Group Policy Changes in Windows Server 2003

Three years ago, in Microsoft Certified Technical Education Centers (CTECs) around the world, Microsoft Certified Trainers (MCTs) tried to put Windows NT administrators at ease by giving some version of the following speech: "Windows 2000 adds hundreds of new features. But just because so many features are included doesn't mean you have to use all of them." Many administrators took this pronouncement to heart with regard to Group Policy and simply ignored this powerful Win2K tool. Group Policy introduced the ability to control a wealth of computer and user-environment settings by using the structural elements (i.e., sites, domains, and organizational units—OUs) of Active Directory (AD). For example, you could configure Group Policy Objects (GPOs) to standardize security policies by server function and restrict users' ability to reconfigure desktop computers.

Unfortunately, Microsoft's implementation of all that power was imperfect. For example, Win2K Group Policy management tools couldn't provide a comprehensive view of policy deployment and its effects. Windows Server 2003 tries to remedy Group Policy's shortcomings through several new policy options and two GPO administration tools.

Win2K Group Policy Shortcomings
As one of the more significant (and complex) new features pioneered in Win2K, Group Policy wasn't thoroughly understood by Win2K adopters. Organizations that wanted to implement Group Policy needed to make that decision early in migration planning, and some decided to avoid its use to simplify the migration process. In organizations that embraced Group Policy, many administrators found the Group Policy management tools to be cumbersome.

Simply to use Win2K's Group Policy management tool, which doesn't launch by default, you typically need to launch the Microsoft Management Console (MMC) Active Directory Users and Computers snap-in or the MMC Active Directory Sites and Services snap-in, navigate to the container (i.e., the domain, site, or OU) that holds a GPO, then manually launch the Group Policy snap-in from the container. If you want to examine or edit policies in two different containers—even closely related containers, such as parent and child OUs—you need to launch the Group Policy snap-in for each container. In fact, if you associate multiple GPOs with one container, you must view each GPO in a separate MMC window.

Layers of nested OUs, combined with site and domain GPOs and dozens of categories to which different GPOs might apply, make planning GPOs difficult. Simply determining the effect of combined GPO settings—what applies to a particular user logged on to a particular computer—is a piece of detective work.

Windows 2003 addresses almost all these Group Policy problems. The most important Windows 2003 changes are the Group Policy Management Console (GPMC) and the MMC Resultant Set of Policies (RSoP) snap-in.

The GPMC
The GPMC doesn't ship with Windows 2003, but it's available for download from the Microsoft Web site (http://www.microsoft.com/downloads/details.aspx?familyid=f39e9d60-7e41-4947-82f5-3330f37adfeb&displaylang=en). After you download the tool, simply double-click the gpmc.msi package and follow the instructions to install it. In addition to adding a GPMC shortcut to the Administrative Tools folder, the installation process updates the Group Policy tab on the properties pages of sites, domains, and OUs in the Active Directory Users and Computers and Active Directory Sites and Services snap-ins to provide a direct link to the GPMC. You can also launch the GPMC by clicking Start, Run, then typing

gpmc.msc

You must run the GPMC from Windows 2003 or Windows XP Professional Edition with Service Pack 1 (SP1) or later, but you can use the tool to manage GPOs in Win2K domains. You can manage sites, domains, and OUs from one tool and multiple domains and forests from one screen. As Figure 1 shows, the GPMC's treeview pane provides a top-level view of forests and the containers within them. The right-hand pane's contents change depending on what you select in the treeview pane.

When you select a container, three tabbed windows—Linked Group Policy Objects, Group Policy Inheritance, and Delegation—appear in the right-hand pane, as Figure 2 shows. The Linked Group Policy Objects tab displays all GPOs that are directly linked to the selected container, shows the order in which they are applied, and lets you launch Group Policy Editor (GPE) or create a new GPO.

The Group Policy Inheritance tab conveniently lists all GPOs that are in effect in the selected container, including those that are linked to a higher-level container and that are enabled in the selected container through inheritance. This display takes into account whether inheritance is blocked and whether blocking is overridden. However, the Group Policy Inheritance tab doesn't display GPOs applied at the site level for domains or OUs. The Delegation tab displays user profiles that have permission to manage GPOs in the selected container.

The GPMC displays four containers that aren't available in the Win2K AD management tool. Figure 2 shows these containers in the treeview pane.

The GPMC also adds power to scripters' arsenals. All GPMC functions are scriptable. You'll find several sample scripts (for tasks such as GPO backup and creation) in the program files gpmcscripts directory.

RSoP
Microsoft's RSoP tool doesn't help you create or link GPOs, but rather lets you examine their effects—think of RSoP as a "read-only" tool. RSoP is a query engine and reporting tool that operates in two modes. Logging mode displays the effects of currently applied GPOs, and Planning mode displays the effects of a combination of current and proposed GPOs. You won't find the RSoP tool in Windows 2003's Administrative Tools folder; to use the RSoP tool, define a custom MMC console for its snap-in or type

rsop.msc

at the command line.

When you launch the RSoP snap-in, the first window you'll see is the Mode Selection screen, which lets you choose between Logging and Planning modes. Logging mode displays all effective settings. In Planning mode, the RSoP tool's wizard interface lets you change existing GPOs, add new GPOs, move user or computer accounts to new OUs or sites, alter security group memberships, and apply WMI filters.

After you choose the mode, the snap-in will prompt you for the username and the computer you want to examine. The RSoP then displays the effect of the specified policy or combination of policies. The RSoP tool is a great way to try out a change without actually inflicting it on users.

Other Group Policy Changes
Windows 2003 also provides many other Group Policy enhancements. Here are five of the most notable improvements.

New Group Policy Settings
Windows 2003 introduces more than 160 new Group Policy settings, many with expanded security potential. Windows 2003 also renames some Win2K settings.

A Better ROI
Group Policy typifies many of the functional aspects of AD that Microsoft introduced in Win2K. However, implementing Group Policy's sizable potential in Win2K required an equally sizable investment of effort and planning. Through new tools and some overall fine-tuning in Windows 2003, Microsoft made ignoring Group Policy's capabilities much less attractive.