13 Configuring Group Policy Preferences

16/11/2014
13 Configuring Group Policy Preferences

Section Topics
Introducing Group Policy Preferences
Comparing Preferences and Policy Settings
Configuring Preferences Settings
Section Objectives
After completing this section, you will be able to:

Describe the purpose of Group Policy Preferences
Describe the differences between Preferences and Policy settings
Identify the settings that you can configure in the Computer Configuration and User
Configuration sections of the Group Policy Management Console
Describe the Windows and Control Panel settings
List the advanced Preferences configuration options that are common to all GPO
Preferences
Section Overview
This section describes the function of Group Policy Preferences. You will learn how to
combine Preferences with Policies, and how Preferences are different from Policies. This
section also explains how to configure Group Policy Preferences and modify the advanced
https://skillpipe.courseware-marketplace.com/reader/en-GB/Book/BookPrintView/b6175ac1-149e-4f52-83bd-6350c9133320?ChapterNumber=14&FontSize
1/17
16/11/2014
configuration options.
Introducing Group Policy Preferences
Figure 302: Introducing Group Policy Preferences

This topic describes Group Policy Preferences and explains how to deploy these preferences.
Group Policy Preferences Feature
Figure 303: Group Policy Preferences Feature

The Group Policy Preferences feature was formerly available from a company called Desktop
Standard Corporation. Near the end of 2006, Microsoft purchased the company to acquire
their Group Policy management products.
The Group Policy Preferences feature is now an integral part of the Group Policy
management tools in Windows Server 2008 and later. With this addition, administrators now
have the ability to simply configure a broad array of settings that were previously available
only through logon scripts based on batch files or VBScript.
Traditional GPO Policies are considered managed configuration options. Once these options
are defined, these settings cannot be changed by the end user until the policy is modified by
2/17
16/11/2014
the administrator or the policy object is removed.

The GPO Preferences are considered unmanaged settings. The user can modify these
configuration options on his or her system at any time. The GPO Preferences are simply being
predefined at the policy level as a default setting.
The following topic explains how to deploy Group Policy Preferences.
Deploying Group Policy Preferences
Figure 304: Deploying Group Policy Preferences

Windows Server 2008 and later systems already include everything that needed to utilize
Group Policy Preferences. The Group Policy management tools and the Group Policy client
software are both aware of the new configuration settings.
Windows Vista, on the other hand, did not originally include the Preferences functionality. To
edit Preferences from a client operating system, you must be using Windows Vista SP1 or
above with the RSAT pack installed.
In order to configure Windows Server 2003 and Windows XP with Group Policy Preferences,
you must download and install the Group Policy Preferences Client Side Extensions.
Comparing Preferences and Policy Settings
3/17
16/11/2014
Figure 305: Comparing Preferences and Policy Settings

Figure 305 compares the Preferences and Policy settings.
The following topics describe these settings in more detail.
Enforcement of Settings
One of the primary differences between Policies and Preferences is the fact that the user can
undo the Preferences. You cannot enforce them as you can enforce Policies.
Ease of Administration
In the past, new configuration settings in the registry for an application required the creation of
a new administrative template that you had to import into Group Policy. Now, you can create
or modify any registry value to suit the needs of an application.
Files and Folders

Standard policies allow you to configure permissions on files and folders. Preferences go a
step further and allow you to create or modify folders and files.
Application
Most GPO Policies that are applied to a user or computer are temporary in nature. When the
policy object is removed, the settings from that policy revert to their former settings. Group
4/17
16/11/2014
Policy Preferences, however, will stay at their new values even if the governing GPO is
removed.
Filtering
The ability to apply a GPO based on a WMI query is a powerful feature. Unfortunately, the
process for creating a WMI query is cumbersome and time consuming. Item-level targeting in
Group Policy Preferences presents a user-friendly interface to configure the exact computer or
user to which a specific preference item should apply.
Configuring Preferences Settings
Figure 306: Configuring Preferences Settings

This topic describes the Computer Configuration and User Configuration settings of
Group Policy Management Editor. This section also describes the Windows and Control Panel
settings within Group Policy Preferences.
Computer and User Configuration Sections
5/17
16/11/2014
Figure 307: Computer and User Configuration Sections

Like all group policies, the Preferences are also split between the Computer Configuration
and the User Configuration sections. A few preference items are available only to either the
Computer or the User sections.
Unique Computer Preference Items
Some settings apply to the computer as a whole, no matter who is logged on at the console.
These settings include:
Network Shares
Services
Unique User Preference Items

The following settings are more personal in nature for each individual user and do not apply to
the computer as a whole.
Applications
Drive Maps
Internet Settings
6/17
16/11/2014
Start Menu
Windows Settings
Figure 308: Windows Settings

The Windows Settings within Group Policy Preferences provide a new mechanism with
which to configure certain aspects of the operating system. Features like drive mapping,
creating folders, and editing the registry were formerly only available through the use of logon
scripts.
The ultimate goal of these settings is to eliminate the complexity of configuring these settings,
and to provide a common foundation of settings that will give the user a good starting point.
From there, users still have the flexibility to modify the settings to suit their own needs.
Control Panel Settings
7/17
16/11/2014
Figure 309: Control Panel Settings

The Control Panel Group Policy Preferences provide a way to manage aspects of the
operating system that have been unreachable by traditional means. Some of these settings
could be scripted, but others really have no workable mechanism from which to configure
them.
One notable example is the Folder Options preference item. At the user level, this setting
allows you to configure the Windows Explorer file browsing attributes. For instance, instead of
the default Hide Extensions, you could make extensions visible.
Another great feature of the Preferences interface is that the options are laid out in a fashion
similar to what you would see on the screen itself. Instead of just looking at a bland list of
options, you actually experience the settings in a familiar layout.
Mapping Drives
8/17
16/11/2014
Figure 310: Mapping Drives

Group Policy Preferences can often be used to replace configurations performed with logon
scripts in the past. One example of this is mapping network drives.
There are many advantages to using Preferences instead of logon scripts:
Preferences can be reapplied at the next GPO refresh, while logon scripts only occur at
logon.
Preferences can use Item Level Targeting to apply to specific users, machines or other
conditions. Logon scripts would have to use complex scripting logic to accomplish the same.
In the case of the Mapped Network Drive, the Preference can be set to assign a drive letter
Starting at a specific letter. It will skip that letter if it is already in use.
Common Settings
9/17
16/11/2014
Figure 311: Common Settings

The Common tab of the Properties sheet for each preference setting contains additional
options for the Preference item. Some of these options enable a more powerful application of
the preference setting.
One of these options, however, should be used with care. The Remove this item when it is
no longer applied setting is not the same as reverting standard Group Policy settings back to
the previous value. In this case, the item is removed completely. There is no previous setting;
the value is just deleted. This may be fine in the case of a desktop shortcut that is no longer
needed.
However, this could be a problem with values such as registry keys or service settings.
The following topic describes item-level targeting, item-by-item filtering on which computer or
user should get a setting,
Item-Level Targeting
https://skillpipe.courseware-marketplace.com/reader/en-GB/Book/BookPrintView/b6175ac1-149e-4f52-83bd-6350c9133320?ChapterNumber=14&FontSiz
10/17
16/11/2014
Figure 312: Item-Level Targeting

One of the best features of the Group Policy Preferences section is the ability to perform itemby-item filtering on which computer or user should get the setting. With standard Group Policy
filtering, a WMI query must be created and applied to the entire GPO, not just one setting.
This option provides a granularity that simply does not exist anywhere else in Group Policy. In
addition, the item-level restrictions are easy to create, and do not require any knowledge of
WMI or SQL-type syntax. It is simply a process of clicking through a series of drop-down
lists.
Acronyms
The following acronyms are used in this section:
DUN
dial-up networking
GPO
Group Policy Object
ISV
independent software vendor
ODBC
Open Database Connectivity
SP1
Service Pack 1
SQL
Structured Query Language
VBScript Visual Basic Scripting Edition

VPN
virtual private network
11/17
16/11/2014
WMI
Windows Management Instrumentation
Section Review
Summary
Group Policy Preferences allow administrators to configure a broad array of settings, which
were previously available only through logon scripts based on batch files or VBScript.
The following table compares Preferences and Policy settings.
Feature
Enforcement of
settings
Ease of
administration
Files and folders
Policies
Preferences
User cannot change settings.
Settings are refreshed regularly.
User can change preferences.
Refresh is optional.
New settings require editing of
New settings can be imported or
administrative templates.
File and folder management is not
created.
possible.
Application
New files and folders can be

created.
Existing files can be modified.
Settings are temporary.
Preferences are permanent.
Policy removal reverts settings.
Policy removal does not revert

preferences.
Filtering
WMI queries for filtering.
Granular targeting is built in.
In the Group Policy Management Console, the Computer Configuration section, you can
12/17
16/11/2014
configure these settings:

Network Shares
Services
In the Computer Configuration section, you can configure these settings:
Applications
Drive Maps
Internet Settings
Start Menu
The following table describes the Windows Group Policy Preferences settings.
Setting
Description
Applications
Extensible for ISVs to create simple Group Policy preference settings for their applications.
Drive Maps
Create, modify, or delete mapped drives
Environment
Create, modify, or delete environment variables
Files
Copy, modify the attributes of, replace, or delete files
Folders
Create, modify, or delete folders
Ini Files
Modify .ini or .inf files
Registry
Copy registry settings to other computers and create, replace, or delete registry settings
Network Shares
Create, modify, or remove shares
Shortcuts
Create, modify, or delete shortcuts
The following table describes the Control Panel Group Policy Preferences settings.
Setting
Description
Data Sources
Manage ODBC connections
13/17
16/11/2014
Devices
Manage device drivers
Folder Options
Configure folder options and file extension associations
Internet Settings
Manage Windows Internet Explorer settings
Local Users and Groups
Create, modify, or delete local users and groups
Network Options
Manage VPN and DUN connections
Power Options
Configure power management settings
Printers
Manage printer connections
Regional Options
Modify regional settings
Scheduled Tasks
Manage scheduled tasks
Services
Manage service behavior
Start Menu
Configure Start menu settings
The advanced configuration options are available on the Common tab of the Properties
sheet for each preference setting. Some of the options that are common to all GPO
Preferences are:
Error handling
Security context
Item removal
Reapplication
Item-level targeting
Knowledge Check
1.
What are the differences between GPO Policies and GPO Preferences? (Choose all that
apply.)
a.
Preferences are not enforced.
b.
Preferences do not revert when the policy is removed.
14/17
16/11/2014
c.
Preferences targeting requires a WMI query.
d.
Preferences allow you to create or modify folders and files.
2.
What is the purpose of Group Policy Preferences?
3.
Which of the following settings are located in the Computer Configuration section of
the Group Policy Management Console? (Choose all that apply.)
4.
a.
Start Menu
b.
Drive Maps
c.
Applications
d.
Services
List the advanced Preferences configuration options that are common to all items in
Group Policy.
5.
Describe each of the following Group Policy Preferences settings.

Registry:
Drive Maps:
Folder Options:
Network Options:
Knowledge Check Answer Key

The correct answers to the Knowledge Check questions are bolded.
1.
What are the differences between GPO Policies and GPO Preferences? (Choose all that
apply.)
a.
Preferences are not enforced.
b.
Preferences do not revert when the policy is removed.
15/17
16/11/2014
2.
c.
Preferences targeting requires a WMI query.
d.
Preferences allow you to create or modify folders and files.
What is the purpose of Group Policy Preferences?

Group Policy Preferences allow administrators to configure a broad array of
settings, which were previously available only through logon scripts based on
batch files or VBScript.
3.
Which of the following settings are located in the Computer Configuration section of the
Group Policy Management Console? (Choose all that apply.)
4.
a.
Start Menu
b.
Drive Maps
c.
Applications
d.
Services
List the advanced Preferences configuration options that are common to all items in
Group Policy.
Error handling
Security context
Item removal
Reapplication
Item-level targeting
5.
Describe each of the following Group Policy Preferences settings.

Registry: Copy registry settings to other computers and create, replace, or delete
registry settings
Drive Maps: Create, modify, or delete mapped drives
Folder Options: Configure folder options and file extension associations
16/17
16/11/2014
Network Options: Manage VPN and DUN connections
17/17

13 Configuring Group Policy Preferences

Diunggah oleh

Informasi Dokumen

Hak Cipta

Format Tersedia

Bagikan dokumen Ini

Bagikan atau Tanam Dokumen

Opsi Berbagi

Apakah menurut Anda dokumen ini bermanfaat?

Apakah konten ini tidak pantas?

Hak Cipta:

Format Tersedia

13 Configuring Group Policy Preferences

Diunggah oleh

Hak Cipta:

Format Tersedia

16/11/2014