Group Policy. Jeremy Moskowitz
Чтение книги онлайн.
Читать онлайн книгу Group Policy - Jeremy Moskowitz страница 18
Название: Group Policy
Автор: Jeremy Moskowitz
Издательство: John Wiley & Sons Limited
Жанр: Зарубежная образовательная литература
isbn: 9781119035688
isbn:
Figure 1-19: The Sounds applet goes from four tabs to three tabs because the user is affected by the domain-level policy
Applying Group Policy Objects to the OU Level
OUs are wonderful tools for delegating away unpleasant administrative duties, such as password resets or modifying group memberships. But that’s only half their purpose. The other half is to be able to apply Group Policy.
You’ll likely find yourself making most Group Policy additions and changes at the OU level, because that’s where you have the most flexibility and the OU is the most refined instrument to affect users. Once OU administrators become comfortable in their surroundings, they want to harness the power of Group Policy.
Preparing to Delegate Control
To create a GPO at the OU level, you must first create the OU and a plan to delegate. For the examples in this book, we’ll create three OUs that look like this:
● Human Resources
● Human Resources Users
● Human Resources Computers
Having separate OUs for your users and computers is a good idea – for both delegation of rights and GPO design. Microsoft considers this a best practice. In the Human Resources Users OU in our Corp.com domain, we’ll create and leverage an Active Directory security group to do our dirty work. We’ll name this group HR-OU-Admins and put our first users inside the HR-OU-Admins security group. We’ll then delegate the appropriate rights necessary for them to use the power of GPOs.
To create the Human Resources Users OU using your WIN10MANAGEMENT machine, follow these steps:
1. Earlier, you created a “unified console” where you housed both Active Directory Users and Computer and the GPMC. Simply use Active Directory Users and Computers, right-click the domain name, and choose New ⇒ Organizational Unit, which will allow you to enter a new OU name. Enter Human Resources as the name. (Note that newer versions of Active Directory Users and Computers will ask you if you want to “Protect container from accidental deletion.” It’s your choice. I typically deselect the check box.)
2. Inside the Human Resources OU, create two more OUs —Human Resources Computers and Human Resources Users, as shown in Figure 1-20.
Figure 1-20: When you complete all these steps, your Human Resources OU should have a Human Resources Users OU and Human Resources Computers OU. In the users’ side, put Frank Rizzo and the HR-OU-Admins.
Alternatively, you can create the OU in the GPMC. Just right-click the domain and choose New Organizational Unit from the context menu.
To create the HR-OU-Admins group, follow these steps:
1. In Active Directory Users and Computers, right-click the new Human Resources Users OU and choose New ⇒ Group.
2. Create the new group HR-OU-Admins as a new global security group.
To create the first user to go inside HR-OU-Admins, follow these steps:
1. In Active Directory Users and Computers, right-click the Human Resources Users OU and choose New ⇒ User.
2. Name the user Frank Rizzo, with an account name of frizzo, and click Next.
3. Modern domains require a complex password for a user. Again, my suggested password is p@ssw0rd. That’s a lowercase p, the at sign, an s, an s, a w, a zero, then r, and d.
4. Finish and close the wizard.
If you’re following along, Frank Rizzo’s login will be [email protected].
Easily Manage New Users and Computers
The Computers folder and Users folder in Active Directory Users and Computers are not OUs. They are generic containers. You’ll notice that they are not present when you’re using the GPMC to view Active Directory. Because they are generic containers (and not OUs), you cannot link Group Policy Objects to them. Of course, these objects will receive GPOs if linked to the domain, because the containers are still in the domain. They just aren’t OUs in the domain.
These folders have two purposes:
● If you ever did an upgrade from NT 4 domains to Active Directory, these User and Computer accounts would wind up in these folders. (Administrators are then supposed to move the accounts into OUs.)
● The two folders are the default location where older tools drop new accounts when creating new users and computers. Additionally, command-line tools, such as net user and net group, will add accounts to these two folders. Similarly, the Computers folder is the default location for any new client workstation or server that joins the domain. The same goes when you create computer accounts using the net computer command.
So, these seem like decent “holding pens” for these kinds of objects. But ultimately, you don’t want your users or computers to reside in these folders for very long – you want them to end up in OUs. That’s where the action is because you can apply Group Policy to OUs, not to these folders! Yeah, sure, these users and computers are affected by site- and domain-level GPOs. But the action is at the OU level, and you want your computer and user objects to be placed in OUs as fast as possible – not sitting around in these generic Computers and Users folders.
To that end, domains that are at least at the “Windows 2003 functional level” have two tools to redirect the default location of new users and computers to the OUs of your choice. For example, suppose you want all new computers to go to a NewComputers OU and all new users to go to a NewUsers OU. And you want to link several GPOs to the NewUsers and NewComputers OUs to ensure that new accounts immediately have some baseline level of security, restriction, or protection. Without a little magic, new user accounts created using older tools won’t automatically be placed there.
Starting with Windows 2003 Active Directory, Microsoft provided REDIRUSR and REDIRCMP commands that take a distinguished name, like this:
Now if you link GPOs to these OUs, your new accounts will get the Group Policy Objects dictating settings to them at an OU level. This will come in handy when users and computers aren’t specifically created in their final destination OUs.
To learn more about these tools, see the Microsoft Knowledge Base article 324949 at http://support.microsoft.com/kb/324949.
To add Frank Rizzo to the HR-OU-Admins group, follow these steps:
1. Double-click the HR-OU-Admins group.
2. Click the Members tab.
3. Add СКАЧАТЬ