Windows Nation: William Stanek's (Not A Blog) Blog Page

Group Policy Preferences A-Z (pdf download)

By William R. Stanek

Okay, so call me a zealot, I probably am but when a technology works I’m not afraid to say it (and I’m not afraid to proclaim it from the rooftops either) so here I go with a bold statement. That statement being this: I just don’t understand why Group Policy Preferences (GPP) aren’t being used everywhere. I first started exploring GPP when I was doing research for my book Windows Group Policy Administrator’s Pocket Consultant. Although months had passed since, I still wasn't finding as many organizations using GPP as I thought there should be. My thought: Some people just don’t understand the technology, so I wrote a series of blog entries about GPP for Microsoft that I hoped would change that and might also help administrators get management to say “Yes, we want GPP.” So here's the entire GPP blog series, as one long (and hopefully very useful) post:

First of all, you may be wondering what GPP is all about and that’s where I’ll start. Group Policy preferences differ from Group Policy settings in many ways. If you think of GP settings as set of rules that you apply to computers and users, you can think of GP preferences as a set of guidelines that you apply to users and computers. Alternatively, you can think of GP settings as managed settings for computers and users, and GP preferences as unmanaged settings for computers and users.

You use settings to control configuration of the operating system and its components. Often settings you apply prevent users from making certain changes to their computers. On the other hand, you use preferences to establish baselines. Users can change settings applied through preferences (though you can have GP re-apply preferences automatically as part of the policy refresh process). So it’s apply once or reapply with refresh for preferences.

Other things to keep in mind:

· When you configure GP settings, changes typically are made in policy-based areas of the registry and original settings are not overwritten. When you configure GP preferences, changes are made in the same areas of the registry used by the operating system and applications, which overwrites the original settings.

· When you remove a GP setting, the original settings are restored. When you remove a GP preference, the original settings are not restored.

Bottom line: GP settings are enforced, GP preferences are not enforced. So if that’s the case why use preferences?

Unlike GP settings which apply to both local computer policy and Active Directory policy, GP preferences only apply to Active Directory policy. You use preferences to configure many areas of the operating system, including:

·         System devices, including USB ports, floppy drives and removable media.

·         Network shares and mapping of network shares to drive letters

·         System and user environment variables

·         User and group accounts for the local computer

·         VPN and dial-up networking connections

·         Printer configuration and mapping

·         Registry settings, schedule tasks, and system services

·         Settings for Folder Options, Internet Options, Regional and Language Options

·         Settings for power schemes and power Management

·         Start Menu properties and menu items

Preference also can help you manage files, folders and shortcuts. You can use preferences to create shortcuts and folders on computers. You also can copy files from a source location to a specified file path on computers.

Previously many of these features were configured with logon, logoff, startup, or shutdown scripts or by manual configuration of system images. Therefore, with GP preferences, you may able to replace these types of scripts or manual configuration. Applying configuration through preferences is easier than you think as well. For example, if you don’t want computers to run a service such as the FTP service or the World Wide Web Publishing service, you can configure a preference to disable and stop the service. Although preferences are unmanaged and not enforced, you can set the preference to be applied each time Group Policy is refreshed. As a result, if a user started the service, it would be stopped and then disabled whenever GP is refreshed.

So what’s the scoop. Here it is: GP preferences allow you to configure many areas of the operating system and they may allow you to replace certain types of scripts and manual configuration tasks.

Unlike GP settings which you set to an Enabled, Disabled or Not Configured state, you configure most preferences using one of four actions. These actions are: Create, Replace, Update, and Delete, which you can remember using the handy acronym C-R-U-D.

The Create action creates a preference if it doesn’t already exist. For example, you can use the Create action to create and set the value of a user environment variable called CurrentOrg on computers where it does not yet exist. If the variable already exists, the value of the variable will not be changed.

The Replace action creates preferences that don’t yet exist, or deletes and then creates preferences that already exist. For example, you can use the Replace action to replace a file on computers. If the file exists, Group Policy removes it from the target location, copies it from a specified source location and then overwrites the existing file in a designated target location. If the file doesn’t exist, Group Policy simply copies it from the source location to the designated target location.

The Update action creates preferences that don’t yet exist or modifies preferences if they exist. For example, you can use the Update action to modify a local group on computers. If the local group exists, you are able to rename the group and update its settings with the settings you’ve defined for the preference item. This allows you to add users and groups as members while ensuring current membership in the group is not modified. However, as with many preferences, you have action modifiers, which act as additional update options, as well. With these update modifiers, you could choose to delete all member users, delete all member groups, or perform both actions.

The Delete action deletes preferences if they exist. For example, you could use the Delete action to delete a specified network share from computers. Action modifiers allow you to perform other tasks as well, such as deleting all regular shares, all hidden non-administrative shares, all administrative drive-letter shares or any combination thereof.

So that’s CRUD and that’s how it works. In addition to preferences you manage using C-R-U-D, there are preferences you manage using an interface similar to the actual Control Panel interface. Generally, these preferences have both CRUD actions that can be applied and editing states. For ease of reference, I call these special preference and they include preference items for:

·         Start Menu settings

·         Regional and Language settings

·         Internet options

·         Folder options

·         Power options

You can identify special preference items immediately because settings are underlined using a solid green line or a red dashed line or have an icon depicting a green circle or a red circle. These elements indicate the editing state of a particular item. Green items are delivered and processed. Red items are not delivered or processed.

One thing to point out and if you’ve been working with Windows for a while, you won’t be surprised as you’ve probably come to expect that things aren’t always clear cut. And indeed, there are standard preference items that have extended interfaces. For example, when you create preference items for scheduled tasks to run in Windows Vista or later, you have the CRUD actions and an extended interface similar to the standard interface used by Windows Vista or later. However, these preference items won’t have green and red editing state indicators. The green and red indicators tell you that you are working with a special preference item.

The best way to show you how special preferences are used is just to start right in and go. When you are configuring preferences for the Start Menu, you specify whether you want to create a preference item for computers running Windows XP or computers running Windows Vista and later. You can then define general settings, including icon size for programs and then number of programs to list on the Start Menu as well as configuration options for the Classic Start Menu, the simple Start Menu or both.

Preference items for folder options and power options are also divided into separate items for computers running Windows XP or computers running Windows Vista and later. For Windows XP, you can configure Power options and Power schemes. For Windows Vista and later, you can configure Power plans.

With Internet options, you can configure settings based on the browser version. There are separate preference items for Internet Explorer 5 and 6, Internet Explorer 7, and Internet Explorer 8. You specify the desired settings using a dialog box similar to the Internet Options dialog box you see when the related browser version is installed.

Although most Group Policy preferences support only the CRUD management actions, a few also support editing states and you’ll know them as soon as you see them because they have UIs similar to what you’ll find in the relevant operating system or application. For example, the Internet Settings preference is specific to the version of Internet Explorer installed while the Power Options preference is specific to the Windows version installed.

Wondering what other preferences support editing states? Well, here’s a complete list:

·         Start Menu settings

·         Regional and Language settings

·         Internet options

·         Folder options

·         Power options (to include Power Schemes)

The editing state of a particular option is depicted visually as follows:

· Green means the setting will be delivered and processed by the client.

· Red means the setting will not be delivered or processed by the client.

Or put another way:

· Green (go; processed)

· Red (no go; not processed)

When an option is green, you can enable, disable or configure the option to a specific value to control how the option is used. When an option is red, it is not applied so the current value is irrelevant.

Use the function keys to toggle the editing state. To enable all options on the currently selected tab, press F5. To disable all options on the currently selected tab, press F8. To enable current, press F6. To disable current, press F7. For quick reference:

· F5 = Enable All

· F6 = Enable Current

· F7 = Disable Current

· F8 = Disable All

Well, there you have it—a whole lot of discussion about Group Policy Preferences, which I hope more folks will start using to master the enterprise PC. Thanks for reading! And as Bob Dylan croons, "You better start swimming or you'll sink like a stone."

William R. Stanek

williamstanek at aol dot com

Twitter at http://twitter.com/WilliamStanek