DesktopStandard - PolicyMaker Review?

[Murph]

If anyone is using this product I would like to know your thoughts both positive and negative. What about GPOVault from DesktopStandard? - thx

[SIver]

We've been using PolicyMaker for a few months now. It's useful for what it is....

Basically it adds some functionality that most of us probably feel MS should have had in GPO's in the first place...

We use it mostly for "pushing" files, folders, drivemaps, printers,etc. onto users and computers from "on high", without having to get a tech to go to each desktop and configure this things. Very helpful when your user (luser) base is not tech savvy enough to copy files from a network share and place them in a folder you told them too.

We're looking at an add on for PolicyMaker that sets program permissions (I forget the name of the add-on)... Basically you can setup your users as normal User accounts instead of Power User etc. and then specify individual programs / folders that should run with Admin Privleges. We're testing it for use on Remote Sales Laptops...

Basically we're going to set the laptops up as domain members, and then mod the registry to include the AutoAdminLogon line, and store the Users name/password in the registry. That user will actually be set as a local user (not admin rights). One nice thing about XP is that the settings in the GPO's we're using will be cached (no software installs sorry, refere to Jeremy's book for more details on what else won't process), so to the user's point of view, they'll have a computer that boot's directly to thier desktop, and the programs they need to use will run, even thought they won't have any Admin Rights to the machine at all.

We're still in the tweaking phase, but we expect to have the bulk of this rolled out by the end of the year.

I hope that helps you out!

[Murph]

Every bit of information helps especially when it is real world experience. Have you guys used any of the filters, if so do you find it beneficial. Any noticeable performance issues? thx

[SIver]

No performance issues, other than with the FRS (File Replication Service). FRS keeps the GPO's in sync between all your DC's in your domain. After you make a change to a GPO the FRS has to replicate the policy to all the other DC's and they have to match, before the policy will be applied to the desktops/laptops. There is a great tool called GPOTOOL.exe that will check the version #'s on GPO's between the DC's and alert you to any problems....


All that said: the issue with PolicyMaker Policy's appears to be they take a little bit longer to sync up between the DC's (about 1 min longer on a policy using Policy Maker settings vs. one using only MS settings). Granted our DC's are all seperated by T1's, so there is a bit of a bottle neck to deal with, but not too bad at all....

As far as the filter's go, I consider them to be THE single best reason to get Policy Maker in the first place. You get to avoid having to learn WMI !

For example: I created a policy yesterday to do the following...

Accounting OU, I want to push an .ODC file (OLAP Connection) onto certain users who will be using a spreadsheet to access an OLAP cube.

So I fire up GPMC and create a new policy and go into the User settings Policy Maker settings. I copied my ODC file out to a network share, and then in the policy I create an UPDATE file policy that will copy the file from the network share to the folder I want on thier local HD. With the Update setting, even if they delete the file, the next time they reboot it will be re-copied. Then I go into the Policy Maker Filter Settings (because I only want certain members of the Accounting OU to have this file), and I start setting the Filter for "If the User IS XXX, OR if user is XXX OR ..." In this way I simply use a GUI tool to pick the users I want this policy to apply too.

You can also do filters on things like, If the computer has a battery (then it's a laptop) therefore apply this policy...

Granted, much of that you can do with WMI filters, except you have to know WMI pretty well, most of the options to query for are named strangely....

Bottom line - The tool is worth the cost they charge, it could be a bit better, but then again, MS could have given us these features in the first place

I would at least get the Demo and setup a test lab, or if you don't have the resources for a lab, at least a Test OU and a Virtual PC (or VM Ware) to try it out with.

The hardest thing for me, after buying the tool, was remembering that I don't have to getup out of my chair as much anymore. Now I can "push" my wishes from "on high" down to the masses of client machines.

I hope that helps, if you need more info, please reply and I'll try to answer your questions as best I can.