What is AGPM4?
(Note: This tip may look familiar. It’s a “re-do” of something I blogged about back in 2008, but I wanted to re-talk about it, adding some new 2010 Juice to this 2008 discussion.)
Note: UK & European people / Aussie & New Zealand people… I have a special request at the VERY END of this email, so, please don’t ignore ! Just jump to the end right now if you only have a second.
Okay.. on with the deep thoughts of the day:
Dealing with GPOs can sometimes feel like you’re juggling grenades.
As soon as you open a GPO for editing, it’s already whizzing around your network,
replicating around your DCs and potentially available for any clients looking for
an update.
What if you’re in the middle of editing a GPO and you suddenly get called away, with, say a half-finished GPO?
Well, it’s likely at least SOME Windows machines will ask for that update and download it.
Also, I don’t know about you, but even with my daily GP comings-and-goings, I
still kinda wish there was an “Are you sure?” prompt when I’m editing stuff or
for when I’m about to do a bone-headed move.
Let’s think about all the times I wish I could put some process around my GP world. For instance, there
is no “Are you sure” when…
() Creating GPO
() Editing GPO
() Linking a GPO
() Deleting a GPO
You get the idea. There’s a lot of potential for quick damage there.
And, no way to see history of a GPO and “roll back” a set of changes once a GPO is rolled forward (though there is manual backup and restore capability.)
That’s why I like products that put a little “process” around GP management.
Microsoft’s AGPM v 4.0 was recently released as part of the MDOP subscription service (http://www.Microsoft.com/mdop) and it’s got some neat-o features. Since AGPM 3.0, there are a handful of new items, but nothing too radical.
It’s strange, but I ask a lot of people if they’ve even HEARD of Microsoft’s AGPM (Advanced Group Policy Management) product, and I often get blank stares.
So, in the interest of GP Public service, I’m here to clear up what it is and what it does. Let’s spend a quick minute discussing what it is and how to get it.
What it is: It’s one of the 6 tools which are part of the Microsoft Desktop Optimization Pak (MDOP).
What does it do: It puts “Change management” around GPOs, so you have a full trackable history of what people did plus a way to roll back if there are problems.
How to get it: MDOP is a yearly subscription service which is only available to Microsoft SA customers who then ADDITIONALLY pay about $10 a seat, PER year.
Holy moly factor: Yep. With the SA costs and the yearly ongoing $10 a sat, it can be expensive, but because MDOP is a set of 6 products, it’s actually a pretty good bargain overall. But it’s pretty understandable to have a strong reaction to the cost.
AGPM’s Philosophy: You can think of AGPM almost like a library system. (At least, that’s how I think of it.) Only one person can have a GPO “checked out” at any given time for editing. And those edits don’t happen ONLINE and LIVE. They happen OFFLINE and are trackable. Essentially removing any direct impact to live computers — until you’re ready to rock.
What’s new in AGPM 4.0 vs AGPM 3.0: There’s a smattering of stuff, but here’s the hitlist:
() Searchable names and fields within the “Change Control” node
() Windows 7 and Windows Server 2008 R2 compatibility
() Export / Import from “test lab” to “production” domain or forest
Note that two COMMON MISCONCEPTIONS about AGPM are:
1. You have to deploy some “client” or “agent” to every machine. False. Totally false. Yes, AGPM has a “client” piece, but it’s just a fancy way to describe the “GPMC-add-on” piece which shows the AGPM stuff within the GPMC.
2. You get the ability to control “more stuff” on your target machines. False. Totally false. Remember: Group Policy “magic” only occurs when you have a new CSE (client-side extension) on your target machine, which can pick up your “directives” inside the GPO. AGPM doesn’t do this. Products like Specops Deploy, BeyondTrust Priv Manager, and PolicyPak Application Manager all ship “true CSEs” which extend Group Policy’s magic and ability. AGPM does no such thing.
So, are you using AGPM? Here’s my one-question survey:
http://www.surveymonkey.com/s/TYBZXFB
PS: If you have no plans to be an SA customer and then get the MDOP suite, then, note you can get MDOP comparible functionality from 3rd party vendors, like NetIQ with their GPA product, Quest with their GPOAdmin product, or ScriptLogic with their Active Administrator product.
In the effort of full disclosure, note that some of those 3rd party vendors do occasionally advertise on GPanswers.com (but they didn’t know this email was going out until.. well, right this second.)
Other notes:
1. My new book thoroughly covers AGPM 4.0 in a deep, deep way. And, that chapter is totally, totally FREE. Head over to http://dev.gpanswers.com/book and click eChapters and find the AGPM chapter on the LEFT (GREEN) side. It suggests a way for you test this all yourself. You’re then also in the “right place” if you wanted to get your own signed copy of the printed book to get the rest of the story.
2. I’m doing a “Do more with Group Policy and PolicyPak” LIVE demonstration TOMORROW at 11.00 AM EST (weird time, I know.). But sign up for the free live demonstration at https://www.policypak.com/demo. See you there !
3. We’ve got lots of PEOPLE COMING in my upcoming class in Washington, DC / VA July 19th. Some discount seats still left. Honestly, these will not last long. $200 + Free book for the next three people who sign up at http://dev.gpanswers.com/training/live-courses.html and use discount code FIRSTFIVEDC at checkout.
3. If you’re in UK / Europe and might want me to have a public training class over there, please click this link: http://www.surveymonkey.com/s/R62QWFJ
4. If you’re in AUS or NZ, and might want me to have a public training class over there, please click this link: http://www.surveymonkey.com/s/RH79CXY
5. If you’re “happy and you know it” .. clap your hands. Just seeing if you’re paying attention.
Thanks for reaching the end of this long email. ?
PS: Going on vacation for a week after my talk on Friday. Diane is here all week if you need a PO for the class or any other special situation. 302-351-4903. Thanks Team !
Jeremy Moskowitz
GPanswers.com (Group Policy Community)
PolicyPak.com (PolicyPak Software)
Comments (0)