Let's create a custom policy and link it to our HQ
Data Team organizational unit.
Nowadays, we do have this concept of Starter GPOs, where
when you enable it you get these basic Starter ones that
talk about updating firewall ports.
These are, this just presents a way for you to easily import and
export GPOs that already have preconfigured settings.
Notice that we can click Load Cabinet. You can find pre‑created starter GPOs
online, and the idea is that you can build your custom GPOs based on these
settings, because oftentimes a Starter GPO would already have industry
standard or compliance‑aligned settings in it.
If you take a look at one of these,
you'll notice that when you double‑click into a GPO there's a Settings
tab, and this allows you to browse granularly down into the content of
the policy, where eventually you can see what actually is being set.
It can be useful for Sure.
So I'm going to finish by going to HQ Data Team, and I'm going to
say create a GPO in this domain and link it here.
Now notice there's also a Link an Existing GPO option.
Here's where we have our Block Inheritance. And then actually I
made a couple changes farther up in the scope.
I might want to force a refresh, for example. It's easy to
do at the OU level. We can right‑click and do a Group
Policy Update, as you see here.
It says, You have chosen to force a Group Policy update on
all computers within this container.
Now, there's nothing in there, right? Do I have cli and Test OU? Let me go
back to Users and Computers and figure out what's up. Oh,
it looks like cli1 is in Domain Workstations, right, so let me go to Domain
Workstations, and now I will right‑click and create a GPO in this domain and
link it here, and I'll call this Control Panel GPO.
Now I should be more granular than that according to best
practices, but I'm just thinking of this example off the top of
my head, so give me a break, okay? Now, as I said,
if you're using Starter GPOs, you can import those
settings as an excellent starting point.
I'm not going to do that.
I'm just going to create an empty one.
And now that I have that,
you can see the metadata for that GPO over at right. You can see that
the link is enabled on the parent OU by default. We can right‑click the
Control Panel GPO and see that the default settings are going to pick up
authenticated users, so anybody signing on to cli1 is going to be
subject to these settings.
Now, you can directly specify a domain computer account in your GPO access list.
Watch this, if I go to Add and I change the Object Type filter to
include Computers, I can do a search for cli1, for example, and I
can bring that guy in, give the computer read permission so it
will process the GPO itself.
So lastly, let me right‑click and edit this, and if we're
going to do computer‑wide settings,
it makes sense that we would want to focus on the
computer configuration side of the fence.
So let's open up Computer Configuration, Preferences,
Control Panel Settings here, and if we come down to, say,
Printers, we can create a new network printer.
I'm going to say its IP address is 10.10.10.100, and the Local Name is
office‑printer, and the Printer path is rootdc1\printer1.
So basically I just want you to see here that we're
just working through the GUI here.
The preferences, and particularly the Control Panel
Settings, has a different UI.
This reflects an old acquisition that Microsoft made a long time ago.
We can see there's Windows Setting, Environment variables, Folders, etc., etc.
It doesn't matter specifically what I'm configuring here, I
just want you to see. Let me actually come up to Policies,
and Administrative Templates.
There's also Control Panel in there, as a matter of fact, let's try to find,
and Printers is in there as well, so you can see there's no one, in most cases,
there's no one spot to find a canonical setting.
There's our Software installation, Startup Scripts, etc., etc., etc.
Let me go under Administrative Templates,
Network, DNS Client, and let's just set Dynamic update to Enabled
to formally force DNS, or Dynamic DNS update.
I just want to make a couple changes to this policy, because I want to both
run a Group Policy Update, and we can see that that completed without errors,
but I also want to see the Group Policy Results.
So let's go to Group Policy Results Wizard and run through this.
We're going to say this computer, Current user, click Next,
and we'll finish the wizard, and we see a report here.
Let me maximize the screen. And we can see down at the bottom under
Group Policy Objects, let me scroll up on that one, we can see that
the Applied GPO's are the LocalGPO,
but that's being overridden by the Default Domain Policy.
And then we can see our specific settings down here.
Let's expand the Default Domain Policy and see when it was last applied.
it's not getting right down to the settings level,
but at least it shows which policies are actually in effect on that machine and it gives us a basis for troubleshooting.