MDM & GP Tips Blog

Jul 2009
30

Policy vs Preference

Team: I had this email exchange with a friend of mine the other day.

The email title was: "Policy vs. Preference (I don't get it.)"

I thought you'd like it. Read all the way thru to the end for how to get more information TOMORROW, Friday at 12.00 PM EST.

[Note, we're having some login issues to the GPanswers.com web accounts. Sorry if you're affected right now; we're working to fix it... Thanks.]

--

Jeremy...

OK I'm having serious brain 'problem.' What, really, is the difference between an unmanaged policy setting and a preference (GPPreferences-style)?

I CAN remember, at this late hour, that managed policy settings are in the Policies key of the registry. Seems to me that unmanaged policy settings (which equate to settings that can tattoo, right?) are elsewhere, yeah? So what makes them different than changes made by Preferences?

I am just trying to hone my use of terminology and make my boss understand "Policy" vs "Preference" vs "PolicyPak". THANKS!!!!

Okay Frank.. So.. I'm sure there's some "complete and proper definition" somewhere at Microsoft about what a Policy is vs. a Preference.

But when I talk with people about "Policy" Vs. "Preference" here's the litmus-test I use to determine "which is which."

I define policy as "three things"... that is, these three things need to be TRUE for you to be able to call it a "True Policy." A policy means that the setting:

1. Properly goes to the "Policies" keys in the registry (one of only FOUR sanctioned locations)

and

2. UI lockout occurs such that users cannot scoot around it

and

3. UI lockout / setting reverts when GPO falls "out of scope" (ie: You whack the GPO.)

So, "Prohibit Access to the Control Panel" is a true POLICY. It meets these three criteria.

If you crack open the ADM/X, you'll see that the registry punch goes to the Policies keys... and once set, users cannot scoot around it.

A Preference is EVERYTHING ELSE.

So.. some criteria to check if it's a Preference would be:

1. Does it store its keys anywhere in the registry? (ie: OUTSIDE the 4 proper Policies keys?)

and

2. Does it still permit a user to manipulate the UI? (ie: No UI lockout?)

So, 99% of hand-created ADM or ADMX templates and a large percentage of GP Prefs items are just that.. Preferences. (Note that many GP Preferences items have a scope which are NOT the registry. For instance, "Local users and groups" deals with the local SAM and NOT the registry. Others, deal with services. But for the purposes of this discussions, I think you're asking about REGISTRY items, and many of the GP Preferences items are, indeed, registry focused.)

So, let's examine the GP Preferences "Internet Explorer Settings." They're Preferences.

Why? Because... once a user gets the settings...

Test #1: The keys aren't contained in the "Policies" keys
Test #2: Users can scoot around and change the values to whatever they want
Test #3: If you whack the GPO with a preference, what happens? It "tattoos" or "leaves behind" the settings you set.

Do note, if you whack the GPO with a GP Preference, on some items there is an extra flag which is called "Remove when no longer applies" which will DELETE THE VALUE (not REVERT the value). Which, could be harmful to your application. Ouch.

So, where does PolicyPak fit in?

In contrast.. POLICYPAK will "bridge the gap" when it comes to Registry punches and settings Applications' settings.

The free PolicyPak Community edition is able to:

1. Write keys anywhere in the registry

while

2. Performing UI lockout

and magically

3. Reverting to the value you want when no longer applies (not totally deleting the value!)

PS: There's a guide which I wrote to help clear up a lot of these questions. Let me know what you think:
https://www.policypak.com/solutions/why-group-policy-admins-need-policypak.html

 

 

Jul 2009
16

Backing up (even quicker)

Quick update #1: About the "backing up GPOs" stuff we talked about this week...
-------------------------------------------------------------------------------------------------------------------

I forgot all about Darren Mar-Elia's PowerShell cmd-lets (free!)

If you don't want to wait for Win 7 but want to use Powershell to manage GPOs now, head on over to http://www.sdmsoftware.com/freeware and get their free Powershell GPMC cmdlets.

To backup up all GPOs in a domain using the SDM Powershell cmdlets, just use:

Get-sdmgpo * | export-sdmgpo -location c:gpbackups

Neat !



Jul 2009
13

Automating your backups....

Team:

Last week, we talked about backing up your GPOs, and how you should be, ya know, "just doing it."

Then I got some emails asking me about "automating that backup."

Turns out.. that's easy too! Here's two ways (I'm sure there are more.)

Way #1: VB-scripts via the GPMC scripts
The older GPMC had built-in scripts. The newer GPMCs require that you download the sample scripts. These are great and super helpful and can be found here: http://tinyurl.com/gpscripts

You can see examples of using the scripts if you head over here:
http://msdn.microsoft.com/en-us/library/aa814151(VS.85).aspx

The script you want to play with is called "BackupAllGPOs.vbs."

It's easy as pie. Or punch. Or something that's easy.

Way #2: If you're a Powershell geek / geekette
The newest GPMC with Win7 and WS08/R2 supports lots of SIMILAR constructs (create GPOs, backup, restore, etc), but now you can ALSO use PowerShell. So, to "get" the GP-related commands into Powershell, I typed

"Import-Module grouppolicy -verbose"

then I was able to run this quick command

"backup-gpo -all -path c:SavedGPOs"

And, blammo. Instant backup of my GP-world.

There's more to the command, of course; but that's its simplest use.

Again, easy as falling off a log... if you know the secrets.



Dec 2008
02

DNS is LIFE

Why isn't Group Policy Working on this client?
Did You Check the DNS Configuration of the Client?
---------------------------------------------------

One of the most frequently encountered problems with Windows 2000 and above is that things just 'stop working' when DNS gets out of whack. Specifically, if you're not seeing Group Policy apply to your client machines, make sure their DNS client is pointing to a Domain Controller or other authoritative source for the domain. If it's pointing to the wrong place or not pointing anywhere, Group Policy will simply not be downloaded.

As a colleague of mine likes to say, 'Healthy DNS equals a healthy Active Directory.'

Moreover, in the age of Windows 2003/2008 with its multiple forests with cross-forest trusts, Group Policy could be applying from just about anywhere and everywhere. It's more important than ever to verify that all DNS server pointers are designed properly and working as they should. For instance, if clients cannot access their 'home' Domain Controllers while leveraging a cross-forest trust, they won't get Group Policy.

Finally, to put a fine point on it, DNS leverages only the fully qualified name. It's not enough to verify that you can resolve a computer named xppro1 as opposed to xppro1.corp.com. The first is actually the NetBIOS name and not the fully qualified domain name. The second is the fully qualified domain name. If you find yourself in a DNS resolution situation where resolving the NetBIOS name will work, but the fully qualified name will not work, then you have a DNS problem that needs to be addressed.



Aug 2008
05

More freeness awesomeness -- WinInstall LE

Remember the good ol' days? When right on the Windows CD-ROM was a great little free MSI repackaging tool called WinInstall LE?

Well, then it just went away.

A lot happened since then. WinInstall broke free, and became their own company. Then they were bought out by Attachmate. Then finally sold to Scalable software.

And look what happened? It's free again! So, if you're looking for a great little MSI repackaging tool (totally free) check it out here.

Oh yeah, and they mention me in the press quote. Because, you know I like free stuff!



May 2008
14

Issue#28

  • Policy or Preference: Who wins the smackdown?
  • Announcing: Downloadable eChapters of Jeremy's two new upcoming books!
  • Kansas City Class: ON! Will you be there?

Welcome to Newsletter #28.

One of the questions I get all the time is: "Which one 'wins' if a Policy and a Preference overlap?"

Think you know the answer? I thought I did too; so let's see how that shakes out. Next,

I'm happy to announce my two new upcoming books on Group Policy.

  • Group Policy Fundamentals, Security, and Troubleshooting
  • Creating the Secure Managed Desktop: Group Policy, SoftGrid, and Microsoft Deployment and Management Tools

Right now, you can zip on over to www.GPanswers.com/books and learn about them, or a little later in the newsletter I'll give you the full rundown of the two books, what's new, and tell you why I had to expand it into two books!

I'm also super excited to announce our new Partner/Affiliate. Sign up, and everyone you recommend for a GPanswers.com training (or newsletter signup) means some extra dough in your pocket. More, later in the newsletter.


This Month's Newsletter Sponsored by: NetIQ

Are you stepping on other administrator's toes when managing Group Policy? It happens a lot, but there are some strategies to help you address that. In this new whitepaper, "Group Policy Management Challenges" authored by Group Policy guru Jeremy Moskowitz and NetIQ you'll learn some immediate techniques to get working better today.

Download it now


Getting Down to Business: Policy vs. Preferences

Microsoft has a Group Policy blog entry called "GP Policy vs. Preference vs. GP preferences" which you should all stop and read right now. Really. I'll wait. I know you'll come back, because there's a lot more to learn on this subject. Check it out here. http://tinyurl.com/339wgx

And while I really dug that blog entry, and it was really well written and smart, there are some other angles to that Policy vs. Preferences story. And that's what I want to cover here.

How, exactly does the Group Policy engine deal with overlaps between policies and preferences? Well, there’s the short answer, the middle-length answer, and the long answer. Let’s go over all of them. (We’re old friends now—you knew I would anyway, right?)

The Short Answer: Policy Wins over Preferences

The short answer is that if there’s a conflict between a policy setting and a preference setting, the policy setting will win. (So, for instance, items in Computer and User Configuration | Policies should always win over Computer or User Configuration | Preferences.)

Why?

Because only policies actually lock out the user interface of the application they manage (Explorer, Office 2003, etc.).

Preferences don't.

Remember, preferences are suggestions that you can give to the user’s application, but the user can usually just wipe them out if they want. (Although, GPPEs will re-apply again at policy refresh time by default.)

Here's a quick example to prove the point. In the example in Figure 1, I’m clicking Help to ensure that the Help menu is on the Start Menu for all Windows Vista machines using GPPEs. True, this is the default anyway, but by selecting it here, I’m laying down a preference that is always put on the machine.

Figure 1

However, if I use the policy setting User Configuration | Policies | Administrative Templates | Start Menu and Taskbar | Remove Help menu from Start Menu, as seen in Figure 2, the Help option disappears in the Windows Vista Start Menu.

Figure 2

But the general case here is that policies always beat preferences. Rock always beats scissors. Or does it? Can the rock crumble when it’s hit by the scissors? Let’s continue onward to see at least one interesting case where it doesn’t work that way.

The Middle-Length Answer: Sometimes Preferences Win over Policy

You need to be careful to assume that policy always wins over preference. In fact, that’s not always true. Here’s an example we can use to prove it:

  1. Create a single GPO and link it to a Windows Vista or Windows Server 2008 machine that uses the Internet Settings preference extension to set the Internet Explorer 7 proxy server to 10.1.1.1 with port 8080. You can see a shot of this in

    Figure 3

  2. Then, use Group Policy’s Internet Explorer Maintenance to set the proxy to 10.2.2.2 with a port of 8282. You can see a shot of this in

    Figure 4

    Click on image for larger view
  3. Then, refresh your client via GPupdate and fire up Internet Explorer 7.

Uh oh. This seems to break the laws of nature! How can preferences win over policy? Because Internet Explorer Maintenance policy isn’t really policy. Indeed, by setting the IE Home page using Internet Explorer Maintenance, the value goes to HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings in a value called ProxyServer, as seen in Figure 5. And since this is not a place for a true policy, it must actually be a preference.

Figure 5

Click on image for larger view

Indeed, the value that’s being set is exactly the same for both the IE Group Policy Preference and Internet Explorer Maintenance.

Why does one win over the other? I’ll show you the nuances of why in the next section.

But for now, it turns out there is a clever way to attain our goal; which is to force an IE proxy server and lock it down so users cannot change it.

Check out an obscure Administrative Templates policy setting named Disable changing proxy settings (located in User Configuration | Policies | Administrative Templates | Windows Components | Internet Explorer). A-ha! That’s true policy, so hopefully that will perform some kind of lockdown, as shown in Figure 6!

Figure 6

But why then does that Administrative Templates setting named Disable changing proxy server settings work in a way the other guys don’t? Because IE 7.0 (and 6.0 and 5.0) are all coded to look in the proper policies keys. And if there’s a value there that IE recognizes, then IE makes sure to honor that.

And it does.

The end result is that true policy wins. You can see this in Figure 7 where the proxy server entry’s values are taken from the preferences, but it’s locked down via the policy.

Figure 7

For most people, the medium-length answer will be good-enough. But you’re not most people. You’re looking for the most detailed knowledge you can get. So if you’re curious to know why the Internet Explorer GPPE won against the Internet Explorer Maintenance Group Policy settings, read on for The Longer Answer.

The Longer Answer: Understanding CSE Timing and Overlap

To get to the bottom of this mystery, we need to understand when Group Policy applies. Recall that the Group Policy system is a last-written-wins technology. So, if you have an overlap between, say, the domain level and the OU level, the default is that the OU level will win because it was written last.

But now things become markedly more confusing. Not only is there overlap between Active Directory levels (site, domain, OU) for some of the features above, there’s overlap at the feature level, where two or three CSEs compete to write their data last.

Ow.

There is some order in this chaos. But to understand it you’ll need an intimate understanding of what happens when the CSEs process (in the foreground and in the background). In short, the CSEs process in the order seen in Figure 8. This is a script you can download from http://tinyurl.com/23xfz3 called FindGPOsByPolicyExtension.wsf.

This exposes the same information as if you went to the following Registry key on a machine with the GPPE extensions loaded: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions.

There, you’ll see the registrations for all CSEs. The GUID of each CSE dictates the order in which things will process. They’ll process alphabetically, by GUID. So, Wireless Group Policy fires off first (that’s a classic Group Policy setting), then Group Policy Environment (that’s a new GPPE CSE), then Group Policy Local Users and Groups (another new GPPE CSE), then Folder Redirection (a classic Group Policy CSE), and so on.

Figure 8

Click on image for larger view

So on the surface, it appears that if you had a conflict with both classic Group Policy settings and newer GPPE settings, you could just see which one ran last and bank on that setting always “winning.”

But that’s only true if the two CSEs end up writing to the exact same places. While this is precisely what we encountered with the Internet Proxy server setting, usually two technologies don’t write to exactly the same place. The tie will be broken when an application is coded to look in the proper policies keys. And, if there’s a policy setting in those keys, the target application will honor the policy, not the preference.

In our mystery, it’s now easy to understand why the Internet Explorer GPPEs (listed as Group Policy Internet Settings) in Figure 8 “won” over the IE Maintenance settings (listed as Internet Explorer Zonemapping and Internet Explorer Branding). The new Internet Explorer GPPE CSE (Group Policy Internet Settings) applies after the original Internet Explorer CSEs.

But in neither case are we actually applying policy. We’re really just applying preferences—using two different kinds of technology. We finally got it to work the way we wanted when a true policy was applied, and Internet Explorer saw the policy in the policies keys and acted accordingly.

Whew. All this stuff can give you a headache. This “who will win” stuff is really confusing, and I haven’t tested every case. Be sure to test all interactions in a test lab before you roll out settings into production.

Other Items That Can Affect Group Policy and GPPE Processing

If you download Chapter 4 of Book 1 , you will learn about various policy settings found at Computer Configuration | Policies | Administrative Templates | System | Group Policy that have the configuration option to “Process Even If the Group Policy Objects Have Not Changed.” (It's in the section called “Using Group Policy to Affect Group Policy.”)

If this option is turned on for a particular CSE, then that CSE will always try to rewrite its configuration data—upon every single refresh. Again, that’s not the default for classic Group Policy, but it is an option on a CSE-by-CSE basis.

However, this same “always try to rewrite configuration data” mantra is held by the GPPE CSEs by default, but it can also be set such that the data is laid down once and never rewritten.

So knowing this information, you might have to do a little mental math to figure out which one is going to win if you have conflicting policies plus the wildcard settings.

The Group Policy Results reports, which is discussed in Chapter 2 of Book 1, are going to be helpful in figuring out which settings ultimately applied, but they’re not going to be helpful in your understanding of why the setting ultimately applied.

Hopefully, this newsletter helps you out. This section is lightly lifted from Chapter 10 of Book 1 where I discuss this topic in even more depth.

If you want to conquer Group Policy Preference Extensions, consider taking my Group Policy 2.0 Training at www.GPanswers.com/workshop.

OMG: Now Jeremy has Two Books on Group Policy!

I've been in deep, deep quarantine the last 9 months or so. I spent three quarters of a year to get the most awesome tips, tricks, how-tos, and deep-dive information on Group Policy to you. And it took two books to do it. So, let me explain how the two books work.

The books are Companion Books to each other. Not exactly "Volume I/Volume II." But, they do go together like peanut butter and jelly.

Lucy and Desi. Group and Policy.

You get the idea.

Start out with Book 1, which is really called Group Policy Fundamentals, Security, and Troubleshooting. You already know this book, but it’s been rev’d for 2008 with the following new superpowers:

  • How to create a modern management station with RSAT and the GPMC 2.0
  • GPMC 2.0 Features: Filters, Comments, and Starter GPOs
  • Microsoft’s Advanced Group Policy Management Tool (AGPM)
  • Powershell with Group Policy (ooohhhh yeahhh!)

And the crown jewels...

  • The Group Policy Preference Extensions: 21 new features you positively must have

But to make room for all that stuff, I moved some “Group Policy Friends of the Family” from Book 1 to Book 2. Book 2 is really called

Creating the Secure Managed Desktop: Group Policy, SoftGrid, and Microsoft Deployment and Management Tools. But now Book 2 is fortified with EVEN MORE AWESOMENESS. Re-read the title of Book 2 again. Let’s break it down:

The main title is:
“Creating the Secure Managed Desktop”

And you do that by first knowing Group Policy Fundamentals (that’s Book 1). You’ll take your Group Policy knowledge and put it to PRACTICAL use here in Book 2. Start out by using Microsoft new Microsoft Deployment Toolkit.

Then move on to create the managed desktop with Roaming Profiles, Offline Files, the Sync Manager and more.

Deploy software to your machines using Group Policy and Microsoft’s newest tool: SoftGrid. Yep, to my knowledge this is the only book that has any real, meaty SoftGrid coverage. We have three MEGA chapters on SoftGrid. You’ll learn how to deploy your first servers, learn all about the architecture, and learn how to sequence applications like a pro. Truly a one-of-a-kind resource. I had help from GPanswers.com Shortstop Eric Johnson with two SoftGrid chapters. Way to hit one (well, two) out of the park!

Continue on and learn how to lock down machines. Use WSUS to protect and patch your machines (thanks to Greg Shields for that awesome chapter), use Network Access Protection (NAP) to keep unhealthy machines off the network, and learn to use Windows SteadyState to put the full smackdown on your most critical machines.

Wrap up the book with a little printer magic and finishing touches, and I’m totally confident you’re going to love this newest member of the Group Policy book family.

Here’s the best part: you can pre-order copies at www.GPanswers.com/books. Or, better yet (and this is going to blow your mind)

you can download just specific chapters you might want, today, as eChapters

That’s right. I’ve worked it out so you can buy just the chapters you need. Some people will want BOTH the eChapters and the actual books. Some may want one medium. It’s up to you. Your choice.

Just head over to www.GPanswers.com/books and explore the books’ contents then select “Download eChapters now.” When you do, you’ll be able to select the chapters from each book. Go ahead and mix and match. Just put checkmarks next to the chapters you want to download and select “Buy Selected eChapters Now” as seen here.   We have a FAQ on the same page you should read before you buy. But by all accounts, people are very happy with their PDF purchasing experience.

If you want signed copies, select Pre-Order Your Signed Hard Copy Now. Then once we get the books in stock, we’ll send them to you right away.

We’re expecting the first one at the end of April, and the second one at the end of May.

So, not far off. Pre-order your hard copy now and you'll be the first kid on the block when the books come in. www.GPanswers.com/books .

Let me know what you think of the chapters as you download them!

About GPanswers.com Training

I hate the word "bootcamp," but I guess that's what it is. So, if you want your butt kicked in Group Policy (in a kind, gentle way), then join me for the full week of Group Policy awesomeness:

  • Two Day Essentials Group Policy Training and Workshop
  • Two Day "Group Policy 2.0" Training for Vista, Server 2008 and the Group Policy Preference Extensions and
  • One-Day Advanced Group Policy Training

"I finally figured out how we would block out USB ports, games and lockdown users. This alone made the entire class an extremely valuable and fun learning experience. I learned how to use Vista's event viewer to track a single event in group policy - so easy but powerful!

I learned how to set up various restrictions on a PC for different users. A tremendously valuable feature! I cannot wait to get back to the office and implement what I have learned.

I highly recommend the whole week to anyone who has anything to do with Group Policy. Nothing beats these classes, nothing." -- Mark Latham, PC Support Specialist, Mercy Regional Medical Center

Learn more about each course here:

https://www.gpanswers.com/workshop/courses/

You can take the full week, or join us for just the classes you need.

Announced Classes:

  • May 5 - 9: Kansas City, MO (Lenexa, KS, really)
    • Class is declared ON. If you sign up now, you'll be guaranteed a seat.
    • It's the full week: Group Policy Essentials Course, Group Policy 2.0 Catch-up and Advanced One Day Course
  • No other cities are announced yet. Maybe more coming soon, but I suggest if you want to get GP 2.0 with Group Policy Preferences training, then come to Kansas City!

For any public class, sign up online at: https://www.gpanswers.com/workshop/

What about OTHER CITIES in 2008?

We have a new "Suggest a city" form at https://www.gpanswers.com/suggest .

Even if you've used this before, please re-suggest your cities, as we have a new back-end tracking system. Thanks !

Private courses

I have limited dates remaining in 2008 for private classes. But call me soon, and we might be able to work it out. If you think you might want your own private in-house training (with all the personalized attention that affords), don't keep it a secret.

Call me.

If you have even a handful of in-house people interested in the training (about 6–8), the course pays for itself (since you don't need to ship people offsite!). I'll even travel overseas to the U.K., other parts of Europe, Japan—or wherever! Have passport, will travel!

Join the thousands of administrators (and managers!) who have gotten smarter using the technology they already have.

For a public class, sign up online at: https://www.gpanswers.com/workshop/.
For a private class, just contact me at [email protected] or call me at 302-351-8408.


 

Become a GPanswers.com Partner/Affiliate

Amazon had a great idea. Put up some links on your web site for stuff you love, and when people buy stuff you recommend, you get some extra dough. We now have a similar program. It's super easy to sign up and get started. We provide you with your own tracking links and you get credit each time someone signs up for a class or signs up to be on our Newsletter/Tips.

It's that easy. Learn more about the program and start making some extra dough today by checking out www.GPanswers.com/partners.

Don't forget our Sponsors

I can't tell you how often I hear that people LOVE the Solutions Guide we have at GPanswers.com/solutions. Inside, you'll find both free and third-party products which extend the reach of Group Policy, or let you do something you haven't discovered before!

So, head on over to the Solutions Guide and see what other goodies are available!

Be a GPanswers.com "Booster"

Do you feel you get value out of GPanswers.com and want to see us grow? Well, I'm a Group Policy guy, not a web guy, so I need to pay for my web services somehow and enhance the site and bring you more stuff (both features and content).

If you'd like to help out, please consider making a one-time donation, or become a monthly GPanswers.com Booster for just $5 a month. If you and just 500 other people do it, I'll be able to pay for all the web bills each month and really take the site up a notch.

To help GPanswers.com and donate, here's how:

Thank you for your support!

Subscribe, Unsubscribe, and Usage Information

If you've received this message as a forward from a friend, or are reading it online in the archives, you can sign up for your own newsletter subscription .

Also, if you want to unsubscribe, you can do that, too (but we'll be sad to see you go).

For all Subscription information, we have a one-stop-shop page at the following address: https://www.gpanswers.com/newsletter

You can use this information as you see fit, but if you're going to copy any portion, please FORWARD THE ENTIRE email.

While Moskowitz, inc. tries to ensure that all information is technically accurate, we make no warranty with regard to the information within. Please use at your own risk.

If you need personalized attention regarding subscriptions and unsubscriptions, just email me: [email protected]

Please POST your technical question on the GPanswers.com/community forum whenever possible.

If you have questions about ordering a book or signing up for a public class, contact my assistant Margot at: [email protected] . I endeavor to respond to everyone who emails.

Thanks for reading!

May 2008
14

Issue#27

  • Installing the GPPEs: Could they make it any harder?
  • Another newsletter coming soon !
  • Public GP Training Schedule Update
    • Cities that are scheduled for public courses
  • Subscribe, Unsubscribe, and Usage Information

Welcome to Newsletter #27.

As some of you know, the GPPEs, or Group Policy Preference Extensions are finally released.

They're here: they're real, and they're spectacular.

Apologies to Seinfeld fans everywhere.

But, even though they’re here, it’s going to take a little negotiating to make sure we don’t install them, then, right away blow ourselves in the foot. This is a the first in a multi-part newsletter series.

First, we'll talk about installing the GPPEs. A little later, I'll have updates for automatically installing the GPPEs, then another newsletter on how to deal with the "overlaps" that are now created in the various categories.

Additionally inside this newsletter -- where I'm having public training courses and more.

PS: I know my graphics have the word "width" in them. Working on fixing that, but I wanted to get the newsletter out ASAP and fix it later.

Getting Down to Business: Installing the GPPEs

Microsoft likes to call them the Group Policy Preferences. But I like GPPEs, so I’m going to keep calling them that.

The Group Policy Preference Extensions (GPPEs) look “different” than the rest of the Group Policy universe. That’s because they are different. They were born at Desktop Standard and integrated into Microsoft technology.

In all, it's a cool, cool brave new (or rather updated ) world. You can see the new Preferences node underneath User Configuration | Preferences and Computer Configuration | Preferences as seen here. You might be asking yourself: why don't *I* see these in my GP editor? Because you're not using Windows Server 2008 as your editor or the download update (which isn't yet released) called RSAT which contains the updates.

This is going to be a two-part newsletter. In this first part, we'll tackle installing the GPPEs. In the next part, we'll tackle one of the most misunderstood aspects of the technology. That s, why they are called Preferences in the first place and how they work differently than it’s Policy cousins.

Now that the GPPEs are available. How do you install them?

Well, it's different depending on the operating system. We'll explore that now.

The CSEs for Windows Server 2008

Everything you need to take advantage of the Group Policy Preference Extensions is already installed here. Both the management station pieces (where you define what you want to control) and the CSE piece (the .DLLs that process the GPOs).

So, if you wanted to get started using Group Policy Preference Extensions, you can do so immediately with very little effort by using a Windows Server 2008 machine.

The CSEs for Windows Server 2003, Windows XP, and Windows Vista

Again, for Windows Server 2003, Windows XP, and Windows Vista you need to download pieces to make the magic happen. Let’s examine each operating system, where to get the downloads, and how to install the pieces by hand.

The Group Policy Preference Extensions can be downloaded from http://tinyurl.com/2za5zz. You can also track them down by heading over to http://www.microsoft.com/downloads and searching for the word "Preference."

Windows XP and Windows Server 2003 machines also need a prerequisite called XMLlite, and it can be found at http://support.microsoft.com/default.aspx/kb/914783 .

Here's the trick. Neither the XMLlite prerequisite nor the GPPEs themselves are MSIs.

Nope, they're patches.

So, for Windows XP and Windows Server 2003, they're .EXE patches, and for Windows Vista they're a newfangled format called .MSU for Microsoft Update patch.

And, if you'll recall, Group Policy Software Installation cannot install patches. You need a "big tool" like an SCCM 2007 or WSUS which expressly handles patch management. Or, you'll need a script to install it en-mass for your systems.

Ugh, what a nightmare!

You'll always be able to install each piece "by hand" (which we'll explore first), but you'll also want a mass-deployment recipe to start really rolling this out. I'll provide a script which helps you roll this out to your machines, so you're not running around from machine to machine doing all the dirty work. I don't have this ready yet, but along with my pal Jakob Heidelberg, I hope to have something for you in the next several days.

Installing the Prerequisites and CSEs for Windows Server 2003, Windows XP by hand

If you’re installing the CSEs on Windows Server 2003, you’ll likely do each one by hand. This makes sense, as “mass deploying” and mass rebooting live servers can be, well, not good for your users. However, if you wanted to mass-rollout the CSEs, check out the section “Installing the Prerequisites and CSEs for all operating systems automatically.”

Again, both Windows XP and Windows Server 2003 have the prerequisite of XMLlite, a Microsoft middleware component. You can see the available command line switches in Figure X, if you want to do something fancy, or you can just double-click on the downloaded .EXE and kick off the installation. Figure: The XMLLite component's command-line switches

In my testing, the XMLlite components didn't require a reboot (but your mileage may vary.) Knowing this fact will come in handy when we try to automate the whole thing using a script. Next, in my testing, I simply double-clicked the .EXE which contained the CSE.

Once again, it didn't even require a reboot and it appeared ready to go. You might want to reboot once one the safe side for good measure.

You can verify the Group Policy Preference Extensions installed on Windows Server 2003 or Windows XP in Add or Remove Programs and clicking on "Show updates" as seen here. When you do, you'll see the hotfixes, like GPPE installation. Figure: You can verify that the Group Policy Preference Extensions were installed on Windows XP and Windows Server 2003 by selecting “Show updates.”

Installing the CSEs for Windows Vista by hand

The Windows Vista CSE ships as an MSU a Microsoft Update package as seen in Figure X. Just double-click on it and click OK to install, and you’re off to the races. Figure: Installing the Windows Vista MSU file is like installing an executable

Again, in my testing there was no need to reboot after completion, but it certainly couldn’t hurt. You can verify that the Group Policy Preference Extensions were properly installed by looking at Control Panel | Programs | Uninstall a program and then clicking “Turn Windows features on or off” as seen in Figure X.

Note the Group Policy Preference Extensions are on by default, and it’s not such a hot idea to turn them off. Note you can also see the MS KB update number as an installed update. Figure: You can verify that the Group Policy Preference Extensions were properly installed

Installing the Prerequisites and CSEs for all operating systems automatically

Again, at this point, we’re still working on a fully-automating script to install the prerequisites and the GPPE CSEs.

Hang tight.

That'll appear in a tip or newsletter or something else soon.

Thing we're going to tackle #2 (in a newsletter coming soon): How Does the Group Policy Engine Deal with Overlaps?

This is something that’s really, really confusing for a lot of people. And with good reason. There are lot of “similar and shared” areas in both Group Policy and the Group Policy Preference Extensions.

So to answer this question, there's the short answer, the middle-length answer and the long answer.

That'll be the next newsletter, which shouldn't be too far behind.

Hang tight, we'll explore this stuff at that point.  


About GPanswers.com Training

I teach three courses on Group Policy now .. usually in the same week:

  • Two Day Essentials Group Policy Training and Workshop
  • Two Day "Group Policy 2.0" Training for Vista, Server 2008 and the Group Policy Preference Extensions and
  • One-Day Advanced Group Policy Training

Learn more about each course here:

https://www.gpanswers.com/workshop/courses/

You can take the full week, or join us for just the classes you need.

Announced Classes:

  • March 17 - 21: Portland, OR:
    • This Class is ON. We have a really great group coming.
    • It's the full week: Group Policy Essentials Course, Group Policy 2.0 Catch-up and Advanced One Day Course
  • May 5 - 9: Kansas City, MO (Lenexa, KS, really)
    • Class is ALMOST ON. If you sign up now, you'll be guaranteed a seat.
    • It's the full week: Group Policy Essentials Course, Group Policy 2.0 Catch-up and Advanced One Day Course
  • No other cities are announced yet. Maybe more coming soon, but I suggest if you want to get GP 2.0 training to come to one of these cities.

For any public class, sign up online at: https://www.gpanswers.com/workshop/

What about OTHER CITIES in 2008?

We have a new "Suggest a city" form at https://www.gpanswers.com/suggest .

Even if you've used this before, please re-suggest your cities, as we have a new back-end tracking system. Thanks !

Private courses

If you think you might want your own private in-house training (with all the personalized attention that affords), I'd love to join you onsite!

If you have even a handful of in-house people interested in the training (about 6–8), the course pays for itself (since you don't need to ship people offsite!). I'll even travel overseas to the U.K., other parts of Europe, Japan—or wherever! Have passport, will travel!

Again, while the training course isn't officially endorsed by Microsoft, the class does have the distinction of being a suggested avenue for intense Group Policy training by members of the Group Policy, Microsoft Consulting Services, Security, and Product Support Services teams at Microsoft!

For a public class, sign up online at: https://www.gpanswers.com/workshop/ .
For a private class, just contact me at [email protected] or call me at 302-351-8408.


 

Don't forget our Sponsors

I can't tell you how often I hear that people LOVE the Solutions Guide we have at GPanswers.com/solutions. Inside, you'll find both free and third-party products which extend the reach of Group Policy, or let you do something you haven't discovered before!

So, head on over to the Solutions Guide and see what other goodies are available!

Be a GPanswers.com "Booster."

Do you feel you get value out of GPanswers.com and want to see us grow? Well, I'm a Group Policy guy, not a web guy, so I need to pay for my web services somehow and enhance the site and bring you more stuff.. (both features and content.)

If you'd like to help out, please consider making a one-time donation, or become a monthly GPanswers.com Booster for just $5 a month. If you and just 500 other people do it, I'll be able to pay for all the web bills each month and really take the site up a notch.

To help GPanswers.com and donate, here's how:

Thank you for your support!

Subscribe, Unsubscribe, and Usage Information

If you've received this message as a forward from a friend, or are reading it online in the archives, you can sign up for your own newsletter subscription .

Also, if you want to unsubscribe, you can do that, too (but we'll be sad to see you go).

For all Subscription information, we have a one-stop-shop page at the following address: https://www.gpanswers.com/newsletter

You can use this information as you see fit, but if you're going to copy any portion, please FORWARD THE ENTIRE email.

While Moskowitz, inc. tries to ensure that all information is technically accurate, we make no warranty with regard to the information within. Please use at your own risk.

If you need personalized attention regarding subscriptions and unsubscriptions, just email me: [email protected]

Please POST your technical question on the GPanswers.com/community forum whenever possible.

If you have questions about ordering a book or signing up for a public class, contact my assistant Margot at: [email protected] . I endeavor to respond to everyone who emails.

Thanks for reading!