Active Directory and Group Policy (GPO) with Labs

Explain domain-based GPOs, describe where GPOs are stored on domain controllers, perform common GPO management tasks with Windows PowerShell, and delegate administration for creating GPOs.

Explore domain-based GPOs in Active Directory, including the default domain policy and default domain controllers policy, and how they centrally configure domain users and computers.

Explore how group policy objects are stored as a container and template, with versioned updates and separate replication via DRA for containers and FRS/DFS-R for templates across domain controllers.

Use starter GPOs as templates in PMC starter to create GPOs and distribute settings, since they contain administrative template settings only and export to cabinet files for distribution.

Learn how to link a GPO to AD DS sites, domains, or OUs and how the scope includes child OUs, affecting users and computers.

Explore the hierarchical processing of group policy—from local to site, domain, and OU GPOs—where later settings can overwrite earlier ones.

Filter a GPO to specific groups using security filtering, ensuring allowRead and allowApplyGroupPolicy permissions, and include or deny exclusion for exemption groups to control scope.

Create WMI filters to target GPOs using WQL queries. Query Windows that meet criteria like OS version, service pack, and hardware, then consider performance and test before wide deployment.

Enable look-back policy processing to apply computer-scoped GPOs to users, using replace or merge modes to standardize desktops in classrooms, conference rooms, laboratories, kiosks, and VDI environments.

Explore how group policy handles slow links and disconnected systems, including client side extensions' processing decisions, software installation, and startup or logon script behavior.

Group policy takes effect after GPO and SYSVOL replication, token updates, and sign-in or restart. Use gpupdate to refresh and enable always wait for network at startup and logon.

Configure and verify domain controller security policies using the group policy management console, adjust password length and security log size, then validate with event viewer and GP update.

Build and optimize a group policy infrastructure in an active directory lab, configuring screen saver timeouts, registry editing tools restrictions, and loopback processing with two-hour timeouts for conference room computers.

Create and configure GPOs with the group policy management console, link policies, set screen saver timeout and registry editing tools, and manage scope, security filtering, and loopback processing.

Evaluate and troubleshoot group policy using RSOP, gpupdate, and GPMC; manage refresh intervals, event logs, and policy health to prevent issues.

Explore how the resulting set of policy RSoP reveals the net effect of group policy objects on users and computers, and learn to model scenarios with Group Policy Results Wizard.

Model and analyze group policy effects with what-if scenarios using Group Policy Modeling Wizard and Group Policy Results Wizard, simulating slow links, loopback processing, and WMI filters to generate reports.

Examine how group policy event logs in Windows Vista and later support troubleshooting by detailing system, application, and operational events for GPO issues.

Detect and monitor group policy health across large domains using the group policy management console. Compare GPO replication and versioning against a baseline to identify inconsistencies.

Analyze how security permissions and security filtering influence EU users' group policy logon scripts, across slow links, with domain-level enforcement and managers group exemption.

Update and save PowerShell help files across a domain by using a local network share, and enforce a group policy to set the default update source.

Learn to implement standardized desktop environments using group policy objects, administrative templates, folder redirection, software installation, scripts, and group policy preferences.

Discover administrative templates in user and computer GPOs, learn the available sections, and configure registry-based policies using .adm and .admx files, central store concepts, and practical management.

Administrative templates in group policy divide settings into user and computer sections, organized by areas like network and components, mapping to registry hives and admx/adml files; conflicts favor computer policies.

Compare adm and admx policy templates used by group policy, noting adm's markup language, admx's xml-based format, and language-specific adml descriptions stored in the policy definitions folder.

Create a central store for ADMX/ADML files so the Group Policy Management Editor uses consistent administrative templates; if unavailable, fall back to the local store, with updates replicated via DFS/FRS.

Learn to manage windows security settings with security templates and group policy: use security templates snap-in, security compliance manager, and import templates into GPOs for single or multiple machines.

Explore folder redirection and software installation with group policy, deploying scripts for logon, logoff, startup, and shutdown, and categorize configurations for user and computer settings.

Explore folder redirection, a feature that stores user folders on a network file server but presents them on a local drive, enabling synchronization, offline access, and data backup.

Learn to create and configure manual permissions on a shared folder for redirected folders, or let folder redirection auto-set subfolder permissions, with NTFS and share permissions for root and subfolders.

Create a shared folder named redir with read-write access for everyone, then configure a folder redirection GPO for documents toward redir share on long dc1 and test with gpupdate /force.

Manage the software lifecycle with Group Policy software installation, deploying, upgrading, maintaining, and removing apps across users or computers, while weighing advantages, limitations, and deployment options.

Demonstrates creating a logon script to display a message, linking a GPO in the domain, and testing results by signing into a client and forcing a group policy update.

Configure group policy preferences to tailor Internet Explorer settings with Internet Explorer options, Short Cards for favorites, and registry-based Internet Explorer configurations, and learn that item-level targeting cannot traverse forests.

Explore group policy preferences, with more than 20 extensions, applying items like drive mappings, shared printers, registry entries, shortcuts, and scheduled tasks in Windows Server 2008 and newer.

Learn to configure group policy preferences with actions like create, delete, replace, or update, set drive mappings, UNC paths, and drive letters in the General tab, and apply item-level targeting.

Explore item-level targeting in group policy preferences, using 27 categories and boolean logic to precisely target computers or user objects, with background refresh for dynamic management.

Demonstrate configuring a shared printer and a balanced power plan with Group Policy Preferences, applying item level targeting by IP range and Windows 10, and testing with gpupdate.

Configure Office 2016 settings with administrative templates via group policy, implement drive mapping and Notepad shortcut via policy, and enable folder redirection. Design GPO strategy for user desktops and servers.

Explore hands-on group policy administration for Office 2016, drive mappings, desktop shortcuts, and folder redirection via GPOs, security groups, and policy preferences.

Review how to manage user settings with group policy, including folder redirection to multiple servers, WMI filters and GPO permissions, and item level targeting for portable computers' power options.

Review why group policy settings require two sign-ins due to cached credentials, how a central store loads administrative templates, and how group policy settings differ from group policy preferences.

Discover how group policy processing uses a pull-based model from GPO objects, driven by client side extensions and the policy engine, with foreground or background execution and update now.

Explore how client side extensions interact with the group policy engine, how the policy client service enforces policy, and how registry and administrative template settings shape processing.

Learn that group policy applies user configuration to user objects and computer configuration to computer objects, and that linking user settings to a computer OU has no effect.

Demonstrate targeting computers and users with GPOs in a real Active Directory structure by linking computer policies to the Sales client OU and user policies to the Sales users OU.

Explore linking GPOs to containers, apply security filtering with groups like sales users, use WMI filters, and target GP preferences with item level targeting to control drive mappings.

Explore how GPO processing uses the LSD OU order: local, site, domain, and OU-linked GPOs, resolving conflicts in favor of the closest OU, with block inheritance and enforced links.

Illustrates the LSD OU GPO processing order by tracing Joe sales from local to site to domain to his sales OU, showing link order and last writer wins.