MDM & GP Tips Blog

Last week was a big week over here at the Group Policy HQ.

Here’s four fun and informative things that I think you’ll want to know.

Item 1: Quick, Informative Interview
Matt Hester, Tech Evangelist from Microsoft sits down with me and asks “What’s new and cool in modern GP?” When my wife saw this video, she dubbed it “Schmoozin’ with the Mosk.” Anyway, it’s fun and it’s here: 
https://moskowitzinc.infusionsoft.com/link/33465afc20/b8a1a0

2. My TechEd 2010 speech Replay — Application Smackdown with Applocker This was the #5 top-most rated session within all of the 900+ sessions at TechEd 2010. You get to check it out, for free! Learn how to smack down your apps.. Now! Here’s the link:
https://moskowitzinc.infusionsoft.com/link/33465afc20/bbaee0

Of course, when you’re ready for hands-on AppLocker training, I’ve got it in my GP Workshop, of course! (www.GPanswers.com/training) — in my GP 2.0 Catchup Class.. and more information in the newest book (www.GPanswers.com/book) in Chapter 8 — Implementing Security with Group Policy !

3. An article I wrote that found it’s way into Network world This was tweeted about 80 billion times last week… “Seven tips for using group policy in Windows 7”
https://moskowitzinc.infusionsoft.com/link/33465afc20/bebc20

And.. Lastly…
4. I’ve received lots of questions asking me: “Hey Moskowitz, is your book available as an e-Book somewhere?”

Yes, and yes again. Here’s what’s what:

1. If you want to get the newest book as a Kindle edition, you can get it from Amazon. Click here:
http://www.amazon.com/dp/0470581859/

2. There are some EXTRA (free) bonus chapters for the GREEN (newest) book here:
http://dev.gpanswers.com/books/extra-echapters.html#tabs
(look left)

3. I also have some (older, but still relevant!) eChapter (pay) PDF downloads at the same link:
http://dev.gpanswers.com/books/extra-echapters.html#tabs
(look right)

Also… if you buy the Kindle edition, I’m happy to sign your Kindle’s or iPad screen with a sharpie next time I see you. Just ask!

PS: Holy cow! HUUGE Class in DC coming up next week.. Super crazy excited. If you still want to come, I think we have a spot left. You MUST CALL at this point if you want to secure a seat. 302-351-8408.

PPS: I’ve had some upcoming “extra time” suddenly materialize after the DC class. If you think you / your company might be interested in a PRIVATE On-Site class, where I teach your team — PERSONALLY — how to overcome GP and desktop management challenges…  then just buzz me. I’m at 302-351-8408. We can talk about what your challenges are and how a GP class can help you out. Then, we’ll fit it into YOUR schedule. Talk with you soon. (The sooner you call, the sooner you’ll get over the issue your company has and you’ll be happier and more productive.)

Sometimes I get asked if there is anything that we can do to be “safer” around Group Policy usage.

The answer is a resounding “Yes.” Here are some quick tips for you to put into practice NOW, if you’re not already on the right track:

Tip 1: Create, link, then disable a GPO

Sounds counter-intuitive, but this tip can be a quick fix to a big problem. I don’t usually like “big fat GPOs with lots of stuff in them.” That’s not my preferred method of GPO creation. But there are clearcut times when you NEED multiple policy settings or multiple preference settings WITHIN a GPO .. and that’s a-ok.

The problem is, you won’t be able to “implement all the settings at once.” So, in essence you’ll have “half-created” GPOs replicating around with your clients getting those partially completed GPOs.

The tip is: Disable the GPO, add what you need to add, then ENABLE it. (You can choose your method: on the LINK, or on the GPO itself.)

So, if you’re working on setting up a GPO which dictates Firewall Rules, you want to ensure that they get ALL the firewall rules one time, instead of possibly downloading the GPO (incomplete) then re-downloading it later.

Tip 2: Think, then name.

This tip is easy to understand. Don’t name your GPOs “Our wonderful desktop settings” or “Everyone’s security settings” because that’s not descriptive enough. Surely there’s something SPECIFIC these GPOs could be named, like “Sales: Desktop Background” or “Marketing: Firewall Settings.” Clarity, clarity, clarity. You likely don’t work alone, so it’s important to be clear and deliberate in how you name your GPOs.

Tip 3: Use GP Comments

You can implement comments about the GPO itself and the settings within the GPOs. So don’t miss out by leaving “breadcrumbs” behind for “the next person” who edits those GPOs. Explain WHY you did something inside the GP comments. Your “future friend” will thank you !

I know you’re looking for more best practices, base-hits and big-wins you can use TODAY to make your world safer and more predictable.

I have exactly 4 spots left for my upcoming 5-day Group Policy Master Class (near Dulles Airport, airport code: IAD.)

I know the takeaways you get from the class will be mega-valuable and I guarantee this will help you with your upcoming Windows 7 rollout, create a smoother transition from XP and relieve the pain around desktop and security management. The best part is you’ll get the hands-on training you need for your real-world problems of today and tomorrow.

Knowing that budgets are tight, I’ve set up class at a hotel with a free airport shuttle (so no rental car needed) and a killer nightly hotel rate.

If you’re thinking about making it.. now is the time. Before the end of this week if you want a guaranteed seat.

Dates: July 19th (Monday) – July 22nd (Friday).

Ensure your seat by:

1. https://www.gpanswers.com/training/sign-up-now-live/
(I know the website says “The class is full” but I can take 4 more people !)

2. Calling 302-351-4903 and Diane will help you if you need an invoice for a PO. We need the PO in hand to guarantee your seat.

Also… !

“Manager’s Special” PolicyPak Webinar – Today at 2.30 PM EST.

Bring your IT Manager to my “PolicyPak: Save Time, Money, and Effort (and increase security and santity)” talk today. He / She only needs to stay for 15 minutes of the full 60 minute talk. So agenda is:

() “Manager-speak” (how the company will save Time, Money, and Effort) for 15-minutes
() “Geek speak” for 45-minutes with me and learn how to use my free PolicyPak software to make your life easier.

You BOTH need to sign up at https://www.policypak.com/demo

I’ll draw a free book for one lucky geek who brings his/her IT manager along!
Or… One lucky IT pro who brings his/her geek along!

That’s it. See you in the July 19th class or today online !

Jeremy Moskowitz
GPanswers.com (Group Policy Community)
PolicyPak.com    (PolicyPak Software)

Hey Team:

Short sweet tip, and a short sweet announcement.

Short sweet tip first:

You are the King or Queen of your castle, er, domain.

I like to think of every policy setting as a little “edict” that I’m forcing my user population to embrace.

Well, on the Policy side of the house there are a zillion policy settings that can be set to one of three states:

– Enabled,
– Disabled,
-or Not Configured.

Enabled means: “Do this thing, and do it at the level I’m currently working within.”

So, if you’ve got a GPO, link it over to the domain (thus affecting all user accounts in the domain) and Enable a policy setting like “Prohibit Access to the Control Panel.” Then, as expected, everyone in your kingdom will magically embrace the stone-cold fact that their days of messing around within the Control Panel are now over!

Huzzah! Mission accomplished! You and your other network sovereigns cry out with joy!

Except this decree affects YOU as well. Oops… Seems like you poured the burning hot oil on yourself on this one.

Okay.. Great. What are you to do?

Disable that same policy setting from earlier — but now, at a level that affects YOUR (the King and Queen’s men) accounts.

That’s right. Disable.

Disabled’s job isn’t (generally) to “disable” stuff. No, no!

The “Disabled” setting’s job is to “invert” a higher-level policy.

So, assuming you had an OU called “Exalted Leaders OU” and your account was in there, you could simply create a new GPO, link it over to the GPO named “Exalted Leaders OU” and edit the policy setting for the SAME SETTING — “Prohibit Access to the Control Panel.”

Except this time.. instead of ENABLING the policy — you’ll DISABLE it, thus rendering it innocuous to your user account.

It’s like your own “suit of armor” to avoid the burning hot oil.

Try it out and let me know what you think, either in the comments of this blog post on GPanswers.com.

Okay.. and now for the short, sweet announcement:

That is.. the upcoming Washington DC (Northern VA) class — July 19th is OFFICIALLY ON.

We already have 10 people signed up with guaranteed seats, and another 9 people “swearing on a stack of Group Policy Bibles” that they are working on POs and whatnot.

Since we only have so many seats, ensure your butt is in the right place by securing your seat before they’re all claimed!

Go to www.GPanswers.com/training.

And to answer your question before you ask it: Yes, yes.. the class is fully updated for WS08 and Win7. The result is that after the class is over, you’ll actually KNOW WHAT TO DO when you’re rolling out and managing Windows 7 and Windows Server 2008 and R2.

On that page, you can:

[] Read what the class is all about, and check out the hands-on lab content.
[] Watch the 20+ video testimonials.
[] Click SIGN UP and we’ll send you a Welcome letter. 

Oh, again: Everyone taking the class gets my newly updated book (Which, by the way, is FLYING off the shelves here at GP H.Q. Thank you, thank you, and sincerely thank YOU for being so enthusiastic and supportive.  My publisher says thanks, too.  ?  )

On Amazon it’s ranked #2 in “Networking books.”  Awesome!!

() Get your own signed copy: www.GPanswers.com/book.
() Get it on Amazon.. http://www.amazon.com/gp/bestsellers/books/377894011/

PS: Hey.. who’s gonna help me out and write some nice stuff on Amazon about the book? ? Thanks in advance !

(Note: This tip may look familiar. It’s a “re-do” of something I blogged about back in 2008, but I wanted to re-talk about it, adding some new 2010 Juice to this 2008 discussion.)

Note: UK & European people / Aussie & New Zealand people… I have a special request at the VERY END of this email, so, please don’t ignore ! Just jump to the end right now if you only have a second.

Okay.. on with the deep thoughts of the day:

Dealing with GPOs can sometimes feel like you’re juggling grenades.

As soon as you open a GPO for editing, it’s already whizzing around your network,
replicating around your DCs and potentially available for any clients looking for
an update.

What if you’re in the middle of editing a GPO and you suddenly get called away, with, say a half-finished GPO?

Well, it’s likely at least SOME Windows machines will ask for that update and download it.

Also, I don’t know about you, but even with my daily GP comings-and-goings, I
still kinda wish there was an “Are you sure?” prompt when I’m editing stuff or
for when I’m about to do a bone-headed move.

Let’s think about all the times I wish I could put some process around my GP world. For instance, there
is no “Are you sure” when…

() Creating GPO
() Editing GPO
() Linking a GPO
() Deleting a GPO

You get the idea. There’s a lot of potential for quick damage there.

And, no way to see history of a GPO and “roll back” a set of changes once a GPO is rolled forward (though there is manual backup and restore capability.)

That’s why I like products that put a little “process” around GP management.

Microsoft’s AGPM v 4.0 was recently released as part of the MDOP subscription service (http://www.Microsoft.com/mdop) and it’s got some neat-o features. Since AGPM 3.0, there are a handful of new items, but nothing too radical.

It’s strange, but I ask a lot of people if they’ve even HEARD of Microsoft’s AGPM (Advanced Group Policy Management) product, and I often get blank stares.

So, in the interest of GP Public service, I’m here to clear up what it is and what it does. Let’s spend a quick minute discussing what it is and how to get it.

What it is: It’s one of the 6 tools which are part of the Microsoft Desktop Optimization Pak (MDOP).

What does it do: It puts “Change management” around GPOs, so you have a full trackable history of what people did plus a way to roll back if there are problems.

How to get it: MDOP is a yearly subscription service which is only available to Microsoft SA customers who then ADDITIONALLY pay about $10 a seat, PER year.

Holy moly factor: Yep. With the SA costs and the yearly ongoing $10 a sat, it can be expensive, but because MDOP is a set of 6 products, it’s actually a pretty good bargain overall. But it’s pretty understandable to have a strong reaction to the cost.

AGPM’s Philosophy: You can think of AGPM almost like a library system. (At least, that’s how I think of it.) Only one person can have a GPO “checked out” at any given time for editing. And those edits don’t happen ONLINE and LIVE. They happen OFFLINE and are trackable. Essentially removing any direct impact to live computers — until you’re ready to rock.

What’s new in AGPM 4.0 vs AGPM 3.0: There’s a smattering of stuff, but here’s the hitlist:

() Searchable names and fields within the “Change Control” node
() Windows 7 and Windows Server 2008 R2 compatibility
() Export / Import from “test lab” to “production” domain or forest

Note that two COMMON MISCONCEPTIONS about AGPM are:

1. You have to deploy some “client” or “agent” to every machine. False. Totally false. Yes, AGPM has a “client” piece, but it’s just a fancy way to describe the “GPMC-add-on” piece which shows the AGPM stuff within the GPMC.

2. You get the ability to control “more stuff” on your target machines. False. Totally false. Remember: Group Policy “magic” only occurs when you have a new CSE (client-side extension) on your target machine, which can pick up your “directives” inside the GPO. AGPM doesn’t do this. Products like Specops Deploy, BeyondTrust Priv Manager, and PolicyPak Application Manager all ship “true CSEs” which extend Group Policy’s magic and ability. AGPM does no such thing.

So, are you using AGPM? Here’s my one-question survey:

http://www.surveymonkey.com/s/TYBZXFB

PS: If you have no plans to be an SA customer and then get the MDOP suite, then, note you can get MDOP comparible functionality from 3rd party vendors, like NetIQ with their GPA product, Quest with their GPOAdmin product, or ScriptLogic with their Active Administrator product.

In the effort of full disclosure, note that some of those 3rd party vendors do occasionally advertise on GPanswers.com (but they didn’t know this email was going out until.. well, right this second.)

Other notes:

1. My new book thoroughly covers AGPM 4.0 in a deep, deep way. And, that chapter is totally, totally FREE. Head over to http://dev.gpanswers.com/book and click eChapters and find the AGPM chapter on the LEFT (GREEN) side. It suggests a way for you test this all yourself. You’re then also in the “right place” if you wanted to get your own signed copy of the printed book to get the rest of the story.

2. I’m doing a “Do more with Group Policy and PolicyPak” LIVE demonstration TOMORROW at 11.00 AM EST (weird time, I know.). But sign up for the free live demonstration at https://www.policypak.com/demo. See you there !

3. We’ve got lots of PEOPLE COMING in my upcoming class in Washington, DC / VA July 19th. Some discount seats still left. Honestly, these will not last long. $200 + Free book for the next three people who sign up at http://dev.gpanswers.com/training/live-courses.html and use discount code FIRSTFIVEDC at checkout.

3. If you’re in UK / Europe and might want me to have a public training class over there, please click this link: http://www.surveymonkey.com/s/R62QWFJ

4. If you’re in AUS or NZ, and might want me to have a public training class over there, please click this link: http://www.surveymonkey.com/s/RH79CXY

5. If you’re “happy and you know it” .. clap your hands. Just seeing if you’re paying attention.

Thanks for reaching the end of this long email. ?

PS: Going on vacation for a week after my talk on Friday. Diane is here all week if you need a PO for the class or any other special situation. 302-351-4903. Thanks Team !

Jeremy Moskowitz
GPanswers.com (Group Policy Community)
PolicyPak.com (PolicyPak Software)

So, in a previous installment, we explored GPupdate /force.

One use, as we examined enabled us to move a user or computer account around in AD, and have it’s new location “magically picked up.”

Let’s examine the other use of of GPupdate /force. Let’s take a closer examination of how “GP does it’s thing.” When a user (or computer) get it’s first batch of GPOs, it has to download them.

Now, the good news is that WHAT it downloads is really, really small. Usually 1, 2, 3 or 4k ish. That’s KILOBYTES, like what my VIC-20 was packin’ back in the day.

So, okay. First myth busted: the download “payload” of Group Policy objects isn’t that big (under most circumstances.)

Now, it’s true that the stuff the GPO is DOING can have an impact. But, even then, it’s usually pretty nominal if you’re sticking mostly to GPPrefs and/or Admin Templates (registry settings.)

Okay. So, back to /force versus no /force. ?

So if your user or computer is just sitting there a while, it asks, every so often “Hey.. any updated (or new) GPOs out there for me?” If the answer is YES, it downloads JUST the new or changed GPOs and processes those.

Wow. Neat. So how does it KNOW which ones are NEW or CHANGED? The GPO Version number, of course. This is little internal counter (found on both the user and computer sides.) If either version changes, then blamo! the GPO comes down and is processed.

Okay, okay. Back to /force versus no /force.

When you run GPupdate by itself (no force) you’re “accelerating the hands of time” and forcing the user and computer side to ask “Hey.. any updated (or new) GPOs out there for me?” Again, if YES, those come down and apply.

Then why would you ever NEED /force ?

Honestly, under most circumstances.. you shouldn’t.

A key case when you WOULD need the /force would be, say, if someone with local admin rights did a no-no, like change a value that only the protected SYSTEM should get to. For example, if a local administrator deleted a registry key, which restricted access to the control panel. Now — REGULAR USERS cannot do this. But ADMINS can.

Then running a GPupdate — by itself — wouldn’t fix the problem. Only a GPupdate /force will “re-bring down” the settings — EVEN IF THE VERSION NUMBER HAS NOT CHANGED. Only this will shore up the hole that local admin has created.

That being said… On the other hand, I have seen plenty of times where GPupdate /force is like a kick to the system’s head. There is some magical quality about /force which does sometimes “jumpstart” you out of a problem, and .. whoa.. things seem to “just be all a-ok, ducky” right now.

Has the /force helped you get out of a pickle? Post your story to my GPanswers.com blog.

Ready to learn more? Group Policy University.. Live or Online.

Next Live.. the week of Seattle April 19th.
Online.. whenever you need it it.
One line: www.GPanswers.com/training

Great News!  The Windows 7 and Windows Server 2008 R2 Group Policy spreadsheets have been released! 

Microsoft has also placed all of the spreadsheets into one download page for easier access.

Click here to access the download page.