Group Policy Team Blog

Group Policy Cmdlets in Windows PowerShell Released!

2009-11-03T19:21:00Z

In a previous post, Lilia wrote an Introduction to Windows PowerShell Cmdlets in Windows 7. Windows PowerShell is a command-line shell and scripting language that helps IT professionals achieve greater productivity and control system administration more easily without the need for a programming background.

PowerShell also introduces the concept of a cmdlet (pronounced "command-let"), which are specialized commands in the PowerShell environment that implement specific functions. In addition to more than two hundred core cmdlets that ship with PowerShell, you can also write your own cmdlets and share them with other users. To that end, the Group Policy Management Console (GPMC) ships with several PowerShell cmdlets that you can use to configure registry-based settings and various GPMC tasks.

You can use these Group Policy cmdlets to perform the following tasks for domain-based Group Policy objects (GPOs):

· Maintain GPOs: GPO creation, removal, backup, reporting, and import.

· Associate GPOs with Active Directory Directory Services (AD DS) containers: Group Policy link creation, update, and removal.

· Set inheritance and permissions on AD DS organizational units (OUs) and domains.

· Configure registry-based policy settings and Group Policy Preferences Registry settings.

To learn more about these Group Policy cmdlets, including how to access the cmdlets, which cmdlets are available, how to use the cmdlets, and examples that you can copy and paste into your PowerShell console session or script, visit the TechNet topic “Group Policy Cmdlets”

Enjoy!

Tom Archer, Programming Writer

Group Policy Preferences : Colorful and Mysteriously Powerful, just like Windows 7

2009-11-02T20:01:00Z

How could something like CRUD be desirable? In Group Policy world, even the impossible becomes possible. In this entry, you’ll discover why Red does not mean Error and what the different colors mean when you make a Preference item. Read on!

Let’s talk about some of the intricacies of Preferences, specifically what we fondly refer to as CRUD options. Now, keep in mind, CRUD only applies to “stuff”, meaning things you can create and delete on the client, like mapped drives and shortcuts and printers. There are no CRUD options for things you just make changes to but don’t create, like “folder options”. More on this at the end.

Despite it’s unfortunate acronym, CRUD is very useful. It is also the reason those little spots of color get associated with you new Preference items. Select one of the four actions from the drop down menu to choose between Create, Replace, Update, and Delete. That decides how your Preference item will be pushed onto the client. Let’s take drive mappings as an example.

This is the Preference item

(in UI) (in XML)

Now, under the “Action” drop down, you have four options : Create, Replace, Update, Delete

Create – If a drive mapping doesn’t exist for this user for the share “\\share\userDocuments\”, then create one. If there already is one, don’t do anything! It’s a kind, gentle sort of policy, it won’t overwrite anything you already have, so it has a Green icon associated in the UI.

Replace – Remove whatever drive mapping exists for this share, and create a new one with these settings. If there isn’t one, just create it. No matter what, you’re getting this drive mapping, whether something existed there or not. It’s very insistent, like the bully of the CRUD options, so it gets a Red icon.

Update – Yellow – If that drive mapping exists, it will be updated with the settings specified here. If there are other settings associated with the drive mapping that aren’t specified here, they will be maintained. If no drive mapping exists for this share, create it. Nothing gets blasted away like with the Replace setting, but there is still a chance that you’ll overwrite something, so it gets a Yellow icon (warning! make sure you know what you’re going to be over-writing!).

Delete – X mark – If that drive mapping exists, it will be removed. That’s it, it’s just removed, so it gets an ‘x’ icon. It does not roll back, it gets deleted.

What did we learn? Red does not mean error! X marks the (delete) spot. Another picky note is that if you choose the “remove when no longer applicable” option under the common tab, it’ll force the CRUD action to Replace.

So, really, I’d recommend reading the help associated with each Preference item to make sure you know what you’re doing.

Hope that helps!

liliaG aka @superlilia

P.S. The end! Here’s more on my stuff vs. state discussion. Stuff means something that can be created or deleted on the client machine / user account. Think of at is as something you can see appear. It has a new icon that becomes associated with it: when you add a new printer, an icon appears that looks like that printer in your Devices window. When you add a shortcut to the desktop, that shortcut appears. Similarly, when you remove a local security group, it is gone, the icon is removed, the group no longer exists. That doesn’t mean that not all local security groups are gone, just that instance of one.

State is a state of being, like folder options. You can’t “create” a folder options, but you can make changes like “Show all hidden files”.

GP Preferences has both of these types of things, but CRUD only applies to the stuff bits. You can’t configure CRUD for state, and the UI isn’t there to let you try.

P.P.S. Here’s the help in the product:

Cross post: Terminal Server 2003 issues with Group Policy Preferences History Folder

2009-10-28T18:47:00Z

I blogged on my blog today an article on Windows 2003 Terminal Servers and Group Policy Preferences issues with History folders. In the article I discuss why this occurs and what we have done about it.

Over to there...

Michael Kleef, Program Manager

Windows 7 - Do I need to change my Active Directory for new Group Policy features?

2009-10-27T08:31:00Z

Now that you’ve obviously purchased, installed, and started playing with your Windows 7 client, you’re probably fantasizing about all the great things that will happen to your environment when you upgrade all of the machines in your site / OU / domain / basement to Windows 7 as well. Let me tell you, it’s going to be great. Why? Because you’ll have GP Preferences client side extensions installed already in all of those Windows 7 clients! That means that you can map drives and push out shortcuts and add printers and configure power plans for all these Windows 7 machines from your own Windows 7 client (with RSAT) or with Windows Server 2008 R2.

To answer the question in the title, NO, you do not need to change your update your Active Directoy (if it's at least 2000, when Group Policy came about) to take advantage of sweet new Group Policy features and settings. The exception is if the application that the setting is relevant to requires an AD upgrade, like BitLocker. This is a good article on configuring BitLocker in your AD, written by the guys on the Directory Services team: http://blogs.technet.com/askds/archive/2009/08/18/bitlocker-and-active-directory.aspx

Also - check out an overview plus good getting started tips on this website: Group Policy Management for IT Pros. If there was anything in the above paragraphs that you have questions on, read this article first. Seriously.

http://windows.microsoft.com/en-US/windows7/Group-Policy-management-for-IT-pros

Have fun! Go Preferences!

LiliaG (@superlilia)

Group Policy Changes in Windows XP SP3

2009-10-20T16:33:00Z

Im seeing tons of people on forums trying to find the Group Policy Changes in XP SP3 and Windows 7. It seems that both Google and Bing dont return the relevant results if you search for “Group Policy Changes XP SP3” because of all the noise of people asking where they are…

So for your enjoyment they are all here: http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=18c90c80-8b0a-4906-a4f5-ff24cc2030fb

Enjoy!

Michael Kleef, Program Manager

TechEd Europe - Windows Server 2008 R2 GP Changes Session

2009-10-13T22:37:00Z

I mentioned previously that I might be attending TechEd Europe this year to present on Windows Server 2008 R2 Group Policy changes. Well its confirmed. I am definitely coming! (Yeah!!)

So I started to think about what you might like to see from my sessions....and rather than me guess about what you want to see, Im going to turn it over to you to make the call. I want to hear from you!! If youre planning on attending TechEd Europe and youre interested in this session how about you just comment on this blog entry with what you want.

If your content idea makes it into my session, I promise to give you kudos for your idea and may even bring gifts along if I can get the marketing guys to give me stuff (no promises there as they are a pretty cheap bunch :) )

My current core ideas are:

A brief recap on the work done in Vista/WS08 (as many customers didnt deploy that and dont know about all the cool stuff we did in it)
Some GPP changes
The new GP Powershell work
Coverage of some of the new GP extensions
Any known impacts in moving from XP/2003 to W7/WS08R2

The details of each of these areas and any extra ideas I will leave up to you! (BTW - If I dont get any feedback I will just do what I had planned with my own ideas :) )

Let the feedback roll in!

Michael Kleef, Program Manager

Managing Power with Group Policy Preferences: TechEd Online Video

2009-10-09T17:51:00Z

We've mentioned managing power a couple times here on the blog, including a brief introduction and a detailed step-by-step walk through by Alan Burchill (shows how to configure power options that consider Business Hours vs . Off Hours using Group Policy Preferences targeting). Here's a high level discussion of GP Preferences and why managing power using GPP will save money, time, and energy in a TechEd Online video.

Note: there's a bit of pre and post conversation chiat chat between Alan and I about my trip to Australia, so avoid it by skipping ahead to the 2:15 mark and stop at about 6:00.

The TechEd Online link is here:

http://www.msteched.com/online/view.aspx?tid=5da3f6a6-779a-45a9-9bab-a8b7c204da07

LiliaG, Group Policy PM, @superlilia

Interested in managing desktops with an online service? Get in on the private beta!

2009-10-07T21:29:09Z

Want to test out and use new bits for Microsoft’s new hosted management service? A good friend to the Group Policy team is the System Center Online team, who announced the first version of their product at MMS 2009.

They are looking for qualified customers to be part of their fall beta, check out the full details here:

http://blogs.technet.com/systemcenteronline/archive/2009/09/23/system-center-online-desktop-manager-beta-is-coming-soon.aspx

If you are an IT pro who manages an IT environment, look into this! They’ve been working with members of the Group Policy team to create a cool hosted management experience. The beta includes the following:

Updates Management: Manage the Microsoft updates from a web-based console. Review available updates, choose updates and deploy to selected computers or groups of computers. Imagine WSUS from the cloud.
Policy Settings: Provides the ability to configure operational settings of the Windows Update and Anti-Malware agents installed on the client computers.
Anti-malware : Review anti-malware, anti-virus status and remedial actions from the SCODM console. Ensure managed computers have up-to-date signatures.
Assets Inventory: Collect detailed hardware and software inventory on managed computers. View this information in reports. Use the License reconciliation feature to load your Microsoft volume license agreement information and compare installed application quantities with licensed quantities.
Alerts : Helps you quickly and easily find problems (or potential) on your computers. You can also get help on how to solve the problem or how to start troubleshooting.

If you are chosen, here’s what they expect from you:

Active involvement in discussion groups, good feedback and bug reporting
Ability to deploy to a number of test PCs (preferably 5 or more)
Test on a variety of browsers, Windows operating systems, and PC architectures.
Ability to run through all the documented core scenarios and provide feedback

I’m going to test out some of this stuff tomorrow, you can too!

LiliaG, Group Policy PM

AGPM: GPLinks are being destroyed each time I deploy

2009-10-05T21:35:00Z

A customer reported an issue to me recently where the customer reported that when using AGPM 3.0, each time they deployed out to production, their GPLinks were being destroyed.

Why is this occurring?

What’s probably relevant here is to outline what’s happening and why.

When AGPM manages GPO’s it performs all its editing offline. When you have finished editing your GPOs and “Deploy to Production”, what you're essentially doing is overwriting the GPO with the new information. It does this operation with everything that AGPM knows about including:

GPO settings
Access Control Lists (security filtering and management)
GPLinks

Anything that you do in the Production object before this occurs will be overwritten with AGPM deploys its new object information. This means if you make a GPLink change in production and then don't tell AGPM about it, the object AGPM has will overwrite those changes next time around and you will wonder what happened.

This problem is compounded by the fact that AGPM doesn’t offer any ability to manage GPLinks (or Security Filtering) within AGPM itself – this is all done with GPMC and Imported into AGPM later.

So how do you make sure AGPM knows about GPLink and Security Filter changes?

There are actually two ways to do this though the best way is to make the GPLink and Security Filtering changes to the Production object and then do an “Import from Production” operation. This essentially takes a copy of everything in production and pulls it into AGPM. Note that in this case the reverse can occur where changes in AGPM are overwritten by the production object. Heres a good way to make sure you capture everything you want:

Make your GPO changes (if necessary) in AGPM
Deploy to production
Make any necessary changes to GPLinks and Security Filtering
Import from Production

This ensures that the settings stay the way you want and the GPLinks and Security Filtering are preserved and known by AGPM for that particular object. From then on you can make all the settings changes you want and AGPM will continue to push out the correct GPLinks and Filtering (unless of course you want to change it again)

Hope this helps

Michael Kleef, Program Manager

Configuring a Power Plan with Group Policy Preferences (by Alan Burchill)

2009-10-01T01:39:00Z

Alan and I had a great time presenting about Group Policy Preferences at TechEd Australia a few weeks ago. He did a quick demo in our session about configuring Power Schemes; here's the breakdown in more detail. He captures the idea of targeting power plans to be sensitive to the time of day, so you can be more efficient when people are out of the office. Go-go-Preferences Targeting!

Read it from his blog here: http://abskb.spaces.live.com/blog/cns!8834054641A09100!1133.entry

Enjoy!

LiliaG, GroupPolicyPM

How to use Group Policy Preferences to manage Windows Power Plans

One of the new feature of Group Policy Preferences in Windows 7 and Windows Server 2008 R2 is support for configuring power plans using preferences for Windows Vista and later (see Image 1). You used to be able to control power management in Vista using native policies however the advanced targeting of preferences now enables lot of new scenarios with power savings. AWESOME!

Image 1. Creating a new Windows Vista and Later Power Plan

One of the really neat things that you can do with Group Policy Preferences (GPP’s) and Targeting is change the power scheme of a computer based on the time of the day and the day of the week. This allows you to apply more aggressive power plans to your workstations after hours but then then back off during the day when people are working. Even though that Windows Vista (and Windows 7) support adaptive display time out which backs off the screen saver timeout when a user is still sitting at a computer but not actively using it, they still have to wake up the computer by before the timeout started to back off. Applying the less aggressive power plan during working hours means that the user is less likely to have to keep waking up their computer in the first place as you have configured longer time out values.

Now if this sounds familiar you’d be right as I did demo some of this during my TechEd Australia Group Policies session that I did with Lilia Gutnik and it is similar to the TechNet Edge video by Michael Kleef and Mark Gray. But in this article I am going to diving a lot deeper than my demo or in the TechNet Edge video.

So before we talk about how to do this first lets go over what we are trying to achieve. We are assuming you manage a fleet of workstations that are only used during standard business hours and afterhours you want the computers to go to use as little as power as possible. You want to apply different power plans to the computers not only based on the day of the week but also the time of the day to make sure you get maximum possible power savings (see Image 2).

Image 2. Example power plan timetable

So to do this we setup two separate power plans, with one that is applied by default all the time and the other one that will take precedence and apply during business hours.

How to setup the Default Power Plan Policy

Step 1. Create a Power Plan under the User Configuration option of a GPO that has has aggressive power savings configured without any targeting other than being applied to all the users you want to control the power plans. I will leave the exact details of the power plan up to you but I will recommend that if you are going to set the “Sleep” timeout for Windows Vista (or greater) then make sure you also enable the “Allow hybrid sleep” option (even on your desktops) (see Image 3.) as this will protect your computers from data loss if you lose power to your office environment afterhours.

Image 3. Enable hybrid sleep mode

Step 2. Rename the item to be called something like “Default Power Plan” (see Image 4) and also make sure that it is always set to order number one.

WARNING – If you do this make sure you either immediately disable the item (tool bar > red circle “disable this item”) or setup the Business Hours Power Plan straight away so that you don't start shutting down all your computer during the middle of the day.

Image 4. Default Power Plan at Order 1

How to setup the Business Hours Power Plan Policy

Step 3. Create another Power Plan setting item called “Business Hours Power Plan” (see Image 5.) making sure it is lower order than the default power plan. Again I will leave the exact settings up to you but this one should be less aggressive than your default power plan.

Image 5. Business Hours Power Plan

Step 4. Now go into the properties of the “Business Hours Power Plan”

Step 5. Click on the Common Tab and tick “Item-Level Targeting”

Step 6. Click on the targeting button

First of all we are going to create a collection that will target the Business House Power Plan to only the weekdays of the week.

Step 7. In the targeting Editor click on “Add Collection” (see Image 6.)

Image 6. Creating a targeting collection

Step 8. Click on the “New Item” and then click on “Date Match” (see Image 7 & 8.)

Image 7. Creating a Date Match rule

Image 8. Date match rule before being dragged into a Collection

Step 9. Now you will need to drag the “AND the day of the week is Sunday” onto the “the collection is true” and change the day to “Monday” (see Image 9.)

Image 9. Date Match rule after being dragged in the collection.

Step 10. Now make sure that “the day of the week is Monday” is highlighted and click CTRL-C once and CTRL-V four times to copy and paste the date match rule once for each weekday (see Image 10).

Image 10. Five date match rules in one collection

Step 11. Now click on each of the “AND the day of the week is Monday” and press F6 to change each date match rule from and “AND” to a “OR” and then change the days to Tuesday , Wednesday, Thursday and Friday (see Image 11).

Image 11. Data Range Collection configured to apply only during weekdays

Now we will add a Time Range option that will refine when we target the Business House Power Plan to just working hours of the weekdays.

Step 12. Click on the “this collection is true” and then click on “New Item” and then click on “Time Range” (see Image 12).

Image 12. Adding Time Range to targeting

Step 13. Now configured the time range to when during the day you want to Business Hours Power Plan to apply (see Image 13).

Note - Make sure you allow for the policy refresh interval (default 90 minutes with a 20% random offset) when configuring the start and end time. This means you might want to start applying the policy 2 hours before the start of business (e.g. 6:30am) to make sure all the computers are configured with the Business Hours Power Plan before people login in the morning (e.g. 8:30am).

Image 13. Targeting configured with Date Range collection and a Time Range

Now you have configured a Group Policy Preference to apply less aggressive power plans to your computer during business hours while still having more aggressive power plans applied after hours.

Other Option - More user Control

In the example above we just modified the “Balanced” power plan setting when we wanted to make changes to the power settings. If you did not want to give your users some more control and not force specific power plans you could just select the “High performance“ plan and tick “Set as the active power plan” for the Business Hours Power Plan (see Image 14) and the “Power Saver” plan as active in the Default Power plan (see Image 15).

Image 14. Setting the High Performance plan as active

Image 15. Setting the Power Saver plan as active

This way your users can still configure each of the power plans to their own preference but you will still make sure that the “Power Saver” plan will be applied to your computers after hours. However as you are only setting which plan is active then your users could get around the power plan as by configure both plans to never time out thus negating the benefit of any of the plan’s.

Other Options – Less aggressive Default Power Plan

You may also want to set the default power policy to be less aggressive by default and then apply the aggressive power as the second item in the list using a little more complicated targeting (see Image 16). The advantage of this method is you can easily turn off the aggressive power savings plan when you want to do afterhours by just disabling the “Afterhours Power Plan”.

Image 16. Targeting to apply plan only afterhours

AGPM 4.0 to be released in October

2009-09-16T02:30:00Z

As part of the official announcement on the MDOP blog, Advanced Group Policy Management 4.0 (AGPM) will be releasing in October to customers. With this release we had strong feedback on two main areas of improvement and an additional area that improves discoverability and manageability.

1. Multi Forest/Multi Domain Support

We heard strong feedback that customers really needed a clean way to move GPO's from one change controlled environment to another. Currently AGPM 3.0 does not support multi-forest/multi-domain environments and requires customers to use GPMC's import/export capability which essentially breaks the change management workflow. You really dont want to be importing into production in order to get the GPO's into the change management environment. The model we used was very similar to GPMC's method and actually uses the same API's that GPMC uses.

So why didnt we support online GPO (push/pull) moves rather than import/export? The primary scenario for this feature was to support test and production. If you think about those kinds of implementations, these tend to be airgapped or heavily firewalled implementations due to their essentially mirrored nature. So that really drove the requirement that this feature needed to support that topology rather than the other way around.

2. Windows 7/Windows Server 2008 R2 Support

We wanted to ensure that anything we did in AGPM aligned to what customers were likely to deploy this year. We knew the RTM schedule of Windows 7 and the fact that many customers were discussing moving to it sooner than later so we felt it was important to include. We made sure we added support for Windows 7 settings reporting and editing as well as for the server to run on Windows Server 2008 R2.

Word of advise here. Its a better together story. While we do support Vista and Windows Server 2008 with AGPM 4.0, dont mix the platforms. That means if you're going to edit policy with Windows 7, make sure you run Windows Server 2008 R2 on the backend. For a start its unsupported and its unsupported for very good reasons. The documentation will also have this warning in there too.

We also fixed a number of reporting based issues that were present in AGPM 3.0 (if you've noticed them) while we were doing the Windows 7 work. You will notice a much more predictable experience overall.

3. Search and Filtering

I can hear you saying it already..."Really? I can search for settings now?" Answer is No. This change was about enterprise manageability. Often just finding the GPO for editing is a painful experience. Some customers we talk to have upwards of over 1000 GPOs. Two customers have reported to us that they have over 10000 GPOs. Thats a huge amount that I wouldn't wish upon anyone! So the problem is, and even if you have 200 GPO's, how do I quickly find the GPO I need? AGPM now allows you to search for the GPO by partial name match or other metadata like date/time or author or a combination of all of them. We made this very similar to Windows 7 search and its ease of use with a similar filtering experience.

So in the next couple of weeks Ill be taking the time to demo AGPM with a screencast and show you all the new stuff. Or if youre going to be at TechEd Europe, its looking likely that Ill be there to present it live!

Michael Kleef, Program Manager

Group Policy Preferences Client-Side Extension Hotfix Rollup Released

2009-09-10T00:41:00Z

Quick note to let you all know that today we released a GPP update hotfix. We do plan to have this released to Windows Update also and the Download Center though for now you can get it from Microsoft Product Support.

A quick note too - when you go to download the update it will say that theres a package for Vista and another one for Windows Server 2003. The Windows Server 2003 package is also for Windows XP - we are trying to get that fixed ASAP.

Heres some details on what it fixes:

Issues in Windows Vista Service Pack 1 (SP1) and Windows Vista Service Pack 2 (SP2)

The Windows Event Log service crashes when the regional options preferences are set to English (United Kingdom).
If you create or update a virtual private network (VPN) connection by using a Group Policy object, the connection does not bind to IP Version 4 (TCP/IPv4) or IP Version 6 (TCP/IPv6).
A Lightweight Directory Access Protocol (LDAP) query that is used by item level targeting uses an incorrect base distinguish name.
Group Policy Service (GPSVC) stops responding during the GPSVC shutdown process if third-party printer drivers are installed by Group Policy Preferences.
The %GPTPATH% variable is not resolved correctly when Group Policy Preferences are processed.

Issues in Windows XP and Windows Server 2003

Thread handle leaks occur in Group Policy Preferences.
The %GPTPATH% variable is not resolved correctly.
The Power Scheme Group Policy Preferences client-side extension, together with the replacement action, increases the registry size.
You cannot set the Shortcuts preference extension.
When you use Group Policy Preferences on a Terminal Server, it takes longer than usual to log on to the terminal server.

This package resolves the following issues that were formerly resolved in Microsoft Knowledge Base (KB) article 943729:

Client-side extensions are removed when a service pack is installed.
The Remove option is not available in the Add or Remove Programs window when a package is uninstalled and reinstalled.
Invalid support URLs are shown in the Add or Remove Programs window.
Incorrect titles are shown in the Installed Updates window.
Vista packages cannot install on Windows Vista SP2 or on later versions of Windows Vista service pack.

http://support.microsoft.com/kb/974266

Enjoy!

Michael Kleef, Program Manager

Migration Tables do not work with Group Policy Preferences

2009-09-09T23:18:00Z

We have had an issue raised to us about Migration Tables and GPP that we wanted to take a moment to clarify. What are Migration Tables you might ask?

GPMC provides a mechanism for Importing and Exporting policies. This is especially useful for moving tested GPO's from one forest to another such as from the test network to the production network. Part of the involves whats called a Migration Table. This is essentially a mapping table that allows you to map security principals (users and groups) from one domain to another. It also allows you to map UNC share paths from one domain to another also.

Recently a customer found that the Group Policy Preferences does not work with Migration Tables. This means specifying a Migration Table will have no effect on the security principals from one domain to another with GPP settings and the result is that these will be ignored.

The workaround of this is essentially to manually map them either post-import or to edit the XML exported in the exported policy folder manually or through a script.

Note that this also affects the to be released Advanced Group Policy Management 4.0 solution as it uses the same GPMC APIs and Migration Table functionality that GPMC itself uses.

We know its not a great outcome and are currently looking at options to address this in future.

Michael Kleef, Program Manager

Fun with Security Settings

2009-09-08T03:17:00Z

LiliaG: Reporting from Australia (TechEd Australia 2009)

Almost everyone at the Brisbane User Infrastructure Group last night said their biggest priority with Group Policy is security settings. Box office ratings will have my believe that wizards are all the rage. How can I combine these two and launch Group Policy into mega-box-office glory?

The Security Configuration Wizard!

This handy tool walks you through some best practices to lock down you server. Check out the introduction:

It harnesses a massive database of all security settings to provide you with a security policy that will cover server roles, client features, administration options, services, firewall, and more.

You can read the deployment guide for Security Configuration Wizard: http://technet.microsoft.com/en-us/library/cc731515(WS.10).aspx

Not working on Server 2008 yet? No worries.

To read about the SCW in Windows Server 2003 SP1, go here: http://redmondmag.com/articles/2005/06/01/the-security-configuration-wizard.aspx

“ Apparently, you triggered some undocumented response that removing the lockdowns doesn't resolve. You find yourself wishing for two things—a different career, and a single, authoritative source of lockdown settings you can deploy with a single stroke that are fully supported by Microsoft.

You got your second wish, at least. There's a little gem in Windows Server 2003 SP1 called the Security Configuration Wizard (SCW). This deceptively simple tool packs a huge XML database consisting of every service, feature and administration option from every server product produced by Microsoft. It also provides lockdown settings that are fully supported by Microsoft's major product teams. “

Here’s the Microsoft deployment guide for Windows Server 2003 SP1:

http://technet.microsoft.com/en-us/library/cc776871(WS.10).aspx

Any other tips on security settings? Popular security configurations you use in your environment (that you can reveal)? Post them in the comments. For help with security settings, go to the Group Policy Forum.

http://social.technet.microsoft.com/Forums/en-US/winserverGP/threads?sort=repliesdesc

Enjoy!

LiliaG, Group Policy PM

Windows 7 ADMX Settings Spreadsheet Released

2009-09-03T23:38:00Z

We have received numerous questions about when the Group Policy Settings Spreadsheet would be updated for the new Windows 7 ADMX settings. I am happy to announce that new version has been completed and is available from the Download Center.

In addition to the new spreadsheet we have also taken the opportunity to consolidate the spreadsheets for all releases onto the single download center page above. This will make it easier for you to find the spreadsheet that you are interested in.

Mark Gray, Program Manager