Group Policy preferences

hls_grouppolicy

Last week at IT Forum in Barcelona, Microsoft announced the upcoming releases of Group Policy preferences (formerly PolicyMaker Standard Edition and PolicyMaker Share Manager by DesktopStandard).

 

Microsoft acquired DesktopStandard last year and, along with some fantastic people, we obtained GPOVault and most of the PolicyMaker family. GPOVault has been updated and released as Advanced Group Policy Management (AGPM), part of the Microsoft Desktop Optimisation Pack for Software Assurance (MDOP). 

Where Group Policy preferences will be included

Group Policy preferences, formerly known as PolicyMaker Standard Edition and PolicyMaker Share Manager, will be available in two ways. Preference extensions for creating and managing preference items will be integrated into the Group Policy Management Console (GPMC) in:

  • Windows Server 2008
  • Remote Server Administration Tools (RSAT) for Windows Vista, which will be available as a separate download in the Windows Server 2008 timeframe and will also work in a Windows Server 2003 environment

The client-side extensions (CSEs) for Group Policy preferences are included in Windows Server 2008, and will be available as a separate download for:

  • Windows Vista RTM and later
  • Windows Server 2003 Service Pack 1 and later
  • Windows XP Service Pack 2 and later

What Group Policy preferences can do for you

Group Policy preference items increase the manageability of Windows Server 2008, Windows Vista, Windows Server 2003, and Windows XP, and reduce the TCO of servers and client computers running those operating systems. With Group Policy preference items, you have:

  • Simpler configuration via common user interfaces, and reduced need to create and maintain complex configuration scripts.
  • Item-level targeting to give you more precise control over the application of preference settings
  • Flexibility for how preference items are applied – a Group Policy administrator can initially configure a preference item, but allow the end user to change the settings later
  • Richer configuration within an image, so you need fewer images

 

  • The ability to use Group Policy to manage:

Windows settings

  • Applications: Extensible for ISVs to create simple Group Policy preference settings for their applications. 
  • Drive Maps: Create, modify, or delete mapped drives, and configure the visibility of all drives.
  • Environment: Create, modify, or delete environment variables.
  • Files: Copy, modify the attributes of, replace, or delete files.
  • Folders: Create, modify, or delete folders.
  • Ini Files: Add, replace, or delete sections or properties in configuration settings (.ini) or setup information (.inf) files.
  • Network Shares: Create, modify, or delete ("un-share") shares.
  • Registry: Copy registry settings and apply them to other computers. Create, replace, or delete registry settings.
  • Shortcuts: Create, modify, or delete shortcuts.

Control Panel settings

  • Data Sources: Create, modify, or delete Open Database Connectivity (ODBC) data source names.
  • Devices: Enable or disable hardware devices or classes of devices.
  • Folder Options: Configure folder options; create, modify, or delete Open With associations for file name extensions; create, modify, or delete file name extensions associated with a type of files.
  • Internet Settings: Modify user-configurable Internet settings.
  • Local Users and Groups: Create, modify, or delete local users and groups.
  • Network Options: Create, modify, or delete virtual private networking (VPN) or dial-up networking (DUN) connections.
  • Power Options: Modify power options and create, modify, or delete power schemes.
  • Printers: Create, modify, or delete TCP/IP, shared, and local printer connections.
  • Regional Options: Modify regional options.
  • Scheduled Tasks: Create, modify, or delete scheduled or immediate tasks.
  • Services: Modify services.
  • Start Menu: Modify Start menu options.

How to learn more

To learn more about Group Policy preferences, see:

 

To learn what else is new for Group Policy in Windows Server 2008, see:

 

Benefits of Group Policy Preferences

The following list summarises the benefits of using Group Policy preferences in your environment:

· Improving IT Productivity

Group Policy preferences extends the Group Policy feature set with over 20 new extensions, helping you get more done with tools that are already very familiar to you. It also enables you to configure and deploy settings at a central source, rather than repackaging and redeploying the settings when you update configurations. You simply edit the GPO that contains the preference items you want to update. Preferences provide a central location from which you can completely manage user and computer configurations.

· Reducing Need for Logon Scripts

Although Group Policy preferences might not eliminate the need for logon scripts, it significantly reduces their need. The most common tasks performed by logon scripts are installing printers, mapping network drives, configuring registry settings, and copying files and folders. Often, these tasks require complex scripting, testing, and debugging.

· Limiting Configuration Errors

Configuration errors during and after deployment are often a significant source of support calls and escalations that lead to higher deployment costs. Group Policy preferences significantly help reduce these costs. First, preferences allow you to configure items with a higher level of precision than other tools. For example, you can configure a single Internet Explorer option without touching other settings. Other deployment methods often change more options than you intend. Second, you can configure items without knowing their details—where to find them in the registry or what they represent. Instead, Group Policy preferences collects preference items using clear, familiar, easy-to-use dialog boxes that prevent you from needing to know how Windows stores the value in the registry. You can configure a Start menu setting by selecting an option in a preference item instead of having to know what value to store in the registry and where to store it. And, Group Policy preferences all but eliminate the need to use default user profiles to deploy settings. Often you deploy far more with a default user profile than you need to deploy, and this can lead to unreliable configurations.

· Enhancing End-User Satisfaction

More consistent, reliable configurations make users happy by maintaining or even increasing their productivity. Additionally, using Group Policy preferences to configure users and computers, you can make using Standard user accounts more palatable to users. Group Policy preferences use the local System account by default, enabling it to configure settings that users can’t configure. By configuring these settings on behalf of users, you can often avoid the issue altogether—which is proactive IT.

· Minimising Image Maintenance

Using Group Policy preferences with a thin-image strategy, you can significantly reduce the time and cost of maintaining disk images. Instead of updating images to reflect configuration changes, you can deploy a generic image and then update Group Policy preferences. This approach reduces engineering and testing time—and costs—significantly.

· Reducing Overall Image Count

Group Policy preferences, in combination with a thin-image strategy, helps you reduce the number of disk images you must develop and maintain. If you build thick images, you often create unique images for different groups of users in the organization. Instead, you can build and deploy a generic image for each group, and then configure users and computers uniquely by targeting preference items.