Good day, Cloud Gurus, and welcome back
for this lesson where we're going to take a look
at how you can leverage Group Policy preferences
to provide even greater control over the settings
on your Windows servers and Windows clients.
Let's take a look at what we're going cover.
First up, we'll introduce Group Policy preferences,
and then we'll explore
Group Policy preference configuration
as there are some tricky things
about Group Policy preference configuration
that can trip people up when they first start using them.
And then we'll wrap up with a bit of a demo
where we will configure Group Policy preferences.
Let's get started.
All right.
So what are Group Policy preferences?
Group Policy preferences are used
to extend the functionality provided by Group Policy.
And Group Policy preferences
include settings like shortcuts, shares,
folders, network and power options, and more.
But Group Policy preferences work a little bit differently
to regular Group Policy settings.
Group Policy preferences are exactly as the name implies.
They are a preference,
meaning the user can override the setting
if configured to allow it.
And the preference change made by the user can be permanent.
Now, sometimes this is not possible
with regular Group Policy settings,
as when the next Group Policy refresh occurs,
the user's preferences will be changed back
to the settings configured in the Group Policy settings.
Another important point to make
is that where Group Policy preferences
and Group Policy settings are both configured,
Group Policy settings will overwrite
those configured in Group Policy preferences.
If you need to ensure a setting is applied,
for example, a security setting that's required
to meet your compliance requirements,
you should not use Group Policy Preferences for this.
Instead, you should use regular Group Policy settings.
Now, most Group Policy Preferences
have an associated action.
And in my experience, I found that the action associated
with a Group Policy preference is often misunderstood.
The actions available
on most Group Policy Preferences include Create,
where it will create a new item,
and if the item already exists
this preference item will do nothing.
The second action is Replace,
and Replace will delete and recreate the item,
whether or not it already exists.
And the third action is Update,
and it will modify existing settings on a preference,
or create new settings if they're missing.
And the final action is Delete,
where it will delete or remove an item.
Now, this seems pretty basic, right?
Well, let's look at an example of a mapped network printer
that you have changed the network information for
in the preference item.
If you use the Create option,
the existing settings for that printer
will not be updated with new settings.
For this you would need to use the Update setting.
Another potential issue is around the Replace option.
If you use the Replace option with network drives,
those drives will be disconnected and reconnected
whenever Group Policy is refreshed.
Now Group Policy preferences have the advantages
of some common configuration options
that are available in all preferences.
The first of these is Apply Once and Do Not Reapply.
And this is ideal where you want
to configure default settings,
but allow your users to overwrite those defaults
with their own preferences.
And in addition to the targeting scoping
and filtering available on a standard Group Policy object,
Group Policy Preferences have the advantage
of additional filtering using powerful
item-level targeting.
Item-level targeting allows you to filter
individual preference items in a Group Policy Object
based on a wide array of user and computer attributes.
You can also use multiple attributes
and combine them to create powerful filters.
Filters include basically anything you could imagine,
from hardware and network information,
through to security group membership.
And item-level targeting has allowed me to work
some serious Group Policy magic in the past
by targeting very specific sets of users
or PCs to fix a configuration issue
where only a very specific condition exists.
All right, let's take a look at a demo
where we will configure Group Policy preferences.
In this demo, we will create a Group Policy Object
in our domain, and then we will explore
the settings available as preferences.
We'll take a look at item-level targeting configuration,
and finally, we will test the preference actions
by creating a sample file
and changing the action through create,
replace, update, and delete, and observe the results.
Let's take a look at the demo.
All right, so here we are logged
onto our administrative server.
Let's take a quick look at Group Policy preferences.
We'll right click on the domain,
and we'll create a new GPO and link it here.
And I'm going to call this, Group Policy Preferences
Test GPO, and then we can go ahead and click OK.
And then we will edit this Group Policy Object.
And then we'll navigate under Computer Configuration.
And then we can take a look at preferences.
And we can see we have a number of window settings available
for computer configuration preferences.
We just collapse that.
And there are also user configuration preferences available.
So if we expand that node, we have Windows settings,
and we have control panel settings.
Go ahead and collapse that.
Now let's go ahead and take a look at item-level targeting.
So I'm going to navigate into computer configuration
and then preferences.
Navigate into Windows settings,
and then we'll navigate into folders.
Now I'm going to right click and select New Folder.
Now I'm going to create a Group Policy Preference
that will delete the C drive Temp folder.
If the free disk space on the computer
is less than 20 gigabytes and a C:\Temp folder exists.
So we'll go ahead and provide an action as delete.
We'll provide a path as C:\Temp
and then we're going to delete this folder if emptied,
and we're going to recursively delete all sub-folders
and delete all files in the folder.
And we're going to allow the deletion
of read-only files and folders as well.
And then we'll just ignore errors
for any files that cannot be deleted.
We'll navigate to the Common tab,
and then we'll select item-level targeting.
We'll go ahead and click the Targeting button.
Now, this is where we can provide item-level targeting
to target very specific computers.
Let's go ahead and add our first item.
So we'll select New and we'll select File Match.
And here we're going to change the match type
to Folder exists.
We'll change the path to C:\Temp.
Now let's go ahead and add another item.
And we'll use Disk Space,
and we'll say the disk space on the C drive
is 20 gigabytes.
And we can see here, it says, Greater than or equal to.
We're going to change this to is not.
And that'll be, Is not greater than or equal to,
which is less than, and we can see here
the preferences are using an and.
So we can see that this item level-targeting
will ensure that C:\Temp exists
and the free space is less than 20 gigabytes.
And we could change that to an or if we wanted to,
but for our purposes and and is okay.
So we'll go ahead and click OK.
Now we actually don't want to apply this setting.
So I'm going to go ahead and click Cancel.
All right. Now let's take a look
at Group Policy Preference actions.
I have a sample file created in our NETLOGON share.
So I'm just going to open up file Explorer
and then we'll navigate to NETLOGON.
And then I have a Sample Files directory
and then I have a sample file in there.
And in that sample file I have,
this is the original sample file,
we're going to use this file to test
Group Policy Preference actions.
So I'll go ahead and close this.
And when you are creating files
on the network using Group Policy Preferences,
you need to ensure that the file is available
on a network accessible location.
And NETLOGON is a great place to store
small files like this, but for larger files,
you could use a traditional file server.
All right, now let's go ahead and copy this file
to our computer using Group Policy Preferences.
We'll navigate to the files node
in the Group Policy editor.
We'll right, click select New and then File.
Our source will be our sample file.
And our destination file will be C:\Temp samplefile.txt.
And we're going to set the action to create.
Now we can go ahead and click OK.
Now let's go ahead and run a Group Policy update
to see if that file is created on our computer.
So we're going to go ahead and run GPUPDATE.
We're going to use the Force parameter,
and we're just going to target the computer configuration
so the policy applies quicker.
So we'll go ahead and run that command.
It'll update the computer configuration Group Policy
and then we can navigate to C:\Temp in Windows Explorer.
And we can see that our sample file has been created
and it has the original sample file contents.
So that's working as expected.
Now let's edit this sample file
and then we'll run a Group Policy update again.
So I'll just edit the contents,
and then I'll save it.
Go ahead and close that.
We'll navigate back to Windows PowerShell,
and we'll run a Group Policy update again.
All right.
And the Group Policy has been successfully applied.
Let's have a look at the sample file again.
And we can see that the file contents have not changed
even after a Group Policy update.
And this is because the create
Group Policy preference action only creates the file
if it doesn't exist.
Let's change the Group Policy preference action to Replace
and see how that works.
We'll close the sample file,
navigate back to our Group Policy editor,
and edit the Group Policy preference item.
And we'll change the setting to Replace.
So we know that this will delete
and recreate the file on the client.
Go ahead and click OK.
Run a Group Policy update,
and we'll go and check out the file contents
on the client again.
And we can see that the file has been replaced
with the original file contents again.
Now let's change the content of this file again,
and we'll change the Group Policy Preference action
to Update.
So I'll update the file and then go ahead and close it.
We'll navigate back to the Group Policy editor,
we'll update this Group Policy Preference item,
and we'll change this to Update.
We can click OK.
We'll run a Group Policy update again.
All right. Now let's go ahead and take a look
at the contents of the file again.
We can see that the file contents
still have the new contents set by the user,
even though we've had the Group Policy Preference item
set to Update.
So because the file already exists,
Group Policy does not recreate the file.
Let's go ahead and change some of the attributes
of this file to see what Group Policy does in that case.
So we'll go ahead and close the file.
And we'll navigate back
into the Group Policy management editor again.
We'll edit our Group Policy Preference item,
and let's change it to Hidden.
We'll go ahead and click OK.
And then we'll run a Group Policy update again.
And then let's see if the attributes of the file
have changed.
So we'll right click our file and select Properties.
And we can see the file has now been marked Hidden.
So we can see that the update Group Policy Preference
doesn't update the contents of the file,
but rather it updates the properties of the file.
And that's an important thing to know
about the update Group Policy preference action item.
All right, now let's click OK.
And finally, we'll change the Group Policy
Preference item action to be Delete.
We'll go ahead and click OK.
And then we'll go ahead and run a Group Policy update.
And we can see the file has been deleted.
All right.
That concludes this demo on Group Policy preference actions
and item-level targeting.
Let's take a look at what we've covered in lesson.
All right.
So what have we covered in this lesson?
It's important to remember
that Group Policy settings take precedence
over Group Policy preferences.
And another important gotcha to know about
is the Group Policy preference action, Create,
will not update an item that already exists.
And you can use item-level targeting
to apply individual preferences
to very specific users or computers
based on a wide variety of filters.
All right.
That concludes this lesson.
Thanks for being with me.
And I hope you found it useful.
And I look forward to seeing you on the next lesson.