Group Policy Management

How do you manage your Group Policies? Do you use the Windows 2003 Group Policy Management Console? Or, are you using some third party tool?

One of my projects for this upcoming year is to expand the use of our Group Policies. I'm using them now for basic security and etc, but I know it can use some work.

I've just found this product called PolicyMaker which was aquired by m$.
http://www.desktopstandard.com/

It looks pretty good and I've signed up for a trial. This is avaiable for those who are already software assurance customers...

I use Windows 2003 Group Policy. I have to say, I like it a lot. But be careful as to what you enable/disable as it can have unexpected results.

I use the 2003 Group Policy on a limited basis...

One tip is to copy any default template before editing....that way you dont muck the template and can always revert back.

MLF

Yep, I'm also using the 2003 Group Policy MMC. It has worked so far for what I need. I just spent most of the day creating custom ADM files to tweak things that they didn't have settings for.

I make a backups on a regular basis using the GPMMC.

Windows 2003 Group Policy Management Console

2K3 GPMC for me too
still new to all of it as well
so for me it's all still fun :)

I am about to build me a W2K3 server for home, and will be setting it to run as a domain, with all bells and whistles
had problems on my MCSE 2k3 with GPO's, so any new 'toy' always welcome

just had a quick read through off the link
might do some more in depth into it too

always looking for more reading :D

what's the betting it ends up in Vista / Server 2k7 too :p
I know 2k7 is going to be CLI based, but there IS a GUI option going to be made ready eventually

Quote:

---

Originally Posted by foxyloxley

2K3 GPMC for me too
what's the betting it ends up in Vista / Server 2k7 too :p
I know 2k7 is going to be CLI based, but there IS a GUI option going to be made ready eventually

---

HuH?! You mean Exchange 2007? I haven't heard anything about Server going that route too... please point me to some docs if you've seen otherwise. I've read little about 2008. I'm still trying to get everything moved over to 2003! lol

I just got back from a 'Training Camp' doing my MCSE 2K3, and the instructor there was talking about it,
as I am looking to do MCSE 2K8 fairly soon too ........
and I should have put it down as 2K8 :p
but the word is it will be a CLI on server 2K8
and 'maybe' get a GUI option later

will look for links now ..........

Interesting... I'll have to download and play around with the Server 2008 beta. I know that they've been working hard on developing the windows powershell. The GUI that runs on top of that is just a bunch of options/switches that get appended to the powershell command. They've effectively worked backwards to try to give the same flexibility as linux... but just made it more difficult.

I started learning the powershell when I had to transition to exchange 2007. Some things are easy to do there, but it just seems clunky and it doesn't follow the rules that most other scripting languages (like perl) do.

Not only that, but when you need a script to query snmp, ssh or etc, you have to license that feature from someone else! (or write your own) What kind of crap is that? http://www.nsoftware.com/powershell/

Maybe I need to spend some more time learning powershell... but so far, I'm not impressed.

We use a 3rd party tool called PolicyMaker here. Seems to work fairly well (I don't work with it myself). Downside seems to be that a client needs to be on all the machines you wish to manage.

Quote:

---

and I should have put it down as 2K8
but the word is it will be a CLI on server 2K8
and 'maybe' get a GUI option later

---

Looks like the trainer has no clue what he is talking about. There will be a version of Windows Server 2008 called "Server Core." It will not have a GUI and will be used for systems that need an imbedded OS, or for bastion style IIS implementations, things that don't need the overheard of the GUI running.

But regular old Windows 2008 enterprise, etc... will have a GUI. Looks similar to vista. I played with it quit a bit at tech ed and also got to mess around with it when I did the exchange 2007 ignite training at a MS facility. There should not be as much speculation around what this product will have as the beta is available, and they have a ton of information detailing the differences between 2003 server and 08 server.

Also not sure why people would think that Exchange 2007 is CLI only. You have both the Exchange management console, and the Exchange powershell console. Just about everything that can be done in powershell can be done in the GUI. Most of the things that can not be done in the GUI in 2007 RTM have been added into the GUI with 2007 SP1. There are still some things that can only be done with powershell for exchange 2007.

Quote:

---

Server Core features:

* Allows administrators can choose to install a minimal installation of Windows Server with specific functionality and without any unneeded features. The server roles available are:
o Dynamic Host Configuration Protocol (DHCP) server
o Domain Name System (DNS) server
o File server
o Active Directory® Domain Service (AD DS)
o Active Directory Lightweight Directory Services (AD LDS)
o Windows Media® Services
o Print Management
o Windows Server Virtualization
* Reduces software maintenance
* Decreases the attack surface of the server
* Reduces management
* Requires less disk space

---

http://technet.microsoft.com/en-us/w.../bb725831.aspx

The information is out there. Get it straight from the source and don't depend on "trainers" to give you good information.

I really like powershell. And given that the only released version is powershell for Exchange I don't see a problem that right now it is kind of limited in how it interacts with other parts of the OS. Right now it is intended to give easy scriptable access to common things done inside of the OS. I'm sure as more and more people start to use it you will see more and more free plug-ins and already written scripts to do custom type things that the MS engineers did not think about. From an exchange management perspective it is a god send in very large implementations. I don't have to run LDAP queries and then dump stuff into excel or access to do high level queries any more. I can write a single command that will select, sort, output the data however I tell it to... It makes automating redundant and boring admin tasks a breeze.

Wow...great info Monaughn

I like the min install...just the stuff you need...

Reminds me of a novell server I worked on many moons ago...where you would load an admin console when needed...otherwise it just hums along with out all the overhead..

You must spread some Reputation around before giving it to mohaughn again.
:?

MLF

Monaughn: I didn't see your edit until now. Anyway, you can use the Powershell for various windows admin tasks. You don't have to use it just for exchange tasks. I'm in a small environment, so it doesn't help me out that much.

Just for fun, I tried to convert some of my hacked together perl scripts into powershell but I kept running into walls. If you want better features, (like networking), you have to pay for it. For example: I wanted to write a powershell script to ssh into X number of routers and sftp the config to a server. Can't do it unless I go to some third party and pay for their commands. :(

Phish- Yes, I know it can also do limited OS stuff right now, but the full OS version of powershell will not be available until 2008 RTM. You can run a beta version on XP, or run the 2008 beta. I've not noticed any differences in the 2008 powershell beta and the XP beta.

So the only official RTM version that I'm aware of right now is the exchange command console. It is very possible that the RTM version of server 2008 will have more cmdlets available than what is available right now.

Different applications will load different cmdlets for use in the powershell.

It is even possible to create your own cmdlets, so with some .net programming knowledge. That is why I think once 2008 goes RTM we will see more people developing custom cmdlets.

Unfortunately any type of remote commands from Microsoft will probably only support other MS products. So if you want to sFTP into a router, powershell may not ever support that natively. MS really seems to be pushing RDP and remote console and their own secure file transfer improvements in 2008.