Windows Group Policy, Microsoft policies, security administrative settings

Who is this Group Policy Section for?

Administrators who want to plan their Windows 2003 Group Policy.
Experienced network managers who wish to lockdown their users’ Start menu.
Network Architects who need to turn a desktop vision into reality.
Those interested in an overview of XP policies.

‡

What are Windows 2003 Group Policies?

With planning, Microsoft’s Group Policies can control every aspect of a computer desktop. Whilst the master plan is to control the configuration of both the user and the computer settings, the technique is to define each setting once in an Active Directory Group Policy. For example, if you need to change everyone’s proxy server, the add the IP addresses to a Group Policy rather than edit every Internet Explorer manually.

It may help to remember that Group Policies manipulate registry values, consequently, if the item that you want to control is in the registry, then it can be set by a policy. Where registry keys do not have ready-made policies, it is possible to create your own policy templates. However, designing your own templates would be a specialist job for your developers.

Group Policy Contents

Some say Microsoft has created 700+ group polices for XP, while others tell me that there are over 850. What ever the exact total, the point is that Group Policies are here to stay, and that each new version of Windows will bring yet more settings to organize the desktop. Here are the commonest policy categories for XP / Windows Server 2003. Incidentally Windows Server 2003 SP1 added hundreds more Group Policies, particularly to the Inetres (Internet Explorer) section.

Security settings, passwords: length, frequency, lockout duration.
Desktop settings, which icons appear, and which are features are hidden.
Software assigned to the user, which programs are available from the start menu.
Folder redirection, where is the ‘My documents’ are stored?
Settings which dictate the operating system behaviour, for example, disable unnecessary services such as IIS or telnet.

Guy Recommends: Permissions Analyzer – Free Active Directory Tool

I like thePermissions Monitor because it enables me to see quickly WHO has permissions to do WHAT. When you launch this tool it analyzes a users effective NTFS permissions for a specific file or folder, takes into account network share access, then displays the results in a nifty desktop dashboard!

Think of all the frustration that this free utility saves when you are troubleshooting authorization problems for users access to a resource. Give this permissions monitor a try – it’s free!

Download Permissions Analyser – Free Active Directory Tool

Guy’s Group Policy Mission

My mission is to bring each Group Policy category or folder to life. I want to save you time by concentrating on what I consider are the best settings in each Group Policy folder. Look out for ‘Guy’s top selections’ on each page. Occasionally, I express an opinion that a policy is of limited use – no sitting on the fence! However, even if a policy is only needed for specialist configurations, I still point out its purpose, just in case it applies to your situation.

Before you begin evaluating policies, I urge you to decide on the security rating of your organization. It is important to have a reference point, otherwise it will be difficult to gain a perspective of what makes sense for your users. My advice is aimed at those who need medium security setting for their domains; therefore, if you are a high or low security company then make the necessary adjustments when assessing my selections. Windows Group Policy Settings

Remember, that the more security that you enforce, the more work there will be for you. For instance, do not insist on 14 letter, complex passwords, just because they are the highest settings. However, if there is a good business case for this level of security, then fair enough, but does take on extra help desk staff to cope with the resultant password lockouts.

Pre-requisites for Creating Policies

The advice and screen shots in this section are designed for Windows Server 2003.
You have installed the GPMC (Group Policy Management Console), available as a free download from Microsoft’s site.
You create a test OU. (Not essential, but safer than using the default domain policy.)
right-click your OU, Properties, Group Policy. Click on Open.
right-click on your OU, and select ‘Create and Link a GPO Here..’
right-click your policy, then edit.