Local Group Policy objects (part 1) : Administrators and Non-Administrators Local GPOs

Local Policy Object

This is the most generic of the three local GPOs. If you are familiar with earlier versions of GPOs, the basic premise of the Local Policy Object is identical to the original design of the local GPO for Windows 2000 or Windows XP Professional. This GPO should be used to include the generic settings that affect all users. Of the three local GPOs, it has the weakest precedence. Any settings in this GPO apply to all users who log on to the computer. Furthermore, if there is a conflicting setting with this GPO and any GPOs from Active Directory (or the other two local GPOs), this GPO will not take precedence for that setting.

To access this GPO, you use the Local Group Policy Editor. To access the Local Group Policy Editor, type gpedit.msc in the Run dialog box.

The Local Group Policy Editor opens, exposing the Local Computer Policy, as shown in Figure 1.

Figure 1. The Local Computer Policy can be opened in the Local Group Policy Editor by running gpedit.msc.

Note that this local GPO includes settings for both the computer and user accounts. This is not the case for all local GPOs. This GPO is used to configure all settings for the computer and user in a generic manner.

Administrators and Non-Administrators Local GPOs

One of the new local GPOs that comes with Windows Vista is not just one GPO, but two. Together, the Administrators and Non-Administrators local GPOs give you the ability to separate those users who are seen by the local desktop as administrators from standard users on the desktop.

This structure of local GPOs is ideal for both normal desktops and specialized desktops, such as kiosks, training room computers, and shared computers. The Administrators local GPO applies only to user accounts that have membership in the local Administrators group on the desktop. Because this group is controlled at the desktop level, each desktop can have a unique list of members. You use the Administrators Local GPO to override the Local Policy Object when the administrators need more privileges than other users and the Local Policy Object is too confining.

The Non-Administrators local GPO applies to all users who are not affected by the Administrators local GPO. By deduction, this includes all users who log on to the desktop who do not have membership in the local Administrators group. You use the Non-Administrators Local GPO to modify the Local Policy Object settings, or as an alternative to configuring the Local Policy Object.

Access to these local GPOs is not as simple as it is for the Local Policy Object. These GPOs are exposed by using the Microsoft Management Console (MMC). To access them for editing, follow these steps:

Note that these two local GPOs have only User Configuration settings, not Computer Configuration settings, as shown in Figure 2. This is because a computer cannot have membership in the local Administrators group, so there is no way to differentiate between the two types of computers.

Figure 2. The Administrators local GPO and the Non-Administrators local GPO can be edited in the MMC; they offer control over User Configuration settings only.

Any settings that are configured in both the Local Policy Object and one of these Administrator GPOs are controlled by the Administrator-based GPO.

User-Specific Local GPOs

There are some instances in which you would like to have more precise control over the settings on a computer. This is not possible with the Local Policy Object, the Administrators GPO, or the Non-Administrators GPO. These GPOs are for “groups” of users, not specific users.

The final local GPO option is to specify a unique set of policy settings for a local user account. This is an ideal solution for controlling users logging on to kiosks or other specialized desktops throughout the enterprise. With user-specific local GPOs, you can create a custom environment that will allow for a more relaxed or more strict set of policy settings.

As with the Administrators local GPOs, access to user-specific GPOs requires the use of the MMC and involves several steps. Follow these steps to access the user-specific local GPOs:

As with the Administrators local GPOs, the user-specific local GPOs contain only User Configuration settings, as you can see in Figure 3.

Figure 3. The user-specific local GPOs can be edited in the MMC; they offer control over User Configuration settings only.

The user-specific local GPOs give you control over User Configuration settings, which is logical. Because these GPOs involve user accounts, it would not make sense for them to configure computer-related settings.

Precedence

If you review the local GPOs from the more generic to more specific, you will see the overall precedence structure. The most generic local GPOs have the weakest precedence, and the most specific local GPOs have the highest precedence. Table 1 lists the affected settings of each local GPO and their precedence in relation to local and Active Directory–based GPOs.