enterprise admins privileged groups,
and you can delegate control
to change these default permissions.
There is one important point
I'd like to make here about organizing Active Directory.
In my experience, I've seen some really complex structures
in Active Directory
and remember that you should only really create
additional organizational units for two purposes.
And that is for delegating permissions
and for assigning Group Policy.
So don't be too enthusiastic about creating a complex
Active Directory Domain Services structure.
Now, when you deploy your Active Directory Domain
Services Domain,
you get some default Group Policy Objects.
The first of these is the Default Domain policy
and it's linked to the domain
and it applies to all domain users and computers,
and it contains settings like password settings,
account lockout settings
and Kerberos authentication protocol policies.
And the settings defined in the Default Domain policy
can only be applied once per domain at the domain level.
So you can't apply them
at a lower level organizational unit.
The other default policy you get
is the Default Domain Controllers policy.
And it's linked to the domain controllers
organizational unit
and applies to domain controllers
and contains user writes assignment policies,
and audit policies.
Now by default only domain admins
and enterprise admins
can modify the built-in Group Policy Objects
but it's not recommended
to modify these default GPOs anyway.
Instead, you should create and link new GPOs as required.
And we'll take a look at this in more detail
later in this lesson.
If you're a member of the domain admins
or the Group Policy Creator Owners group,
you can create additional Group Policy objects.
And by default, if you're a member of Administrators,
Domain Admins, or Enterprise Admins,
you can link those Group Policy Objects
to organizational units within the domain.
And of course you can delegate those permissions
to other users and groups as required.
You can also create Starter GPOs
which come with preconfigured settings
to speed up the creation of Group Policy Objects
by including default settings
that might be applied to multiple GPOs.
Now, password policies are a little special
when it comes to Group Policy.
Password policies,
like other security related settings
in the Default Domain policy,
can only be set once per domain
and only at the domain level within Group Policy.
Now within a Group Policy Object,
you can have 2 broad types of settings;
they are user configuration settings
and computer configuration settings.
Computer configuration settings apply to the computer
and anyone that logs onto that computer.
And computer settings
are useful for setting system-level settings
and for applying settings to all users.
User settings apply to a user,
no matter which computer they log onto.
Now, sometimes a setting can be configured
as either a user setting or a computer setting.
And when a conflict occurs,
computer settings take precedence.
For example, if you configure a computer setting
that the clock shouldn't appear on the task bar,
all users that log onto that computer
with that policy applied will not have the clock
regardless of any user policies.
And if you do not want to configure user settings
or computer settings within a GPO,
you can disable those settings
to improve the Group Policy performance.
All right, now let's take a look
at some of the tools you can use to manage Group Policy.
You can manage local Group Policy on a Windows PC
using the local Group Policy editor called Gpedit.
Settings configured using Gpedit
do not affect other domain-joined PCs.
And Gpedit is also used
to configure Group Policy settings on PCs
that are not domain-joined.
You can also manage Group Policy in Active Directory
using the Group Policy Management Console
and the Group Policy Management Editor.
And of course, you can also manage Group Policy
using Windows PowerShell.
Microsoft provides this functionality
through the Group Policy PowerShell module.
The new GPO cmdlet
can be used to create a new Group Policy object.
And when you want to link that Group Policy object,
you can link the GPO with the new GP link command line.
All right,
let's take a look at a demo of implementing Group Policy.
In this demo, we'll make some changes
to implement Group Policy for our domain,
starting with our server computers.
The default computers container
that computer accounts are created in
when they are domain-joined
cannot have Group Policy Objects linked to it.
So we're going to create an organizational unit
named Domain Computers.
And then we'll create 2 suborganizational units,
one for servers and another for workstations
as they will likely have different Group Policy settings.
And then we'll move our existing servers
into the server's organizational unit.
Then we'll create a new Group Policy object
named Server Baseline Policy
and configure it to hide the shutdown option
from the start menu.
This will help prevent accidental shutdowns
on our servers
when users log in directly to a server.
And as this Group Policy Object
will only ever have computer settings configured,
we'll disable the user settings
for this Group Policy Object.
And then finally, we will link the GPO to our servers OU.
And because we wanted to also apply to domain controllers,
they're servers too, after all,
we will link the GPO to our Domain Controllers
organizational unit as well.
Let's jump into the demo.
All right, here we are
logged onto our internal administrative server
called BNE-ADM01.
And we're going to go ahead and use
Active Directory Users and Computers
to create some organizational units.
So we'll go ahead and launch
Active Directory Users and Computers.
And we can see here
we have the default Computers container,
and this is the container where computer accounts
are added to, by default,
when they're joined to the Active Directory domain.
But because this is a container,
we can't link Group Policy Objects to it.
So let's go ahead and create some organizational units.
I'll go ahead and right click on the domain
and I'll select New
and then Organizational Unit.
And we're going to create an organizational unit
named Domain Computers.
And then we're going to go ahead
and create 2 suborganizational units:
one for servers and one for workstations.
So I'll right-click the organizational unit
and then select New
and then Organizational Unit.
I'll go ahead and create the Workstations
organizational unit first.
And now I'll go ahead and repeat the process
to create the Servers organizational unit.
Now you might have missed this because it's quite subtle,
but the icon next to the Computers container
is the icon for a container
and the icon next to Domain Controllers
and domain computers is the organizational unit icon.
All right, now that we have
these organizational units created,
let's go ahead and move the computers
out of the computers container
and into the Servers container.
So we'll navigate back to the Computers container.
I'll select the Servers,
right-click and select Move
and then I'll navigate to our domain computers
and then select Servers
and then click OK.
All right, now that all of our servers have been moved,
let's go ahead and use the Group Policy Management Console
to create some Group Policy Objects and link them.
So I'll go ahead and close
Active Directory Users and Computers.
Now I've gone ahead and installed
the Group Policy Management Console on this server
and I did that using PowerShell.
So you can see
I've got the Group Policy Management Console installed.
And you can install that using PowerShell
or using Server Manager.
All right, let's jump into
the Group Policy Management Console
and then we'll expand our forest
and then expand our domain.
I'll just drag this slider across a little bit
so we can see everything a little bit better
and we'll expand our domain again.
Now let's go ahead
and create our server baseline Group Policy Object.
So I'll write click Group Policy Objects
and then select New.
And I'm going to call this Server Baseline Policy
and then click OK.
Now we'll navigate into the Group Policy Objects
and then I'll edit our Server Baseline Policy.
And the setting we want to configure
is to prevent the shutdown option
from being showed on the start menu.
So I'm going to navigate into computer configuration
and then policies
and then administrative templates
and then I'll navigate into Start Menu and Taskbar
and then I'm going to select the option
that removes access to the shutdown button.
So I'm going to ahead and double click that setting
and then we're going to enable this setting.
We can go ahead and click OK.
Now that that setting is configured,
it'll apply to any computers
where we link this Group Policy Object.
Now, because we're only going to
use this Group Policy Object
to apply computer configuration,
I'm going to go ahead
and disable the user configuration for this policy.
So I'm going to go ahead and right click the policy
and then select Properties.
And then we're going to disable
the user configuration settings.
And then it's asking us to confirm
so we'll go ahead and click Yes,
and then we can go ahead and click OK.
Now with our Group Policy Object created,
we can go ahead and close
the Group Policy Management editor.
Now, for our Group Policy Object
to apply to the computers that we want it to apply to,
we need to link the Group Policy Object
to the organizational unit.
So let's go ahead and link the Group Policy Object
to the servers organizational unit
and the Domain Controllers organizational unit.
Now, there are a few ways you can go about doing this
but I'm going to just go ahead
and right click on the Domain Controllers
organizational unit
and then select Link an existing GPO.
Then I'll select our Server Baseline Policy
and then click OK.
And then I'm going to repeat the process
for the server's organizational unit.
All right, the Group Policy Object is now linked
to our Servers organizational unit
and our Domain Controllers organizational unit.
And we'll continue to work
with this Active Directory environment moving forward
and take a look at how we can confirm
that the Group Policy is applying successfully.
But that concludes this demo.
Let's wrap up with a bit of a summary
of what we've covered in this lesson.
All right, so what have we covered in this lesson?
Group Policy is used to centrally administer
Active Directory users and domain-joined computers.
And despite the name,
remember that Group Policy cannot be applied to groups.
If you have a group of Active Directory users
or computers in an organizational unit
that a GPO is linked to,
members of those groups will not have that Group Policy
applied to them.
It's also important to remember
that you should not modify
the built-in Group Policy Objects.
Instead, you should create
additional Group Policy Objects
to override those settings as required.
It's also important to remember
that computer settings take precedence over user settings
when the same setting is configured
in both a computer setting and a user setting.
And finally, it's also important to remember
that you can use the Group Policy Management Console
or Windows PowerShell to manage group policy
in an Active Directory domain.
All right, thanks for being with me in this lesson
and I hope you found it useful.
And I look forward to seeing you in the next lesson.