Active Directory 2008 : Implementing Group Policy (part 5)

Log on to SERVER01 as Administrator.

Open the Group Policy Management console from the Administrative Tools folder.

Expand Forest, Domains, the contoso.com domain, and the Group Policy Objects container.

Right-click the Group Policy Objects Container in the console tree and choose New.

In the Name box, type CONTOSO Standards. Click OK.

Right-click the CONTOSO Standards GPO and choose Edit.

Group Policy Management Editor appears.

Right-click the root node of the console, CONTOSO Standard, and choose Properties.

Click the Comment tab and type Contoso corporate standard policies. Settings are scoped to all users and computers in the domain. Person responsible for this GPO: your name. Then click OK.

In this scenario, the Contoso corporate IT security policy specifies that computers cannot be left unattended and logged on for more than 10 minutes. To meet this requirement, you configure the screen saver timeout and password-protected screen saver policy settings. You use the search functionality of Group Policy to locate the policy settings.

Expand User Configuration\Policies\Administrative Templates.

Spend a few moments browsing the settings beneath this node. Review the explanatory text of policy settings that sound interesting to you. Do not make any configuration changes.

Right-click Administrative Templates in the User Configuration node and choose Filter Options.

Select the Enable Keyword Filters check box.

In the Filter For Word(s) text box, type screen saver.

In the drop-down list next to the text box, choose Exact.

Click OK.

Administrative Templates policy settings are filtered to show only those that contain the words screen saver.

Browse to examine the screen saver policies that you have found.

In the Control Panel\Personalization node, click the policy setting Screen Saver Timeout. Note the explanatory text in the left margin of the console’s details pane.

Double-click the policy setting Screen Saver Timeout.

Review the explanatory text in the Help box.

Click Enabled.

In the Seconds box, type 600.

In the Comment box, type Corporate IT Security Policy implemented with this policy in combination with Password Protect The Screen Saver.

Click OK.

Double-click the Password Protect The Screen Saver policy setting.

Click Enabled.

In the Comment box, type Corporate IT Security Policy implemented with this policy in combination with Screen Saver Timeout.

Click OK.

Close the GPME.

Changes you make in the GPME are saved in real time. There is no Save command.

In the Group Policy Management console, right-click the contoso.com domain and choose Link An Existing GPO.

Select the CONTOSO Standards GPO and click OK.

On SERVER01, start Control Panel, and then click Appearance.

Click Change Screen Saver.

Note that you can change the screen saver timeout and the option to display the logon screen on resume. Close the Screen Saver Settings dialog box.

Open Command Prompt and type gpupdate.exe /force /boot /logoff.

These options of the Gpupdate.exe command invoke the most complete Group Policy refresh. Wait until the command has completed.

Return to the Screen Saver Settings dialog box. Note that you can no longer change the screen saver timeout or resume option.

In the Group Policy Management console, in the console tree under the Group Policy Objects container, select the CONTOSO Standards GPO.

On the Scope tab, notice that the GPO reports its links in the Links section.

Click the Settings tab to see a report of the policy settings in the GPO.

If you have Internet Explorer Enhanced Security Configuration (IE ESC) enabled, you are prompted to confirm that you want to add about:security_mmc.exe to your Trusted Sites zone. Click Add. In the Trusted Sites dialog box, click Add, and then click Close.

Click the Show All link at the top of this settings report to expand all sections of the report. Notice that the policy setting comments you added are part of the settings report.

Point to the text for the policy Screen Saver Timeout. Notice that the policy title is actually a hyperlink. Click the link to open a new window that shows the explanatory text for the policy setting.

If you have IE ESC enabled, you are prompted to confirm that you want to add about:security_mmc.exe to your Trusted Sites zone. Click Add. In the Trusted Sites dialog box, click Add, and then click Close. If a Script Error dialog box appears, click Yes. If you continue to have problems clicking the Screen Saver Timeout link, open Server Manager and disable IE ESC.

In the Group Policy Management console, click the Details tab. Notice that your GPO comments appear on this tab along with GPO version information.

Write down the Unique ID shown on the Details tab.

In Windows Explorer, open the following folder: \\contoso.com\SYSVOL\contoso.com\Policies.

Double-click the folder with the same name as the GPO’s Unique ID.

This is the GPT of the GPO.

In Windows Explorer, open the %SystemRoot%\PolicyDefinitions folder.

Open the en-us folder or the folder for your region and language.

Double-click ControlPanelDisplay.adml. Choose the Select A Program From A List Of Installed Programs option and click OK. Choose to open the file with Notepad and click OK.

Turn on Word Wrap from the Format menu.

Search for the ScreenSaverIsSecure text.

Note the label for the setting and, on the next line, the explanatory text.

Close the file and navigate up to the PolicyDefinitions folder.

Double-click ControlPanelDisplay.admx. Choose the Select A Program From A List Of Installed Programs option and click OK. Choose to open the file with Notepad and click OK.

Search for the text shown here:

<policy name="CPL_Personalization_ScreenSaverIsSecure" class="User"
            displayName="$(string.CPL_Personalization_ScreenSaverIsSecure)"
            explainText="$(string.CPL_Personalization_ScreenSaverIsSecure_Help)"
            key="Software\Policies\Microsoft\Windows\Control Panel\Desktop"
            valueName="ScreenSaverIsSecure">
   <parentCategory ref="Personalization" />
   <supportedOn ref="windows:SUPPORTED_Win2kSP1" />
   <enabledValue>
      <string>1</string>
   </enabledValue>
   <disabledValue>
      <string>0</string>
    </disabledValue>
</policy>

Identify the parts of the template that define the following:

In the Group Policy Management console, right-click CONTOSO Standards and choose Edit.

Expand User Configuration\Policies\Administrative Templates, and then click Administrative Templates.

Note that the node reports Policy Definitions (ADMX Files) Retrieved From The Local Machine.

Close the GPME.

In Windows Explorer, open the following folder: \\contoso.com\SYSVOL\contoso.com\Policies.

Create a folder named PolicyDefinitions.

Copy the contents of the %SystemRoot%\PolicyDefinitions folder to the \\contoso.com\SYSVOL\contoso.com\Policies\PolicyDefinitions folder you created in the previous step.

In the Group Policy Management console, right-click CONTOSO Standards and choose Edit.

Expand User Configuration\Policies\Administrative Templates, and then click Administrative Templates.

Note that the node reports Policy Definitions (ADMX Files) Retrieved From The Central Store.