Michael Cross,
... Thomas W. Shinder Dr.Technical Editor, in MCSE (Exam 70-294) Study Guide, 2003 Another feature that is becoming increasingly popular is folder redirection, especially since
group policy makes this an easy task to perform. Through group policy, you can specify folder redirection for the following four system folders on the user system: Application Data Desktop My Documents Start Menu Folder redirection can be seen as a subset of roaming profiles. By specifying an alternate location for these folders on a network share, the user has access to these folders no matter which computer he or she uses to log on. Of the four folders that can be redirected, setting the My Documents folder for redirection is probably the most advantageous. Not only will the user have his
or her data available at any computer, but storing this data on the server allows the data to be easily backed up to tape or other offline storage media. As an administrator, you can also set quotas on server storage, helping to keep the size of the My Documents folder in check. You can also take advantage of the offline folders feature of Windows 2000 and Windows XP to keep the data available to users when they are not on the network. When setting up folder
redirection, you should allow the system to create the folders in the location where the data will be directed. A number of permissions must be set correctly to maintain security on the redirected folders. Your best bet is to let the system handle this part of the process. Folder redirection settings are located in the User Configuration area of the GPO under Windows Settings. To enable redirection of one of the four folders, follow these steps: Right-click the folder name and select Properties. In the Target tab of the window, you can select the setting to use for redirection, as shown in Figure 9.29.You can select between two options for the location of the redirected folder. The basic option redirects the folder to the same folder path for all users. For the Application Data and Desktop
folders, there are three options for the folder location: Creating a directory for each user in the path specified Redirecting all users to the same location Pointing the folder to the local user profile location Figure 9.29. Selecting Options for Redirecting My Documents If you choose to point the folder to the path in the user profile, the folder will point to the default location as if no redirection had been applied. Redirecting the folder to a specific location will create that location either on the network or on a local path, and all users who have this policy applied will point to the same folder. For the Start Menu and Desktop folders, this might be a beneficial setting, as you can centrally control the appearance and contents of those folders in one location, but you need to be aware of the security settings on the folder. The primary choice for this setting will probably be to create a folder for each user in a location specified, as shown in Figure 9.30. As you can see, when the root path is specified, the dialog box gives you an example of what the folder path will be.  Figure 9.30. Setting the Folder Location for Redirection The Start Menu and My Documents folders have slightly different options for redirection. When redirecting the Start Menu, you do not have the option of specifying a unique path for each individual user. Whether setting up basic or advanced redirection of the Start Menu, you can only specify one common location for all users or redirect the folder back to the local user profile. The Start Menu options are simpler than the Application Data and Desktop folder settings, but the My Documents options are more complex. When redirecting the My Documents folder, there are four location options for storing the folder. As with the Application Data and Desktop folders, you can store the My Documents folder in the local user profile, a common directory for all users, or have the system create a folder for each user in a common location. There is a fourth option, however, for My Documents. That option allows you to redirect the My Documents folder to the user’s home folder on the network. This option will not create a My Documents folder in the user’s home folder. It will simply point the My Documents folder to the user’s home directory on the network. There are a few items you should pay attention to if you consider implementing this option. First, you must have implemented the home folder settings for all users, and you must have created those folders prior to implementing this option. Second, the security settings on the home folder are not changed by the folder redirection policy, so you need to be aware of the settings applied to the user home folder on the network. Finally, you have the choice of including the My Pictures folder with the redirected My Documents folder, or having the My Pictures folder stored in a different location. This might be advisable if server disk storage is a concern. If you choose this option, the My Pictures item in the My Documents folder will be a shortcut pointing to the correct location for the actual folder. Exam WarningIt is likely that there will be exam questions related to folder redirection. Be sure you are able to spell out the differences in folder locations for the My Documents and Start Menu folders. You should also be able to explain how folder permissions are set in each of the different redirection settings. The advanced option allows you to select the folder location based on security group. This is one way to specify a different target location for the folder for different groups of users. You can set multiple security groups to have different target locations within a single GPO in the domain. Another way to accomplish this, especially if you only have a small set of users whose folders should be redirected, is to set folder redirection GPOs at other locations within the directory and filter access to those GPOs based on security. When selecting the advanced redirection option, you can add the individual security groups for redirection, and have the same choices for folder location as with the basic option. Setting advanced folder redirection is functionally equivalent to setting up multiple GPOs with basic redirection settings and security filtering. The difference is that there is only one GPO to manage instead of several. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9781931836944500155 Policies and Procedures for Securing XenAppTariq Bin Azad, in Securing Citrix Presentation Server in the Enterprise, 2008 Strategy for Configuring the User EnvironmentWhen setting group policy at the user level, you are creating an environment that will follow the user around the network. No matter what computer the user logs on to, the group policy settings inherited by that user will apply. This section covers some of the “shoulds” and “should nots” related to the user environment. One policy setting that will follow the user around no matter where he or she logs on is roaming profiles. Enabling roaming profiles for a user community will store all the user settings on a server rather than on the local computers. When a user logs on, all of his or her profile settings (Desktop items, My Documents, Registry settings, etc.) will be pulled off the server, ensuring that the user has the same environment on each computer he or she uses. This approach has many advantages, but it has disadvantages as well. Some profile settings are hardware-dependent, and if the computers used by the user do not have the same hardware, the user could encounter difficulty upon logon (video cards can be especially problematic in this regard). The vast majority of other group policy settings that you can apply to users in the directory have little chance of causing conflict with other settings on the local computer. Logon and logoff scripts, application settings, folder redirection, and environment configurations can help to standardize the user's computing experience across multiple machines, which can, in turn, ease the support burden on your IT staff. Are You Owned? Letting That One Client Through: Configuring GPOs in Mixed EnvironmentsMany organizations still use multiple operating systems on client machines. It should be noted that Microsoft's WMI features have only begun to mature, and client support for WMI only exists on Windows XP. Therefore, note that when configuring WMI filters for GPOs, Windows 2000 and earlier clients will ignore the WMI filter and the GPO will always apply regardless. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9781597492812000068 MCSA/MCSE 70–294: Working with Forests and DomainsMichael Cross, ... Thomas W. Shinder Dr.Technical Editor, in MCSE (Exam 70-294) Study Guide, 2004 Preparing DNSAny time a client requires access to Active Directory, it activates an internal mechanism called the DC locator for locating DCs through DNS. It uses SRV records for this. If no SRV records are found in DNS, the access fails. To prevent this failure, before renaming an Active Directory domain you need to be sure that the appropriate zones exist for the forest and for each domain. After you create the DNS zones for the new domain name, your DCs will populate each zone through dynamic update. This is one of the reasons for the reboot after the execution of the renaming script. Configure the zones to allow secure dynamic updates as a good security practice. Repeat the zone creation for each domain you plan to rename. Everything needed to support your existing Active Directory domain must be recreated to support the domain after renaming. Usually, this is accomplished by mirroring your current DNS infrastructure. As an example, say you want to rename an existing domain called Labs.dog.com to Retrievers.dog.com. If the zone containing your current SRV resource records is called Labs.dog.com, you will need to create a new DNS zone called Retrievers, dog. com. To analyze and prepare DNS zones for domain rename, first compile a list of DNS zones that you need to create. Second, create the forward lookup zones using the DNS tool and configure them to allow dynamic updates. The section Configuring DNS Servers for Use with Active Directory gives more detailed information. Head of the Class…What Happens to My Distributed File System When I Rename My Domain?First, those of you who are not using DFS should think seriously about it. DFS allows you to redirect specific folders like My Documents out to a high-availability network location where each user’s files can be backed up and protected. Folder redirection is a Group Policy extension that allows you to identify a connection between network servers or DFS roots and the local folders that you want to redirect. What happens to DFS when you rename a domain ail depends on how you have it configured. Think about it, If you use a domain-based DFS path like \\domainName\DFSRoot, then when the domainName goes away, what happens to the path? It goes dead, and everyone’s documents disappear, or become inaccessible. As far as the users know, all of their data is gone. Your telephone will ring by 5 a.m. the next day—guaranteed. What does it depend on, and how can you keep your telephone from ringing? If your Folder Redirection policy specifies the NetBIOS name of the domain in your domain-based DFS path, and you keep the NetBIOS name of your domain the same instead of changing it along with the DNS name, then you’re okay. What if you want to change your NetBIOS name along with your DNS name? You could push out a new group policy and move the files to another location. Temporarily, you could point your folder redirection to a stand-alone DFS path, or even to a simple server-based share. You should do that a couple of days before the rename just to be sure it works before shaking things up again—you’ll be too busy renaming to worry about DFS at that point. Since \\hostName\DFSRoot stays rock solid through a domain rename, your documents should still be available the next morning. When things settle down, restore the user files back to your domain- based DFS root and push out the old DFS policy again. That isn’t without risk, but it keeps things working. What about home directories and roaming profiles? Same thing. Look at the pathname you specify in your policy to determine whether they’ll break when you rename the domain. Make sure to fix those beforehand. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9781931836944500106 Feature focusDustin Hannifin, ... Joey Alpern, in Microsoft Windows Server 2008 R2, 2010 Administering group policyGroup Policy is widely used in Windows networks of all sizes to manage various user and computer policies. In this section, we will explore Group Policy and how to properly deploy it within an AD domain. Overview of Group PolicyGroup Policy was first introduced in Windows Server 2000 AD and was widely adopted as the standard method to manage user and computer configurations for Windows networks. Group Policy allows administrators to set and enforce settings on users and computers within the domain. These settings include security settings, restricting access to specific parts of the OS, and deploying software. At the core of the Group Policy is GPOs. GPOs contain the settings you wish to apply to computers or users and are applied locally or to sites, domains, or OUs within AD. Group Policy links and security filteringGPOs can be linked to AD sites, domains, or OUs. They can also be set up locally on individual computers. As you develop your GPOs, you will need to understand what objects you wish to apply the settings to. For example, if you want to prevent access to the Windows control panel for all users in the HR department, you could apply a GPO with those settings to the OU containing all the users in HR. Maybe you want to configure a specific Internet Explorer homepage for every user in the New York location. You could create a GPO with the IE settings defined and apply it to the New York AD site. In addition to linking GPOs, you can also filter them based upon security. A user or computer must have read and apply permissions to a GPO before it applies to him. You can limit which users or computers can apply a specific GPO by adding or removing them to the GPO permissions as seen in Figure 4.40. Figure 4.40. GPO permissions. Notes from the field GPOs apply to users and computers only. They do not apply to groups. Groups can be used to security-filter GPOs but you cannot apply a GPO to an AD group. Group Policy user and Computer Settings and preferencesEvery GPO has a User Settings section and a Computer Settings section which means it can apply settings to user objects, computer objects, or both. As you expand each section, you will see various settings that can be applied to user or computer objects. You can configure the following groups of settings within a GPO: ▪Software Settings—Software Settings allow you to use GPOs to deploy applications such as Microsoft Office. ▪Windows Settings—Windows Settings allow you to configure basic windows settings such as startup and shutdown scripts, folder redirection, and Public Key Policies. ▪Administrative Templates—Administrative Templates allow registry keys to be modified on systems applying the policy. This allows administrators to configure detailed settings for Windows and other applications, including Microsoft Office. Group Policy Preferences were first introduced in Windows Server 2008 R1. Group Policy Preferences allow for even more granular control of various Windows settings. Group Policy Preferences additionally have better targeting techniques such as applying the GPO to only specific OSs, specific hardware specs, or IP address ranges. Group Policy processing orderIt is important that you understand how Group Policy is applied and the processing order is used to apply GPOs. As mentioned earlier, GPOs can be set up on the local computer or applied to AD Sites, Domains, and OUs. When multiple GPOs are configured, the order in which they are applied to a user or computer is important. In the event of a conflict, the next policy applied will override the one that was applied before it. GPOs are applied in the following order: 1.Local Policies created on the computer 2.GPOs applied to AD Sites 3.GPOs applied to Active Directory Domains 4.GPOs applied to AD OUs 5.GPOs applied to AD child OUs Creating and managing Group Policy ObjectsGPOs are created using the Group Policy Management console in Server Manager. To create a new GPO, perform the following tasks: 1.Log on to a DC and open Server Manager. 2.Expand the nodes Features | Group Policy Management | <your forest name> | Domains | <your domain name>. 3.Right-click an OU where you want to create a new GPO and select the option Create a GPO in this domain and link it here. Optionally, you could right-click on the Domain itself if you wanted to assign the GPO to the entire domain. 4.Enter a name that describes the use of this policy. For example, HR Computer Policy. The new policy will appear under the OU you selected to apply it to (see Figure 4.41). Figure 4.41. Editing a new GPO. 5.Right-click on the newly created policy and select Edit. 6.The GPO management editor window will open. Here, you can configure specific settings for users and computers. In our example, we will configure the HR GPO to turn on branch cache as seen in Figure 4.42. After editing the setting, close the GPO management editor window. Figure 4.42. Editing GPO Settings. 7.The new GPO will now apply to all computers in the HR OU as seen in Figure 4.43. Figure 4.43. Newly created and applied GPO. We will now assume that we have a VPs OU that we want to be sure they do not get the new settings. To prevent them from having the GPO applied, we need to block inheritance. By blocking inheritance, we tell the OU to not apply any parent GPOs. To block inheritance to the VPs child OU, right-click the OU and select the option Block Inheritance. You should now notice that a blue exclamation appears over the OU as seen in Figure 4.44. Figure 4.44. Organizational Unit Blocking Inheritance. Troubleshooting Group PolicyGroup Policy can be one of the toughest technologies to troubleshoot in an AD deployment. Luckily, Microsoft has provided some good tools to assist with troubleshooting issues. GPUDATE and GPRESULTGPUDATE and GPRESULT are two command-line utilities you can run from a machine to perform a group policy update or display the results of the currently applied GPOs. ▪GPUPDATE can be used to update the current computer's Group Policy Settings. By issuing the/force parameter, GPUDATE will force a fresh push of policies down to the specific user and computer. ▪GPRESULT can be used to display currently applied GPOs and those that have been filtered out due to security settings or other configurations. If you do not see changes taking effect after creating a new GPO, run GPRESULT from the machine or user the policy is applied to. If it does not show up as applied, then you need to troubleshoot possible security misconfigurations on the GPO. Resultant Set of Policies and modeling toolsThe Resultant Set of Policies (RSOP) can be used to help iron out GPO conflicts. The RSOP will take a specific user and computer choice and will provide a report of what policies will be applied if the selected user logs on to the selected computer. RSOP can be very powerful in verifying your GPO configuration as well as troubleshooting issues. The Modeling tool is helpful when you are still planning your GPOs. The modeling tool allows you to walk through “whatif” scenarios for deploying Group Policy. This tool is very useful when blocking inheritance and enforcing GPOs. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9781597495783000049 MCSE 70-293: Planning, Implementing, and Maintaining Internet Protocol SecurityMartin Grasdal, ... Dr.Thomas W. ShinderTechnical Editor, in MCSE (Exam 70-293) Study Guide, 2003 Using RSoP for IPSec PlanningRSoP is a utility provided in Windows Server 2003 for gathering information to help you configure Group Policy in the way that best serves the needs of your network. It functions as a query engine that uses the Common Information Management Object Model (CIMOM) database to store this information. RSoP is used to sort through the complexities of applying multiple policies and determine the totality of their effects. This is important, because it can be very difficult to predict the outcome when Group Policy is applied at several different levels (site, domain, and OU), and some of those policies conflict. There are two modes in which RSoP can be used: logging mode and planning mode. Logging mode tells you the effects of the policy settings that are applied to the computer and currently logged-in user. Administrators can use RSoP in planning mode to check existing GPOs and search for all policy settings that can be applied. The results of this search can then be placed in a scenario-based simulation to view how the changes will affect the policies. EXAM WARNINGThe IPSec extension to the RSoP console is a new feature in Windows Server 2003, so you can expect to encounter one or more exam questions dealing with this topic. Ideal situations for using the RSoP tool include the following: ■Simulating the effect of policy settings on a domain, site, OU, computer, or user ■Determining the effective policies for a newly created account in your Active Directory domain ■Testing policy precedence, such as the user or the computer in different OUs, the user or the computer in different security groups, and when the user or computer is moving You can also simulate a slow network or create a network loopback situation. RSoP can provide network administrators with details such as security settings, scripts, Group Policy installation, folder redirection, templates, and Internet Explorer maintenance. EXAM WARNINGIf you need to use RSoP on a remote computer, you must be a member of the Domain Admins or Enterprise Admins security group, or be granted the Generate Resultant Set of Policy planning rights. Using the RSoP WizardYou can use the RSoP Wizard to create an RSoP query on your Windows Server 2003 server. You begin by adding the RSoP snap-in to an empty MMC console. You can also access RSoP through the Active Directory Users and Computers console and the Active Directory Sites and Services console. To access RSoP planning through the Active Directory Users and Computers MMC and start the RSoP Wizard, do the following: 1.Select Start | Programs | Administrative Tools | Active Directory Users and Computers. 2.Right-click the name of the domain or OU and select All Tasks. 3.Choose Resultant Set of Policy (Planning).
To access RSoP planning through the Active Directory Sites and Services MMC and start the RSoP Wizard, do the following: 1.Click Start | Programs | Administrative Tools | Active Directory Sites and Services. 2.Expand the Sites node in the left pane. 3.Right-click the name of a site and select All Tasks. 4.Select Resultant Set of Policy (Planning). To start the RSoP Wizard from a stand-alone RSoP MMC, right-click Resultant Set of Policy in the left pane and select Generate RSoP Data (or select it from the Action menu). The Wizard will display the query results in the RSoP snap-in. You can save, change, or refresh your RSoP queries. You can create more than one query by adding the RSoP snap-in to your console. The information that RSoP gathers comes from the CIMOM database through Windows Management Instrumentation (WMI).
|
