G'day, Cloud Gurus,
and welcome back for this lesson,
where we're going to take a look at managing Group Policy
in Azure Active Directory Domain Services.
Let's take a look at what we're going to cover.
First up, we'll cover off
the requirements and considerations
regarding Group Policy in Azure AD Domain Services.
Then we'll take a look
at managing Azure AD Domain Services passwords.
And finally, we'll do a bit of a demo
where we will manage Azure AD Domain Services Group Policy.
All right, let's get started.
First up, let's take a look at some of the requirements
for managing Group Policy in Azure AD Domain Services.
Firstly, it's important to know that you need to be a member
of the Azure AD DC Administrators
Azure Active Directory group
and you need to have an Azure AD Domain Services
domain-joined management PC.
And you also need to have the Group Policy management tools
installed on that management VM.
Now let's take a look at some of the considerations
regarding Azure AD Domain Services Group Policy.
Firstly, it's important to know
that there are two default Group Policy objects,
and they are the AADDC Computers Group Policy Object
and the AADDC Users Group Policy Object.
Now, you can edit or disable these GPOs,
but you can't edit the security filtering on these GPOs.
And you can also create additional organizational units
and Group Policy Objects as required.
But users cannot be moved
from their default organizational unit, as they are created
in Azure AD or on-premises Active Directory
and that is the source of truth.
But you can organize your Azure AD Domain Services
joined computers as required.
And as we mentioned in some of the previous lessons,
Group Policy Objects are not copied
from on-premises Active Directory Domain Services
to Azure AD Domain Services.
And another important consideration
is that you cannot modify the Default Domain policy
or the Default Domain Controllers Policy
to configure things like password settings.
So you'll need to use fine-grained password policies.
Let's take a look at that now.
As we know already,
passwords will sync between AD Domain Services,
Azure AD, and Azure AD Domain Services.
Now, by default,
passwords in Active Directory Domain Services
are set to expire every 42 days.
And by default, passwords in Azure AD
are set to expire every 90 days.
And in Azure AD Domain Services,
passwords are set to expire every 90 days as well.
Now, with the default configuration,
this won't create any problems.
But often, password policies
are changed from the default values,
and in some cases, your passwords could expire
in Azure AD Domain Services
before they expire on-premises or in Azure AD.
And you'll remember that passwords cannot be updated
in Azure AD Domain Services.
So you might need to modify your password settings
in Azure AD DS,
but you are not able to modify the Default Domain policy
or create a policy at this level.
So how can you do this?
Well, you can use fine-grained password policies
to edit password policies in Azure AD DS.
And we'll take a look at that in the demo, in just a moment.
And it's also important to know
that the password doesn't expire setting
and the user must change password values
are synced from Azure AD to Azure AD Domain Services.
So passwords that are set not to expire in Azure AD
will also not expire in Azure AD Domain Services.
All right, let's take a look at a demo
of managing Group Policy in Azure AD Domain Services.
This demo will be more about getting familiar
with Azure AD Domain Services when it comes to Group Policy.
As, depending on your experience, you might not get a chance
to get hands on with Azure AD Domain Services
before taking the AZ-800 exam.
And it's not something that's supported
in our hands-on lab environment.
So let's explore Azure AD Domain Services
Group Policy management together.
In this demo, we will log on to our management VM
as a user that is a member
of the Azure AD DC Administrators group.
Then we will install the Group Policy Management tools,
and we will explore the default policies,
and I'll show you how you can create and customize policies.
And then we will deploy some administrative templates
to the management VM,
and we will also explore some of the limitations.
And finally, we'll take a look
at fine-grained password policies
and how you can use them to customize the default policies
in Azure AD Domain Services.
Let's take a look at the demo.
All right, so here I am logged onto our management VM.
And this VM has been joined
to the Azure AD Domain Services managed domain.
And I've logged on with a user account that is a member
of the AADDC Administrators Azure AD group.
And I've gone ahead and used PowerShell
to install the Group Policy Management tool.
So you can see, I've done that using Install-WindowsFeature
and then GPMC.
Let's launch the Group Policy Management Console
and have a look at some of the default policies
that are created as part of your managed domain.
So here we are in Group Policy Management.
And you can see that you get a Default Domain Policy,
and you also get a Default Domain Controllers policy,
and you also get a default policy for AADDC Computers,
and another for AADDC Users.
Now, I just want to show you here,
that you can edit these default Computer and User policies,
but you're unable to edit the Default Domain Policy
and the Default Domain Controllers policy.
Now, I'm going to launch
Active Directory Users and Computers,
and we'll take a look at the organizational units,
user accounts, and computers.
So we'll launch Active Directory Users and Computers.
Now, I just want to show you, in here,
if I select the AADDC Computers organizational unit,
and then I right-click and select New,
I don't get the option to create an organizational unit.
So I couldn't create a hierarchy
within this organizational unit.
And the same applies
for the default Users organizational unit.
If I right-click on that,
I also can't create a new organizational unit below that.
But what I can do is create my own organizational unit.
So if I right-click the domain, and then select New,
and then Organizational Unit.
I'm just going to call this My OU, then we'll go OK.
Now let's try and move some of the user accounts
into that organizational unit.
So we'll select a user, we'll select Move,
and we'll select our new My OU, and then go OK.
And so, you can see here,
that you can't move the users that are synchronized
from Active Directory Domain Services on-premises
or Azure Active Directory.
I'll go ahead and click OK.
Now, let's go ahead and try and move a computer.
So if I select the default Computers container,
and then I try and move this computer into our new My OU,
and then I'll select My OU, and we can see
that we're successfully able to move the computer objects.
And we could create sub-organization units
within this organizational unit
to have better control over Group Policy.
Now, I'll just minimize this,
and minimize Group Policy Management and PowerShell.
Now, I've downloaded some administrative templates
for Microsoft Edge.
So if I open that up,
and then open up the MicrosoftEdgePolicyTemplates folder,
and then go into Windows,
you can see here, we've got some admx files.
And I can copy those administrative templates
to either a central store for the managed domain,
or I can copy them to the local policy store.
So you're still able to use administrative templates
as you would on-premises.
Now, let's take a look at password settings.
I'll go ahead and minimize these windows
and then we'll launch Group Policy Management.
And you can see here, that we're not able to edit
the Default Domain Policy.
So we're not going to be able to change password settings
in that Default Domain Policy.
So to change passwords, we're going to have to use
the Active Directory Administrative Center.
So I'll minimize Group Policy Management.
Then we'll launch
the Active Directory Administrative Center.
And then we'll navigate into our domain,
and we'll navigate into the System folder,
and then we'll navigate
into the Password Settings Container.
I'll just drag this column out a little bit,
so you can see the full name.
Password Settings Container is the one we're after.
And you can see here,
we have a default fine-grained password policy
created for all users in our domain.
But we can go ahead and create a new,
more specific password policy.
So if I select New, and then Password Settings,
I can then configure the password settings as required.
For example, I could set a custom length, set a custom age.
And then I can add the users and groups
that these password settings apply to.
So I can select Add, and then I could navigate out
and select some users and groups.
So, for example, I could apply it to just Adam.
Then I could provide a Name, and then a Precedence,
and then OK.
I'm just going to go ahead and click Cancel here.
And you can see the default password policy
has a very high precedence.
So our custom password settings
would only need to have a precedence higher than 200
to apply and override the default password settings.
All right, that concludes this demo.
Let's wrap up with a bit of a summary
of what we've covered in this lesson.
Membership to the Azure AD DC Administrators group
is required to manage Group Policy
in Azure AD Domain Services.
And you cannot modify the Default Domain
or the Default Domain Controllers policy in Azure AD DS.
So instead, you can create fine-grained password policies
to override the default password policy
in your managed domain.
All right.
Thanks for being with me in this lesson,
and I hope you found it useful.
And I look forward to seeing you in the next lesson.