Microsoft created two ways to control local and domain security groups membership. One is Restricted Groups which can be set in the “Computer Configuration\Policies\Windows Settings\Security Settings\Restricted Groups” node of a group policy object. Right-click the node and specify the group to be managed. Any group on the local computer or in Active Directory can be restricted in both the “Members” tab and the “Members of” tab.

Windows Server 2008 R2, with PowerShell 2.0 and the GroupPolicy management module allows for powerful administration of Active Directory Domain Services (AD DS) based Group Policy. A question came up during a recent session of the Group Policy course, and then again the following week during a session of a PowerShell course. The distilled-down question […]

SQL Server 2008 supports Policy Based Management. When it was first announced it was called the Declarative Management Framework but PBM has stuck. It’s SQL Server’s version of Group Policy but luckily Active Directory is not involved at all. In fact, that was a requirement. I think Microsoft learned their lesson with Exchange 2000. It’s […]

/cast bronze drake That was the message I received from a person who was starting into a Group Policy lab exercise. Certainly, I wouldn’t think such strong magic would need be summoned to get through the lab, but it’s good to be prepared. Then again someone in class noted earlier in the week that I […]

Group Policy is a many-splendored thing. Like many other aspects of Active Directory Domain Services (AD DS), Group Policy has evolved over time, partly with respect to best practices that we recommend, tools and features from Microsoft, and third-party software and solutions. After having so much fun with Microsoft GPO Accelerator, some of my students […]

One of the most time consuming tasks in system administration is the process of locking down desktop computers. In the Security Options node of Group Policy a bewildering assortment of settings can be found. Enabling these settings on multiple computers can be a very repetitive experience. It is easy to miss a setting and configuration […]

When Active Directory was introduced with Windows Server 2000 a rumor circulated that the US federal government had forbidden the use of Group Policy Objects (GPOs) by its administrators until this new capability had been thoroughly studied.  That was probably a good idea since Group Policy can be extremely powerful and has the potential to […]

When Windows Vista was released in January of 2007 there was much discussion of the new Vista look, the Aero 3D enhancements, the programs menu with integrated search. What escaped notice by many was the enormous number of new group policy settings. In Microsoft’s words: “In Windows Vista, enhancements to Group Policy significantly improve the ability […]