Avatar of TITG
TITG asked on

Help with GPOs

I migrated from SBS 2003 to 2k3 standard and separate exchange&etc old server is gone and all working one thing i haven't completed is GPO I only modified one of the GPOs for my documents redirection for everyone with the current server name instead of the older SBS name but there are bunch of GPOs not sure if they are even used or not Im not so familiar with GPO SBS got the management console to enable/disable stuff, push software install&etc it was handy is there is a software I can use to clean unused GPO, push software install, exclude the Administrator from users GPO&etc  
Windows Server 2003

Avatar of undefined
Last Comment
PeteJThomas

8/22/2022 - Mon
ashleyknowles86

GPO's are applied to OU's in Active Directory. If you separate your user accounts from admin accounts by putting them in different OU's, then you can set different GPO's on the OU's.

As for unused GPO's, you only *need* the Default Domain Policy and Default Domain Controller Policy. You can remove any other policies if you so wish and re-create them. If you want to find out if they are being used or not, used the Group Policy Management Console to see if there are any GPO objects not linked to any OU's. Alternatively, if you have any empty OU's with GPO's applied, then that would suggest it isn't being used.

You can push software installations by adding software packages to a GPO and applying it to an OU with a subset of users inside of it.
ASKER
TITG

ok...i meant something easy to manager than the windows interface for GPOs : )
Net_Worker

The group policy management console is what you want not just from the properties tab but the actual MMC snapin. You can also use the resultant set of policy snapin. These tools allow you to easily do what you want. You can view which policies are being used by which containers and also see which settings have been altered without having to go through each individual setting.
Experts Exchange is like having an extremely knowledgeable team sitting and waiting for your call. Couldn't do my job half as well as I do without it!
James Murphy
ASKER
TITG

Any screen shots or link for a start
Thank You

Net_Worker

If its not in Administrative tools already, open MMC and click Add then select Group Policy Management Console and/or RSoP. To open MMC simply type mmc into the RUN dialoge box from the start menu.
Net_Worker

I found a good link with screen shots.

http://www.windowsecurity.com/articles/Group-Policy-Management-Console.html

Good luck.
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
PeteJThomas

If needs be, it can also be downloaded here - http://www.microsoft.com/downloads/details.aspx?FamilyId=0A6D4C24-8CBD-4B35-9272-DD3CBFC81887&displaylang=en

You can also install this http://www.microsoft.com/downloads/details.aspx?FamilyID=c16ae515-c8f4-47ef-a1e4-a8dcbacff8e3&DisplayLang=en (adminpak), and if you install both to your laptop/PC, you manage Active Directory and Group Policy from your own machine...

(of course, only if you don't already have these things... :)

Pete
ASKER
TITG

http://img213.imageshack.us/img213/1562/gpoqc7.jpg totally brain washed here...need opinion/help and would someone be patients please...Im understanding GPO concept and how simple it can make my day simple but if you guys can put me quick on track to get this taking care of I would really appreciate it so before when it we had SBS I doubled the polices over again because someone told me it I mess up I wouldnt want to mess up with the default policies& and I end up not using none of them : ). Im managing this from exchange since the DC is 64bit and GPO management console cant run it&so before I do anything& Im trying to exclude the main domain Administrator from any policies that is what it should be? There is a blue check mark on the right side why do I have that? Current default lock policy applies only to the Admins which is fine how can I apply it to the users? For XP SP3 instead of going to the user desktop or laptop how can I puch install from GPO?
Net_Worker

You should generally not mess with the default policies. Instead create your own set of policies and apply then as you need to. If you don't want Administrator to be bound by policies you would need to move that user account out of the OU where the policy is applied. You create a new OU and place the users into that then apply the policy to the OU where all users are now located. To push XP SP3 you have a few options you either use WSUS server, create a software package and force install it using policies, or you could use a login script. The login script would take quite a bit of work and testing. The wsus option is by far the easiest if you have a large number of PC's to get to.
I started with Experts Exchange in 2004 and it's been a mainstay of my professional computing life since. It helped me launch a career as a programmer / Oracle data analyst
William Peck
ASKER
TITG

Sorry guys& I Still need help with the current setup I got in the image above& how can I exclude Administrator from GPO and how can I make our copied policy the default policy to use instead of using the defaults

PeteJThomas

Your domain administrator account should be in the built-in 'Users' container, as no GPO will apply to this container... Or, if you have you domain admin (or even just normal admin accounts) in a separate OU, you can use the 'block inheritance' option within the GPMC to stop any policies from applying to that OU (unless they are applied directly to that OU).

I think what Net Worker was saying is that the default policies should be left in place - You can modify the settings of this policy (i.e. make changes to it like number of incorrect password attempts before lockout etc) but you shouldn't really ADD additional settings to it or remove settings from it. Then you apply separate GPOs to accomplish any other configuration changes you want to take effect.

Are you with me so far?
PeteJThomas

For example, see the attached image of my AD layout... (all references to company name etc have been blanked out).

See the 2 containers I have highlighted in red. These are 2 of the built-in containers that are there in any AD implementation. Any containers (except OUs, which can be identified by the little 'AD book' symbol within the folder icon next to them) cannot have GPOs applied to them.

So any admin accounts can be placed within the Users container and will not have ANY GPO applied to them...

Let me know if you're following me or if I'm losing you anywhere in particular... :)
AD.jpg
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
ASKER
TITG

Feel like total stupid in GPO stuff&from AD users and computers I right clicked on the domain, created a new OU, right clicked it properties, check on block policy inheritance and move my two users in it to exclude GPO on the OU that I created I still have the yellow book in it? Meaning GPO still applied?


PeteJThomas

No - that book just shows you that it's a particular type of container (called an OU) to which Group Policy CAN still apply...

If you have blocked inheritance (you can see this in the Group Policy Management Console - The OU should be marked with a blue exclamation mark) then no GPO will be INHERITED.

Remember, that blocking inheritance will not take effect on any OUs that have GPOs applied directly to them. So if you don't have any GPOs applied to that particular OU, then it won't inherit any either, meaning no GPO will be applied.

So in summary, what you've done will work (provided no GPO is applied directly to that OU!) :)
ASKER
TITG

Okay... in group policy management when I click on the OU I just created on the right side under group policy inheritance I got two GPO one small business folder redirection (I need it for the users) but not the OU I created and default domain policy how can I remove them from this OU? I linked an image too
All of life is about relationships, and EE has made a viirtual community a real community. It lifts everyone's boat
William Peck
ASKER
TITG

sorry here
GPO.jpg
PeteJThomas

The reason for these 2 GPOs still being applied is because they are 'enforced' GPOs. Enforced GPOs override the block inheritance option.

You would need to 'un-enforce' these 2 GPOs to stop them from over riding the block inheritance flag.

(the main reason for using enforced GPOs is to ensure that the GPOs which are enforced override any other GPOs that have conflicting settings).

There are other ways of achieving the same goals, but if you're comfortable with this method so far, then that is what you would need to do. :)

Please say if I'm not explaining anything properly, and I'll try to be more clear.

Cheers,

Pete
ASKER
TITG

Unchecked enforced... now they are gone from OU I created can I add the domain administrator to the OU I created? Its now with the users OU all the previous SBS server GPOs apply to him... etc I still need to clean up GPOs...etc also the lockout policy that we have by default its apply to the Admins group how can I apply it to users as well?
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
ASKER
TITG

here is what i mean
GPO.jpg
PeteJThomas

As far as I remember (I've left work now so I can't say for sure!) the domain admins account is usually located in the Users Container (as in the picture I posted earlier? It's NOT an OU) in which case no GPO of any kind will apply to it anyway.

In fact when viewing through the GPMC, you will not even see the containers I'm talking about at all (because no GPO can apply to them it would be pointless to even see them through the GPO console) - That is where I advise you keep the domain admins account anyway.

As for your second question - Are you sure it's only applying to the admins group? The default domain policy would normally be linked at the Domain Level and would therefore apply to ALL OUs (therefore all user objects, and computer objects etc) in your entire domain...

I'm afraid I can't see what you mean from that pic... It's a tad small, can you explain it again in a different way perhaps? Show me where the links are for your domain (basically an expanded view of the GPMC?)
ASKER
TITG

Well now on the DC after I created this OU I can't see what is in it or access it I got the error I attached? But I see the changes on the exchange box no prob and exchange is a member server not a DC we only got 1 DC but I use Group Policy Management Console from another 32bit 2k3 because our DC is 64bit and its not compatible with 64bit



GPO.jpg
Your help has saved me hundreds of hours of internet surfing.
fblack61
PeteJThomas

Hi, can't say I've seen that one before, but if the error is telling the truth, then all should be OK now...

Can you check and let me know?

Pete
ASKER
TITG

working now...
The current GPOs i got now "pic from the first post" i copied the default ones i renamed them how can i have the one i copied the active one? I don't see this policy but admins after 15 min or so PC get locked how can i apply this to the users too incase someone walk away for a while from their PC?
Thanks
PeteJThomas

I'm sorry, I don't really understand?

The policies are assigned through the OUs or Domains they are 'linked' to (done through the GPMC) - If you've created a policy, but it's not active, then you need to 'link' it to something (if you link to your domain then it will apply to ALL users AND computers in that domain). If you need an explanation on how to do that then let me know.

If you have a policy that locks users workstations after 15mins of idle time, but it's only effecting a small group of people, then chances are that it's not linked in the right place - e.g. It's linked directly to an OU that only contains those few accounts - If you want it to effect EVERYONE, then the GPO that has that setting would need to be linked at the domain level instead.

Does that make sense?

Pete
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
ASKER
TITG

yes... I'm using GPMC under the domain I'm seeing 7 policies, default domain policy,SBS client computer....etc where can i tell who is it applied/linked to?
PeteJThomas

Ok, I'm at home again now so if you want screenshots it will have to wait til tomorrow...

But as an explanation - If you open GPMC, you can see a structure very similar to Active Directory - As you expand the domain and the OUs within it, you can see what look like 'shortcut' icons.

So for example, directly beneath your domain, you should see 'Default Domain Policy' with the little shortcut arrow next to it - This shows you that the Default Domain Policy is 'linked' to the domain itself, and will therefore apply to all user and computer objects in the domain (except for the ones that are blocking inheritance etc).

If ALL of your GPOs are linked in that same place, then they should ALL be applying to the entire domain. However if you cannot see any, then none of your GPOs are linked. So if you expand everything in GPMC, you should be able to see where all the links are, and therefore which GPOs are linked to which OU's etc.

An example of the 'shortcut' symbol I'm talking about is attached...
Shortcut.jpg
ASKER
TITG

Pete...info is great i got the concept of GPOs ...but i still can't find the policy that lock computer in 15 min and it's only applied for the Admins can i get one more help

Thanks
This is the best money I have ever spent. I cannot not tell you how many times these folks have saved my bacon. I learn so much from the contributors.
rwheeler23
PeteJThomas

You can't do this directly as you want to, however you can do it using Screensaver options in a GPO.

In a new/existing GPO, go to User Configuration -> Administrative Templates -> Control Panel -> Display, and enable the following settings -

Activate screen saver: Enabled
Screen saver executable name: Enabled (Enter the FULL path to the screensaver file)
Password protect the screen saver: Enabled
Screen Saver timeout: Enabled (15)

This should be applied at a domain level if you want it to effect ALL users, and will mean that after 15mins of idle time, the screen saver will kick in, and when the user returns to the PC and either moves the mouse or presses any key, they will be prompted for their domain password before they can get back in.

I believe that is the only way to accomplish what you're trying to do!

Any further questions, just ask... :)

Pete

The downside is that you have to find a generic screensaver (if you have a company screensaver anywhere, this would be ideal, if not, some people just choose one of the text screensavers and just have the company name bouncing around the screen)
ASKER
TITG

got it... The policies under the domain apply to every1& I created an OU add it TS server in it to create some GPOs for that server some the domain level GPOs I dont want it to apply to this OU how can I do that tho?
 
ASKER CERTIFIED SOLUTION
PeteJThomas

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
See how we're fighting big data
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question