Overview - CionSystems€¦ · Web viewWindows Server 2003 Service Pack 2, Windows Server 2003 R2,...

Group Policy ManagerHelp Guide

Software version 4.0.0.0

General Information: [email protected] Support: [email protected]

Copyright © CionSystems Inc., All Rights Reserved

mailto:[email protected]

mailto:[email protected]

© CionSystems Inc. ALL RIGHTS RESERVED.

This guide may not be reproduced or transmitted in part or in whole by any means, electronic or mechanical,

including photocopying and recording for any purpose other than the purchaser's use under the licensing

agreement, without the written permission of CionSystems Inc.

The software application in this guide is provided under a software license (EULA) or non-disclosure

agreement. This product may only be used in accordance with the terms of the applicable licensing

agreement.

This guide contains proprietary information protected by copyright. For questions regarding the use of this

material and product, contact us at:

CionSystems Inc.

6640 185th Ave NE

Redmond, WA-98052, USA

http://www.CionSystems.com

Phone: +1.425.605.5325

Trademarks

CionSystems, CionSystems Inc., the CionSystems Inc. logo, CionSystems Group Policy Manager (GPO Manager)

are trademarks of CionSystems. Other trademarks and registered trademarks used in this guide are property

of their respective owners.


http://www.CionSystems.com/

Contents

Overview...............................................................................................................................................................5

System Requirements...........................................................................................................................................6

Backup Repository (Storage Method)...................................................................................................................7

Installation............................................................................................................................................................7

Configuring the Application..................................................................................................................................7

Step-By-Step Walkthrough...................................................................................................................................9

Add GPO to versioning......................................................................................................................................9

To add a GPO for version..................................................................................................................................9

Check Out and Edit GPOs................................................................................................................................10

To check out a GPO.........................................................................................................................................10

To edit a GPO..................................................................................................................................................10

To check in and request approval...................................................................................................................10

Features..............................................................................................................................................................11

Configuring Role Based Delegation.....................................................................................................................11

Delegate..........................................................................................................................................................12

Removing Delegated Permissions...................................................................................................................14

Scheduling:.........................................................................................................................................................14

Configuring Workflow.........................................................................................................................................15

Stages of Workflow.....................................................................................................................................16

Configure........................................................................................................................................................16

Configure SMTP settings for Mail notifications...............................................................................................17

Adding Approvers...........................................................................................................................................18

Adding Executors............................................................................................................................................19


To Create a Request........................................................................................................................................20

Request to Modify GPO..................................................................................................................................24

Creating GPO’s from Migration Table.................................................................................................................27

Troubleshooting:.................................................................................................................................................29


OverviewGroup Policy allows users administrators to implement specific configurations for users and computers. Group Policy settings are contained in Group Policy objects (GPOs), which are linked to the following Active Directory service containers: sites, domains, or organizational units (OUs). The settings within GPOs are then evaluated by the affected targets, using the hierarchical nature of Active Directory. By using Group Policy, users can define the state of someone’s work environment once, then rely on Windows Server 2000/2003/2008 to continually force the Group Policy settings applied across an entire organization or to specific groups of people and computers.

As security issues are becoming paramount within any organizations. Within Active Directory (AD), the Group Policy Objects (GPOs) are at the forefront of an organization's ability to roll out and control functional security. Core aspects of user life cycle such as password policies, logon hours, software distribution, and other critical security settings are handled through GPOs. It is paramount for Organizations to have proper methods to control the settings of these GPOs and to deploy GPOs in a meaningful and safe manner with confidence, easily backup and restore GPOs when they are either incorrectly updated or corrupt.

Windows Group Policy is powerful and allows user centralized management. However, uncontrolled and unintentional changes can have disastrous consequences. For example, unintended effects of a GPO change could stop hundreds of users from logging on, exclude access to critical software applications, or expose system settings. The Group Policy Management Console (GPMC) from Microsoft is a useful tool for the individual administrator, but additional functionality—such as GPO workflow management, check in/check out, change control, backup/restore, reports and rollback—is needed to effectively manage GPOs across the enterprise.

CionSystems GPO Manager offers a mechanism to control this highly important component of Active Directory. GPOs, Scope of Management links, and WMI filters are backed up in a secure, distributed manner and then placed under version control. GPO Manager offers following benefits and more:

o Gives Active Directory administrators and security personnel control of GPO changes, to eliminate system outages and security exposures

o Allows administrators to edit and test GPOs and have them approved before they are deployed

o Provides a way to quickly roll back changes

o Archives all GPO settings

o Leverages, complements and extends native Microsoft technology, including Group Policy Management Console (GPMC), to strengthen infrastructure investments


System Requirements

CionSystems GPO Manager needs:

2 GHz processor

4 GB RAM or greater

100 MB hard disk space

Windows Server 2003 Service Pack 2, Windows Server 2003 R2, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012/ 2012R2,Windows Server 2016, Windows 8 or Windows 7 operating systems

MMC 3.0

.NET Framework 3.5 and 4.0

• Microsoft Group Policy Management Console with Service Pack 1 or Remote Server Administration Tools• System must be domain joined


Backup Repository (Storage Method)

You have the option of choose the following for the location of the physical backup copy of the object versions and other configuration:

A network share for the majority of deployments, network share is the best approach as it provides a high performance backup store with a minimum of configuration and maintenance overhead.

InstallationSee quick start guide “GPOManager_quickstart_guide.pdf”

Configuring the ApplicationInstall the CionSystems GPO Manager. Open the application by double clicking on the GPO Manager icon from the desktop. Click on Configuration tab and then click on Connect.

We can configure the domain credentials in two ways:

Using Credentials tab or by using Add Credential Manually tab.

1. If the system is domain joined then in Credentials tab we will get domain name automatically. Enter UserName(domain user name) and Password and click on Show button, it will display the list of domain controllers, select One Domain controller as Primary.


2. Through Add Credential Manually option we can configure the domain credentials manually. Here we need to enter domain controller name, domain name, domain user name and password details. After that click on Show button, it will display the list of domain controllers, select One Domain controller as Primary.

Next, Select the Repository Location tab. Select Network location so that it can be accessible from any system joined in the same domain as managed GPO’s. Ensure this is a file share and all users of the application have read and write privilege to the shared folder.

Note:1.If you installed the application on other Systems that was joined in Domain (If application is installed on a Domain controller and Repository location is already defined) click on “Fetch Repository Location” button in Repository location. The Application will show the repository location from the previous installs.

2. If you installed the application on other Systems that was joined in Domain, The user which is use to login to CionSystems GPO Manager must be in “Domain Admins” Group and must be added into Local Administrators group to the local machine.


Select Audit Path Location, GPOs Workflow audit data will be saved in this location in the form of XML.

Next, Select the Backup/Restore Location tab, select the location for backup and restore of GPOs.

Click on Submit button.

Step-By-Step WalkthroughThis step-by-step walkthrough takes you through CionSystems GPO Manager Scenario that includes the following: Connect to the Version Repository Registering an object/GPO, by attempting to edit Check out and edit an object Check in the object and request approval. CionSystems GPO Manager provides roles that enable users to perform

actions within the GPO Manager workspace. The following scenario is created on the assumption that the administrator has already delegated the User and Moderator roles to the required users.


To view the roles applied to a specific container, right-click it, select Properties, and click the Security tab.For complete information on how to create and delegate roles, see “Configuring Role-based Delegation” in this guide.

Add GPO to versioningInitially all GPOs are unregistered. To add GPOs to the Version Control system, they must be first open for edit and saved. This process forces the system to register the GPO in version control and maintain their GPO status (User and Computer settings enabled or disabled), links, security, and WMI filters.

To add a GPO for versiono Expand CionSystems GPO Manager, ensure under configuration, the connect, The Repository location

and the Backup and Restore location are defined. Now select the GPO, right click and Edit and close the editor.

o Once objects have been added, they are located in the selected container under the versioning with their initial version number set to 1.0. They are now available to be checked out and edited.

Check Out and Edit GPOs

Before users can edit registered GPOs, the GPOs must be checked out.

The workflow is as follows:

Check out the GPO from the system,

make the required edits, and

Check in the changes to the system.

Version information is updated in the system’s history when the GPO is checked back in. Only one person within the system can check out and work on any GPO at a given time.

Checking out a GPO for the first time creates a copy of the original GPO. The copy is an exact duplicate of the original GPO until it passes through the approval process.

To check out a GPOo Expand the GPO Manager Work space and select the available GPO. o Right-click a GPO and select checkout. o Enter a comment and click OK.

Once you have a GPO checked out, you can edit the settings from the Group Policy Management Editor as well as edit the Security and WMI Filter settings. When you check out a GPO, the changes are made to a copy of the live GPO. Those changes do not affect the GPO settings on the network until the changes are checked in and deployed.

To edit a GPOo Right-click a checked out GPO and select Edit.o Click Launch Editor and make the required changes.


o If required, select the Security tab and click Add or Remove to modify the current security filter. Enter or search for the required user, computer, or group, and click OK.

o Click the Advanced button to select advanced permissions.o To add or remove a WMI filter, select the WMI Filter tab and choose a filter from the list of available

WMI filters. Click OK.You now have the option to check in the GPO to be stored for later use or check in and request approval of the changes.

To check in and request approval Expand the Version Control Root node and select the checked out GPO.

Right-click and select Check In.

Enter a comment and click OK.

Right-click the GPO and select Request Approval.

Enter a comment and click OK.

The GPO status will be Pending Approval until the changes are approved or rejected by a user with the appropriate permissions. When the GPO has been approved it is ready to be deployed into the live environment.

Features

Version Comparisons: Quickly verify setting consistency and improve GPO auditing with advanced, side-by-side GPO version comparisons at different intervals.

Enhanced Group Policy Comparison and side-by-side two distinct GPO’S, two Versions and with Existing GPO with a Checkout copy GPO comparisons to verify setting consistency.

GPO history and Compare: to record all changes to GPO’s Delete version history: to manage and reduce size of backup store Undo GPO changes: Rolled back to previous versions. Approval-based workflow: process to ensure that changes adhere to change management best practices before

their deployment. Configure workflow: to enable organizational requirements and set for specified users or groups on edit

settings, cloak and uncloak and lock and unlock. Workflow Commenting: Track the request, review and approval process with comments and e-mail notifications

at any stage. Scheduling: Enable approved changes to be implemented immediately or on a schedule. Microsoft Group Policy Management Console (GPMC) for familiar look and feel. Cloaking: Hidden pre-production GPS from all but selected administrators. GPO check-in and check-out to prevent simultaneous editing conflicts. GPO locking: to prevent unwanted changes to product GPOs. Backup and Restore: Schedules the ALL GPO’s Backup or selected GPO’s to be taken at a specified date and time Delegation and permissions management: Delegates or provide Read, Edit, Apply Permissions on GPO to Users Day to Day task : Perform common GPO Actions/Tasks like Create , Edit, Delete, Link, Rename ,Backup, Import,

Restore GPO, add comments to GPO, View, Enable, Disable Manage security: Apply Filters to GPO Copy /Paste : Create a duplicate GPO with same settings Reports: Creates Report of all GPO’S at a specified Location.


Advance Categorizing: Easily find GPOS that are Linked, Unlinked, Orphaned, Disabled, Deleted etc. Replication: To replicate the data among the Available domain controllers Delegation: To grant Permission for Users to create GPO. To Apply WMI Filter. Grant Permission on All GPO’s: To grant permission for users on all GPO’s to read, Edit, delete.

Configuring Role Based Delegation

You can manage permission of Group Policy Objects container for a given domain using GPO Manager Delegation.

With GPO Manager Delegation the following Permissions can be delegated:

GPO Create Permission WMI Permissions SOM Permissions

GPO Create Permission: The ability to grant users permissions to create GPOs

WMI Permission: The ability to grant users permissions to create and Edit WMI Filters

SOM Permissions: The ability to link GPOs to a SOM, The ability to perform Group Policy Modeling analyses for objects in that SOM, The ability to collect Group Policy Results data for objects in that SOM.

Delegate Click On More > Delegation

Note: More option available only for the administrator and the domain user who have administrator privileges (user must be in “Administrators” group).


Delegation Window will be opened

Click on Add to add Users to Delegate Permissions

Select Users and Press Ok


Provide the Appropriate Permissions on selected Users and Press Apply/OK to Finish Delegation

Removing Delegated Permissions

Select the Delegated Permissions and Click on Remove and Press Apply/Ok to Finish the Task.


Scheduling:While Scheduling GPO backup or scheduling create / modify / delete GPO, before going to schedule, we need to perform the following settings.

If the machine is client machine (Windows 7/8/10):

Go to start >Run >Type Services.msc> Services window will be open > Select GPOManagerService, check if its Log On As value set to Local System. If so, right click on Service >Go to Properties>Click on Logon tab >Deselect Local System account radio button and select This account radio button >Enter the administrator or domain-user with admin privileges credentials >click on Apply > finally click on OK.

Configuring Workflow

A workflow is a sequence of inter connected steps that carry out a process based task. A typical workflow contains three stages.

Requester -->Approver --> Executor

Administrators have flexibility and choose the relevant steps for their enterprise. Not all enterprise might require all stages of the workflow. In addition, disable the workflow if need be. Tasks that are waiting in stages are immediately notified to the right group via email.


Stages of Workflow

Initially request is created by the requester.

Requester is that one who raises a request for a particular action.

The request will come to the approver stage,

Who has the authority to finalize an action?

After getting the approval then the request goes to the Executor.

Executor is that one who executes the approved action.

ConfigureOpen GPMC application. Click on Configuration>Configure WorkFlow


Requester and approver are default roles for an organization. If you want to configure Executor in the Organization select Executor and click on save. If Executor is not configured in the workflow then Approver automatically becomes the Executor.

Configure SMTP settings for Mail notificationsConfigure the SMTP settings to receive notifications for pending or upon completion of a pending work items.

When a request is Created, Mail will be sent to Requester and Approver When a request is Approved, Mail will be sent to Requester and Executor When a request is Executed, Mail will be sent to Requester and Executor When a request is Rejected mail will be sent to Requester

Note: To disable the workflow select Disable Workflow and click on save

Adding ApproversClick on Show Approvers, it will show all the currently configured Approvers.

Click on Add to add approvers.


Select a user and Click on OK To Remove Approvers select a configured Approver and Click on Remove

Adding ExecutorsClick on Show Executors. Action will show all currently configured Executors.

Click on Add to add new Executors

Select a user from the list and Click on OK To Remove Executors select an Executor and Click on Remove

To Create a RequestLogin with User and click on Create GPO. Enter GPO Details and click on create. Now a Request will be created for the Creation of GPO and will go for approver’s approval.


Now login with Approver’s credentials.

Click on Workflow, click on “Requests to Create GPO”. It will show all the requests created by Users.


Select on GPO click on Approve. After Approval it will go to Executor stage Approver can reject the Request

Now login With Executor.

Click on Workflow, click on “Requests to create to GPO”


Select a GPO click on Execute. Now the Request will be Executed and GPO will be Created. If you schedule it, click on schedule, enter the date and time click on ok.

At the Scheduled time GPO will be created.

Request to Modify GPOLogin with User, select the GPO to modify, right click and click on Edit, do the required modifications. GPO status will be changed to CheckedOut. Now select the GPO, right click and click on CheckIn, enter the comments and click on Submit.Message with text “Request created successfully” will be displayed.

Now a Request will be created for the Modify GPO and will go for approver’s approval.


Now login with Approver’s credentials, Click on Workflow, click on “Requests to Modify GPO”

It will show all the requests created by Users.

Select on GPO click on Approve. After Approval it will go to Executor stage Approver can reject the Request Now login With Executor and click on Workflow, click on “Requests to Modify GPO”

Select a GPO click on Execute. Now the Request will be executed and GPO will be modified. To verify the modifications, login with user, select and right click on modified GPO , click on View option, a report will be generated, click on Show all link to see all the information about GPO. (Here we changed Audit policy, In the below figure you can see the changed audit policy settings).


Follow the same procedure for “Request to Delete GPO”.

Creating GPO’s from Migration TableUsing CionSystems GPO Manager, administrators can migrate GPO’s from one domain to another new domain. This is a very powerful feature if you are looking to migrate GPO’s and doesn’t want to recreate these GPO’s in the new domain.

Open CionSystems GPO Manager

Connect with Domain administrator credentials

Click on More, click on Export Migration Data


Enter Migration Template name and Browse Path to store the file

Use the Exclude Permissions option so that policy-related permissions are not included in XML file

Click on save. All GPO’s along with the settings will be stored in a XML at the provided location.

Now copy the Migration Data on a system that is joined in the new domain or a Domain control of the new domain

Click on More, click on Import Migration Data, click on Browse and select the XML file form the Migration Data which you stored and click on Migrate


Specify the Exclude Settings to ignore the GPO templates specified in the XML.

Specify the Exclude Permissions to ignore the permissions on scopes of management (SOMs) and on GPOs. Default permissions will be used instead

Troubleshooting:1. Reference Memory Exception in Windows2003

The following memory reference exception will be raised at the end of exporting and importing migration report successfully in Windows 2003. This is because of script incompatibility of with Windows 2003 OS. It is NOT an issue. You can ignore it.

2. Trusted domains are not showing in GPO manager:

GPO manager is a standalone GPMC snap-in. It can be installed on any Domain joined machine as well as on Server machine which is part of a Domain. So, GPO manager will list only the Domain in which local machine is joined.

3. In Permissions Dialog box, Already assigned permission to users on All GPO are not showing:

Due to performance issue, currently it will show users list only when Permission is assigned to users on all GPOs as long as Dialog is open. Once the dialog is closed, Previous Users will not be listed again.


4. GPO Manager is not opening on 64 bit Window 7 and Windows 8 machine:

There is a problem with 32bit GPMC supplied by Microsoft with Windows 7 and Windows 8 for 64bit version of Operating System.

5. In the Link GPO dialog box, the OU picker is not showing already linked OU to currently selected GPO:

OU picker is one directional picker. It will only list all available OUs in current domain as tree structure with check boxes where user can select the OUs to link currently selected GPO. Once currently selected GPO is linked with selected OUs, all OUs will be added to parent (Link GPO) dialog box. Where user can delete already linked OUs from the list.

6. While editing selected GPO, selection to current GPO is losing being in sorted mode list of GPO:

After click on edit to selected GPO, a flag column which is showing checkout is must be refreshed to reflect the changes. So, grid is refreshing. Once grid is refreshed, earlier sorting will also be reset to default and selection current GPO being editing will be lost.7. When selecting Domain Node (root node) in GPMC on Windows 2012 machine, GPMC is crashing after installing GPO manager:

There is a problem with GPMC on Windows 2012 machine, it is better NOT to select Domain root node after installing GPO Manager while using Snap-in. To see child objects inside Domain tree, just click on expand icon, left to Domain root node instead of selecting node. GPMC will NOT be crashing while selecting any child objects inside Domain root node.

8. When changing GPO settings by restoring from versions backups, showing GPO is restore successfully but GPO setting is not restored:

Microsoft library GPMGMTLib’s method will NOT throwing any exception while apply Old GPO version to current GPO for Normal Domain User. If user has right permissions to restore GPO setting from version backup, this feature will work fine.

9. While closing the GPO edit window, GPMC is hiding:

While editing GPO in GPO manager Snap-in, if other application already opened then in background then GPMC will loss the focus to background application once GPO editor is closed. To avoid this problem close all background application while using GPO Manager Snap-in or switch application to bring in focus.


Contact Notes:

For technical support or feature requests, please contact us at [email protected] 425.605.5325

For sales or other business inquiries, we can be reached at [email protected] 425.605.5325

If you’d like to view a complete list of our Active Directory Management solutions, please visit us online at www.CionSystems.co m

Disclaimer

The information in this document is provided in connection with CionSystems products. No license, express or implied, to any intellectual property right is granted by this document or in connection with the sale of CionSystems products. EXCEPT AS SET FORTH IN CIONSYSTEMS’ LICENSE AGREEMENT FOR THIS PRODUCT, CIONSYSTEMS INC. ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL CIONSYSTEMS INC. BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF CIONSYSTEMS INC. HAS BEEN ADVISED IN WRITING OF THE POSSIBILITY OF SUCH DAMAGES. CionSystems may update this document or the software application without notice.

CionSystems Inc.

6640 185th Ave NE,

Redmond, WA-98052, USA

www.CionSystems.com

Ph: +1.425.605.5325

This guide is provided for informational purposes only, and the contents may not be reproduced or transmitted in any form or by any means without our written permission.


http://www.CionSystems.com/

Overview - CionSystems€¦ · Web viewWindows Server 2003 Service Pack 2, Windows Server 2003 R2,...

Documents

Transcript of Overview - CionSystems€¦ · Web viewWindows Server 2003 Service Pack 2, Windows Server 2003 R2,...