Group Policy Preferences – Doug's AD Blog

Group policy preferences (GPP) are a set of new group policy extensions that came out at the same time as Windows Server 2008. The great part about it, though, is that the GPP does not require 2008 DCs and are backwards compatible with XP, Server 2003 and Vista.

Client Installation

In order to use GPP, you need to install the group policy preferences client. Here are the minimum system requirements to install the GPP client:

· XP SP 2 or later

· Windows 2003 Server or later

In addition, xmllite needs to be installed. This will be installed if you have the following components on your systems:

· Internet Explorer 7

· XP SP3 installed or Windows Server 2003 SP2

The client can be pushed out via WSUS or SMS/SCCM/Altiris. (Note that the WSUS push only works if xmllite is already installed.)

If you need to verify if the GPP client is installed on a client machine, you can find it by looking for one of two things:

· In Add/Remove programs, look for Microsoft update KB943729

· C:\Windows\System32\gpprefcl.dll

Managing GPP Settings

In order to manage GPP settings, you must be running the Group Policy Management Console (GPMC) on either Windows Server 2008 or Vista SP1 (with RSAT tools installed). Unfortunately, even though they can be applied in a 2003 or XP environment, you cannot view the settings without either 2008 or Vista.

GPP Settings Available

One of the advantages to GPP is how many more settings are made available. (With group policy, we already have access to thousands of settings, but this opens up even more settings.) Using GPP can also help eliminate the need for scripts. Some of the additional settings that are available include:

· Map drives – this includes the ability to give the drive a “friendly” name for the end user

· Copy files to a users machine

· Create folders

· Edit registry keys

· Manage ini file settings (including the ability to manage individual lines within an ini file

· Create shortcuts

· Manage local users and groups

· Manage folder options (ever want file extensions to show for all users?)

· Change environment variables

· Change ODBC settings and create new settings

· Manage power options

· Add printers

· Create scheduled tasks

· Work with services on a machine

· Manage internet settings easier that today’s GPO settings allow

· Set regional options

Fine Tune GPP Application

To me, one of the best things about GPP is that I can do item-level targeting. This allows you to use a myriad of settings to control how each GPP setting gets applied. From the figure, you can see all of the various options that are available to manage how the GPP is targeted. Also, since most of these are not using a WMI Query (unless you are using the WMI Query J), it is much less process intensive in applying these settings.

Hidden Options

Why these are so hidden is a mystery, but if you know the tricks, you can control which settings are included in your GPP. For example, if you go into Folder Options, you will see that the items are underlined in green. That means that those settings will be processed. If there is a red underline, that means that the item will not be processed.

So, how do I change these settings? Here are the keys used to do so:

· F5 – Define all settings in this dialog box

· F6 – Define the currently selected setting

· F7 – Don’t define the currently selected setting

· F8 – Don’t define any setting in this dialog box

Another hidden key is to let you select a system variable. Pressing F3 will present you a list of those variables.

Conclusion

With the advent of GPP, it is making our job of administering computers and users much easier. We now have a large number of additional settings that are much easier to manage. Dive in and you will be able to learn all about the cool new options available.

References

Here are some references for more detailed information on GPP.

Group Policy Preferences – Getting Started

http://technet.microsoft.com/en-us/library/cc731892.aspx

An Overview of Group Policy Preferences

http://www.microsoft.com/downloads/details.aspx?familyid=42E30E3F-6F01-4610-9D6E-F6E0FB7A0790&displaylang=en

Group Policy Preferences Overview

http://www.gpoguy.com/Portals/0/Group%20Policy%20Preferences%20Overview.pdf

Group Policy Changes in 2008