DesktopStandard PolicyMaker

You can probably use logon scripts to do much of what DesktopStandard's PolicyMaker client-side extensions do, but that doesn't mean PolicyMaker is designed just for administrators who are leery of the command line. PolicyMaker adds intuitive functionality to Group Policy Objects (GPOs) that makes scripting seem painful by comparison.

PolicyMaker is a set of group policy extensions that you install on administrator workstations and a DLL that you install on each computer in your domain. Both components come as .msi files for easy deployment via group policy. After you install the product, you'll see new folders and options when you manage a GPO or review the results of group policy processing in the Microsoft Management Console (MMC) Group Policy Management Console (GPMC) snap-in or the MMC Resultant Set of Policies (RSoP) snap-in.

The free edition, PolicyMaker Registry Extensions, lets you control only registry keys, but it includes some common features, such as filtering, that apply to all PolicyMaker policies. Filtering conditions can include elements such as processor speed, disk space, and available memory; the user's response to a dialog box; or an administrator-specified schedule. PolicyMaker filtering is a great improvement over writing Windows Management Instrumentation (WMI) queries for Microsoft's native group policy filtering.

PolicyMaker Standard Edition, the commercial version of the product, adds a host of policies to the registry extensions. Some policies mirror typical login scripts, such as drive mapping, printer mapping, and file creation. Others ease tasks that would be complicated scripting jobs, such as configuring multiple versions of Microsoft Office and Outlook, changing settings in .ini files, and configuring options, such as power settings, that are available in the Control Panel. Some of the simplest features might even be the most useful. You can reliably map drives and create shortcuts to them on users' desktops or in the Start menu to enforce a look and feel across all the machines you manage.

As part of its PolicyMaker product line, Desktop Standard also sells Application Security and Software Update, a patch-management solution that lets you configure various applications' rights so that users don't have to run as administrators. Although each of these products is sold separately, Desktop Standard offers discounts when you buy multiple products.

Group Policy can be difficult to troubleshoot, but PolicyMaker's integration with the MMC RSoP snap-in and two levels of logging help a lot. PolicyMaker's group policy client-side extensions can write errors, warnings, and informational events to the Windows event log and more detailed information to a text file. You control the level of logging through—you guessed it—a group policy. Between the MMC RSoP snap-in and the logs, the PolicyMaker policies I tested worked fairly easily.

I found PolicyMaker's local user and group control limiting, however. I wanted to use it to delete rogue user accounts, but PolicyMaker only lets you create and delete users for which you specify a name. Such a feature would have been a nice addition to Group Policy Restricted Groups.

PolicyMaker is a great product for enforcing standards, and its integration with Microsoft's group policy tools makes it easy to use. Although a few policies are limiting, other features, such as filtering, are excellent. I hope Microsoft takes some clues from DesktopStandard's great group policy ideas.

See associated figure