Group Policy in Active Directory Domain Services.
With Group Policy, we're talking about configuration management.
We're talking about ensuring that our domain controllers,
member servers,
and client workstations are all in compliance with our
security and management policies.
In terms of history, way back when, before Windows 2000 Server,
we had Windows NT, and there we had System Policy.
And this is the progenitor, if you don't mind the 5‑yen term,
of Group Policy as we know it today.
So you can see Local Computer and Local User,
and then we had the ability to scope System Policy to the domain level as well.
But you're delivering settings directly to the registry that affect the
HKEY_LOCAL_MACHINE or the HKEY_CURRENT_USER hives in the registry.
And the thing with System Policy,
it was great at the time to be able to lock down server and workstation systems,
but those changes, those registry changes,
were permanent.
With System Policy,
it was very difficult to undo your work or layer system policies.
This is fixed, definitely, with Windows 2000 Server,
Active Directory, and Group Policy.
Here, again,
we're delivering User and Computer settings to target server
and workstation systems all in Windows,
although I do want to say parenthetically that there are
independent software vendors that have adapted Windows Group
Policy for use in non‑Windows environment,
particularly macOS.
Check the exercise files if you're interested in more info.
But, anyway, Group Policy is beautiful, because it's,
well, because Microsoft engineered it correctly right out of the gate.
It really hasn't changed much in the past 20‑odd years.
And the biggest thing to me that is a fix from System Policy is
the fact that we can modularly layer Group Policy and you're never
permanently tattooing the registry.
When the Group Policy is out of scope, the state of the system registry reverts.
It's really nice.
Now,
what are some representative settings that we can deliver using
these Group Policy Objects in Active Directory.
A very common and important one would be password policy and account policies.
We could roll that into security settings,
ensuring that if someone tries to brute force by logging on or
attempting a logon over and over and over again,
once they reach a threshold, their account is locked out for a period of time.
This hopefully will slow down the attacker to the point
where they give up and they move on.
Now you might know that password policy has undergone some revisions,
particularly over the last few years, in terms of,
it used to be earlier in my career, we'd always in IT be fighting with users,
forcing them to change their passwords on a regular basis,
but the current thinking on that, and you may already know this,
is that it's much better for the user to hold onto one strong password than be
forced to change passwords that do just arbitrary things,
simple password, simple password 1, simple password 2, I love you 55,
these sorts of things.
And that will be reflected in the demo.
You'll see how Group Policy has evolved a little bit
with password and account policy.
Desktop and application settings,
now this is not only enforcing a consistent desktop experience
for your users on their client workstations,
but we also want to prevent configuration drift on our
Windows Server infrastructure machines.
That's what configuration management is about.
We want to make sure that the configuration or the desired state
of our systems remains compliant and static,
such that even if one of your colleagues were to
make a change directly in the OS, we could have GPO override that change.
We can do software deployment with Group Policy,
and it's been like that for a long time.
We can do folder redirection like roaming,
home folders, again,
the landscape has shifted quite a bit over the last
several years with cloud services now.
The concept of a roaming user profile and the disk space
that that could involve and the bandwidth,
frankly,
that that could involve has really gotten to be less of an issue with
increasing network speeds and seemingly limitless storage.
And then we have network settings, configuring organizational Wi‑Fi, etc.
Now, you might be thinking, well, Tim, isn't GPO,
isn't Group Policy and the Group Policy Object idea outdated in 2022?
I mean,
in the System Center product family you've got System Center Config Manager.
That product's been around a long, long time.
If you're old like me, you might remember Microsoft Systems Management Server,
or SMS, that was the precursor to System Center.
And yes,
you can use System Center to do software deployment
and folder redirection and desktop, you can overlap a lot of these things,
but then again,
Group Policy is built in natively in the OS and
doesn't require expensive licenses, and infrastructure servers,
and agents, and all of that.
All of your Windows machines actually have a local Group Policy Object,
so there's Group Policy built in regardless of whether a machine is
a member of an Active Directory domain or not.
You may also be thinking, Tim,
what about Microsoft Intune and Azure Active Directory?
Well, again, that's true,
Microsoft Intune can do mobile and endpoint
management from a cloud‑based perspective,
and there is a Group Policy‑like settings delivery service built into the cloud.
I just want to say that it's not either/or.
Group Policy is not being sunsetted.
It's still a completely valid and appropriate way to do configuration management in Active Directory Domain Services.