Basic policies Windows 2008, best practises.

janhoedt
janhoedt used Ask the Experts™
on
Hi,

I'm looking for really short structure & best practises guide for applying policies Windows 2008.

Reason: I want to apply regional settings and keyboard layout to some machines and see several different ways to do this: import registry, use adm-file (why doing this and not registry), predefined registry keys (for regional settings some are greyed out, no idea why).

Please advise, if you can give input on regional settings & keyboard also, it would come in handy.
J.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Best Practices Analyzer (BPA) is a server management tool that is available in Windows Server® 2008 R2. BPA can help administrators reduce best practice violations by scanning one or more roles that are installed on Windows Server 2008 R2, and reporting best practice violations to the administrator. Administrators can filter or exclude results from BPA reports that they do not have to see. Administrators can also perform BPA tasks by using either the Server Manager GUI, or Windows PowerShell cmdlets.

Best Practices Analyzer

BPA is installed by default on all editions of Windows Server 2008 R2 except the Server Core installation option.

for more info..
http://technet.microsoft.com/en-us/library/dd759260.aspx

Author

Commented:
Sorry, appreciate the input, but this has nothing to do with my questons regarding policies.
Commented:
In general settings made by "Microsoft Supplied" Group Policy Objects (GPOs) and domain membership are reversible and cascadable in a well defined way. Removing the policy will cause the system to revert to its previous behaviour. Tools exist to model the settings after these (Group Policy results and Group Policy Modeling). In general things set by policy can't be modified by the users. The new (XP SP3 I think) group policy preferences allow you to set default vaulues that can be modified by the users.

However if you use a custom home brew ADM file (rather than a registry file) then you WILL "tatoo" the registry and removing it will leave the new setting in place. You are basically providing a GUI to creating registry values. Again these can be cascaded in a predicatable manner. Easily applied by GPO etc.

Registry files probably allow most control, but they are not very supportable.

As for keyboard languages, well these are a hardware thing. I would have thought these are set when the machine is built. Not sure how registry values can be grayed out, can you give sample keys. I guess it could be because the necessary files aren't loaded.

I found the tutorial on this here:-

http://learnthat.com/2009/04/windows-server-2003-group-policy-and-security-70-290/

but I havn't read it.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial