13 Configuring Group Policy Preferences

8/10/2019 13 Configuring Group Policy Preferences

1/17


https://skillpipe.courseware-marketplace.com/reader/en-GB/Book/BookPrintView/b6175ac1-149e-4f52-83bd-6350c9133320?ChapterNumber=14&FontSize 1/17

13 Configuring Group Policy Preferences

Section Topics

Introducing Group Policy Preferences

Comparing Preferences and Policy Settings

Configuring Preferences Settings

Section Objectives

After completing this section, you will be able to:

Describe the purpose of Group Policy Preferences

Describe the differences between Preferences and Policy settings

Identify the settings that you can configure in the Computer Configuration and User

Configuration sections of the Group Policy Management Console

Describe the Windows and Control Panel settings

List the advanced Preferences configuration options that are common to all GPOPreferences

Section Overview

This section describes the function of Group Policy Preferences. You will learn how tocombine Preferences with Policies, and how Preferences are different from Policies. This

section also explains how to configure Group Policy Preferences and modify the advanced


2/17



configuration options.

Introducing Group Policy Preferences

igure 302: Introducing Group Policy Preferences

This topic describes Group Policy Preferences and explains how to deploy these preferences.

Group Policy Preferences Feature

igure 303: Group Policy Preferences Feature

The Group Policy Preferences feature was formerly available from a company called Desktop

Standard Corporation. Near the end of 2006, Microsoft purchased the company to acquire

heir Group Policy management products.

The Group Policy Preferences feature is now an integral part of the Group Policy

anagement tools in Windows Server 2008 and later. With this addition, administrators now

ave the ability to simply configure a broad array of settings that were previously available

only through logon scripts based on batch files or VBScript.

Traditional GPO Policies are considered managed configuration options. Once these options

are defined, these settings cannot be changed by the end user until the policy is modified by


3/17



he administrator or the policy object is removed.

The GPO Preferences are considered unmanaged settings. The user can modify these

configuration options on his or her system at any time. The GPO Preferences are simply being

redefined at the policy level as a default setting.

The following topic explains how to deploy Group Policy Preferences.

Deploying Group Policy Preferences

igure 304: Deploying Group Policy Preferences

indows Server 2008 and later systems already include everything that needed to utilize

Group Policy Preferences. The Group Policy management tools and the Group Policy client

software are both aware of the new configuration settings.

indows Vista, on the other hand, did not originally include the Preferences functionality. To

edit Preferences from a client operating system, you must be using Windows Vista SP1 or

above with the RSAT pack installed.

n order to configure Windows Server 2003 and Windows XP with Group Policy Preferences,ou must download and install the Group Policy Preferences Client Side Extensions.

Comparing Preferences and Policy Settings


4/17



igure 305: Comparing Preferences and Policy Settings

igure 305 compares the Preferences and Policy settings.

The following topics describe these settings in more detail.

Enforcement of Settings

One of the primary differences between Policies and Preferences is the fact that the user can

ndo the Preferences. You cannot enforce them as you can enforce Policies.

Ease of Administration

n the past, new configuration settings in the registry for an application required the creation of

a new administrative template that you had to import into Group Policy. Now, you can create

or modify any registry value to suit the needs of an application.

Files and Folders

Standard policies allow you to configure permissions on files and folders. Preferences go a

step further and allow you to create or modify folders and files.

pplication

ost GPO Policies that are applied to a user or computer are temporary in nature. When the

olicy object is removed, the settings from that policy revert to their former settings. Group


5/17



olicy Preferences, however, will stay at their new values even if the governing GPO is

emoved.

Filtering

The ability to apply a GPO based on a WMI query is a powerful feature. Unfortunately, therocess for creating a WMI query is cumbersome and time consuming. Item-level targeting in

Group Policy Preferences presents a user-friendly interface to configure the exact computer or

ser to which a specific preference item should apply.

Configuring Preferences Settings

igure 306: Configuring Preferences Settings

This topic describes the Computer Configurationand User Configurationsettings of

Group Policy Management Editor. This section also describes the Windows and Control Panel

settings within Group Policy Preferences.

Computer and User Configuration Sections


6/17



igure 307: Computer and User Configuration Sections

ike all group policies, the Preferences are also split between theComputer Configuration

and the User Configuration sections. A few preference items are available only to either the

Computeror the Usersections.

nique Computer Preference Items

Some settings apply to the computer as a whole, no matter who is logged on at the console.These settings include:

Network Shares

Services

nique User Preference Items

The following settings are more personal in nature for each individual user and do not apply to

he computer as a whole.

Applications

Drive Maps

Internet Settings


7/17



Start Menu

Windows Settings

igure 308: Windows Settings

The Windows Settings within Group Policy Preferences provide a new mechanism with

hich to configure certain aspects of the operating system. Features like drive mapping,

creating folders, and editing the registry were formerly only available through the use of logon

scripts.

The ultimate goal of these settings is to eliminate the complexity of configuring these settings,

and to provide a common foundation of settings that will give the user a good starting point.

rom there, users still have the flexibility to modify the settings to suit their own needs.

Control Panel Settings


8/17



igure 309: Control Panel Settings

The Control Panel Group Policy Preferences provide a way to manage aspects of the

operating system that have been unreachable by traditional means. Some of these settings

could be scripted, but others really have no workable mechanism from which to configure

hem.

One notable example is the Folder Optionspreference item. At the user level, this settingallows you to configure the Windows Explorer file browsing attributes. For instance, instead of

he default Hide Extensions, you could make extensions visible.

Another great feature of the Preferences interface is that the options are laid out in a fashion

similar to what you would see on the screen itself. Instead of just looking at a bland list of

options, you actually experience the settings in a familiar layout.

Mapping Drives


9/17


10/17


https://skillpipe.courseware-marketplace.com/reader/en-GB/Book/BookPrintView/b6175ac1-149e-4f52-83bd-6350c9133320?ChapterNumber=14&FontSiz 10/17

igure 311: Common Settings

The Commontab of the Properties sheet for each preference setting contains additional

options for the Preference item. Some of these options enable a more powerful application of

he preference setting.

One of these options, however, should be used with care. The Remove this item when it is

o longer appliedsetting is not the same as reverting standard Group Policy settings back to

he previous value. In this case, the item is removed completely. There is no previous setting;

he value is just deleted. This may be fine in the case of a desktop shortcut that is no longer

eeded.

owever, this could be a problem with values such as registry keys or service settings.

The following topic describes item-level targeting, item-by-item filtering on which computer orser should get a setting,

Item-Level Targeting


11/17



igure 312: Item-Level Targeting

One of the best features of the Group Policy Preferences section is the ability to perform item-

y-item filtering on which computer or user should get the setting. With standard Group Policy

iltering, a WMI query must be created and applied to the entire GPO, not just one setting.

This option provides a granularity that simply does not exist anywhere else in Group Policy. In

addition, the item-level restrictions are easy to create, and do not require any knowledge of

MI or SQL-type syntax. It is simply a process of clicking through a series of drop-down

lists.

cronyms

The following acronyms are used in this section:

UN dial-up networking

GPO Group Policy Object

SV independent software vendor

ODBC Open Database Connectivity

SP1 Service Pack 1

SQL Structured Query LanguageBScript Visual Basic Scripting Edition

PN virtual private network


12/17



MI Windows Management Instrumentation

Section Review

Summary

Group Policy Preferences allow administrators to configure a broad array of settings, which

were previously available only through logon scripts based on batch files or VBScript.

The following table compares Preferences and Policy settings.

Feature Policies Preferences

Enforcement of

settings User cannot change settings.

User can change preferences.

Settings are refreshed regularly.

Refresh is optional.

Ease ofadministration

New settings require editing of

administrative templates.

New settings can be imported or

created.

Files and folders File and folder management is not

possible.

New files and folders can be

created.

Existing files can be modified.

Application Settings are temporary.

Policy removal reverts settings.

Preferences are permanent.

Policy removal does not revert

preferences.

Filtering WMI queries for filtering. Granular targeting is built in.

In the Group Policy Management Console, the Computer Configurationsection, you can


13/17



configure these settings:

Network Shares

Services

In the Computer Configurationsection, you can configure these settings:

Applications

Drive Maps

Internet Settings

Start Menu

The following table describes the Windows Group Policy Preferences settings.

Setting Description

Applications Extensible for ISVs to create simple Group Policy preference settings for their applications.

Drive Maps Create, modify, or delete mapped drives

Environment Create, modify, or delete environment variables

Files Copy, modify the attributes of, replace, or delete files

Folders Create, modify, or delete folders

Ini Files Modify .inior .inffiles

Registry Copy registry settings to other computers and create, replace, or delete registry settings

Network Shares Create, modify, or remove shares

Shortcuts Create, modify, or delete shortcuts

The following table describes the Control Panel Group Policy Preferences settings.

Setting Description

Data Sources Manage ODBC connections


14/17



Devices Manage device drivers

Folder Options Configure folder options and file extension associations

Internet Settings Manage Windows Internet Explorer settings

Local Users and Groups Create, modify, or delete local users and groups

Network Options Manage VPN and DUN connections

Power Options Configure power management settings

Printers Manage printer connections

Regional Options Modify regional settings

Scheduled Tasks Manage scheduled tasks

Services Manage service behavior

Start Menu Configure Startmenu settings

The advanced configuration options are available on the Commontab of the Properties

sheet for each preference setting. Some of the options that are common to all GPO

Preferences are:

Error handling

Security context

Item removal

Reapplication

Item-level targeting

nowledge Check

1. What are the differences between GPO Policies and GPO Preferences? (Choose all that

apply.)

a. Preferences are not enforced.

b. Preferences do not revert when the policy is removed.


15/17



c. Preferences targeting requires a WMI query.

d. Preferences allow you to create or modify folders and files.

2. What is the purpose of Group Policy Preferences?

3. Which of the following settings are located in the Computer Configurationsection ofthe Group Policy Management Console? (Choose all that apply.)

a. Start Menu

b. Drive Maps

c. Applications

d. Services

. List the advanced Preferences configuration options that are common to all items in

Group Policy.

5. Describe each of the following Group Policy Preferences settings.

Registry:

Drive Maps:

Folder Options:

Network Options:

Knowledge Check Answer Key

The correct answers to the Knowledge Check questions are bolded.

1. What are the differences between GPO Policies and GPO Preferences? (Choose all that

apply.)

a. Preferences are not enforced.

b. Preferences do not revert when the policy is removed.


16/17



c. Preferences targeting requires a WMI query.

d. Preferences allow you to create or modify folders and files.

2. What is the purpose of Group Policy Preferences?

Group Policy Preferences allow administrators to configure a broad array of

settings, which were previously available only through logon scripts based on

batch files or VBScript.

3. Which of the following settings are located in the Computer Configuration section of the

Group Policy Management Console? (Choose all that apply.)

a. Start Menu

b. Drive Maps

c. Applications

d. Services

. List the advanced Preferences configuration options that are common to all items in

Group Policy.

Error handling

Security context

Item removal

Reapplication

Item-level targeting

5. Describe each of the following Group Policy Preferences settings.

Registry: Copy registry settings to other computers and create, replace, or delete

registry settings

Drive Maps: Create, modify, or delete mapped drives

Folder Options: Configure folder options and file extension associations


17/17

13 Configuring Group Policy Preferences

Documents

Transcript of 13 Configuring Group Policy Preferences