Group Policy Preferences.docx
- 文档编号:10852698
- 上传时间:2023-02-23
- 格式:DOCX
- 页数:34
- 大小:2.23MB
Group Policy Preferences.docx
《Group Policy Preferences.docx》由会员分享,可在线阅读,更多相关《Group Policy Preferences.docx(34页珍藏版)》请在冰豆网上搜索。
GroupPolicyPreferences
AnOverviewofGroupPolicyPreferences
ByJerryHoneycutt
PublishedNovember2007
Abstract
GroupPolicypreferencesenableITprofessionalstoconfigure,deploy,andmanageoperatingsystemandapplicationsettingstheypreviouslywerenotabletomanageusingGroupPolicy.Examplesincludemappeddrives,scheduledtasks,andStartmenusettings.Formanytypesofsettings,usingGroupPolicypreferencesisabetteralternativetoconfiguringtheminWindowsimagesorusinglogonscripts.ThiswhitepaperintroducesthisnewMicrosoft®WindowsServer®2008feature,anddescribeshowyoucanuseGroupPolicypreferencestobetterdeployandmanagecomputeranduserpreferences.
TheinformationcontainedinthisdocumentrepresentsthecurrentviewofMicrosoftCorporationontheissuesdiscussedasofthedateofpublication.BecauseMicrosoftmustrespondtochangingmarketconditions,itshouldnotbeinterpretedtobeacommitmentonthepartofMicrosoft,andMicrosoftcannotguaranteetheaccuracyofanyinformationpresentedafterthedateofpublication.
Thiswhitepaperisforinformationalpurposesonly.MICROSOFTMAKESNOWARRANTIES,EXPRESSORIMPLIED,INTHISDOCUMENT.
Complyingwithallapplicablecopyrightlawsistheresponsibilityoftheuser.Withoutlimitingtherightsundercopyright,nopartofthisdocumentmaybereproduced,storedinorintroducedintoaretrievalsystem,ortransmittedinanyformorbyanymeans(electronic,mechanical,photocopying,recording,orotherwise),orforanypurpose,withouttheexpresswrittenpermissionofMicrosoftCorporation.
Microsoftmayhavepatents,patentapplications,trademarks,copyrights,orotherintellectualpropertyrightscoveringsubjectmatterinthisdocument.ExceptasexpresslyprovidedinanywrittenlicenseagreementfromMicrosoft,thefurnishingofthisdocumentdoesnotgiveyouanylicensetothesepatents,trademarks,copyrights,orotherintellectualproperty.
©2007MicrosoftCorporation.Allrightsreserved.Microsoft,ActiveDirectory,Windows,WindowsServer,WindowsVista,andtheWindowslogoandareeitherregisteredtrademarksortrademarksofMicrosoftCorporationintheUnitedStatesand/orothercountries.
Thenamesofactualcompaniesandproductsmentionedhereinmaybethetrademarksoftheirrespectiveowners.MicrosoftCorporation•OneMicrosoftWay•Redmond,WA98052-6399•USA
Contents
Contents2
Overview3
Preferencesvs.PolicySettings4
GroupPolicyPreferenceItems7
WindowsSettings8
ControlPanelSettings11
GroupPolicyPreferencesFeatures17
CommonOptions17
TargetingControl18
ProcessVariables20
SettingsReport22
DeployingGroupPolicyPreferences23
WindowsDeploymentStrategies24
ThickImaging25
ThinImaging25
BenefitsofGroupPolicyPreferences27
Summary29
Glossary30
Overview
DuringyourcareerasanITprofessional,you’velikelymappednetworkdrivesforusers.Youprobablyconfiguredthemusinglogonscripts.Thisrequiredyoutowriteanddebugthelogonscript,storethescriptinacentrallocation,andthenrunthescriptbyconfiguringUserobjectsinActiveDirectory®directoryserviceorbycreatingaGroupPolicyobject(GPO).Thinkaboutalltheothersettingsyou’veconfiguredusinglogonscriptsorsimilarmethods.Asimple,centralsystemtoconfigureanddeploythesesettingswithoutrequiringyoutomakescatteredchangesthatareeasilyforgottenandseldomdocumentedwouldcertainlyhelpreducecostsandmakeyourjobeasier,wouldn’tit?
Organizationstypicallydeploytwotypesofsettings:
managedandunmanaged.Managedsettingsarepolicysettingsthatyouenforce.Youdon’tallowuserstochangepolicysettings.Policysettingsreducesupportcostsbyenforcingstandardconfigurations,helppreventproductivityloss,andprotectanorganization’sassets.GroupPolicyisthebesttechnologyfordeliveringpolicysettingstocomputersrunningMicrosoftWindows®,andifyourorganizationislikemostwithMicrosoftinfrastructures,you’vealreadyadoptedGroupPolicy.
Unmanagedsettingsarepreferences.Incontrasttopolicysettings,youallowuserstochangepreferencesafteryou’vedeployedthem.Byexplicitlydeployingpreferencesratherthanacceptingthedefaultoperatingsystemsettings,youcreateconfigurationsthataremorecompatiblewithyourITenvironmentandarespecificallytailoredtoyourorganizationandhowitspeopleusetheircomputers.Additionally,deployingsomepreferencesforusersisanecessityinlocked-downenvironments,whereuserscan’tchangemanysettings.Organizationsdeploypreferencesavarietyofways,butthemostcommonaredefaultuserprofiles,registrationentry(.reg)files,andlogonscripts.IncludingpreferencesinWindowsimagesisalsocommon.Inanycase,mostmethodsfordeployingpreferencesaredecentralizedandunwieldy.
IncontrasttothelessIT-friendlymethodsfordeployingpreferences,GroupPolicypreferencesaddtoGroupPolicyacentralizedsystemfordeployingpreferences.Itprovidesthemeanstosimplifydeployment,reduceconfigurationerrors,andreduceITcosts.Ratherthanusingthestepsdescribedearliertodeploymappeddrives,forexample,yousimplycreateaGroupPolicyobjectandedititsDriveMapspreferenceitem.ThiswhitepaperdescribesGroupPolicypreferences—itsfeatures,thedifferencesbetweenpolicysettingsandpreferences,andthemanybenefitsofusingthisnewtechnology.
Preferencesvs.PolicySettings
WindowsServer2008includesthenewGroupPolicypreferencesbuilt-intotheGroupPolicyManagementConsole(GPMC).Additionally,administratorscanconfigurepreferencesbyinstallingtheRemoteServerAdministrationTools(RSAT)onacomputerrunningWindowsVistaServicePack1(SP1). RSAT,currentlyinbetaandexpectedtoreleaseshortlyafterWindowsServer2008,includestheupdatedGPMC.
ThemostcommonquestionaboutGroupPolicypreferencesis,“Howarepreferencesdifferentfrompolicysettings?
”UnderstandingthisconceptiscrucialtotakingfulladvantageofGroupPolicypreferences.Table1summarizesthedifferencesbetweenthem,andthe“Glossary”sectiondefinesmoreterminologyusedthroughoutthisandotherGroupPolicywhitepapersthatcoverpreferences.
Table1.Preferencesvs.Settings
GroupPolicyPreferences
GroupPolicySettings
Enforcement
∙Preferencesarenotenforced
∙Userinterfaceisnotdisabled
∙Canberefreshedorappliedonce
∙Settingsareenforced
∙Userinterfaceisdisabled
∙Settingsarerefreshed
Flexibility
∙Easilycreatepreferenceitemsforregistrysettings,files,andsoon
∙Importindividualregistrysettingsorentireregistrybranchesfromalocaloraremotecomputer
∙Addingpolicysettingsrequiresapplicationsupportandcreatingadministrativetemplates
∙Cannotcreatepolicysettingstomanagefiles,folders,andsoon
LocalPolicy
∙NotavailableinlocalGroupPolicy
∙AvailableinlocalGroupPolicy
Awareness
∙Supportsnon-GroupPolicy-awareapplications
∙RequiresGroupPolicy-awareapplications
Storage
∙Originalsettingsareoverwritten
∙Removingthepreferenceitemdoesnotrestoretheoriginalsetting
∙Originalsettingsarenotchanged
∙StoredinregistryPolicybranches
∙Removingthepolicysettingrestorestheoriginalsettings
TargetingandFiltering
∙Targetingisgranular,withauserinterfaceforeachtypeoftargetingitem
∙Supportstargetingattheindividualpreferenceitemlevel
∙FilteringisbasedonWindowsManagementInstrumentation(WMI)andrequireswritingWMIqueries
∙SupportsfilteringataGPOlevel
UserInterface
∙Providesafamiliar,easy-to-useinterfaceforconfiguringmostsettings
∙Providesanalternativeuserinterfaceformostpolicysettings
Thekeydifferencebetweenpreferencesandpolicysettingsisenforcement.GroupPolicystrictlyenforcespolicysettings.First,GroupPolicywritesthosesettingstothePolicybranchesoftheregistry,andtheaccesscontrollists(ACLs)onthosebranchespreventStandardusersfromchangingthem.WhenaGroupPolicy-awareapplicationoroperatingsystemfeaturelooksforapotentiallymanagedsetting,itfirstlooksforthepolicysetting.Ifthepolicysettingdoesn’texist,itlooksforthesettingelsewhereintheregistry.Second,GroupPolicy-awareapplicationsandoperatingsystemfeaturestypicallydisabletheuserinterfaceforsettingsthatGroupPolicyismanaging,whichpreventsusersfromchangingthem.Finally,GroupPolicyrefreshespolicysettingsataregularinterval,whichisevery90minutes,bydefault,butwhichisconfigurablebyaGroupPolicyadministrator.
IncontrasttoGroupPolicysettings,GroupPolicydoesnotstrictlyenforcepreferences.GroupPolicydoesnotstorepreferencesinthePolicybranchesoftheregistry.Instead,itwritespreferencestothesamelocationsintheregistrythattheapplicationoroperatingsystemfeatureusestostorethesetting.Theimplicationofthisistwofold.First,GroupPolicypreferencessupportapplicationsandoperatingsystemfeaturesthataren’tGroupPolicy-aware.Second,GroupPolicypreferencesdonotcausetheapplicationoroperatingsystemfeaturetodisabletheuserinterfaceforthesettingstheyconfigure.TheresultisthatafterdeployingpreferencesusingGroupPolicy,userscanstillchangethosesettings.Additionally,GroupPolicyrefreshespreferencesusingthesameintervalasGroupPolicysettingsbydefault.However,youcanpreventGroupPolicyfromrefreshingindividualpreferencesbychoosingtoapplythemonlyonce.Thisconfiguresthepreferenceonetimeandallowstheusertochangeitpermanently.
GroupPolicyfilteringissubstantiallydifferentfromGroupPolicypreferenceitem-leveltargeting.Youfil
- 配套讲稿:
如PPT文件的首页显示word图标,表示该PPT已包含配套word讲稿。双击word图标可打开word文档。
- 特殊限制:
部分文档作品中含有的国旗、国徽等图片,仅作为作品整体效果示例展示,禁止商用。设计者仅对作品中独创性部分享有著作权。
- 关 键 词:
- Group Policy Preferences