Group Policy. Jeremy Moskowitz

Чтение книги онлайн.

      Again, I encourage you to try these examples in your test lab and not to try them directly on your production network. This will help you avoid a CLM (career-limiting move).

      For our examples, we’ll assume you’re using WIN10MANAGEMENT as your management station, which is a Windows 10 with RSAT machine.

      Active Directory Users and Computers vs. GPMC

      The main job of Active Directory Users and Computers is to give you an Active Directory object–centric view of your domain. Active Directory Users and Computers lets you deal with users, computers, groups, contacts, some of the Flexible Single Master Operations (FSMO) roles, and delegation of control over user accounts as well as change the domain mode and define advanced security and auditing inside Active Directory. You can also create OUs and move users and computers around inside those OUs. Other administrators can then drill down inside Active Directory Users and Computers into an OU and see the computers, groups, contacts, and so on that you’ve moved to those OUs.

      But the GPMC has one main job: to provide you with a Group Policy–centric view of all you control. All the OUs that you see in Active Directory Users and Computers are visible in the GPMC. Think about it – it’s the same Active Directory behind the scenes “storing” those details about the OU and its contents.

      However, the GPMC just doesn’t have a way to “view” the users, computers, contacts, and such. When you drill down into an OU inside the GPMC, you’ll see but one thing: the GPOs that affect the objects inside the OU.

      In Figure 1-8, you were able to see the Active Directory Users and Computers view as well as the GPMC view – rolled into one MMC that we created earlier. Even though it’s not super-obvious from the screen shot, the Active Directory Users and Computers view of an OU and the GPMC view of the same OU are radically different. For instance, in Figure 1-8 I’ve added (for the sake of this discussion) an OU called Temporary Office Help and some other OUs, too, for fun.

      When focused at a site, a domain, or an OU within the GPMC, you see only the GPOs that affect that level in Active Directory. You don’t see the same “stuff” that Active Directory Users and Computers sees, such as users, computers, groups, or contacts.

      The basic overlap in the two tools is the ability to create and delete OUs. If you add or delete an OU in either tool, you need to refresh the other tool by pressing F5 to see the update. For instance, in Figure 1-8 you could see that my Active Directory has several OUs, including the one I added named Temporary Office Help.

      Deleting an OU from inside the GPMC is generally a bad idea. Because you cannot see the Active Directory objects inside the OU (such as users and computers), you don’t know how many objects you’re about to delete. So be careful!

      If I delete the Temporary Office Help OU in Active Directory Users and Computers, the change is not reflected in the GPMC window until it’s refreshed. And vice versa.

      So, let’s summarize with three key points:

      ● Understanding that the two tools are “separate” and work on the same underlying database is key.

      ● Understanding that what you do in one tool (e.g., delete an OU) affects the other tool (because it’s affecting the same underlying database) is also key.

      ● The final key is realizing that you will need to occasionally “refresh” the view of each tool. This is because other administrators might be “doing stuff” to the GPOs and/or Active Directory user accounts. You won’t see their changes until you refresh your view.

      Adjusting the View within the GPMC

      The GPMC lets you view as much or as little of your Active Directory as you like. By default, you view only your own forest and domain. You can optionally add in the ability to see the sites in your forest as well as the ability to see other domains in your forest or domains in other forests, although these views might not be the best for seeing what you have control over.

      Here’s how to view the various other items you may need to within the GPMC:

      Viewing Sites in the GPMC When you create GPOs, you won’t often create GPOs that affect sites. The designers of the GPMC seem to agree; it’s a bit of a chore to apply GPOs to sites. To do so, you need to link an existing GPO to a site. You’ll see how to do this a bit later in this chapter.

However, you first need to expose the site objects in Active Directory. To do so, right-click the Sites object in GPMC, choose Show Sites from the context menu (see Figure 1-10), and then click the check box next to each site you want to expose.

Figure 1-10: You need to expose the Active Directory sites before you can link GPOs to them.

      In our first example, we’ll use the site level of Active Directory to deploy our first Group Policy Object. At this point, go ahead and enable the Default-First-Site-Name so that you can have it ready for use in our own experiments.

      Viewing Other Domains in the GPMC To see other domains in your forest, СКАЧАТЬ