Group Policy

You can use Group Policy to define policy settings that are applied to computers or users.

  • Before you use Group Policy, see Checklists
    • .
  • To find features that have been moved in Windows XP, see New ways to do familiar tasks
    • .
  • For tips on using Group Policy, see Best practices
    • .
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • To find other sources of information, see Resources.
  • For problem-solving instructions, see Troubleshooting.


Checklists

This section covers:

  • Checklist: Implementing Group Policy through Active Directory
  • Checklist: Implementing local Group Policy
  • Checklist: Opening the Software Installation snap-in


Checklist: Implementing Group Policy through Active Directory

Step | References
Review key concepts about Active Directory and Group Policy. Group Policy overview;
Active Directory Users and Computers
Install the operating systems on the client computers.

Important

  • Clients that run Windows NT 4.0, Windows 95, Windows 98, Windows ME, and Windows XP Home Edition cannot be managed through Group Policy.
To install the operating system from a CD-ROM, follow the printed instructions that accompany the CD-ROM.
After Active Directory and Group Policy are working, Remote Installation Services enables remote installation of the operating system to large numbers of computers.
Install a domain controller. | To install a domain controller
Determine the Active Directory structure that you want to use. Best practices;
Planning site structure;
Planning your domain structure;
Planning your DNS structure
Read about Group Policy. | Group Policy
Open Group Policy. Open the Group Policy snap-in;
Ways to open the Group Policy snap-in


Checklist: Implementing local Group Policy

Step | Reference
Review key concepts about local Group Policy. | Group Policy objects; Local Group Policy
Install Windows XP Professional on the local computer. | Follow the printed instructions that come with the CD-ROM.
Open Group Policy to edit the local Group Policy snap-in. | Open the Group Policy snap-in; Ways to open the Group Policy snap-in


Checklist: Opening the Software Installation snap-in

Step | References
Review key concepts about Software Installation, Group Policy, and Active Directory. Active Directory Users and Computers;
Group Policy overview;
Software Installation
Set up Group Policy in your organization. | Checklist: Implementing Group Policy in Active Directory
Open Group Policy to apply policy to the site, domain, or organizational unit that contains the users and computers that should receive the software. Open the Group Policy snap-in;
Ways to open the Group Policy snap-in
Obtain Windows Installer (.msi) packages for your software. | Contact the software vendor
Open the Software Installation snap-in. | To open the Software Installation snap-in


New ways to do familiar tasks

Windows NT 4.0 introduced the System Policy Editor, which you could use to create a system policy to control user actions and the work environment and to enforce system configuration settings for all computers that run Windows NT 4.0. Policy settings define the various components of the desktop environment, including the applications that are available to users, the applications that appear on users' desktops, and the options that are displayed on the Start menu.

If you upgrade from Windows NT 4.0 to Windows XP, you will find that Group Policy and its extensions provide a unified replacement for many of the tools that you are familiar with. The following table contrasts the differences between Windows NT 4.0 and Windows XP with regard to the creation of system policy.

If you want to | In Windows NT 4.0 use | In Windows XP use
Set policies on users and computers in a site | Not applicable | Group Policy, accessed through Active Directory Sites and Services
Set policies on users and computers in a domain | System Policy Editor (Poledit.exe) | Group Policy, accessed through Active Directory Users and Computers
Set policies on users and computers in an organizational unit | Not applicable | Group Policy, accessed through Active Directory Users and Computers
Use security groups to filter the scope of policy | Not applicable | Edit the permission option for Apply Group Policy on the Security tab in the Group Policy object's properties dialog box.
Manage software For an administrator, Systems Management Server. For a user, Add/Remove Programs in Control Panel. Systems Management Server and the three Software Installation and Maintenance tools:
  • Software Installation, an extension to the Group Policy snap-in
  • Windows Installer
  • Add or Remove Programs in Control Panel
Create a safe user interface for editing the registry Windows NT 4.0–style Administrative Templates for System Policy Editor Windows XP–style Administrative Templates for Group Policy

See The role of Administrative Templates for an explanation of how the use of .adm files has changed in Windows XP.
Perform general administrative tasks Administrative wizards, User Manager, and Server Manager Microsoft Management Console (MMC) snap-ins, particularly
Active Directory Users and Computers,
Active Directory Sites and Services,
and Group Policy and its extensions

If you upgrade from Windows 2000 to Windows XP, you will find that Folder Redirection has become easier to use, as described in the following table.

If you want to | In Windows 2000 use | In Windows XP use
Redirect a special folder to a share with a Universal Naming Convention (UNC) path that is personalized to the user | A UNC path that incorporates %username%, for example, \\server\share\%username%\My Documents | The special folder's properties dialog box, as described in To redirect special folders to the root directory


Best practices

This section contains recommendations to help you get the most out of Group Policy, Folder Redirection, and Software Installation.

For problem-solving instructions, see Troubleshooting. For other sources of information, including links to the World Wide Web, see Resources.

Group Policy

Disable unused parts of a Group Policy object.

  • Under User Configuration or Computer Configuration in the console tree of the Group Policy snap-in, if a Group Policy object contains only settings that are set to Not Configured, you can avoid processing these settings by disabling User Configuration or Computer Configuration. This expedites the startup and logon processes for those users and computers that are subject to the Group Policy object.

    For more information, see:

    • To disable the User Configuration settings in a Group Policy object
    • To disable the Computer Configuration settings in a Group Policy object
  • To prevent an entire Group Policy object from affecting a site, domain, or organizational unit, see To unlink a Group Policy object from a site, domain, or organizational unit and To disable a Group Policy object link. These procedures allow you to enable or re-link the Group Policy object at a later time if you want to.
  • If you never want to use a certain Group Policy object again, see To delete a Group Policy object.

Use the Block Policy inheritance and No Override features sparingly.

  • Routine use of these features makes it difficult to troubleshoot policy. If you must use them, see To block policy inheritance and To prevent a Group Policy object from being overridden.

Use common-sense naming conventions for Group Policy objects.

  • It is not advisable, for example, to use the same name for two different Group Policy objects. Using the same name for two different Group Policy objects does not cause Group Policy to function incorrectly, but it might be confusing.

Caution

  • If you type a name for a Group Policy object that is longer than 255 characters, the name is truncated without warning to 255 characters.

Minimize the number of Group Policy objects that are applied to users in domains or organizational units.

  • The more Group Policy objects that are applied to a user, the longer it takes for the user to log on.

Filter policy based on security group membership.

  • Users who do not have an access control entry (ACE) directing that a particular Group Policy object be applied to them can avoid the associated logon delay, because the Group Policy object is not processed for those users.
  • Filtering can only be done by using membership in security groups. For more information, see To filter the scope of Group Policy according to security group membership.
  • The ACEs are visible on the Security tab in the properties dialog box for a Group Policy object.

Override user-based Group Policy with computer-based Group Policy only when necessary.

  • Override user-based Group Policy with computer-based Group Policy only if you want the desktop configuration to be the same regardless of who logs on. The mechanism for doing this is "loopback," an advanced Group Policy setting that is useful in certain closely managed environments, such as laboratories, classrooms, public kiosks, and reception areas. You can find loopback in the console tree of the Group Policy snap-in.

    Where?

    • Group Policy object name
    • Computer Configuration
    • Administrative Templates
    • System
    • Group Policy
    • User Group Policy loopback processing mode

Use Group Policy rather than System Policy.

Use System Policy only to manage computers that run an operating system that is earlier than Windows 2000 or if you need to manage desktops for multiple users on a stand-alone computer. For more information, see Migration issues.

Avoid cross-domain Group Policy object assignments.

  • The processing of Group Policy objects slows the startup and logon processes if Group Policy is obtained from another domain.

Do not set File System policy on a drive or directory, such as Sysvol, that is replicated by the NTFS file replication system (FRS).

  • Settings that are under File System in the Group Policy console can cause excessive replication, disk-drive thrashing, and waste of network bandwidth.

    Where?

    • Group Policy object name
    • Computer Configuration
    • Windows Settings
    • Security Settings
    • File System

Software installation and management

Specify application categories for your organization.

  • Using categories makes it easier for users to find an application in Add or Remove Programs in Control Panel. You can define application categories, such as Sales Applications, Accounting Applications, and so on. For more information, see To specify categories for applications to be managed.

Make sure that Windows Installer packages are correctly transformed before they are published or assigned.

  • Remember that transforms are applied to packages at the time of assignment or publication. Transforms (.mst files) are customizations that are applied to Windows Installer packages. A transform is applied at the time of assignment or publication, not at the time of installation. In practical terms, this means that you should make sure that the Modifications tab in the package properties dialog box is set up the way that you want it before you click OK. If you neglect to do this, and you assign or publish a transformed package before you have completely configured it, you can remove the software and republish or reassign it, or you can upgrade the software with a completely transformed version. For more information on how to do this, see To remove a managed application and To upgrade applications. Also, see Work with package modifications.

Assign or publish just once per Group Policy object.

  • It is recommended that a Windows Installer package be used to assign an application or to publish an application no more than once in the same Group Policy object. For example, if you assign Microsoft Office to the computers that are affected by a Group Policy object, do not assign or publish it to the users who are affected by the Group Policy object. For more information, see To assign an application and To publish an application.

Take advantage of authoring tools.

  • Developers who are familiar with the files, registry entries, and other requirements that are necessary for an application to work properly can author native Windows Installer packages by using tools that are available from various software vendors.

Repackage existing software.

  • You can use commercially available tools to create Windows Installer packages for software that does not include natively authored .msi files. These tools work by comparing a computer's state before and after installation. For best results, install them on a computer that is free of other application software (clean install).

Use Systems Management Server and Distributed File System.

  • Microsoft Systems Management Server and Distributed File System (DFS) are helpful in managing software distribution points (the network shares from which users install their managed software).

Assign or publish applications at a high level in the Active Directory hierarchy.

  • Because Group Policy settings apply by default to child Active Directory containers, it is efficient to assign or publish applications by linking a Group Policy object to a parent organizational unit or domain. Use security descriptors (ACEs) on the Group Policy object for finer control over who receives the software. For more information, see To filter the scope of Group Policy according to security group membership.

Use required, rather than optional, upgrades.

  • For the correct upgrade procedures, both required and optional, see To upgrade an application.
  • The Upgrades tab for a package in Software Installation has a Required upgrade for existing packages check box. It is recommended that you select this check box. If two users use the application on one computer, and one user upgrades the application and the other does not, both versions of the application exist on the computer. Some applications do not support this configuration.

    You can access the properties dialog box for a package in the console tree of the Group Policy snap-in.

    Where?

    • Group Policy object name
    • Computer Configuration (or User Configuration)
    • Software Settings
    • Software installation
    • Package Name

Notes

  • Authenticated Users need the Read and Apply Group Policy ACE to be able to install applications from the software distribution point.
  • Administrators need Full Control to manage software.

Use Software Installation properties for widely scoped control.

  • In the Group Policy console, right-click Software installation, and then click Properties.

    Where?

    • Group Policy object name
    • Computer Configuration (or User Configuration)
    • Software Settings
    • Software installation

    Using Software Installation properties saves administrative keystrokes when you assign or publish a large number of packages with similar properties in a single Group Policy object; for example, when all the software is published and it all comes from the same software distribution point. For specific procedures, see Set options for Software Installation.

Use Windows Installer package properties for fine control.

  • Go to Software Installation, as described in the previous best practice, right-click the package in the details pane, and then click Properties. Use this method for assigning or publishing a single package. For specific procedures, see Work with applications.

Folder Redirection

Allow the system to create the folders.

  • If you create the folders yourself, they will not have the correct permissions.
  • If you must, or already have, created the folders, the information in the "Folder Redirection permissions" section in the Folder Redirection Help topic might not apply.

Do not redirect My Documents to the home directory unless you have already deployed home directories in your organization.

  • Redirection to the home directory offers less security than standard folder redirection, and it is offered only for backward compatibility. For more information, see Folder Redirection and To redirect My Documents to the home directory.

If you redirect My Documents to the home directory, and if your users log on to the domain via Terminal Server clients, do not specify a separate Terminal Services Home Directory.

  • The properties dialog box for a user in Active Directory has a Profile tab, where the Home Folder can be set, and also a Terminal Services Profile tab, where the Terminal Services Home Directory can be set. If these network folders are different, logging on to the terminal server causes the Profile Home Folder to be copied to the Terminal Services Home Directory. Logging off the terminal server causes copying to occur in the opposite direction. This is probably not the intended behavior, and it might result in delay in the logon and logoff processes for users. For more information, see To redirect My Documents to the home directory.

Enable client-side caching.

  • This is especially important for users with portable computers. For information on how to configure Folder Redirection and Offline Files to work together, see Folder Redirection.
  • Always enable the "Synchronize all offline files before logging" Group Policy setting.

    Where?

    • Group Policy object name
    • Computer Configuration (or User Configuration)
    • Administrative Templates
    • Network
    • Offline Files
    Enabling this setting ensures that offline files are fully synchronized and that all the files in the user's redirected folder are available when the user is working offline. If this setting is not enabled, the system performs only a cursory synchronization, and as a result only recently used files are cached.

Use fully qualified universal naming convention (UNC) paths, for example: \\server\share.

  • Although paths like C:\Foldername can be used, this is not recommended, because the path may not exist on the target computer.

Caution

  • Universal naming convention (UNC) paths that are longer than 260 characters are truncated. If the path is truncated, redirection fails.

Have My Pictures follow My Documents.

  • This practice is recommended, unless there is a compelling reason against it, such as file share scalability.

Remember policy removal considerations.

  • Remember the behavior that your Folder Redirection policies will have at the time of policy removal, as described in the table of policy removal considerations in Folder Redirection. Changing the redirection option to Not configured does not redirect the folder to the user's local profile location. It will continue to be redirected to the previous location. If you want to return the folder to the local user profile location, use the "Redirect to the local user profile" setting, as described in To redirect special folders to the local profile location.

Accept the default settings.

  • In general, accept the default Folder Redirection settings.


How to...

  • Open the Group Policy snap-in
  • Work with Group Policy objects
  • Work with Group Policy object properties
  • Use Administrative Templates
  • Use scripts
  • Use the Software Installation snap-in
  • Use the Folder Redirection snap-in
  • Configure Group Policy
  • Delegate control of Group Policy


Open the Group Policy snap-in

  • Open Group Policy from Active Directory Users and Computers
  • Open Group Policy from Active Directory Sites and Services
  • Open Group Policy as a stand-alone MMC snap-in


Open Group Policy from Active Directory Users and Computers

Microsoft Windows graphic

To open Group Policy from Active Directory Users and Computers

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the domain or organizational unit for which you want to set Group Policy.

    Where?

    • Active Directory Users and Computers [domain_controller_name.domain_name]
    • domain
    • organizational unit
    • child organizational unit
  3. Click Properties, and then click the Group Policy tab.
  4. Click an existing Group Policy object in the list box, and then click Edit.

    or

    Click New to create a new Group Policy object, and then click Edit.

Note

  • To start Active Directory Users and Computers, open a Remote Desktop Connection to either a Windows 2000 domain controller or a member server that has Windows 2000 Administration Tools installed. You must log on to the server as a domain administrator in order to complete this procedure.
Related Topics


Open Group Policy from Active Directory Sites and Services

Microsoft Windows graphic

To open Group Policy from Active Directory Sites and Services

  1. Open Active Directory Sites and Services.
  2. In the console tree, right-click the site for which you want to set Group Policy.

    Where?

    • Active Directory Sites and Services [domain_controller_name.domain_name]
    • Sites
    • site name
  3. Click Properties, and then click the Group Policy tab.
  4. Click an existing Group Policy object in the list box, and then click Edit.

    or

    Click New to create a new Group Policy object, and then click Edit.

Note

  • To start Active Directory Sites and Services, open a Remote Desktop Connection to either a Windows 2000 domain controller or a member server that has Windows 2000 Administration Tools installed. You must log on to the server as a domain administrator in order to complete this procedure.
Related Topics


Open Group Policy as a stand-alone MMC snap-in

Microsoft Windows graphic

To open Group Policy as a stand-alone MMC snap-in

  1. Open Microsoft Management Console.
  2. On the File menu, click Add/Remove Snap-in.
  3. On the Standalone tab, click Add.
  4. In the Available Standalone Snap-ins list, click Group Policy, and then click Add.
  5. In the Select Group Policy object dialog box, click Local Computer to edit the local Group Policy object, or click Browse to find the Group Policy object that you want.
  6. Click Finish, click Close, and then click OK. The Group Policy snap-in opens the Group Policy object for editing.

Note

  • To open Microsoft Management Console (MMC), click Start, click Run, type mmc, and then click OK.
  • If you want to save the Group Policy console, and you want to be able to choose which Group Policy object opens in it from the command line, select the Allow focus of the Group Policy Snap-in to be changed when launching from the command line check box in the Select Group Policy object dialog box.
  • For information about the different ways you can open Group Policy, including opening Group Policy from the command line, see Ways to open the Group Policy snap-in.
Related Topics


Work with Group Policy objects

  • Edit a Group Policy object
  • Edit the local Group Policy object
  • Create a new Group Policy object
  • Delete a Group Policy object
  • Link a Group Policy object to a site, domain, or organizational unit
  • Block policy inheritance
  • Unlink a Group Policy object from a site, domain, or organizational unit
  • Disable a Group Policy object link
  • Prevent a Group Policy object from being overridden


Edit a Group Policy object

Microsoft Windows graphic

To edit a Group Policy object

  1. Open the Group Policy object that you want to edit.
  2. In the console tree, double-click the folders to view their policies in the details pane.
  3. In the details pane, double-click the names of the policies to open their properties dialog boxes and change their settings.

Notes

  • To open the Group Policy snap-in, see Related Topics.
  • You must have Read and Write permissions for a Group Policy object to open it.
  • Because changes to a Group Policy object take place immediately, you might want to disable the Group Policy object while you are editing it. For information on disabling a Group Policy object, see Related Topics.

Related Topics


Edit the local Group Policy object

Microsoft Windows graphic

To edit the local Group Policy object

  1. Open Group Policy.
  2. In the console tree, double-click the folders to view their policies in the details pane.
  3. In the details pane, double-click the names of the policies to open their properties dialog boxes and change their settings.

Notes

  • To open Group Policy, click Start, click Run, type gpedit.msc, and then click OK.
  • Changes that you make to the local Group Policy object are saved automatically.

Related Topics


Create a new Group Policy object

Microsoft Windows graphic

To create a new Group Policy object

  1. Open Active Directory Users and Computers to create a Group Policy object that is linked to a domain or to an organizational unit.

    Open Active Directory Sites and Services to create a Group Policy object that is linked to a site.

  2. In the console tree, right-click the site, domain, or organizational unit to which you want the newly created Group Policy object to be linked. (The Group Policy object will be stored in the current domain, that is, the domain that contains the domain controller that is being used by Active Directory Users and Computers or Active Directory Sites and Services.)
  3. Click Properties, and then click the Group Policy tab.
  4. Click New, type a name for the Group Policy object, and then click Close.

Notes

  • To start Active Directory Users and Computers, open a Remote Desktop Connection to either a Windows 2000 domain controller or a member server that has Windows 2000 Administration Tools installed. You must log on to the server as a domain administrator in order to complete this procedure.
  • To start Active Directory Sites and Services, open a Remote Desktop Connection to either a Windows 2000 domain controller or a member server that has Windows 2000 Administration Tools installed. You must log on to the server as a domain administrator in order to complete this procedure.
  • The newly created Group Policy object is linked by default to the site, domain, or organizational unit that you select when you create the Group Policy object, and its settings apply to that site, domain, or organizational unit. If you want to unlink the Group Policy object from that site, domain, or organizational unit, see Related Topics.

Related Topics


Delete a Group Policy object

Microsoft Windows graphic

To delete a Group Policy object

  1. Open Active Directory Users and Computers.

  2. In the console tree, right-click the domain, or right-click any organizational unit in the domain.
  3. Click Properties, and then click the Group Policy tab.
  4. To find all the Group Policy objects that are stored in the domain, click Add. This opens the Add a Group Policy Object Link dialog box.
  5. Click the All tab, right-click the Group Policy object that you want to delete, and then click Delete.
  6. Click Yes, click Cancel, and then click OK.

Notes

  • To start Active Directory Users and Computers, open a Remote Desktop Connection to either a Windows 2000 domain controller or a member server that has Windows 2000 Administration Tools installed. You must log on to the server as a domain administrator in order to complete this procedure.
  • When you delete a Group Policy object, any sites, domains, or organizational units to which it is linked are no longer affected by it. You might want to disable the Group Policy object instead. For more information, see Related Topics.

Related Topics


Link a Group Policy object to a site, domain, or organizational unit

Microsoft Windows graphic

To link a Group Policy object to a site, domain, or organizational unit

  1. Open Active Directory Users and Computers to link to a domain or an organizational unit.

    Open Active Directory Sites and Services to link to a site.

  2. In the console tree, right-click the site, domain, or organizational unit to which you want the Group Policy object to be linked.
  3. Click Properties, and then click the Group Policy tab.
  4. To add the Group Policy object to the Group Policy Object Links list, click Add. This opens the Add a Group Policy Object Link dialog box.
  5. Click the All tab, click the Group Policy object that you want, and then click OK.
  6. In the properties dialog box for the site, domain, or organizational unit, click OK.

Notes

  • To start Active Directory Users and Computers, open a Remote Desktop Connection to either a Windows 2000 domain controller or a member server that has Windows 2000 Administration Tools installed. You must log on to the server as a domain administrator in order to complete this procedure.
  • To start Active Directory Sites and Services, open a Remote Desktop Connection to either a Windows 2000 domain controller or a member server that has Windows 2000 Administration Tools installed. You must log on to the server as a domain administrator in order to complete this procedure.
  • You can link a Group Policy object to specify that its settings are applied to users and computers in the site, domain, or organizational unit and that its settings are applied to users and computers in Active Directory containers that inherit policy settings from the site, domain, or organizational unit.
Related Topics


Block policy inheritance

Microsoft Windows graphic

To block policy inheritance

  1. Open Active Directory Sites and Services to block policy inheritance in a site.

    Open Active Directory Users and Computers to block policy inheritance in a domain or organizational unit.

  2. In the console tree, right-click the site, domain, or organizational unit in which you want to block Group Policy inheritance, and then click Properties.
  3. Click the Group Policy tab, make sure that the Block Policy inheritance check box is selected, and then click OK.

Notes

  • To start Active Directory Users and Computers, open a Remote Desktop Connection to either a Windows 2000 domain controller or a member server that has Windows 2000 Administration Tools installed. You must log on to the server as a domain administrator in order to complete this procedure.
  • To start Active Directory Sites and Services, open a Remote Desktop Connection to either a Windows 2000 domain controller or a member server that has Windows 2000 Administration Tools installed. You must log on to the server as a domain administrator in order to complete this procedure.
  • The Block Policy inheritance option blocks Group Policy objects that apply higher in the Active Directory hierarchy of sites, domains, and organizational units. It does not block Group Policy objects if they have No Override enabled.
  • The Block Policy inheritance option is set only on sites, domains, and organizational units, not on individual Group Policy objects.

Related Topics


Unlink a Group Policy object from a site, domain, or organizational unit

Microsoft Windows graphic

To unlink a Group Policy object from a site, domain, or organizational unit

  1. Open Active Directory Users and Computers to unlink a Group Policy object from a domain or organizational unit.

    Open Active Directory Sites and Services to unlink a Group Policy object from a site.

  2. In the console tree, right-click the site, domain, or organizational unit from which you want to unlink the Group Policy object. (Unlinking prevents the Group Policy object from affecting that site, domain, or organizational unit).
  3. Click Properties, and then click the Group Policy tab.
  4. Click the Group Policy object that you want to unlink, and then click Delete.
  5. In the Delete dialog box, click Remove the link from the list, and then click OK.

Important

  • If you click Remove the link and delete the Group Policy object permanently in the Delete dialog box, all sites, domains, and organizational units to which the Group Policy object is linked will no longer have those Group Policy settings applied to them, and the Group Policy object itself will be deleted.

Notes

  • To start Active Directory Users and Computers, open a Remote Desktop Connection to either a Windows 2000 domain controller or a member server that has Windows 2000 Administration Tools installed. You must log on to the server as a domain administrator in order to complete this procedure.
  • To start Active Directory Sites and Services, open a Remote Desktop Connection to either a Windows 2000 domain controller or a member server that has Windows 2000 Administration Tools installed. You must log on to the server as a domain administrator in order to complete this procedure.
Related Topics


Disable a Group Policy object link

Microsoft Windows graphic

To disable a Group Policy object link

  1. Open Active Directory Users and Computers to disable a Group Policy object link to a domain or organizational unit.

    Open Active Directory Sites and Services to disable a Group Policy object link to a site.

  2. In the console tree, right-click the site, domain, or organizational unit to which the Group Policy object is linked, and then click Properties.
  3. Click the Group Policy tab.
  4. Right-click the Group Policy object link that you want to disable, click Disabled, and then click Yes. A check appears in the Disabled column.

Notes

  • To start Active Directory Users and Computers, open a Remote Desktop Connection to either a Windows 2000 domain controller or a member server that has Windows 2000 Administration Tools installed. You must log on to the server as a domain administrator in order to complete this procedure.
  • To start Active Directory Sites and Services, open a Remote Desktop Connection to either a Windows 2000 domain controller or a member server that has Windows 2000 Administration Tools installed. You must log on to the server as a domain administrator in order to complete this procedure.
  • When you disable a Group Policy object link, the settings in the Group Policy object no longer apply to users or computers in the site, domain, or organizational unit to which the Group Policy object was linked, and they no longer apply to users and computers in child Active Directory containers that inherit those Group Policy settings.

Related Topics


Prevent a Group Policy object from being overridden

Microsoft Windows graphic

To prevent a Group Policy object from being overridden

  1. Open Active Directory Users and Computers for a Group Policy object that is linked to a domain or organizational unit.

    Open Active Directory Sites and Services for a Group Policy object that is linked to a site.

  2. In the console tree, right-click the site, domain, or organizational unit to which the Group Policy object is linked.
  3. Click Properties, and then click the Group Policy tab.
  4. In the Group Policy Object Links list, right-click the Group Policy object link that you want to enforce, click No Override, and then click OK. A check mark appears in the No Override column.

Notes

  • To start Active Directory Users and Computers, open a Remote Desktop Connection to either a Windows 2000 domain controller or a member server that has Windows 2000 Administration Tools installed. You must log on to the server as a domain administrator in order to complete this procedure.
  • To start Active Directory Sites and Services, open a Remote Desktop Connection to either a Windows 2000 domain controller or a member server that has Windows 2000 Administration Tools installed. You must log on to the server as a domain administrator in order to complete this procedure.
  • If you set No Override on a Group Policy object link, the Group Policy settings are enforced on all users or computers in the site, domain, or organizational unit and on all users and computers in Active Directory containers that inherit Group Policy from it.
  • Group Policy settings that are enforced by using No Override cannot be blocked.

Related Topics


Work with Group Policy object properties

  • Filter the scope of Group Policy according to security group membership
  • Find the sites, domains, and organizational units to which a Group Policy object is linked
  • Disable the User Configuration settings in a Group Policy object
  • Disable the Computer Configuration settings in a Group Policy object


Filter the scope of Group Policy according to security group membership

Microsoft Windows graphic

To filter the scope of Group Policy according to security group membership

  1. Open the Group Policy object whose scope you want to filter.
  2. Right-click the icon or the name of the Group Policy object, which appears as follows:
    Group Policy object name [domain_controller_name.domain_name] Policy,
    and then click Properties.
  3. Click the Security tab, and then click the security group through which you want to filter this Group Policy object.

    If you want to change the list of security groups through which to filter this Group Policy object, use the Add and Remove buttons to add or remove security groups.

  4. In the Permissions box for the selected security group, select or clear the appropriate check boxes to set permissions as shown in the following table, and then click OK.
Your intention | Permissions | Result
Members of this security group have this Group Policy object applied to them. | Set Apply Group Policy to Allow. Set Read to Allow. | This Group Policy object applies to members of this security group, unless they are members of at least one other security group that has Apply Group Policy set to Deny, or Read set to Deny, or both.
Members of this security group are exempt from this Group Policy object. | Set Apply Group Policy to Deny. Set Read to Deny. | This Group Policy object never applies to members of this security group, regardless of the permissions these members have in other security groups.
Membership in this security group is irrelevant to whether the Group Policy object should be applied. | Set Apply Group Policy to neither Allow nor Deny. Set Read to neither Allow nor Deny. | This Group Policy object applies to members of this security group if and only if they have both Apply Group Policy and Read set to Allow as members of at least one other security group. They also must not have Apply Group Policy or Read set to Deny as members of any other security group.

Notes

  • To open the Group Policy snap-in, see Related Topics.
  • Group Policy objects are applied only to sites, domains, and organizational units. Group Policy settings affect only the users and computers that they contain. In particular, Group Policy objects are not linked to security groups.
  • The location of a security group in Active Directory has no relation to, and no effect on, filtering through that security group as described in this procedure.
  • If a user or computer is not contained in a site, domain, or organizational unit that is subject to a Group Policy object, either directly through a link or indirectly through inheritance, there is no combination of permissions on any security group that can cause those Group Policy settings to affect that user or computer.
  • Filtering at the Group Policy object level, as described in this procedure, causes the Group Policy object to be processed or not processed as a whole. The Software Installation and Folder Redirection extensions use security groups to refine control beyond the Group Policy object level. Except for Folder Redirection and Software Installation, security groups are not used to filter individual settings, or subsets, of a Group Policy object. For control over individual settings, edit or create a Group Policy object instead.

Related Topics


Find the sites, domains, and organizational units to which a Group Policy object is linked

Microsoft Windows graphic

To find the sites, domains, and organizational units to which a Group Policy object is linked

  1. Open the Group Policy object.
  2. Right-click the icon or the name of the Group Policy object, which appears as follows:
    Group Policy object name [domain_controller_name.domain_name] Policy,
    and then click Properties.
  3. Click the Links tab, and then click Find Now. The sites, domains, and organizational units to which the Group Policy object is linked are listed in the Sites, Domains or Organizational Units found box.

Notes

  • To open the Group Policy snap-in, see Related Topics.
  • If the Group Policy object is linked to more than one domain, you can limit your search for organizational units to one domain at a time by using the Domain drop-down list.

Related Topics


Disable the User Configuration settings in a Group Policy object

Microsoft Windows graphic

To disable the User Configuration settings in a Group Policy object

  1. Open the Group Policy object that you want to edit.
  2. Right-click the icon or the name of the Group Policy object, which appears as follows:
    Group Policy object name [domain_controller_name.domain_name] Policy,
    and then click Properties.
  3. On the General tab, select the Disable User Configuration settings check box, and then click OK.

Notes

  • To open the Group Policy snap-in, see Related Topics.
  • When you disable the User Configuration settings in a Group Policy object, they no longer affect any site, domain, or organizational unit to which this Group Policy object is linked.

Related Topics


Disable the Computer Configuration settings in a Group Policy object

Microsoft Windows graphic

To disable the Computer Configuration settings in a Group Policy object

  1. Open the Group Policy object that you want to edit.
  2. Right-click the icon or the name of the Group Policy object, which appears as follows:
    Group Policy object name [domain_controller_name.domain_name] Policy,
    and then click Properties.
  3. On the General tab, select the Disable Computer Configuration settings check box, and then click OK.

Notes

  • To open the Group Policy snap-in, see Related Topics.
  • When you disable the Computer Configuration settings in a Group Policy object, they no longer affect any site, domain, or organizational unit to which this Group Policy object is linked.

Related Topics


Use Administrative Templates

  • Add or remove an Administrative Template (.adm file)
  • Use the view provided by Administrative Templates
  • Filter the view provided by Administrative Templates


Add or remove an Administrative Template (.adm file)

Microsoft Windows graphic

To add or remove an Administrative Template (.adm file)

  1. Open the Group Policy object that you want to edit, and in the console tree right-click Administrative Templates.

    Where?

    • Group Policy object name
    • Computer Configuration (or User Configuration)
    • Administrative Templates
  2. Click Add/Remove Templates.
  3. If you want to remove a template, in the Current Policy Templates list, click the template, and then click Remove.

    If you want to add a template, click Add. In the Policy Templates dialog box, click the template that you want to add, and then click Open.

  4. In the Add/Remove Templates dialog box, click Close.

Notes

  • To open the Group Policy snap-in, see Related Topics.
  • Because the role of Administrative Templates has changed from Windows NT 4.0 to Windows XP, the use of Windows NT 4.0–style .adm files on Windows XP clients is not recommended.

    If you do use the older .adm files to create namespaces in the Group Policy console, you can control whether the Windows NT 4.0 System Policy settings are visible in the details pane, as follows:

    1. In the console tree, click Administrative Templates.
    2. On the View menu, click Filtering, and then select or clear the Only show policy settings that can be fully managed check box. Selecting this check box causes System Policy settings to not be visible in the details pane. You can also use the Group Policy setting "Enforce Show Policies Only" to do this.

    Where?

    • Group Policy object name
    • User Configuration
    • Administrative Templates
    • System
    • Group Policy

Related Topics


Use the view provided by Administrative Templates

Microsoft Windows graphic

To use the view provided by Administrative Templates

  1. Open the Group Policy snap-in, and in the console click the folder under Administrative Templates that contains the policy settings that you want to set.

    2. Where?

    • policy name Policy
    • Computer Configuration (or User Configuration)
    • Administrative Templates
    • policy folder
  2. At the bottom of the details pane, click the Extended tab.
  3. In the Setting column, click the name or icon for a setting to read a description of the setting.
  4. If you want to change that setting from its default (not configured) state, double-click the name or icon for the setting. On the Setting tab, click one of the buttons that are described in the following table.
    Button | Result
    Not Configured | The registry is not modified.
    Enabled | The registry reflects that the policy setting is selected.
    Disabled | The registry reflects that the policy setting is not selected.

    Select any other available options that you want on the Setting tab, and then click OK.

    5. You can use the Previous Setting and Next Setting buttons to view other settings in the current folder and set them in the same way.

Notes

  • To open the Group Policy snap-in, see Related Topics.
  • Group Policy has two Administrative Templates branches in the console. Settings for HKEY_LOCAL_MACHINE are under Computer Configuration, and settings for HKEY_CURRENT_USER are under User Configuration.
  • If computer policy conflicts with user policy, computer policy generally takes precedence. Application authors can disregard that convention, however, and if they do, Group Policy cannot enforce it.
  • The Extended tab feature is new. It not only displays the text that explains the policy setting, as Windows 2000 did, but it also indicates which versions of Windows are supported as clients for the setting. If you prefer a view of the policy setting without the explanatory text, click the Standard tab.
  • For details about the new supported keyword in .adm files, see Implementing Registry-Based Group Policy (http://www.microsoft.com/) at the Microsoft Web site.

Related Topics


Filter the view provided by Administrative Templates

Microsoft Windows graphic

To filter the view provided by Administrative Templates

  1. Open the Group Policy snap-in, and in the console tree click Administrative Templates, or click a folder under Administrative Templates that contains the policy settings that you want to filter.

    2. Where?

    • policy name Policy
    • Computer Configuration (or User Configuration)
    • Administrative Templates
    • policy_folder
  2. Click View, and then click Filtering.
  3. Select the Filter by Supported On information check box, and then in the list box select the check boxes for the categories that you want to make visible.
  4. If you want to hide settings that are not configured, select the Only show configured policy settings check box. If you do this, only enabled or disabled settings will be visible.
  5. If you want to hide Windows NT 4.0–style system policy settings, make sure that the Only show policy settings that can be fully managed check box is selected. This option is recommended, and it is enabled by default.

Notes

  • To open the Group Policy snap-in, see Related Topics.
  • This filtering procedure is useful if there are too many Administrative Templates settings at one time in the Group Policy console. This filtering only selects which settings are visible in the console. It does not affect whether the settings apply to users or computers, and it is not the same as another procedure: To filter the scope of Group Policy according to security group membership.

Related Topics


Use scripts

  • Set up scripts on the domain controller
  • Assign computer startup scripts
  • Assign computer shutdown scripts
  • Assign user logon scripts
  • Assign user logoff scripts


Set up scripts on the domain controller

Microsoft Windows graphic

To set up scripts on the domain controller

  • Copy the script and dependent files to the Netlogon share, or other share, of the domain controller from which you want the script to run.


Assign computer startup scripts

Microsoft Windows graphic

To assign computer startup scripts

  1. Open the Group Policy snap-in.
  2. In the console tree, click Scripts (Startup/Shutdown).

    Where?

    • policy name Policy
    • Computer Configuration
    • Windows Settings
    • Scripts (Startup/Shutdown)
  3. In the details pane, double-click Startup.
  4. In the Startup Properties dialog box, click Add.
  5. In the Add a Script dialog box, type the following information, and then click OK:

    Script Name: Type the path to the script, or click Browse to search for the script file in the Netlogon share of the domain controller.

    Script Parameters: Type any parameters that you want, the same way as you would type them on the command line. For example, if your script includes parameters called //logo (display banner) and //I (interactive mode), type the following: //logo //I

  6. In the Startup Properties dialog box, specify the options that you want, as follows, and then click OK:

    Startup Scripts for Group Policy object: Lists all the scripts that are currently assigned to the selected Group Policy object. If you assign multiple scripts, the scripts are processed in the order that you specify. To move a script up in the list, click it, and then click Up. To move a script down in the list, click it, and then click Down.

    Add: Opens the Add a Script dialog box, where you can specify any additional scripts to use.

    Edit: Opens the Edit Script dialog box, where you can modify script information, such as name and parameters.

    Remove: Removes the selected script from the Startup Scripts list.

    Show Files: Displays the script files that are stored in the selected Group Policy object.

Notes

  • To open the Group Policy snap-in, see Related Topics.
  • Startup scripts are run as Local System, and they have the full rights that are associated with being able to run as Local System.

Related Topics


Assign computer shutdown scripts

Microsoft Windows graphic

To assign computer shutdown scripts

  1. Open the Group Policy snap-in.
  2. In the console tree, click Scripts (Startup/Shutdown).

    Where?

    • policy name Policy
    • Computer Configuration
    • Windows Settings
    • Scripts (Startup/Shutdown)
  3. In the details pane, double-click Shutdown.
  4. In the Shutdown Properties dialog box, click Add.
  5. In the Add a Script dialog box, type the following information, and then click OK:

    Script Name: Type the path to the script, or click Browse to search for the script file in the Netlogon share of the domain controller.

    Script Parameters: Type any parameters that you want, the same way that you would type them on the command line. For example, if your script includes parameters called //logo (display banner) and //I (interactive mode), type the following: //logo //I

  6. In the Shutdown Properties dialog box, specify the options that you want, as follows, and then click OK:

    Shutdown Scripts for Group Policy object: Lists all the scripts that are currently assigned to the selected Group Policy object. If you assign multiple scripts, the scripts are processed in the order that you specify. To move a script up in the list, click it, and then click Up. To move a script down in the list, click it, and then click Down.

    Add: Opens the Add a Script dialog box, where you can specify any additional scripts to use.

    Edit: Opens the Edit Script dialog box, where you can modify script information, such as name and parameters.

    Remove: Removes the selected script from the Shutdown Scripts list.

    Show Files: Displays the script files that are stored in the selected Group Policy object.

Notes

  • To open the Group Policy snap-in, see Related Topics.
  • Shutdown scripts are run as Local System, and they have the full rights that are associated with being able to run as Local System.

Related Topics


Assign user logon scripts

Microsoft Windows graphic

To assign user logon scripts

  1. Open the Group Policy snap-in.
  2. In the console tree, click Scripts (Logon/Logoff).

    Where?

    • policy name Policy
    • User Configuration
    • Windows Settings
    • Scripts (Logon/Logoff)
  3. In the details pane, double-click Logon.
  4. In the Logon Properties dialog box, click Add.
  5. In the Add a Script dialog box, type the following information, and then click OK:

    Script Name: Type the path to the script, or click Browse to search for the script file in the Netlogon share of the domain controller.

    Script Parameters: Type any parameters that you want, the same way as you would type them on the command line. For example, if your script includes parameters called //logo (display banner) and //I (interactive mode), type the following: //logo //I

  6. In the Logon Properties dialog box, specify the options that you want, as follows, and then click OK:

    7. Logon Scripts for Group Policy object: Lists all the scripts that are currently assigned to the selected Group Policy object. If you assign multiple scripts, the scripts are processed in the order that you specify. To move a script up in the list, click it, and then click Up. To move a script down in the list, click it, and then click Down.

    Add: Opens the Add a Script dialog box, where you can specify any additional scripts to use.

    Edit: Opens the Edit Script dialog box, where you can modify script information, such as name and parameters.

    Remove: Removes the selected script from the Logon Scripts list.

    Show Files: Displays the script files that are stored in the selected Group Policy object.

Notes

  • To open the Group Policy snap-in, see Related Topics.
  • Logon scripts are run as User, not Administrator, and their rights are limited accordingly.

Related Topics


Assign user logoff scripts

Microsoft Windows graphic

To assign user logoff scripts

  1. Open the Group Policy snap-in.
  2. In the console tree, click Scripts (Logon/Logoff).

    Where?

    • policy name Policy
    • User Configuration
    • Windows Settings
    • Scripts (Logon/Logoff)
  3. In the details pane, double-click Logoff.
  4. In the Logoff Properties dialog box, click Add.
  5. In the Add a Script dialog box, type the following information, and then click OK:

    Script Name: Type the path to the script, or click Browse to search for the script file in the Netlogon share of the domain controller.

    Script Parameters: Type any parameters that you want, the same way as you would type them on the command line. For example, if your script includes parameters called //logo (display banner) and //I (interactive mode), type the following: //logo //I

  6. In the Logoff Properties dialog box, specify the options the you want, as follows, and then click OK:

    7. Logoff Scripts for Group Policy object: Lists all the scripts that are currently assigned to the selected Group Policy object. If you assign multiple scripts, the scripts are processed in the order that you specify. To move a script up in the list, click it, and then click Up. To move a script down in the list, click it, and then click Down.

    Add: Opens the Add a Script dialog box, where you can specify any additional scripts to use.

    Edit: Opens the Edit Script dialog box, where you can modify script information, such as name and parameters.

    Remove: Removes the selected script from the Logoff Scripts list.

    Show Files: Displays the script files that are stored in the selected Group Policy object.

Notes

  • To open the Group Policy snap-in, see Related Topics.
  • Logoff scripts are run as User, not Administrator, and their rights are limited accordingly.

Related Topics


Use the Software Installation snap-in

  • Open the Software Installation snap-in
  • Set options for Software Installation
  • Work with applications
  • Set application properties
  • Work with package modifications


Open the Software Installation snap-in

Microsoft Windows graphic

To open the Software Installation snap-in

  1. Open the Group Policy snap-in.
  2. To assign software applications to computers, in the console tree double-click Computer Configuration. To assign or publish software applications to users, in the console tree double-click User Configuration.
  3. Double-click Software Settings, and then click Software installation.

    Where?

    • policy name Policy
    • Computer Configuration (or User Configuration)
    • Software Settings
    • Software installation

Note

  • To open the Group Policy snap-in, see Related Topics.

Related Topics


Set options for Software Installation

  • Set Software Installation defaults
  • Specify automatic installation options based on file name extension
  • Specify categories for applications to be managed


Set Software Installation defaults

Microsoft Windows graphic

To set Software Installation defaults

  1. Open the Software Installation snap-in.
  2. In the console tree, right-click Software installation.

    Where?

    • Group Policy object name
    • Computer Configuration (or User Configuration)
    • Software Settings
    • Software installation
  3. Click Properties, and on the General tab specify the following options that you want:

    Default package location: Specify the default software distribution point.

    New packages: By default, packages can either be published or assigned. (To computers, they can only be assigned). If you want to select these options for each package, click Display the Deploy Software dialog box. For even more control on a per-package basis, click Advanced.

    Installation user interface options: Click Basic or Maximum, depending on how apparent you want the installation process to be to the users.

Note

  • To open the Software Installation snap-in, see Related Topics.

Related Topics


Specify automatic installation options based on file name extension

Microsoft Windows graphic

To specify automatic installation options based on file name extension

  1. Open the Software Installation snap-in.
  2. In the console tree, right-click Software installation.

    3. Where?

    • Group Policy object name
    • Computer Configuration (or User Configuration)
    • Software Settings
    • Software installation
  3. Click Properties, and then click the File Extensions tab.
  4. On the File Extensions tab, specify the following options that you want, and then click OK:

    5. Select file extension: Displays a list of all the available file name extensions for the managed software. When an extension is selected, all the applications in Active Directory that are associated with the selected file name extension are displayed in the Application precedence list box. For example, for an .htm extension, many applications can be associated, such as Microsoft Word, Microsoft Internet Explorer, Netscape Communicator, and so on.

    Application precedence: Lists all the applications that are associated with the selected file name extension. By default, the application with the highest precedence is at the top of the list.

    Up: Moves the selected application higher in the precedence list. The application at the top of the list is automatically installed if a document with the selected file name extension is invoked before the application has been installed. The Up button is unavailable when the selected application is at the top of the list.

    Down: Moves the selected application lower in the precedence list. The Down button is unavailable when the selected application is at the bottom of the list.

Notes

  • To open the Software Installation snap-in, see Related Topics.
  • When you upgrade an application, make sure to turn off the autoinstall option for the older version.

Related Topics


Specify categories for applications to be managed

Microsoft Windows graphic

To specify categories for applications to be managed

  1. Open the Software Installation snap-in.
  2. In the console tree, right-click Software installation.

    3. Where?

    • Group Policy object name
    • Computer Configuration (or User Configuration)
    • Software Settings
    • Software installation
  3. Click Properties, and then click the Categories tab.
  4. Create or change the list of categories under which programs appear in Add or Remove Programs in Control Panel, using the following buttons:

    5. Add: Opens a dialog box where you can type text to define the new category. This button is unavailable if you do not have permission to add categories.

    Modify: Opens a dialog box where you can change the text of the selected category. This button is unavailable if you do not have permission to edit categories.

    Remove: Removes the selected category from the Categories list. This button is unavailable if you do not have permission to edit categories.

Notes

  • To open the Software Installation snap-in, see Related Topics.
  • The changes that you make to the application categories apply throughout the domain in which this Group Policy object is stored.
  • To perform this procedure, you must be a domain administrator or have equivalent rights.

Related Topics


Work with applications

  • Assign an application
  • Publish an application
  • Upgrade an application
  • Remove a managed application


Assign an application

Microsoft Windows graphic

To assign an application

  1. Open the Software Installation snap-in.
  2. In the console tree, click Software installation.

    3. Where?

    • Group Policy object name
    • Computer Configuration (or User Configuration)
    • Software Settings
    • Software installation
  3. Right-click in the details pane, point to New, and then click Package.
  4. In the Open dialog box, click the Windows Installer package, and then click Open.

    The Open dialog box shows the packages that are located at the software distribution point that you have specified as the default. For instructions on how to set the default software distribution point, see Related Topics.

    If the Windows Installer package is located on a different network share, navigate to the correct software distribution point using the Open dialog box, click the package, and then click Open.

  5. In the Deploy Software dialog box, click Assigned, and then click OK.

Related Topics


Publish an application

Microsoft Windows graphic

To publish an application

  1. Open the Software Installation snap-in.
  2. In the console tree, click Software installation.

    3. Where?

    • Group Policy object name
    • User Configuration
    • Software Settings
    • Software installation
  3. Right-click in the details pane, point to New, and then click Package.
  4. In the Open dialog box, click the Windows Installer package to be published, and then click Open.

    The Open dialog box shows the packages that are located at a software distribution point that you have specified as the default. For instructions on how to set the default software distribution point, see Related Topics.

    If the Windows Installer package is located on a different network share, navigate to the correct software distribution point using the Open dialog box, click the package, and then click Open.

  5. In the Deploy Software dialog box, click Published, and then click OK.

    The application is available for users to install either by using Add or Remove Programs in Control Panel or by opening a file with a file name extension that you have associated with the application. For information on how to associate a file name extension with an application, see Related Topics.

Notes

  • To open the Software Installation snap-in, see Related Topics.
  • Packages can be published only to users, not to computers.

Related Topics


Upgrade an application

Microsoft Windows graphic

To upgrade an application

  1. Open the Software Installation snap-in.
  2. In the console tree, click Software installation.

    3. Where?

    • Group Policy object name
    • Computer Configuration (or User Configuration)
    • Software Settings
    • Software installation
  3. In the details pane, right-click the Windows Installer package that will function as the upgrade (not the package to be upgraded). You will have previously assigned or published this package.
  4. Click Properties, and then click the Upgrades tab.
  5. Click Add to create or add to the list of packages that are to be upgraded by the current package.
  6. Under Choose a package from in the Add Upgrade Package dialog box, click either Current Group Policy object or A specific Group Policy object as the source of the package to be upgraded. In the latter case, click Browse; click the Group Policy object that you want; and then, in the Browse for a Group Policy object dialog box, click OK.

    Under Package to upgrade, a list of all the other packages that are assigned or published within the selected Group Policy object appears. Depending on the Group Policy object, this list may have zero or more entries.

  7. Click the package that you want to upgrade, and then click either Uninstall the existing package, then install the upgrade package or Package can upgrade over the existing package, and then click OK.

    Typically, the uninstall option is for replacing an application with a completely different application (perhaps an application from a different vendor). The upgrade option is for installing a newer version of the same product while retaining the user's application preferences, document type associations, and so on.

  8. On the Upgrades tab, select the Required upgrade for existing packages check box if you want the upgrade to be mandatory, and then click OK.

    If this is an upgrade under Computer Configuration in the Group Policy console tree, the check box appears dimmed and selected, because packages can only be assigned to computers, not published.

Note

  • To open the Software Installation snap-in, see Related Topics.

Related Topics


Remove a managed application

Microsoft Windows graphic

To remove a managed application

  1. Open the Software Installation snap-in.
  2. In the console tree, click Software installation.

    3. Where?

    • Group Policy object name
    • Computer Configuration (or User Configuration)
    • Software Settings
    • Software installation
  3. In the details pane, right-click the application that you want to remove.
  4. Point to All Tasks, and then click Remove.
  5. In the Remove Software dialog box, click one of the following removal methods, and then click OK:

    Immediately uninstall software from users and computers: Click this method to specify that the application is removed the next time a user logs on or restarts the computer.

    Allow users to continue to use the software but prevent new installations: Click this method to specify that users can continue to use the application if they have already installed it. If users have removed the application or if they have never installed it, they will not be able to install it.

Note

  • To open the Software Installation snap-in, see Related Topics.

Related Topics


Set application properties

  • View properties for managed applications
  • Edit installation options for applications
  • Specify application categories for Add or Remove Programs in Control Panel
  • Set the autoinstall option for an application
  • Set permissions for Software Installation


View properties for managed applications

Microsoft Windows graphic

To view properties for managed applications

  1. Open the Software Installation snap-in.
  2. In the details pane, right-click the application for which you want to view properties, and then click Properties.

Note

  • To open the Software Installation snap-in, see Related Topics.

Related Topics


Edit installation options for applications

Microsoft Windows graphic

To edit installation options for applications

  1. Open the Software Installation snap-in.
  2. In the console tree, click Software installation.

    3. Where?

    • Group Policy object name
    • Computer Configuration (or User Configuration)
    • Software Settings
    • Software installation
  3. In the details pane, right-click the application for which you want to set installation options, and then click Properties.
  4. In the properties dialog box for the application, click the Deployment tab.
  5. On the Deployment tab, click one of the following options under Deployment type:

    Published: Users in the selected site, domain, or organizational unit can install the application by using either Add or Remove Programs in Control Panel or file activation.

    Assigned: Users in the selected site, domain, or organizational unit receive this application the next time that they log on (for assignment to users) or when the computer restarts (for assignment to computers).

  6. Under Deployment options, select the check boxes for the following options that you want:

    Auto-install this application by file extension activation: Select this option if you want to use application precedence for the file name extension as it is determined on the File Extensions tab in the Software installation Properties dialog box.

    If the application is not already installed, selecting this option causes the application to be installed when the user opens a file with this file association, for example, by double-clicking the file.

    Uninstall this application when it falls out of the scope of management: Select this option if you want the application to be removed when users log on, or when computers start up, if they move to a site, domain, or organizational unit for which the application is not deployed.

    Do not display this package in Add or Remove Programs in Control Panel: This option removes the most obvious method for users to uninstall the application. This may be useful from time to time during the software life cycle.

    Install this package at logon: This option does not merely advertise the application to the user by means of a shortcut. Instead, it fully installs the application using the package defaults. Note that the package defaults themselves may call for installation of all features or of only some features.

  7. Under Installation user interface options, click one of the following options:

    Basic: Only progress bars and errors are displayed.

    Maximum: The entire user interface that is supported by the package is displayed.

  8. If you want to set the following advanced options, click Advanced:

    Ignore language when deploying this package: Select this check box if you are installing an application whose language differs from the language of the operating system.

    Remove previous installs of this product from computers, if the product was not installed by Group Policy–based Software Installation: This option might be useful, for example, if company policy does not allow users to install applications from their own compact discs.

    Make this 32-bit X86 application available to IA64 machines: Specifies whether the 32-bit application should be assigned or published to 64-bit computers.

    Include OLE class and product information: Specifies whether to deploy information about COM components with the package so that software on the client can install them from Active Directory as needed, in a manner similar to activation by file extension.

Notes

  • To open the Software Installation snap-in, see Related Topics.
  • The Advanced Deployment Options dialog box, which appears when you click Advanced, provides the following advanced diagnostic information, which can be useful for troubleshooting.
    Field | Data
    Product code | A globally unique identifier (GUID) representing the product
    Deployment count | The number of times the package has been deployed in this Group Policy object
    Script name | The full network path, including GUIDs, to the application assignment script (.aas file)

Related Topics


Specify categories for Add or Remove Programs in Control Panel

Microsoft Windows graphic

To specify application categories for Add or Remove Programs in Control Panel

  1. Open the Software Installation snap-in.
  2. In the details pane, double-click the managed application for which you want to set categories.
  3. In the properties dialog box for the application, click the Categories tab.
  4. On the Categories tab, set the following options that you want to use, and then click OK:

    5. Available categories: Lists the application categories that have been defined for your organization.

    Select: Associates the selected application category with the application. To use this option, select a category in the Available categories list, and then click Select.

    Remove: Removes a category from the Selected categories list. To use this option, select a category in the Selected categories list, and then click Remove.

    Selected categories: Displays the categories that are associated with this application.

Notes

  • To open the Software Installation snap-in, see Related Topics.
  • The categories that you set in this dialog box generally pertain to published applications only, because assigned applications do not appear in Add or Remove Programs in Control Panel. The application appears in the selected categories in Add or Remove Programs, which the user can use to install the application.
  • This procedure is not used to create or destroy categories, but only to associate applications with existing categories. To manage the categories themselves, see Related Topics.

Related Topics


Set the autoinstall option for an application

Microsoft Windows graphic

To set the autoinstall option for an application

  1. Open the Software Installation snap-in.
  2. In the console tree, click Software installation.

    3. Where?

    • Group Policy object name
    • User Configuration
    • Software Settings
    • Software installation
  3. In the details pane, right-click the application that you want to be installed automatically when the user tries to open a file with the associated extension.
  4. Click Properties, and then click the Deployment tab.
  5. Under Deployment options, make sure that the Auto-install this application by file extension activation check box is selected, and then click OK.

Notes

  • To open the Software Installation snap-in, see Related Topics.
  • When you upgrade an application, make sure to turn off the autoinstall option for the older version of the application.

Related Topics


Set permissions for Software Installation

Microsoft Windows graphic

To set permissions for Software Installation

  1. Open the Group Policy object that you want to edit.
  2. In the console tree, right-click the icon or the name of the Group Policy object, which appears as follows:
    Group Policy object name [domain_name] Policy,
    and then click Properties.
  3. Click the Security tab, and in the Group or user names box, click the security group for which you want to set permissions.

    If you want to change the set of security groups that have permissions on this Group Policy object, click the Add or Remove buttons to add or remove security groups.

  4. If the security group represents administrators (who manage software for users and computers in the organization), in the Permissions box for the selected security group, select the Allow check box for Full Control, and then click OK.

    If the security group represents users (who use software that is assigned or published by an administrator), in the Permissions box for the selected security group, select the Allow check box for both Apply Group Policy and Read, and then click OK.

Notes

  • To open the Group Policy snap-in, see Related Topics.
  • The permissions that you set in this procedure pertain only to the Group Policy object. In addition, the network must have a shared folder (a software distribution point) that contains the packages to be installed. Administrators must have Full Control of the software distribution point, and users must have Read permission. For information about permissions and how to set them, see Access Control.

Related Topics


Work with package modifications

  • Add or remove modifications for an application package


Add or remove modifications for an application package

Microsoft Windows graphic

To add or remove modifications for an application package

  1. Open the Software Installation snap-in.
  2. In the console tree, click Software installation.

    3. Where?

    • Group Policy object name
    • Computer Configuration (or User Configuration)
    • Software Settings
    • Software installation
  3. Right-click in the details pane, point to New, and then click Package. The Open dialog box opens to the default package location, which you can set. If you want to change the default package location, see To set Software Installation defaults.
  4. In the Open dialog box, click the Windows Installer package, and then click Open.
  5. In the Deploy Software dialog box, click Advanced, and then click OK.
  6. In the properties dialog box for the package, click the Modifications tab.
  7. If you want to add modifications, click Add. In the Open dialog box, browse to the transform file (.mst), and then click Open.
  8. If you want to remove modifications, on the Modifications tab, click the modification that you want to remove, and then click Remove. Repeat this step until you have removed each modification that you do not want.
  9. When you are sure that the modifications are configured the way that you want them, click OK.

Important

  • Do not click OK until you have finished configuring the modifications. When you click OK, the package is assigned or published immediately. If the modifications are not properly configured, you will have to uninstall the package or upgrade the package with a correctly configured version.

Notes

  • To open the Software Installation snap-in, see Related Topics.
  • Modifications (.mst files) are applied to Windows Installer packages (which have the .msi extension) in an order that is specified by the administrator. This order must be determined before the application is assigned or published.
  • You can add multiple modifications (also called "transforms"). The transforms are applied in the order that you specify in the Modifications list, from top to bottom. To rearrange the list, click a transform in the list, and then click Move Up or Move Down.

Related Topics


Use the Folder Redirection snap-in

  • Redirect special folders to the same location for all users
  • Redirect special folders to different locations based on security group membership


Redirect special folders to the same location for all users

  • Redirect My Documents to the home directory
  • Redirect special folders to the root directory
  • Redirect special folders to a specific path
  • Redirect special folders to the local profile location


Redirect My Documents to the home directory

Microsoft Windows graphic

To redirect My Documents to the home directory

  1. Open a Group Policy object that is linked to the site, domain, or organizational unit that contains the users whose My Documents folders you want to redirect.
  2. In the console tree, double-click Folder Redirection to display My Documents.

    Where?

    • policy name Policy
    • User Configuration
    • Windows Settings
    • Folder Redirection
    • My Documents
  3. Right-click My Documents, and then click Properties.
  4. In the Setting box on the Target tab, click
    Basic - Redirect everyone's folder to the same location.
  5. Under Target folder location, click Redirect to the user's home directory, and then click OK.

Notes

  • This option is intended only for organizations that have already deployed home directories and that want to maintain compatibility with their existing home directory environment.
  • If you redirect My Documents to the home directory, domain administrators have full control over the user's My Documents folder. This is the case even if you select the Grant the user exclusive rights to My Documents check box on the Settings tab in the My Documents Properties dialog box.
  • Redirection to the home directory requires a Windows XP Professional client. It does not work for Windows 2000 clients, Windows NT clients, or Windows XP Home Edition clients.
  • In redirection of the home directory, security is not checked, and permissions are not changed. Folder Redirection assumes that the administrator has set directory security correctly. This relaxed security is why redirection to the home directory is only recommended if it is needed for backward compatibility.
  • In home directory redirection, no ownership checks are made. Normally, folder redirection fails if a user is not the owner of the folder to which he or she is being redirected. Because redirection to the home directory is intended for use in a legacy environment, this ownership check is skipped.
  • Users must have the home directory property set correctly on their user object in Active Directory. The client computer finds the path for the user's home directory from the user object in Active Directory at logon time. Users who are affected by Folder Redirection policy must have this path set correctly, or folder redirection will fail.
  • Do not redirect My Documents to a home directory location that is subject to encryption by the Encrypting File System (EFS), because only you or a domain administrator will be able to decrypt it. The user whose My Documents folder is redirected there will not be able to decrypt it.

Related Topics


Redirect special folders to the root directory

Microsoft Windows graphic

To redirect special folders to the root directory

  1. Open a Group Policy object that is linked to the site, domain, or organizational unit that contains the users whose special folders you want to redirect.
  2. In the console tree, double-click Folder Redirection to display the special folder that you want to redirect.

    Where?

    • policy name Policy
    • User Configuration
    • Windows Settings
    • Folder Redirection
  3. Right-click the special folder that you want to redirect (such as Desktop, My Documents, and so on), and then click Properties.
  4. In the Setting box on the Target tab, click
    Basic - Redirect everyone's folder to the same location.
  5. Under Target folder location, click Create a folder for each user under the root path.
  6. In the Root Path box, type a Universal Naming Convention (UNC) path, such as \\servername\sharename, and then click OK.
  7. In the properties dialog box for the special folder, click OK.

Note

  • The user name and folder name are appended to the UNC path automatically.

Related Topics


Redirect special folders to a specific path

Microsoft Windows graphic

To redirect special folders to a specific path

  1. Open a Group Policy object that is linked to the site, domain, or organizational unit that contains the users whose special folders you want to redirect.
  2. In the console tree, double-click Folder Redirection to display the special folder that you want to redirect.

    Where?

    • policy name Policy
    • User Configuration
    • Windows Settings
    • Folder Redirection
  3. Right-click the special folder that you want to redirect (such as Desktop, My Documents, and so on), and then click Properties.
  4. In the Setting box on the Target tab, click
    Basic - Redirect everyone's folder to the same location.
  5. Under Target folder location, click Redirect to the following location.
  6. In the Root Path box, type a UNC path, such as \\server\share, or type a locally valid path, such as C:\somefolder, and then click OK.

Note

  • In most cases, you want to redirect special folders to the root directory rather than to a specific location, as described in this procedure. For more information, see To redirect special folders to the root directory.

Related Topics


Redirect special folders to the local profile location

Microsoft Windows graphic

To redirect special folders to the local profile location

  1. Open a Group Policy object that is linked to the site, domain, or organizational unit that contains the users whose special folders you want to redirect.
  2. In the console tree, double-click Folder Redirection to display the special folder that you want to redirect.

    Where?

    • policy name Policy
    • User Configuration
    • Windows Settings
    • Folder Redirection
  3. Right-click the special folder that you want to redirect (such as Desktop, My Documents, and so on), and then click Properties.
  4. In the Setting box on the Target tab, click
    Basic - Redirect everyone's folder to the same location.
  5. Under Target folder location, click Redirect to the local user profile location, and then click OK.

Notes

  • This procedure is useful for returning redirected folders to their original, default location.
  • Changing the setting to No administrative policy specified on the Target tab of the properties dialog box for a special folder does not cause the special folder to be redirected back to its default location.

Related Topics


Redirect special folders to different locations based on security group membership

  • Redirect My Documents to the home directory based on security group membership
  • Redirect special folders to the root directory based on security group membership
  • Redirect special folders to a specific path based on security group membership
  • Redirect special folders to the local profile location based on security group membership


Redirect My Documents to the home directory based on security group membership

Microsoft Windows graphic

To redirect My Documents to the home directory based on security group membership

  1. Open a Group Policy object that is linked to the site, domain, or organizational unit that contains the users whose My Documents folders you want to redirect.
  2. In the console tree, double-click Folder Redirection to display My Documents.

    Where?

    • policy name Policy
    • User Configuration
    • Windows Settings
    • Folder Redirection
    • My Documents
  3. Right-click My Documents, and then click Properties.
  4. In the Setting box on the Target tab, click
    Advanced - Specify locations for various user groups.
  5. Click Add to open the Specify Group and Location dialog box.
  6. Under Security Group Membership, type the name of the security group, or click Browse to search for it.
  7. Under Target Folder Location, click Redirect to the user's home directory, and then click OK.
  8. In the My Documents Properties dialog box, click OK.

Notes

  • This option is intended only for organizations that have already deployed home directories and that want to maintain compatibility with their existing home directory environment.
  • If you redirect My Documents to the home directory, domain administrators have full control over the user's My Documents folder. This is the case even if you select the Grant the user exclusive rights to My Documents check box on the Settings tab in the My Documents Properties dialog box.
  • Redirection to the home directory requires a Windows XP Professional client. It does not work for Windows 2000 clients, Windows NT clients, or Windows XP Home Edition clients.
  • In home directory redirection, security is not checked, and permissions are not changed. Folder Redirection assumes that the administrator has set directory security correctly. This relaxed security is why redirection to the home directory is only recommended if it is needed for backward compatibility.
  • In home directory redirection, no ownership checks are made. Normally, folder redirection fails if a user is not the owner of the folder to which he or she is being redirected. Because redirection to the home directory is intended for use in a legacy environment, this ownership check is skipped.
  • Users must have the home directory property set correctly on their user object in Active Directory. The client computer finds out the path for the user's home directory from the user object in Active Directory at logon time. Users who are affected by Folder Redirection policy must have this path set correctly, or folder redirection will fail.
  • Do not redirect My Documents to a home directory location that is subject to encryption by the Encrypting File System (EFS), because only you or a domain administrator will be able to decrypt it. The user whose My Documents folder is redirected there will not be able to decrypt it.

Related Topics


Redirect special folders to the root directory based on security group membership

Microsoft Windows graphic

To redirect special folders to the root directory based on security group membership

  1. Open a Group Policy object that is linked to the site, domain, or organizational unit that contains the users whose special folders you want to redirect.
  2. In the console tree, double-click Folder Redirection to display the special folder that you want to redirect.

    Where?

    • policy name Policy
    • User Configuration
    • Windows Settings
    • Folder Redirection
  3. Right-click the special folder that you want to redirect (such as Desktop, My Documents, and so on), and then click Properties.
  4. In the Setting box on the Target tab, click
    Advanced - Specify locations for various user groups.
  5. Click Add to open the Specify Group and Location dialog box.
  6. Under Security Group Membership, type the name of the security group, or click Browse to search for it.
  7. Under Target Folder Location, click Create a folder for each user under the root path.
  8. In the Root Path box, type the UNC path to use for redirection, such as \\servername\sharename, and then click OK.
  9. In the properties dialog box for the special folder, click OK.

Note

  • The user name and folder name are appended to the UNC path automatically.

Related Topics


Redirect special folders to a specific path based on security group membership

Microsoft Windows graphic

To redirect special folders to a specific path based on security group membership

  1. Open a Group Policy object that is linked to the site, domain, or organizational unit that contains the users whose special folders you want to redirect.
  2. In the console tree, double-click Folder Redirection to display the special folder that you want to redirect.

    Where?

    • policy name Policy
    • User Configuration
    • Windows Settings
    • Folder Redirection
  3. Right-click the special folder that you want to redirect (such as Desktop, My Documents, and so on), and then click Properties.
  4. In the Setting box on the Target tab, click
    Advanced - Specify locations for various user groups.
  5. Click Add to open the Specify Group and Location dialog box.
  6. Under Security Group Membership, type the name of the security group, or click Browse to search for it.
  7. Under Target Folder Location, click Redirect to the following location.
  8. In the Root Path box, type the UNC path to use for redirection, such as \\servername\sharename, and then click OK.
  9. In the properties dialog box for the special folder, click OK.

Note

  • In most cases, you want to redirect special folders to the root directory rather than to a specific location, as described here. For more information, see To redirect special folders to the root directory.

Related Topics


Redirect special folders to the local profile location based on security group membership

Microsoft Windows graphic

To redirect special folders to the local profile location based on security group membership

  1. Open a Group Policy object that is linked to the site, domain, or organizational unit that contains the users whose special folders you want to redirect.
  2. In the console tree, double-click Folder Redirection to display the special folder that you want to redirect.

    Where?

    • policy name Policy
    • User Configuration
    • Windows Settings
    • Folder Redirection
  3. Right-click the special folder that you want to redirect (such as Desktop, My Documents, and so on), and then click Properties.
  4. In the Setting box on the Target tab, click
    Advanced - Specify locations for various user groups.
  5. Click Add to open the Specify Group and Location dialog box.
  6. Under Security Group Membership, type the name of the security group, or click Browse to search for it.
  7. Under Target Folder Location, click Redirect to the local user profile location, and then click OK.
  8. In the properties dialog box for the special folder, click OK.

Notes

  • This procedure is useful for returning redirected folders to their original, default location.
  • Changing the setting to No administrative policy specified on the Target tab of the properties dialog box for a special folder does not cause the special folder to be redirected back to its default location.

Related Topics


Configure Group Policy

  • Extend the functionality of Group Policy
  • Refresh Group Policy immediately
  • Set permissions on a Group Policy object
  • Set the Group Policy refresh rate for computers
  • Set other policies for Group Policy


Extend the functionality of Group Policy

Microsoft Windows graphic

To extend the functionality of Group Policy

  1. Open Group Policy as a stand-alone MMC snap-in.
  2. On the File menu, click Add/Remove snap-in.
  3. Click the Extensions tab, click the snap-ins that you want to extend and the extensions that you want, and then click OK.

Note

  • To open the Group Policy snap-in, see Related Topics.

Related Topics


Refresh Group Policy immediately

Microsoft Windows graphic

To refresh Group Policy immediately

  1. Click Start, and then click Run.
  2. In the Open box, type gpupdate, and then click OK.

Note

  • To learn more about gpupdate, gpresult, and other command-line tools, see Related Topics.

Related Topics


Set permissions on a Group Policy object

Microsoft Windows graphic

To set permissions on a Group Policy object

  1. Open the Group Policy snap-in.
  2. In the console tree, right-click the icon or the name of the Group Policy object for which you want to set permissions, which appears as follows:
    Group Policy object name [domain_name] Policy,
    and then click Properties.
  3. Click the Security tab, select the following options that you want, and then click OK:

    4. Add: Opens the Select Users, Computers, or Groups dialog box, where you can specify the users and groups for whom you want to assign permissions.

    Remove: In the Group or user names box, removes selected users or groups and their associated permissions from this object.

    Permissions for Authenticated Users: Lists the standard permissions that you can allow or deny to users, for example, Full Control, Read, Write, and so on.

    Advanced: Use this option to set special permissions, auditing information, and owner information for the selected object.

Notes

  • To open the Group Policy snap-in, see Related Topics.
  • You can only set permissions on a nonlocal Group Policy object.

Related Topics


Set Group Policy refresh rate for computers

Microsoft Windows graphic

To set the Group Policy refresh rate for computers

  1. Open the Group Policy snap-in.
  2. In the console tree, click Group Policy.

    3. Where?

    • policy name Policy
    • Computer Configuration
    • Administrative Templates
    • System
    • Group Policy
  3. In the details pane, double-click Group Policy refresh interval for computers.
  4. On the Setting tab, click Enabled.
  5. In the Minutes boxes, type or click the number of minutes for the refresh interval and random offset, and then click OK.
  6. In the details pane, double-click Disable background refresh of Group Policy.
  7. On the Setting tab, click Disabled, and then click OK.

Notes

  • To open the Group Policy snap-in, see Related Topics.
  • By default, the System.adm file is installed in Computer Configuration\Administrative Templates so that you can view these options. If System.adm is not installed, see Related Topics for information about how to add or remove an Administrative Templates file.
  • Client computers request policy from a domain controller when any of the following events occur:
    • A computer starts up.
    • A user logs on.
    • An application requests a refresh through the RefreshPolicy() application programming interface (API).
    • The user requests an immediate refresh.
    • One of the Group Policy refresh interval policies is enabled, and the interval has transpired.

    Policy is not imposed by the domain controller; it is requested by the client computer.

  • The minimum setting for the Group Policy refresh interval (zero minutes) actually takes about seven seconds between requests for a refresh. Very short refresh interval settings should not be used in a production environment, except briefly for testing.
  • The Software Installation and Folder Redirection extensions to Group Policy are not affected by policy refreshes.

Related Topics


Set other policies for Group Policy

Microsoft Windows graphic

To set other policies for Group Policy

  1. Open the Group Policy snap-in, with System.adm installed.
  2. To edit a computer policy, in the console tree click Group Policy.

    3. Where?

    • policy name Policy
    • Computer Configuration
    • Administrative Templates
    • System
    • Group Policy

    To edit a user policy, in the console tree click Group Policy.

    Where?

    • policy name Policy
    • User Configuration
    • Administrative Templates
    • System
    • Group Policy
  3. In the details pane, double-click the icon or the name of the policy that you want to set.
  4. On the Setting tab, select the options that you want, and then click OK.

Notes

  • To open the Group Policy snap-in, see Related Topics.
  • System.adm is installed by default.

Related Topics


Delegate control of Group Policy

  • Delegate Group Policy object editing
  • Delegate creation of Group Policy objects
  • Delegate Group Policy object linking


Delegate Group Policy object editing

Microsoft Windows graphic

To delegate Group Policy object editing

  1. Open the Group Policy snap-in.
  2. In the console tree, right-click the icon or the name of the Group Policy object, which appears as follows:
    Group Policy object name [domain_name] Policy,
    and then click Properties.
  3. To add a user or group of users, click the Security tab, and then click Add. Type the name of the user or group of users, and then click OK.

    To give the user or users Read and Write permissions, under Permissions for Authenticated Users, select the Allow check box for Read and Write. When you are finished, click OK.

    If you do not want to apply the policy to a user or group of users, under Permissions for Authenticated Users, clear the Allow check box for Apply Group Policy. When you are finished, click OK.

Note

  • To open the Group Policy snap-in, see Related Topics.

Related Topics


Delegate creation of Group Policy objects

Microsoft Windows graphic

To delegate creation of Group Policy objects

  1. Open Active Directory Users and Computers.
  2. In the console tree, click Users.
  3. In the Name column in the details pane, double-click Group Policy Creator Owners.
  4. In the Group Policy Creator Owners Properties dialog box, click the Members tab.
  5. Click Add, and then double click the name of each user or security group to whom you want to delegate creation rights.
  6. Click OK in the Select Users, Contacts, or Computers dialog box, and then click OK in the Group Policy Creator Owners Properties dialog box.

Notes

  • To start Active Directory Users and Computers, open a Remote Desktop Connection to either a Windows 2000 domain controller or a member server that has Windows 2000 Administration Tools installed. You must log on to the server as a domain administrator in order to complete this procedure.
  • By default, only domain administrators, enterprise administrators, Group Policy Creator Owners, and the operating system can create new Group Policy objects. If the domain administrator wants a nonadministrator or a group to be able to create Group Policy objects, that user or group can be added to the Group Policy Creator Owners security group. When a user who is not an administrator, but who is a member of the Group Policy Creator Owners group, creates a Group Policy object, that user becomes the creator and owner of the Group Policy object; therefore, that user can edit the Group Policy object. Being a member of the Group Policy Creator Owners group gives the user full control of only those Group Policy objects that the user creates or those Group Policy objects that are explicitly delegated to that user. It does not give the nonadministrator user any additional rights over other Group Policy objects for the domain—these users are not granted rights over Group Policy objects that they did not create.
  • When an administrator creates a Group Policy object, the Domain Administrators group becomes the Creator Owner of the Group Policy object.
  • When you delegate this task to nonadministrators, also consider delegating the ability to manage the links for a specific organizational unit. The reason for this is that, by default, nonadministrators cannot manage links, and the inability to manage links prevents them from being able to use the Active Directory Users and Computers snap-in to create a Group Policy object.

Related Topics


Delegate Group Policy object linking

Microsoft Windows graphic

To delegate Group Policy object linking

  1. Open Active Directory Users and Computers.
  2. Right-click the organizational unit to which you want to delegate the right to link Group Policy objects, and then click Delegate Control.
  3. Click Next, and then click Add.
  4. In the Select Users, Computers, or Groups dialog box, click a user or group, and then click Add.
  5. In the Select Users, Computers, or Groups dialog box, click OK, and then click Next.
  6. In the Delegate the following common tasks list, select the Manage Group Policy links check box, and then click Next.
  7. Click Finish.

Note

  • To open the Group Policy snap-in, see Related Topics.

Related Topics


Concepts

This section provides general background information about Group Policy and about the change and configuration management technologies that use Group Policy.

  • What's New
  • Group Policy overview
  • Understanding Group Policy
  • Using Group Policy
  • Resources


What's New

The Windows 2000 change and configuration management technologies have been improved in Windows XP Professional.

Resultant Set of Policy

Resultant Set of Policy (RSoP) is a new tool to help you anticipate and troubleshoot policy. For more information, see Resultant Set of Policy.

Administrative Templates

There is a new supported keyword in .adm files that tells you which versions of Windows are supported as clients for the setting. For information about the supported keyword, see Implementing Registry-Based Group Policy (http://www.microsoft.com/) at the Microsoft Web site.

There is also a new Administrative Templates Web view that uses the supported keyword to show you which operating systems are supported clients for individual settings. For information on how to use the Web view, see To use the view provided by Administrative Templates.

Administrative Templates online Help is now included with Windows. The following table contains links to the .adm Help files.

.adm file | Policy settings
System.adm | Open Help for System Settings
Wmplayer.adm | Open Help for Windows Media Player settings
Inetres.adm | Open Help for Internet Explorer settings
Conf.adm | Open Help for NetMeeting settings

Administrative Templates view filtering reduces screen clutter when you work with Administrative Templates. For instructions on how to use filtering, see To filter the view provided by Administrative Templates.

For more information about Administrative Templates, see Administrative Templates.

Command-line tools for policy

The Windows 2000 command secedit /refreshpolicy is obsolete, and it is replaced by gpupdate.

The Windows 2000 Resource Kit command gpresult has been enhanced, and it is now included with Windows XP Professional.

Folder Redirection

It is now easier to use Folder Redirection. It is no longer necessary to type variables such as %username% as part of the redirection path. For instructions on how to use Folder Redirection, see To redirect special folders to the root directory and To redirect special folders to the root directory based on security group membership.

There is a new option for redirecting My Documents to a user's home directory. This is for use in environments where home directories are already deployed. For more information, see To redirect My Documents to the home directory and To redirect My Documents to the home directory based on security group membership. These procedures also include important notes for their use.

Software Installation

Software Installation now has an advanced deployment option to make 32-bit programs available on 64-bit computers. Another new advanced option enables the publication of OLE class information about a software package. For details, see Edit installation options for applications.

For more information, see New ways to do familiar tasks.


Group Policy overview

To begin using Group Policy immediately, see Ways to open the Group Policy snap-in.

Group Policy settings define the various components of the user's desktop environment that a system administrator needs to manage, for example, the programs that are available to users, the programs that appear on the user's desktop, and options for the Start menu. To create a specific desktop configuration for a particular group of users, use the Group Policy snap-in. Group Policy settings that you specify are contained in a Group Policy object, which is in turn associated with selected Active Directory objects—sites, domains, or organizational units.

Group Policy applies not only to users and client computers, but also to member servers, domain controllers, and any other Windows 2000 computers within the scope of management. By default, Group Policy that is applied to a domain (that is, applied at the domain level, just above the root of the Active Directory Users and Computers snap-in) affects all computers and users in the domain. The Active Directory Users and Computers snap-in also provides a built-in Domain Controllers organizational unit. If you keep your domain controller accounts there, you can use the Group Policy object Default Domain Controllers Policy to manage domain controllers separately from other computers.

Group Policy includes policy settings for User Configuration, which affect users, and for Computer Configuration, which affect computers. For more information, see User Configuration and Computer Configuration.

By using Group Policy and its extensions, you can:

  • Manage registry-based policy with Administrative Templates. Group Policy creates a file that contains registry settings that are written to the User or Local Machine portion of the registry database. User profile settings that are specific to a user who logs on to a given workstation or server are written to the registry under HKEY_CURRENT_USER (HKCU), and computer-specific settings are written under HKEY_LOCAL_MACHINE (HKLM). For procedural information, see Use Administrative Templates. For technical details, see
    • Implementing Registry-Based Group Policy (http://www.microsoft.com/) at the Microsoft Web site.
  • Assign scripts. This includes such scripts as computer startup, shutdown, logon, and logoff. For more information, see Use scripts.
  • Redirect folders. You can redirect folders, such as My Documents and My Pictures, from the Documents and Settings folder on the local computer to network locations. For more information about folder redirection, see Use the Folder Redirection snap-in.
  • Manage applications. With Group Policy you can assign, publish, update, or repair applications by using the Software Installation extension. For more information, see Use the Software Installation snap-in.
  • Specify security options. To learn about setting security options, see Security Settings.

Group Policy objects that exist by default

Each computer that runs the Windows XP Professional or the Windows 2000 operating system has exactly one Group Policy object stored locally. This local Group Policy object contains a subset of the settings that are available in nonlocal Group Policy objects. For more information, see Local Group Policy.

By default, when Active Directory is set up, two nonlocal Group Policy objects are created:

  • Default Domain Policy is linked to the domain, and it affects all users and computers in the domain (including computers that are domain controllers) through policy inheritance. For more information, see Policy inheritance.
  • Default Domain Controllers Policy is linked to the Domain Controllers organizational unit, and it generally only affects domain controllers, because computer accounts for domain controllers are kept exclusively in the Domain Controllers organizational unit.

How and when Group Policy is applied

To view a detailed chronology for the application of policy, see Order of events in startup and logon.

User and computer policy

User policy settings are located under User Configuration in Group Policy, and they are obtained when a user logs on. Computer policy settings are located under Computer Configuration, and they are obtained when a computer starts. For more information, see User Configuration and Computer Configuration.

Users and Computers are the only types of Active Directory objects that receive policy. Specifically, policy does not apply to security groups. Instead, for performance reasons, security groups are used to filter the policy by means of an Apply Group Policy access control entry (ACE), which can be set to Allow or Deny or left unconfigured. For more information, see To filter the scope of Group Policy according to security group membership.

Order of application

Policies are applied in this order:

  1. The unique local Group Policy object.
  2. Site Group Policy objects
    3. , in administratively specified order.
  3. Domain Group Policy objects
    4. , in administratively specified order.
  4. Organizational unit Group Policy objects, from largest to smallest organizational unit (parent to child organizational unit) and in administratively specified order at the level of each organizational unit.

For more information, see Order of processing settings.

By default, policies that are applied later overwrite previously applied policies when the policies are inconsistent. If the policies are not inconsistent, however, earlier and later policies both contribute to the effective policy. For more information, see Group Policy precedence.

Filtering policy by security group membership

A security group ACE on a Group Policy object can be set to Not configured (no preference), Allowed, or Denied. Denied takes precedence over Allowed. For more information, see To filter the scope of Group Policy according to security group membership.

Blocking policy inheritance

Policies that would otherwise be inherited from higher sites, domains, or organizational units can be blocked at the site, domain, or organizational unit level. For more information, see To block policy inheritance.

Enforcing policy from above

You can set policies that would otherwise be overwritten by policies in child organizational units to No Override at the Group Policy object level. For more information, see To prevent a Group Policy object from being overridden.

Notes

  • Policies set to No Override cannot be blocked.
  • The No Override and Block options should be used sparingly. Casual use of these advanced features complicates troubleshooting. For more information, see Troubleshooting and Best practices.

This section covers:

  • User Configuration
  • Computer Configuration
  • Administrative Templates
  • Software Settings
  • Windows Settings
  • Software Installation
  • Folder Redirection
  • Scripts


User Configuration

You can use User Configuration in Group Policy to set policies that apply to users, regardless of which computer they log on to.

User Configuration typically contains subitems for Software Settings, Windows Settings, and Administrative Templates, but because Group Policy can have snap-in extensions added to or removed from it, the exact set of subitems that you see might be different.

For more information, see:

  • Computer Configuration
  • Administrative Templates
  • Software Settings
  • Windows Settings
  • To assign user logon scripts
  • To assign user logoff scripts
  • To disable the User Configuration settings in a Group Policy object


Computer Configuration

Administrators use Computer Configuration in Group Policy to set policies that are applied to computers, regardless of who logs on to the computers.

Computer Configuration typically contains Software Settings, Windows Settings, and Administrative Templates. However, because Group Policy can have extensions added to or removed from it, what you see might be slightly different.

For more information, see:

  • User Configuration
  • Software Settings
  • Windows Settings
  • Administrative Templates
  • To disable the Computer Configuration settings in a Group Policy object
  • To assign computer startup scripts
  • To assign computer shutdown scripts


Administrative Templates

There are several .adm files that are included with Windows. These files are text files, called Administrative Templates, that provide policy information for the items that are under the Administrative Templates folder in the console tree of the Group Policy snap-in.

Where?

  • Group Policy object name
  • Computer Configuration (or User Configuration)
  • Administrative Templates

For more information about .adm files, see .adm files included with Windows.

.adm files

An .adm file consists of a hierarchy of categories and subcategories that together define how the policy settings appear. It also contains the following information:

  • Registry locations that correspond to each setting.
  • Options or restrictions in values that are associated with each setting.
  • For many settings, a default value.
  • Explanations of what each setting does.
  • The versions of Windows that support each setting.

The Administrative Templates for Group Policy contain all registry-based policy information. User configurations are saved in HKEY_CURRENT_USER (HKCU), and computer configurations are saved in HKEY_LOCAL_MACHINE (HKLM). HKCU and HKLM each place registry information that is specific to Group Policy under \Software\Policies or under \Software\Microsoft\Windows\CurrentVersion\Policies. Therefore, there are four areas of the registry that contain Group Policy registry settings.

Administrative Templates offer these new features:

  • A description of each policy setting in Administrative Templates appears in searchable online Help. The following table contains links to these Help topics.
    Administrative Template | Description | Help for Administrative Templates policy settings
    System.adm | Installed in Group Policy by default; for Windows 2000 and Windows XP clients. | System settings
    Inetres.adm | Installed in Group Policy by default; Internet Explorer policies for Windows 2000 and Windows XP clients. | Internet Explorer settings
    Wmplayer.adm | Windows Media Player settings; for Windows 2000 and Windows XP clients. | Windows Media Player settings
    Conf.adm | NetMeeting settings; for Windows 2000 and Windows XP clients. | NetMeeting settings
  • A supported keyword in the .adm files that tells you which versions of Windows are supported as clients for the setting. For information about the supported keyword, see Implementing Registry-Based Group Policy (http://www.microsoft.com/) at the Microsoft Web site.
  • A Web view that shows both the Windows 2000–style explanations of each setting and the new supported information. For information about how to use the Web view, see To use the view provided by Administrative Templates.
  • The ability to filter settings from the view to reduce screen clutter when you are using Administrative Templates. For information about how to use this new feature, see To filter the view provided by Administrative Templates.

If you plan to create entries for Administrative Templates, populate the namespace by using the following naming convention, which is also used in the registry:
\CompanyName\product\version (or \CompanyName\product&version)
For example, the operating system settings for Windows are in \Microsoft\Windows.

For information on adding an .adm file, see To add or remove an Administrative Template (.adm file).

Registry.pol files

The Administrative Templates extension of Group Policy saves information in Registry.pol files. These files contain the customized registry settings that you specify (by using Group Policy) that are to be applied to the computer or user portion of the registry:

  • One of the Registry.pol files contains registry settings that are specific to the HKEY_LOCAL_MACHINE key; it is stored in the GPT\Machine folder.
  • The other Registry.pol file contains registry settings that are specific to the HKEY_CURRENT_USER key; it is stored in the GPT\User subdirectory.

For more information, see:

  • To use the view provided by Administrative Templates
  • The role of Administrative Templates


Software Settings

Software Settings are available under both User Configuration and Computer Configuration in the Group Policy console tree.

Computer Configuration\Software Settings is for software settings that apply to all users who log on to the computer. This folder contains the Software installation subitem, and it might contain other subitems that are placed there by independent software vendors.

User Configuration\Software Settings is for software settings that apply to users regardless of which computer they log on to. This folder also contains the Software installation subitem, and it might contain other subitems that are placed there by independent software vendors.

For more information, see:

  • Software Installation
  • User Configuration
  • Computer Configuration


Windows Settings

Group Policy contains two Windows Settings folders.

Computer Configuration\Windows Settings is for windows settings that apply to all users who log on to the computer. It includes two subitems: Security Settings and Scripts.

User Configuration\Windows Settings is for windows settings that apply to users regardless of which computer they log on to. It includes three subitems: Folder Redirection, Security Settings, and Scripts.

For more information, see:

  • User Configuration
  • Computer Configuration
  • Security Settings
  • Scripts
  • Folder Redirection


Software Installation

To begin using Software Installation immediately, see To open the Software Installation snap-in.

Software Installation helps you specify how applications are installed and maintained within your organization. With Software Installation, you can manage an application within a Group Policy object, which is in turn associated with a particular Active Directory container—either a site, a domain, or an organizational unit. Applications can be managed in one of two modes: assigned or published.

You assign an application when you want everyone to have the application on his or her computer. For example, suppose that you want all users in a marketing department to have Microsoft Excel on their computers. A Group Policy object manages every user in marketing. When you assign Excel within the marketing Group Policy object, Excel is advertised on every marketing user's computer. When an assigned application is advertised, it is not actually installed on the computer. In this case, the application advertisement installs only enough information about Excel to make the Excel shortcuts appear on the Start menu and to make the necessary file associations (.xls) appear in the registry. For more information, see To assign an application.

When these users log on to their computers, Excel appears on their Start menu. When they select Excel on the Start menu for the first time, Excel installs. A user can also install an advertised application by opening a document that is associated with the application, either by file name extension or by COM-based activation. If a user who has not yet activated Excel from the Start menu clicks an Excel spreadsheet to open it, Excel installs and the spreadsheet opens.

A user can delete an assigned application, but the assigned application is advertised again the next time the user logs on. It installs the next time a user selects it on the Start menu.

You publish an application when you want the application to be available to people who are managed by the Group Policy object, in case a user wants the application. With published applications, it is up to each person to decide whether or not to install the published application.

For example, if you publish Microsoft Image Composer to users who are managed by the marketing Group Policy object, and a marketing user wants to install Image Composer, the user can go to Add or Remove Programs in Control Panel and install the application. If users do not install Image Composer by using Add or Remove Programs, and if the .jpg file name extension for the image document is associated with Image Composer, Image Composer can be installed for users when they first open any .jpg document. For more information about publishing applications, see To publish an application and Add or Remove Programs in Control Panel.

For more information about Software Installation, see:

  • Use the Software Installation Snap-in
  • Understanding Software Installation
  • To upgrade an application
  • To remove a managed application
  • The administrator's view of Software Installation
  • File types often encountered in Software Installation


Folder Redirection

You can use the Folder Redirection extension to Group Policy to redirect certain special folders to network locations. Special folders are those folders, such as My Documents and My Pictures, that are located under Documents and Settings.

Folder Redirection is located under User Configuration in the Group Policy console tree.

Where?

  • policy name Policy
  • User Configuration
  • Windows Settings
  • Folder Redirection

Folder Redirection options

There are several basic options for Folder Redirection, as described in the following paragraphs. For each basic option, there is an advanced version of that option. The advanced version provides for finer control by allowing redirection that is based on security group membership.

Create a folder for each user under the root path

Rather than having to type a Universal Naming Convention (UNC) path, such as \\server\share\%username%\MyDocuments, an administrator can simply type the path to the share, such as \\server\share, and Folder Redirection automatically appends the user name and the folder name when the policy is applied. With Folder Redirection, administrators do not have to be familiar with environment variables, and errors and spelling mistakes are minimized.

For more information, see To redirect special folders to the root directory and To redirect special folders to the root directory based on security group membership.

Redirect to home directory (My Documents only)

With this option administrators can redirect a user's My Documents folder to the user's home directory. This option is intended only for organizations that have an existing deployment of home directories and that want to maintain compatibility with their existing home directory environment. Use this option only if you have already deployed home directories in your organization.

For more information, see To redirect My Documents to the home directory and To redirect My Documents to the home directory based on security group membership.

Redirect to a specific path

With this option administrators can redirect users' folders to an alternative local drive or partition, or they can enter unusual configurations that are not anticipated by the new Folder Redirection user interface. Functionally, this works in exactly the same way as the Windows 2000 Folder Redirection user interface.

For more information, see To redirect special folders to a specific path and To redirect special folders to a specific path based on security group membership.

Redirect to the local user profile

With this option administrators can redirect the selected folder back to the default location in the local user profile, for example: %userprofile%\<Folder Name>.

For more information, see To redirect special folders to the local profile location and To redirect special folders to the local profile location based on security group membership.

Note

  • In the properties dialog box for a special folder, changing the setting to Not Configured does not cause the special folder to be redirected back to its default location. Not Configured simply leaves the redirected folder where it is. If you want to redirect the special folder back to the original, default user profile location, use one of these procedures.

For more information about using Folder Redirection, see the Folder Redirection section in Best practices.

Windows allows folders to be redirected as described in the following table.

Special folder | Notes
Application Data | A Group Policy setting controls the behavior of Application Data when client-side caching is enabled. Look in User Configuration\Administrative Templates\Network\Offline Files in the Group Policy console tree.
Desktop | Desktop can be redirected independently of all the other special folders.
My Documents | See Advantages of redirecting My Documents for details.
My Documents\ My Pictures | My Pictures can be redirected independently of My Documents, or it can be made to follow My Documents (to remain its subfolder whenever My Documents is redirected), as it does by default. The default behavior is recommended unless you have a specific reason (such as file share scalability) for separating My Pictures from My Documents. If these folders are separated, a shortcut takes the place of the My Pictures folder in My Documents.
Start Menu | When Start Menu is redirected, its subfolders always follow.

Advantages of redirecting My Documents

Some of the following benefits pertain to redirecting any folder, but redirecting My Documents can be particularly advantageous because this folder tends to become large over time.

  • When roaming user profiles are used, only the network path to the My Documents folder is part of the roaming user profile, not the My Documents folder itself. Therefore, its contents do not have to be copied back and forth between the client computer and the server each time the user logs on or off, and the process of logging on or off can be much faster than it was in Windows NT 4.0.
  • Even if a user logs on to various computers on the network, his or her documents are always available.
  • Offline File technology gives users access to My Documents even when they are not connected to the network. This is particularly useful for people who use portable computers. For more information, see To make a file or folder available offline.
  • Data that is stored on a shared network server can be backed up as part of routine system administration. This is safer because it requires no action on the part of the user.
  • The system administrator can use Group Policy to set disk quotas, limiting the amount of space that is taken up by users' special folders.
  • Data that is specific to a user can be redirected to a different hard disk on the user's local computer from the hard disk that holds the operating system files. This makes the user's data safer if the operating system is reinstalled.

For more information, see the Folder Redirection section in Best practices.

Granting exclusive rights to special folders

The Settings tab in each folder's properties dialog box contains a check box labeled Grant the user exclusive rights to My Documents. If you select this check box, the user and the local system have full control over the folder, and no one else, not even the administrator, has any rights to it. If you clear this check box, no changes are made to the permissions on the folder. Whatever permissions are in effect by default remain in effect.

Policy removal considerations with regard to Folder Redirection

The following table summarizes what happens to redirected folders and their contents when the Group Policy object no longer applies.

Move the contents of the special folder to the new location setting Policy Removal option Results when policy is removed
Enabled Redirect the folder back to the user profile location when policy is removed
  • The special folder returns to its user profile location.
  • The contents are copied, not moved, back to the user profile location.
  • The contents are not deleted from the redirected location.
  • The user continues to have access to the contents, but only on the local computer.
Disabled Redirect the folder back to the user profile location when policy is removed
  • The special folder returns to its user profile location.
  • The contents are not copied or moved to the user profile location.

    • Caution

  • If the contents of a folder are not copied to the user profile location, the user cannot see them.
Either Enabled or Disabled Leave the folder in the new location when policy is removed
  • The special folder remains at its redirected location.
  • The contents remain at the redirected location.
  • The user continues to have access to the contents at the redirected folder.

Folder Redirection and Offline Files

The Offline Files technology applies to any mounted or mapped drive that contains documents or data that a user might want to use offline. Offline Files does not depend on Folder Redirection. It is set up and configured on network shares separately from the Folder Redirection snap-in. Offline Files enables the user to do useful work even when the user is not connected to the network, for example, on a portable computer or in the event of router failure.

If you use redirected folders of any type, it is recommended that you set up Offline Files as described in the following table.

Special Folder | Offline File configuration
My Documents | Autocaching for documents (or manual caching for documents, if you want users to have to manually make files and folders available for offline use)
My Pictures | Autocaching for documents (or manual caching for documents, if you want users to have to manually make files and folders available for offline use)
Application Data | Autocaching for programs
Desktop | Autocaching for programs if the desktop is Read Only
Start Menu | Autocaching for programs

Folder Redirection permissions

This is an advanced topic. If you let Folder Redirection create folders for you, which is the recommended procedure, correct permissions are set automatically. Usually, knowledge of these permissions is not necessary. However, there are two reasons the permissions might be of interest:

  • Sometimes, even though it is not recommended, administrators create the redirected folders before Folder Redirection creates them. The following table shows what permissions have to be set for Folder Redirection to work.
  • Redirection of My Documents to the home directory provides more relaxed security than standard folder redirection. The following table shows what security is in effect in the standard case.

NTFS permissions required for the root folder
User account | Folder Redirection defaults | Minimum permissions needed
Creator/owner | Full Control, this folder, subfolders, and files | Full Control, this folder, subfolders, and files
Local Administrator | Full Control, this folder, subfolders, and files | Full Control, this folder, subfolders, and files
Everyone | Full Control, this folder, subfolders, and files | List Folder/Read data, Create Files/Write Data, Create Folders/Append Data: This Folder Only
Local System | Full Control, this folder, subfolders, and files | Full Control, this folder, subfolders, and files
Share-level (SMB) permissions required for the root folder
User Account | Folder Redirection defaults | Minimum permissions needed
Everyone | Full Control | Everyone: No permissions. Use a security group that matches the users who will need to put data on the share.
NTFS permissions required for each user's redirected folder
User account | Folder Redirection defaults | Minimum permissions needed
%username% | Full Control, owner of folder | Full Control, owner of folder
Local System | Full Control | Full Control
Everyone | Traverse Folder, Read Attributes, Read Extended Attributes, and Read Permissions | Everyone: No permissions

For more information, see Resources.


Scripts

Group Policy includes two extensions for script deployment:

  • Scripts (Startup/Shutdown): You can use this extension, which is located under Computer Configuration\Windows Settings in the Group Policy console, to specify scripts that are to run when the computer starts up or shuts down. These scripts run as Local System.
  • Scripts (Logon/Logoff): You can use this extension, which is located under User Configuration\Windows Settings in the Group Policy console, to specify scripts that are to run when the user logs on or logs off the computer. These scripts run as User, not as Administrator.

For more information, see Use scripts.

Windows XP includes Windows Script Host, a language-independent scripting host for 32-bit Windows platforms that includes both Visual Basic Scripting Edition (VBScript; .vbs) and JScript (.js) scripting engines. You can use Windows Script Host to run .vbs and .js scripts directly on the Windows desktop or in the command console, without the need to embed these scripts in an HTML document.

For more information about Windows Script Host, see Windows Script Host overview. To learn about Windows Script Host and the Object Model and to obtain script samples, see the Windows Script Host home page at the Microsoft Web site (http://www.microsoft.com/). For other sources of information, see Resources.


Understanding Group Policy

This section covers:

  • Group Policy objects
  • Policy inheritance
  • Storage of Group Policy objects
  • Group Policy precedence
  • Understanding Software Installation


Group Policy objects

Policy settings are stored in Group Policy objects. The Group Policy snap-in can be thought of as an application whose document type is the Group Policy object, just as a word processor might use .doc or .txt files.

Nonlocal and local Group Policy objects

There are two kinds of Group Policy objects. Nonlocal Group Policy objects, which are stored on a domain controller, are available only in an Active Directory environment. They apply to users and computers in the site, domain, or organizational unit with which the Group Policy object is associated. For more information, see Storage of Group Policy objects.

Local Group Policy objects are stored on individual computers. Only one local Group Policy object exists on a computer, and it has a subset of the settings that are available in a nonlocal Group Policy object. Local Group Policy object settings can be overwritten by nonlocal settings if they are in conflict; otherwise, both groups of settings apply. For more information, see Local Group Policy.


Policy inheritance

In general, Group Policy is passed down from parent to child containers within a domain, which you can view by using the Active Directory Users and Computers snap-in. Group Policy is not inherited from parent to child domains, for example, from wingtiptoys.com to sales.wingtiptoys.com. The Active Directory Domains and Trusts snap-in, which you can use to manage relationships of this type, is not related to Group Policy.

If you assign a specific Group Policy setting to a high-level parent container, that Group Policy setting applies to all containers beneath the parent container, including the user and computer objects in each container. However, if you explicitly specify a Group Policy setting for a child container, the child container's Group Policy setting overrides the parent container's setting.

If a parent organizational unit has policy settings that are not configured, the child organizational unit does not inherit them. Policy settings that are disabled are inherited as disabled. In addition, if a policy setting is configured (enabled or disabled) for a parent organizational unit and the same policy setting is not configured for a child organizational unit, the child inherits the parent's enabled or disabled policy setting.

If a policy setting that is applied to a parent organizational unit and a policy setting that is applied to a child organizational unit are compatible, the child organizational unit inherits the parent policy setting, and the child's setting is also applied.

If a policy setting that is configured for a parent organizational unit is incompatible with the same policy setting that is configured for a child organizational unit (because the setting is enabled in one case and disabled in the other), the child does not inherit the policy setting from the parent. The policy setting in the child is applied.

Blocking inheritance

You can block policy inheritance at the domain or organizational-unit level by opening the properties dialog box for the domain or organizational unit and selecting the Block Policy inheritance check box. For more information, see To block policy inheritance.

Enforcing inheritance

You can enforce policy inheritance by setting the No Override option on a Group Policy object link.

When you select the No Override check box, you force all child policy containers to inherit the parent's policy, even if that policy conflicts with the child's policy and even if Block Inheritance has been set for the child.

You can set No Override on a Group Policy object link by opening the properties dialog box for the site, domain, or organizational unit and making sure that the No Override check box is selected. For more information, see To prevent a Group Policy object from being overridden.

Notes

  • Policies that are set to No Override cannot be blocked.
  • It is recommended that No Override and Block be used sparingly. Casual use of these advanced features makes troubleshooting more complicated. For more information, see Troubleshooting and Best practices.

For more information about Group Policy, see:

  • Group Policy overview
  • Understanding Group Policy
  • Using Group Policy
  • Resources
  • Group Policy precedence


Storage of Group Policy objects

The storage of Group Policy objects is an implementation detail that is usually not necessary to monitor, but this topic provides an overview of it.

For more information, see:

  • Group Policy objects
  • Resources
  • Group Policy white paper (http://www.microsoft.com/)

Each computer that runs Windows XP has exactly one local Group Policy object. It is stored in %systemroot%System32\GroupPolicy.

Group Policy objects, other than the local Group Policy object, consist of two parts that are stored separately: the Group Policy container and the Group Policy template. Information that is large or frequently changed resides in the Group Policy container, while information that is small and infrequently changed resides in the Group Policy template. The Group Policy user interface does not display them separately.

For more information about the local Group Policy object, see Local Group Policy.

Group Policy container

The Group Policy container is a directory service object. It includes subcontainers for computer and user Group Policy information. The Group Policy container contains the following data:

  • Version information: Used to make sure that the information is synchronized with Group Policy template information.
  • Status information: Indicates whether the Group Policy object is enabled or disabled for this site, domain, or organizational unit.
  • List of components: Specifies which extensions to Group Policy have settings in the Group Policy object.

The Group Policy container stores information for the Software Installation snap-in and for the Folder Redirection snap-in, which are two extensions of Group Policy. For more information, see Software Installation and Folder Redirection.

Group Policy template

The Group Policy template is a folder of domain controllers for the storage domain of the Group Policy object. A typical Group Policy template folder might look like this example:

systemroot\Sysvol\SYSVOL\Streetmarket.com\Policies\
{34975054-fd77-df75-54fe-074936850457}

Subfolders of the Group Policy template

The Group Policy template folder contains subfolders, including, but not limited to, the following:

  • adm: Contains all the .adm files for this Group Policy template.
  • Scripts: Contains all the scripts and related files for this Group Policy template.
  • User: Includes a Registry.pol file that contains the registry settings that are to be applied to users. When a user logs on to a computer, this Registry.pol file is downloaded and applied to the HKEY_CURRENT_USER portion of the registry. The User folder contains an Applications subfolder.
  • User\Applications: Contains the .aas files (application advertisement scripts) that are used by the operating system–based installation service. These files are applied to users.
  • Machine: Includes a Registry.pol file that contains the registry settings that are to be applied to computers. When a computer initializes, this Registry.pol file is downloaded and applied to the HKEY_LOCAL_MACHINE portion of the registry. The Machine folder contains an Applications subfolder.
  • Machine\Applications: Contains the .aas files that are used by the operating system–based installation service. These files are applied to computers.


Group Policy precedence

You can apply Active Directory–based Group Policy by linking Group Policy objects to Active Directory objects (sites, domains, or organizational units). Group Policy settings under User Configuration apply to users, and Group Policy settings under Computer Configuration apply to computers. The locations of the user and computer accounts in Active Directory determine what Group Policy objects are used to supply policy. Note that although some settings are user interface settings—for example, the background bitmap or the ability to use the Run command on the Start menu—they can also be applied to computers.

Group Policy is cumulative. Child directory service containers inherit policy from parent containers, and Group Policy processing occurs in the following order: local, site, domain, and then successive organizational units, from highest organizational unit (farthest from the user or computer account) to lowest organizational unit (actually containing the user or computer account). This means that if you link a Group Policy object to a high-level parent container (domain or organizational unit), this Group Policy object applies to all containers beneath the parent container, that is, to the user and computer objects in each container. However, if you explicitly enable or disable some Group Policy settings in another Group Policy object that is linked to a child container, the child container's Group Policy object settings override the parent container's Group Policy object settings.

You can enforce Group Policy on child directory containers by setting the No Override option on a Group Policy object link. You can also prevent inheritance of Group Policy from parent directory containers by using the Block Policy inheritance option on a domain or organizational unit.

Important

  • No Override and Block Policy inheritance are advanced options, and they are not recommended for casual use, because they change the default behavior of policy inheritance, as described in the previous paragraph, and this can complicate troubleshooting.

Note

  • In the event of a conflict, Group Policy settings take precedence over profile settings.

This section covers:

  • Order of events in startup and logon
  • Order of processing settings
  • The role of applications in Group Policy precedence


Order of events in startup and logon

The following sequence shows the order in which computer policy and user policy are applied when a computer starts and a user logs on:

  1. Network starts. Remote Procedure Call System Service (RPCSS) and Multiple Universal Naming Convention Provider (MUP) start.
  2. An ordered list of Group Policy objects is obtained for the computer. The list might depend on these factors:
    • Whether the computer is part of a domain and therefore subject to Group Policy through Active Directory.
    • The location of the computer in Active Directory.
    • Whether the list of Group Policy objects has changed. If the list of Group Policy objects has not changed, no processing is done. You can use a policy setting to change this behavior.
  3. Computer policy is applied. These are the settings under Computer Configuration from the gathered list. This is synchronous by default and in the following order: local, site, domain, organizational unit, child organizational unit, and so on. No user interface appears while computer policies are processed.

    For details about the order in which settings are processed when user or computer policy is applied, see Order of processing settings.

  4. Startup scripts run. This is hidden and synchronous by default; each script must complete or time out before the next one starts. The default time-out is 600 seconds. You can use several policy settings to modify this behavior.
  5. The user presses CTRL-ALT-DEL to log on.
  6. After the user is validated, the user profile loads; it is governed by the policy settings that are in effect.
  7. An ordered list of Group Policy objects is obtained for the user. The list might depend on these factors:
    • Whether the user is part of a domain and therefore subject to Group Policy through Active Directory.
    • Whether loopback is enabled, and the state (Merge or Replace) of the loopback policy setting.
    • The location of the user in Active Directory.
    • Whether the list of Group Policy objects has changed. If the list of Group Policy objects has not changed, no processing is done. You can use a policy setting to change this behavior.
  8. User policy is applied. These are the settings under User Configuration from the gathered list. This is synchronous by default and in the following order: local, site, domain, organizational unit, child organizational unit, and so on. No user interface appears while user policies are processed.

    For details about the order in which settings are processed when user or computer policy is applied, see Order of processing settings.

  9. Logon scripts run. Unlike Windows NT 4.0 scripts, Group Policy–based logon scripts are hidden and asynchronous by default. The user object script (which, as in Windows NT 4.0, is run in a normal window) runs last.
  10. The operating system user interface that is prescribed by Group Policy appears.

Important

  • Three special cases deserve consideration during migration:
    • If the computer account object is in a Windows NT 4.0 domain and the user account object is in Active Directory, only computer (not user) System Policy is processed when the user logs on. Then, user (not computer) Group Policy is processed.
    • If the computer account object is in Active Directory and the user account object is in a Windows NT 4.0 domain, computer (not user) Group Policy is processed during computer startup. When the user logs on, user (not computer) System Policy is processed.
    • If the Windows XP computer and user accounts are members of a Windows NT 4.0 domain, only System Policy (not Group Policy) for the computer and user is applied when the user logs on.

Note

  • Several of these events can be modified. You can set policies to:
    • Reverse the synchronized or asynchronized defaults for running scripts and applying policy.
    • Specify when scripts time out. By default, scripts time out after 600 seconds.
    • Change whether scripts are run hidden, minimized, or in a normal window.


Order of processing settings

This section provides details about the order in which Group Policy settings for users and computers are processed in Windows XP. For information about where the processing of policy settings fits into the framework of computer startup and user logon, see steps 3 and 8 in Order of events in startup and logon.

Group Policy settings are processed in the following order:

  1. Local Group Policy object: Each Windows XP computer has exactly one Group Policy object that is stored locally.
  2. Site: Any Group Policy objects that have been linked to the site are processed next. Processing is synchronous and in an order that is specified by the administrator.
  3. Domain: Processing of multiple domain-linked Group Policy objects is synchronous and in an order specified by the administrator.
  4. Organizational units: Group Policy objects that are linked to the organizational unit that is highest in the Active Directory hierarchy are processed first, then Group Policy objects that are linked to its child organizational unit, and so on. Finally, the Group Policy objects that are linked to the organizational unit that contains the user or computer are processed.

    At the level of each organizational unit in the Active Directory hierarchy, one, many, or no Group Policy objects can be linked. If several Group Policy objects are linked to an organizational unit, their processing is synchronous and in an order that is specified by the administrator.

This order means that the local Group Policy object is processed first, and Group Policy objects that are linked to the organizational unit of which the computer or user is a direct member are processed last, which overwrites the earlier Group Policy objects.

Exceptions to the default order

The default order for processing settings is subject to the following exceptions:

  • Any Group Policy object that is linked to a site, domain, or organizational unit (not a local Group Policy object) can be set to No Override with respect to that site, domain, or organizational unit, so that none of its policy settings can be overridden. When more than one Group Policy object has been set to No Override, the one that is highest in the Active Directory hierarchy (or higher in the hierarchy that is specified by the administrator at each fixed level in Active Directory) takes precedence.

    Note that No Override and Disabled are settings on Group Policy objects links, not on the Group Policy objects. A Group Policy object can be linked several times to the same organizational unit, and No Override and Disabled can be configured independently on each of the links. (Although multiple links from one Group Policy object to a single organizational unit are seldom useful, this capability illustrates the flexibility of the Group Policy infrastructure.)

    For information on how to set links as No Override and Disabled, see To prevent a Group Policy object from being overridden and To disable a Group Policy object link.

  • At any site, domain, or organizational unit, you can mark Group Policy inheritance selectively as Block Policy inheritance. Group Policy object links that are set to No Override are always applied, however, and they cannot be blocked.

    The Block Policy inheritance setting is applied directly to the site, domain, or organizational unit. It is not applied to Group Policy objects, nor is it applied to Group Policy object links. Block Policy inheritance deflects all Group Policy settings that would reach the site, domain, or organizational unit from above (by way of links to parents in the Active Directory hierarchy), no matter what Group Policy objects those settings originate from. However, Block Policy inheritance does not deflect Group Policy settings from Group Policy objects that are linked directly to the site, domain, or organizational unit that has Block Policy inheritance enabled.

  • Loopback: This is an advanced Group Policy setting that is useful on computers in certain closely managed environments, such as kiosks, laboratories, classrooms, and reception areas. For a description of loopback, click the Explain tab after you double-click User Group Policy loopback processing mode in the details pane of the Microsoft Management Console (MMC).

    Where?

    • Group Policy object name
    • Computer Configuration
    • Administrative Templates
    • System
    • Group Policy

    Loopback provides alternatives to the default method of obtaining the ordered list of Group Policy objects whose User Configuration settings affect a user. By default, a user's settings come from a Group Policy object list that depends on the user's location in Active Directory. The ordered list goes from site-linked to domain-linked to organizational unit–linked Group Policy objects, with inheritance determined by the location of the user in Active Directory and in an order that is specified by the administrator at each level.

    Loopback can be set to Not Configured, Enabled, or Disabled, as can any other Group Policy setting. In the Enabled state, loopback can be set to Merge or Replace.

    Loopback with Replace: In the case of Loopback with Replace, the Group Policy object list for the user is replaced in its entirety by the Group Policy object list that is already obtained for the computer at computer startup (during step 2 in Order of events in startup and logon). The User Configuration settings from this list are applied to the user.

    Loopback with Merge: In the case of Loopback with Merge, the Group Policy object list is a concatenation. The default step 2 list for computers in Order of events in startup and logon is appended to the default step 7 list for users, and the user gets the User Configuration settings in the concatenated list. Note that the Group Policy object list that is obtained for the computer is applied later, and therefore it has precedence if it conflicts with settings in the user's list.

  • A computer that is a member of a workgroup processes only the local Group Policy object.


The role of applications in Group Policy precedence

The Group Policy infrastructure cannot force applications to use Group Policy. For example, applications that have always looked for registry entries in a particular place that is outside the approved registry trees that are reserved for Group Policy will continue to look there. Group Policy does not copy registry settings from the Group Policy areas to the Windows NT 4.0 System Policy areas, nor does it copy Windows NT 4.0 System Policy settings into the reserved Group Policy areas. For more information, see Windows NT 4.0 System Policies and Migration issues.

Guidelines for writing applications that take advantage of Group Policy are available in the Group Policy Platform SDK that is used by developers. For more information, see the Group Policy Platform SDK (http://www.microsoft.com/) at the Microsoft Web site. Administrators, who need to anticipate the behavior of applications that they do not author, should be aware of the steps taken by properly written applications to obtain the registry data that the applications need.

Initial state of the registry

After the computer starts and the user logs on, the Group Policy registry areas are rewritten to hold the cumulative Group Policy settings that are in effect from the local Group Policy object and from Active Directory. If Windows NT 4.0 System Policy is enabled (which is not recommended for Windows XP or Windows 2000 clients), other registry areas might also change when the user logs on.

Sequence of events

  1. The user starts the application.
  2. A typical user-oriented application looks for registry data in the Group Policy reserved area HKEY_LOCAL_MACHINE\Software\Policies. If the application finds what it needs, it looks no further.

    However, an application that changes or replaces features at the level of the operating system (such as the Run command), and which therefore affects the behavior of applications other than itself, might look in the following Group Policy reserved key:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies.
    If the application finds what it needs, it looks no further.

  3. The application looks for HKEY_LOCAL_MACHINE registry data outside the Group Policy reserved area, and if it finds what it needs, it looks no further.
  4. The application looks for HKEY_CURRENT_USER registry data outside the Group Policy reserved area, and if it finds what it needs, it looks no further.
  5. The application uses .ini files (not recommended) or default settings.

Newly authored, native Windows XP applications might perform only the first three steps. Applications that use Group Policy under Windows XP, but which remain compatible with earlier versions of Windows, continue to step 4 when they run on older operating systems. Applications that predate Windows 2000 never perform steps 2 and 3; instead, they go directly to step 4.

The order of this sequence of events implies the following:

  • For properly written applications that run on Windows XP clients, Group Policy takes precedence over Windows NT 4.0 System Policy.
  • Older versions of applications (which are not aware of Active Directory and Group Policy) continue to function on Windows XP computers as they did under Windows NT 4.0.
  • HKEY_LOCAL_MACHINE settings take precedence over HKEY_CURRENT_USER settings, as they did under Windows NT 4.0.

For more information, see:

  • Order of events in startup and logon
  • Order of processing settings
  • Policy inheritance
  • Group Policy white paper (http://www.microsoft.com/) at the Microsoft Web site
  • Resources


Understanding Software Installation

To begin using Software Installation right away, see To open the Software Installation snap-in.

The Software Installation snap-in, a software management feature, is the administrator's primary tool for managing software throughout its life cycle within the organization. For more information about Software Installation, see Software Installation.

Software Installation works in conjunction with Group Policy and Active Directory. It is one of the three Software Installation and Maintenance components that are described in the following table.

Component | Role
The Software Installation extension of the Group Policy snap-in | Used by administrators to manage software
Windows Installer | Installs software that is packaged in Windows Installer files
Add or Remove Programs in Control Panel For more information, see Add or Remove Programs in Control Panel. | Used by users to manage software on their own computers

Assigning to users

When you assign an application to a user, the application is advertised to the user the next time the user logs on to a workstation. The application advertisement follows the user, regardless of which physical computer he or she actually uses. The application is installed the first time that the user activates the application on the computer, either by selecting the application on the Start menu or by activating a document that is associated with the application.

For more information, see To assign an application.

Assigning to computers

When you assign an application to the computer, the application is advertised and the installation is performed when it is safe to do so. Typically, this happens when the computer starts up, so that there are no competing processes on the computer.

For more information, see To assign an application.

Publishing to users

When you publish an application to users, the application does not appear as installed on the users' computers. No shortcuts are visible on the desktop or on the Start menu, and no changes are made to the local registry on the users' computers. Instead, published applications store their advertisement attributes in Active Directory. Information, such as the application's name and file associations, is exposed to the users in the Active Directory container. The application is then available for the user to install by using Add or Remove Programs in Control Panel or by clicking a file that is associated with the application, such as an .xls file for Microsoft Excel.

For more information, see To publish an application.

Application assignment scripts

Application assignment scripts are one of the file types that are often encountered in Software Installation. For every published or assigned application in a particular Group Policy object, an application assignment script (.aas file) is generated and stored in that domain's Group Policy object. These script files contain the advertisement information about the application configuration.

For more information, see File types often encountered in Software Installation.

Active Directory

Active Directory consists of a hierarchical collection of containers and an extendable schema. The Active Directory containers include sites, domains, organizational units, users, computers, and printers. Because the schema defines the properties of Active Directory objects, and because it can be extended to define new Active Directory objects, you can use it to store any arbitrary object.

Software management provides schema-extended objects in Active Directory. These objects store the information that is required to map various class settings to the application packages that support these class settings.

The user's view of software installation

At the user's computer, system components—including Winlogon, the shell, object linking and embedding (OLE), the Lightweight Directory Access Protocol (LDAP) client, and the local registry—provide the user's view of software installation. Winlogon is the privileged agent that applies software installation policy. The shell and the OLE are enhanced to be Active Directory–aware and to communicate with Windows Installer to perform setup actions. The LDAP client provides the capability to search and query Active Directory.

By using Add or Remove Programs, users can browse for and install software from Active Directory in a managed environment or from local media (in a nonmanaged environment or, if policy permits, from local media in a managed environment).

This section covers:

  • The administrator's view of software installation
  • Add or Remove Programs in Control Panel
  • File types often encountered in Software Installation


The administrator's view of Software Installation

Administrators generally complete the following phases to manage software for their organization: preparation, management, and removal.

Preparation

Before you can use Software Installation, you should have a Windows Installer package (.msi) for the program that you want to install. The package is often supplied with the software. If a program does not have a Windows Installer package, you must generate one. Other utilities are available for repackaging a program that you plan to install. You can then use transforms to further customize a package. Transforms, which have the .mst extension, are sometimes called "modifications." For more information, see Work with package modifications and File types often encountered in Software Installation.

The next step is to create a network share, called a software distribution point, that contains the packages (.msi files), any transforms (.mst files), and the program files and components. Administration is simpler if packages and program files are kept together, although this is not absolutely necessary. (Packages and transforms do have to be kept together.) Administrators might also benefit from using distributed file systems to help manage these software distribution points.

Finally, make sure that users can read from the software distribution point and write to the target of the installation, particularly if the program is written to a network file server.

Management

You can use Software Installation to manage programs within your organization. You can assign programs to either computers or users, or you can publish programs to users.

Program assignment and publishing to users have the following software life cycle phases:

  • Evaluation phase: For evaluation purposes, you might want to have only a few users try out and evaluate the new program. During this phase, the old version of the program is the default version, and the majority of users are still using it. A new user installs the assigned or published version. This is often called a "pilot." The pilot is a good time to experiment with Software Installation options, such as assigning an application and publishing an application, which is less forceful. You can also try setting the autoinstall option for an application, so that the software is installed when the user attempts to open a file with an extension that you have associated with the application. You can also try the Basic or Maximum options for the installation user interface, which you can set by using the procedure To set Software Installation defaults. These options control the level of visibility of the installation process to the user.

    • For more information, see To assign an application, To publish an application, and To set the autoinstall option for an application.

  • Rollout phase: During rollout, you begin making the new program available to more users. The new version of the program is now the default, and the majority of the users are using the new version. A new user only has the option to install the new program. You can leave certain users unaffected if upgrading them at this time would affect their work.

Removal

When administrators remove a program, they must select one of the following alternatives, which are mutually exclusive:

  • Immediately uninstall: This option requires that no one currently uses the program. Those users who still have the program on their computers receive an advertisement that removes the program.
  • Just prevent new installations: This option allows users to continue using the software that they already have.
For more information, see To remove a managed application.

Deletion from the server

When you are sure that an old version of a program is no longer needed by the organization, you can delete the Windows Installer package and the program files and components. You might want to archive the package and the program files and components and then delete the files from the software distribution point.

For more information, see:
  • Software Installation
  • Best practices
  • Troubleshooting
  • Resources


Add or Remove Programs in Control Panel

By using Add or Remove Programs in Control Panel, you can perform a number of tasks—primarily, the task of installing an application from local media, such as a CD-ROM or floppy disk; a defined Active Directory location, for an assigned and published application on a corporate network; or the Internet. You can also use Add or Remove Programs to remove or modify an existing application or to repair a damaged application.

Add or Remove Programs also offers the following features:

  • Provides users with a single user interface for managing and maintaining their programs.
  • Provides an interface that is useful for users with both advanced and novice knowledge about Microsoft Windows.
  • Supports the installation of programs when a user has the program package (on local media), as well as installation from either a corporate or an Internet environment.
  • Exposes the Windows Installer component while maintaining support for other installation technologies.

For more information, see Using Add or Remove Programs.


File types often encountered in Software Installation

In addition to executables such as Setup.exe and Install.exe, administrators who use Software Installation typically work with the types of files that are listed in the following table.

File type | File name extension | Description
Windows Installer packages | .msi | Your software vendor typically provides these files to facilitate installation of a specific application. Keep these files with any other necessary files at the software distribution point for the software that you are managing.
Transforms | .mst | Also called "modifications," these files customize the installation of a Windows Installer package at the time of assignment or publication. For example, they might specify a subset of a suite of applications.
Patches .msp Bug fixes, service packs, and similar files can be distributed in this form.

Patches should not be used for major changes, and their effects are limited in the following ways:

  • They cannot remove components or features.
  • They cannot change product codes.
  • They cannot remove or change the names of shortcuts, files, or registry keys.
.zap files .zap These files are created with a text editor, such as Notepad. They can only be published (not assigned), and they specify an executable setup program that appears in Add or Remove Programs in Control Panel for users with administrative rights on the local computer.

Note

Correct use of quotes in .zap file syntax can be difficult; the following rules apply:

  • The path and name of the setup executable must always be quoted.
  • If there are no command-line arguments, they must be quoted twice.

Example syntax using an absolute path:
SetupCommand=""\\server\share\folder\setup.exe""
SetupCommand="\\server\share\folder\setup.exe" /argument

Example syntax using a relative path:
SetupCommand=""setup.exe""
SetupCommand="setup.exe" /argument
Application assignment scripts | .aas | These files contain instructions that are associated with the assignment or publication of a package.

For specific Software Installation procedures, see Use the Software Installation snap-in. For general information about Software Installation, see Understanding Software Installation.


Using Group Policy

This section covers:

  • Ways to open the Group Policy snap-in
  • Local Group Policy
  • .adm files included with Windows
  • Advanced methods of extending Group Policy
  • Administering Group Policy
  • Group Policy and network infrastructure
  • Migration issues
  • Command-Line tools for Group Policy


Ways to open the Group Policy snap-in

You can open Group Policy in several ways, depending on the action that you want to perform and the object to which you want to apply it. The ways in which you can open Group Policy are described in the following table.

To apply Group Policy to | Do this
The local computer | In the Group Policy console, edit the local Group Policy object, as described in To edit the local Group Policy object.
Another computer | Open the local Group Policy object that is stored on the Windows XP network computer, as described in To open Group Policy as a stand-alone MMC snap-in, and then browse to the network computer. You must be an administrator of the network computer.
A site | Open Group Policy, as described in To open Group Policy from Active Directory Sites and Services, and then link a Group Policy object to the intended site.
A domain | Open Group Policy as described in To open Group Policy from Active Directory Users and Computers, and then link a Group Policy object to the intended domain.
An organizational unit | Open Group Policy as described in To open Group Policy from Active Directory Users and Computers, and then link a Group Policy object to the intended organizational unit. You can also link a Group Policy object to an organizational unit that is higher in the Active Directory hierarchy, so that the organizational unit can inherit Group Policy settings.
Any existing Group Policy object or set of Group Policy objects | Create and save your own custom Microsoft Management Console (MMC). For more information, see Microsoft Management Console.

Opening Group Policy from the command line

It is sometimes useful to open Group Policy by clicking Start, clicking Run, and then typing a command. Or you can open Group Policy at the command prompt in an MS-DOS window. The following table contains some examples of what an administrator might type to open Group Policy under different circumstances.

Example command Effect
gpedit.msc /gpcomputer:"ThisComputer"

Notes

  • The quotation marks are mandatory.
  • There is no space after /gpcomputer:
You can edit the local Group Policy object on ThisComputer.
gpedit.msc /gpcomputer:"ThisComputer.WingTipToys.com"

Notes

  • The quotation marks are mandatory.
  • There is no space after /gpcomputer:
You can edit the local Group Policy object on ThisComputer, with the computer specified in the DNS style rather than in the older NetBIOS style.
gpedit.msc /gpobject:"LDAP://CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=WingTipToys,DC=com"

Note

  • The GUID for the Group Policy object above is a fictitious example.
You can edit an Active Directory–based Group Policy object.

For other command-line tools that relate to Group Policy, see Command-Line tools for Group Policy.


Local Group Policy

Each computer that runs Windows XP or Windows 2000 has exactly one local Group Policy object. In these objects, Group Policy settings are stored on individual computers, whether or not they are part of an Active Directory environment or a networked environment.

Local Group Policy objects contain fewer settings than nonlocal Group Policy objects, particularly under Security Settings. Local Group Policy objects do not support Folder Redirection or Software Installation.

For more information, see:

  • Security Settings
  • Folder Redirection
  • Software Installation

Because its settings can be overwritten by Group Policy objects that are associated with sites, domains, and organizational units, the local Group Policy object is the least influential object in an Active Directory environment. In a non-networked environment (or in a networked environment that does not have a domain controller), the local Group Policy object's settings are more important, because they are not overwritten by other Group Policy objects.

You can open the Group Policy snap-in to edit the local Group Policy object that is stored on your local computer. Click Group Policy to open the local Group Policy object.

If you want to edit the local Group Policy object that is stored on another computer on the network, open Group Policy as a stand-alone Microsoft Management Console (MMC) snap-in and browse to the Group Policy object that you want. For more information, see To open Group Policy as a stand-alone MMC snap-in.

The local Group Policy object resides in systemroot\System32\GroupPolicy.

Computers that run Windows NT 4.0 or earlier do not have a local Group Policy object, and they do not recognize nonlocal Group Policy. See Migration issues for more information.


.adm files included with Windows

Four Administrative Templates (.adm) files are included with Windows XP Professional. The following table contains a brief description of each of the .adm files. For more information about .adm files, see Administrative Templates.

Administrative Template | Description | Help for Administrative Templates policy settings
System.adm | Installed in Group Policy by default; for Windows 2000 and Windows XP clients | System settings
Inetres.adm | Installed in Group Policy by default; Internet Explorer policies for Windows 2000 and Windows XP clients | Internet Explorer settings
Wmplayer.adm | Windows Media player settings; for Windows 2000 and Windows XP clients | Windows Media Player settings
Conf.adm | NetMeeting settings; for Windows 2000 and Windows XP clients | NetMeeting settings

System.adm, Inetres.adm, Wmplayer.adm, and Conf.adm use the four reserved Group Policy registry areas. For the locations of these areas, see Windows NT 4.0 system policies.

Visibility of System Policy settings in the Group Policy console

When you add an .adm file to Group Policy, as described in To add or remove an Administrative Template (.adm file), by default only the settings that are contained in the genuine Group Policy trees (the trees that correspond to the reserved Group Policy registry areas) are visible in the console.

If you want to change this default behavior and make not only Group Policy settings but also the older-style System Policy settings visible, see To filter the view provided by Administrative Templates. Clear the Only show policy settings that can be fully managed check box, as described in that procedure. Your ability to clear this check box in the Filtering dialog box is subject to the Group Policy setting "Enforce Show Policies Only."

Where?

  • Group Policy object name [domain_controller_name.domain_name] Policy
  • User Configuration
  • Administrative Templates
  • System
  • Group Policy

When you make System Policy settings appear in a Group Policy console, the icons for these settings are colored red. The icons for true Group Policy settings are colored blue.

Important

  • It is highly recommended that you not use System Policy–type .adm files when you manage Windows XP or Windows 2000 clients, because this can lead to undesirably persistent registry settings. For more information, see Migration issues.
To optimize Group Policy technology, including Administrative Templates, see Best practices.


Advanced methods of extending Group Policy

You can use the following advanced methods to extend Group Policy functionality.

Method Advantages Disadvantages
An advanced option for administrators: write an .adm file.
  • Easier than writing an extension to Group Policy.
  • Everything you need is included in Windows XP.
  • The .adm files are text files, which you can edit in Notepad.
  • You can write from scratch or modify existing templates to suit your purpose.
  • This option is only suitable for registry-based policies.
  • The user interface is limited. Finding where to set individual policies might be difficult.
An option for software developers only: write an extension to Group Policy.
  • Richer user interface.
  • The full Group Policy application programming interface (API) is available to the developer.
  • Not limited to registry-based policies.
  • Because writing an extension takes considerable development time, this option is not worthwhile unless it will be used widely or often.
  • Requires software development kit (SDK) material that is not included with Windows XP.

Creating custom .adm files

Administrators can consider creating custom .adm files if the supplied template, System.adm, is inadequate. However, use of the supplied template is recommended, if possible.

Administrative Templates propagate registry settings to a large number of computers without requiring you to have detailed knowledge of the registry. In Windows XP, Group Policy is used to set registry-based policies. In Windows NT 4.0, the System Policy Editor (Poledit.exe) was used to set System Policy.

For more information, see Implementing Registry-Based Group Policy (http://www.microsoft.com/) at the Microsoft Web site.

Creating Microsoft Management Console snap-in extensions

Developers can create snap-in extensions for the Microsoft Management Console (MMC) to provide program-specific user interfaces for setting Group Policy. For more information, see the Group Policy Platform SDK (http://www.microsoft.com/) and the MSDN Library (http://www.microsoft.com/) at the Microsoft Web site. For other sources of information, see Resources.


Administering Group Policy

If you want to delegate policy-related tasks to other people, including nonadministrators, see Delegate control of Group Policy.

For more information, see Configure Group Policy.

This section covers:

  • Default permissions
  • Policy for Microsoft Management Console


Default permissions

The default permissions on Group Policy objects are as follows:

Security group | Default settings
Authenticated users | Read, Apply Group Policy (AGP)
Local system | Full Control (includes AGP)
Domain administrators | Read, Write, Create Child, Delete Child, AGP
Administrators | Read, Write, Create Child, AGP

By default, the Group Policy object Default Domain Policy cannot be deleted by any administrator. The purpose of this restriction is to prevent the accidental deletion of this Group Policy object, which contains important and required settings for the domain. If Default Domain Policy must be deleted for some reason, the Delete permission must be given explicitly to the intended group. This is an advanced access control entry (ACE) on the Group Policy object.

For details about Folder Redirection permissions, see Folder Redirection. For more information, see To set permissions for Software Installation and Resources.


Policy for Microsoft Management Console

There are several Group Policy settings in one of the default Administrative Templates files, System.adm, that govern the use of the Microsoft Management Console (MMC) itself. You can delegate administrative rights by saving previously configured consoles. You can find MMC policy settings in the Group Policy console.

Where?

  • Group Policy object name
  • User Configuration
  • Administrative Templates
  • Windows Components
  • Microsoft Management Console
  • Restricted/Permitted snap-ins
  • Group Policy

You can then double-click each item for which you want to set an administrative Group Policy setting that governs the use of that item in MMC.

For more information, see:

  • Delegate control of Group Policy
  • Microsoft Management Console
  • Administering Group Policy
  • Configure Group Policy
  • Resources


Group Policy and network infrastructure

This section covers:

  • Group Policy in replicated environments
  • Group Policy over slow links
  • Group Policy on sites


Group Policy in replicated environments

In a domain that contains more than one domain controller, Active Directory information takes time to propagate from one domain controller to another. This topic describes the replication mechanism as it relates to Group Policy.

By default, Group Policy objects are created or edited only on the domain controller that is holding the primary domain controller (PDC) emulator operations master token. This token moves from one domain controller to another over time, as Active Directory information is replicated to keep the domain controllers synchronized.

An organizational unit must be replicated to the domain controller that is holding the token before the Group Policy object that is created there can be linked to it, which allows the Group Policy settings to be applied. An administrator who uses Active Directory Users and Computers can create an organizational unit on any domain controller.

These considerations are more significant if the intradomain links are slow.

Options governing selection of a domain controller

When you click the name of the Group Policy object in the console tree in the Group Policy console (Group Policy object name [domain_controller_name.domain_name] Policy), the View menu contains a command called DC Options. This command opens the Options for domain controller selection dialog box, where you can specify a domain controller to use for editing Group Policy. The options in this dialog box are as follows:

  • The one with the Operations Master token for the PDC emulator: This is the default and preferred option, and it is the best option from the standpoint of data safety.
  • The one used by the Active Directory snap-ins: This option uses the same domain controller as the utility from which the Group Policy console was invoked, if Group Policy was started this way.
  • Use any available domain controller: This option allows the Group Policy snap-in to choose any available domain controller. This is the least safe option, because different administrators could theoretically edit a Group Policy object simultaneously, with an indeterminate outcome. On the other hand, when you use this option, it is likely that a domain controller in the local site will be selected. If only one administrator can administer Group Policy on a large domain with several sites, the performance gain might be worthwhile.

Domain controller selection set through Group Policy

In addition to the DC Options command, there is also a Group Policy setting for domain controller selection. This is part of the System.adm Administrative Template that is loaded into the Group Policy console by default.

You can find this Group Policy setting in the Group Policy console.

Where?

  • Group Policy object name
  • User Configuration
  • Administrative Templates
  • System
  • Group Policy
You can double-click Group Policy domain controller selection in the details pane, and then click the appropriate setting in the drop-down list.

For more information, see Group Policy over slow links, Group Policy on sites, and Resources.


Group Policy over slow links

Group Policy can be applied remotely, if the computer is a member of the domain that the Routing and Remote Access server belongs to or is trusted to. This is true whether you are logging on through Routing and Remote Access or logging on with cached credentials and then establishing a Routing and Remote Access connection.

Group Policy is not applied to computers that are members of a workgroup or of a foreign domain (a domain that does not contain the computer and that is not in a trust relationship with the computer's domain). Although the connection may still be made, access to domain resources may be adversely affected because of mismatched Internet Protocol security (IPSec).

By default, registry-based policies are always applied, and they cannot be turned off. Security settings are also applied by default, but all other settings are not applied. For all but the registry settings, the default behavior can be switched to apply or not apply.

A remote access connection is not necessarily a slow link, nor is a local area network (LAN) necessarily a fast link. By default, the fast or slow status of a link is based on a test ping to the server. If it takes less than 2000 milliseconds (two seconds), it is considered a fast link; if it takes more time, it is considered a slow link. You can set this value by using the Group Policy setting "Slow network connection time-out for user profiles."

Where?

  • Group Policy object name
  • Computer Configuration
  • Administrative Templates
  • System
  • User Profiles

Several other Group Policy settings that are related to slow links appear in this folder as well. Also, check the Group Policy setting "Group Policy slow link detection."

Where?

  • Group Policy object name
  • Computer Configuration
  • Administrative Templates
  • System
  • Group Policy

For more information, see Group Policy in replicated environments and Group Policy on sites. For a detailed description of the slow link detection algorithm, see the Group Policy white paper (http://www.microsoft.com/) at the Microsoft Web site.


Group Policy on sites

Group Policy objects that are applied to Active Directory site objects affect all computers in the site. Directory information is replicated and available among all the domain controllers in the site and to any domain controllers in sites for which a site link has been established. Therefore, any Group Policy object that is linked to a site is applied to all computers in that site, without regard to which domain (in the forest) contains the computers.

This allows multiple domains within a forest to receive the same Group Policy object (and included policies), although the Group Policy object exists only as a stored entity on a single domain and it must be read from that domain when the affected clients read their site-linked Group Policy.

If child domains are set up across wide area network (WAN) boundaries, the site setup should take this into account. If it does not, the computers in a child domain access a site-linked Group Policy object across a WAN link. This increases the processing time for Group Policy.

For more information, see Group Policy in replicated environments and Group Policy over slow links.

Note

  • Group Policy is not usually applied to sites. It is usually applied to domains and organizational units. For more information, see Ways to open the Group Policy snap-in.


Migration issues

This section covers:

  • Client operating systems
  • The role of Administrative Templates
  • The role of System Policy Editor
  • Windows NT 4.0 system policies


Client operating systems

This section describes several operating system issues regarding clients for policy.

Windows 2000 Server

Computers that run Windows 2000 Server can either be ordinary member servers of Active Directory or domain controllers. Group Policy fully supports both types of computers.

Windows XP Professional and Windows 2000 Professional

Group Policy fully supports client computers that run Windows XP Professional and Windows 2000 Professional.

Windows NT 4.0 Workstation and Windows NT 4.0 Server

These clients continue to be fully supported by Windows NT 4.0 System Policy, for which the System Policy Editor (Poledit.exe) is provided. The administrator can use Poledit.exe to write Windows NT 4.0–style .adm files.

Windows NT 4.0 does not use Active Directory. Because computers that run Windows NT 4.0 do not have local Group Policy objects, Group Policy does not apply. For more information, see Local Group Policy.

Windows 95, Windows 98, and Windows ME

It is recommended that Windows 95, Windows 98 and Windows ME clients run System Policy Editor (Poledit.exe) on the local computer. This ensures that the Config.pol file that is created is compatible with those operating systems. Copy the resultant Config.pol file to the SysVol folder of the domain controller.

Group Policy does not apply.

Windows XP Home Edition, Windows NT 3.51, Windows 3.1, and MS-DOS

Group Policy does not apply to these operating systems.

Note

  • Exactly one local Group Policy object exists on each computer that runs Windows XP Professional or Windows 2000. The User Configuration settings that it contains are the same for each user of that computer. To handle multiple user configurations by using policy on a computer with one of these operating systems, that is, on a computer that is subject to only a single Group Policy object because it is not part of a domain (for example, a stand-alone computer), the administrator can use System Policy by means of System Policy Editor (Poledit.exe). Poledit.exe is run on the local computer to create a correctly formatted .pol file. User profiles provide individually configured desktops for individual users if neither System Policy nor Group Policy is used.

For more information, see:

  • The role of Administrative Templates
  • The role of System Policy Editor
  • Windows NT 4.0 system policies


The role of Administrative Templates

In Windows XP, Administrative Templates have the .adm file name extension, as they did in Windows NT 4.0. However, their role is slightly different in Windows XP.

Role in earlier versions of Windows

In earlier versions of Windows, Administrative Templates were ANSI-encoded text files. They created a namespace within System Policy Editor for convenient editing of the registry. Administrative Templates provided a friendlier user interface than the Registry Editor (Regedit.exe). They also added a degree of safety by exposing only the registry keys that are explicitly mentioned in the .adm file.

Role in Windows XP

Windows XP includes several .adm files, which are listed in .adm files included with Windows. You can also write additional .adm files. The new version of the .adm language is a superset of the previous version—older templates can create a user interface in Group Policy, but new templates cannot create a user interface in System Policy Editor. For more information on the new .adm language, see Implementing Registry-Based Group Policy (http://www.microsoft.com/) at the Microsoft Web site.

Windows XP supports Unicode-based .adm files.

For cautionary information about using Windows NT 4.0–style .adm files in a Windows XP environment, see Windows NT 4.0 system policies.


The role of System Policy Editor

Although System Policy Editor (Poledit.exe) is mostly replaced by Group Policy, it is still useful under some circumstances. If you are upgrading from earlier versions of Windows, see Migration issues.

  • Management of computers that run Windows 95 or Windows 98: System Policy Editor must be run locally on computers that run Windows 98 or Windows 95 to create Config.pol files that are compatible with the local operating system.
  • Management of computers that run Windows NT 4.0 Workstation and Windows NT 4.0 Server: These computers also need their own style of .pol file: NTconfig.pol.
  • Management of stand-alone computers: A Windows 2000 computer that is not joined to any domain is not subject to nonlocal Group Policy through Active Directory. The only Group Policy that applies to such a computer is local Group Policy, which contains settings for all users of that computer. For more information on local Group Policy, see Local Group Policy. To provide settings for multiple users, use System Policy Editor to write a Registry.pol file. Only the Windows 2000 version of System Policy Editor is compatible with Windows 2000.

Although earlier versions of System Policy Editor worked only with ASCII-encoded .adm files, the Windows 2000 version also supports Unicode-encoded .adm files.

For Windows 2000 and Windows XP clients, use Group Policy instead. For more information, see Best practices.


Windows NT 4.0 system policies

If a Windows NT 4.0 client computer is upgraded to Windows XP, the computer receives only Computer Configuration Group Policy, not Windows NT 4.0 computer System Policy. The policy that is received by the user who logs on is User Configuration Group Policy, if the user account is in Active Directory. If the user account is managed by a Windows NT 4.0 domain controller, the user receives Windows NT 4.0 user System Policy.

For more information, see Computer Configuration and User Configuration.

Registry areas used by Group Policy

Policies that are included with Windows XP or Windows 2000 set registry keys and values only in one of these four reserved trees:

  • HKEY_LOCAL_MACHINE\Software\Policies
  • HKEY_CURRENT_USER\Software\Policies
  • HKEY_LOCAL_MACHINE\Software\Microsoft\
    Windows\CurrentVersion\Policies
  • HKEY_CURRENT_USER\Software\Microsoft\
    Windows\CurrentVersion\Policies

The first two trees are preferred. All four trees are secure, and they cannot be modified by a user who is not an administrator.

When Group Policy changes for any reason, these trees are wiped clean and the new policies are rewritten.

Windows NT 4.0 policies do not respect these special trees, and they can write to any part of the registry. After such a policy is applied, it persists until the value is intentionally reversed, either by a counteracting Windows NT 4.0–style policy or by editing the registry.

Caution

  • It is possible, using the procedure to add or remove an Administrative Template (.adm file), for Administrative Templates to be added to Group Policy that set registry values outside the approved Windows XP Group Policy trees, although Windows XP does not include any such .adm file. Choosing to install Windows NT 4.0–style .adm files can lead to undesirably persistent registry settings.

    For more information, see Administrative Templates and To add or remove an Administrative Template (.adm file).

    • If you must use the procedure in this manner, see the information about the Only show policy settings that can be fully managed check box in To filter the view provided by Administrative Templates and the information about the Enforce Show Policies Only Group Policy setting in To add or remove an Administrative Template (.adm file).

For more information, see:

  • Client operating systems
  • The role of Administrative Templates
  • The role of System Policy Editor
  • .adm files included with Windows
  • Best practices
  • Resources


Command-line tools for Group Policy

This section covers:

  • Gpresult. You can use this tool to see what policy is in effect. Gpresult is useful for troubleshooting.
  • Gpupdate. This tool causes policy to be refreshed immediately, and it permits certain options to be specified on the command line. Gpupdate replaces and improves the Windows 2000 command secedit /refreshpolicy.
To start the Group Policy console from the command line, see Ways to open the Group Policy snap-in.


Resources

You can find a great deal of external information about Group Policy and related technologies in this topic. Here, you can find links to:

  • General Windows information from Microsoft
  • Group Policy Software Developer's Kit (SDK)
  • White papers from Microsoft
  • Online Help topics for Windows tools related to Group Policy, as well as shortcuts to start those tools
  • Information from other companies

For general information about Windows, see the Microsoft Windows (http://www.microsoft.com/) Web site.

For current product support information, see the Microsoft Personal Support Site on the World Wide Web. (http://support.microsoft.com)

For information that is useful to IT professionals, visit Technet (http://www.microsoft.com/).

For help with troubleshooting known problems, do a keyword search of the Microsoft Knowledge Base. (http://www.microsoft.com/)

For information about application programming interfaces (API) for Group Policy, Active Directory, or other items of interest to developers, start at the MSDN Library (http://www.microsoft.com/).

Microsoft technical documents on the Web

Click these links for white papers and SDK information:

Group Policy Platform SDK (http://www.microsoft.com/)

Group Policy white paper (http://www.microsoft.com/)

Implementing Common Desktop Management Scenarios (http://www.microsoft.com/)

Implementing Registry-Based Group Policy (http://www.microsoft.com/)

IntelliMirror Resource Guides (http://www.microsoft.com/)

Operations (http://www.microsoft.com/)

Planning and Deployment (http://www.microsoft.com/)

Step-by-Step Guides (http://www.microsoft.com/)

Systems Migration and Interoperability (http://www.microsoft.com/)

Technologies Index (http://www.microsoft.com/)

Troubleshooting Group Policy (http://www.microsoft.com/)

Windows Management Instrumentation (WMI) Platform SDK (http://www.microsoft.com/)

Microsoft partner Web site

Visit Full Armor for a Microsoft partner company that specializes in policy-related tools, such as FAZAM.

Related Windows tools and online Help topics

When you are working with the IntelliMirror technologies, you might sometimes want to look quickly at these tools or Help topics. Not all of these tools are available on all versions of Windows. Of those tools that are available on your version of Windows, not all of them are appropriate for managing Windows computers. See the Help topics for these tools for details.

Note

  • Usually, Group Policy is not applied to a site. For more information, see Best Practices.

Administrative Templates

Administrative Templates provide a convenient navigable tree under the Administrative Templates folders in the Group Policy console. They contain hundreds of policy settings. Administrative Templates, as files, are identified by the .adm extension.

ADM file | Policy settings
System.adm | Open Help for System settings
WMplayer.adm | Open Help for Windows Media Player settings
inetres.adm | Open Help for Internet Explorer settings
conf.adm | Open Help for NetMeeting settings
There are four .adm files included with Windows.

Computer Management

Power Users and Administrators can manage a computer locally using the Computer Management snap-in. This is not an Active Directory management tool; it is useful for managing individual computers, but not for managing many computers at the same time.

Open Computer Management.

Open Help for Computer Management.

Internet Protocol security

Internet Protocol security (IPSec) is generally accessed through Security Settings in Group Policy or through Local Security Policy.

Open Help for IP Security.

Microsoft Management Console

Microsoft Management Console (MMC) is the hosting application for most Windows 2000 and Windows XP administrative tools, including Group Policy.

Open Microsoft Management Console.

Open Help for Microsoft Management Console.

Offline Files and Folders (client-side caching)

Open Help for Offline Files and Folders.

Registry Editor

Group Policy settings include changes to the registry. You can use Registry Editor to examine or edit a computer's registry.

Open Registry Editor.

Open Help for Registry Editor.

Caution

  • It is recommended that only advanced users edit a computer's registry. If a computer's registry becomes corrupted, the computer might not be able to operate.

Resultant Set of Policy (RSoP)

Open Resultant Set of Policy.

Open Help for Resultant Set of Policy.

Security Settings

Security Settings are accessed through Group Policy.

Open Help for Security Settings.

Open Help for Security Setting Descriptions.

Software Restriction Policies

Software Restriction Policies (SAFER) are accessed through Security Settings in Group Policy.

Open Help for Security Settings.

Windows Installer

Windows Installer has no graphical user interface of its own for administrators. Software Installation in Group Policy, and Add or Remove Programs in Control Panel, both depend on Windows Installer.

Open Help for Windows Installer.


Troubleshooting

An important part of troubleshooting Group Policy problems is to consider dependencies between components. For example, Software Installation relies on Group Policy, and Group Policy relies on Active Directory. Active Directory relies on proper configuration of network services. When trying to fix problems that appear in one component, it is generally helpful to check whether components, services, and resources on which the component relies are working correctly. Event logs are useful for tracking problems that are caused by this type of hierarchical dependency.

Basic tests and information gathering.

I need to know what policy settings are in effect.

Tools that you can use to see what policy is in effect include Resultant Set of Policy and gpresult.

You can also get a report on policy from Help and Support Center by following these steps:

  1. Click the Start button, and then click Help and Support.
  2. Click Support.
  3. Under See Also, click Advanced System Information.
  4. Under Advanced System Information, click View Group Policy settings applied.
The report includes User name and domain; Computer name and domain; When User Settings and Computer Settings were last applied; Folder redirection details; Logon, logoff, startup and shutdown scripts; Installed software; and Administrative Templates. The report also gives information about Security Settings, and connection and proxy settings for IE Maintenance.

I want to refresh policy.

Use gpupdate, which causes policy to be refreshed immediately and permits certain options to be specified on the command line. Gpupdate replaces and improves on the Windows 2000 command secedit /refreshpolicy. For more information, see To refresh Group Policy immediately.

Some policy items, such as computer-assigned software, require a reboot to take effect, however. User-assigned software requires the user to log on and log off.

I want to check basic network connectivity.

Try to ping a domain controller.

Make sure that DNS is working properly.

For Network Connection issues, see About Network Connections, To configure a connection, and Local area connections overview.

For possible TCP/IP issues, see To test a TCP/IP configuration by using the ping command, To test TCP/IP connections by using the ping and net view commands, and To trace a path by using the tracert command.

I want to enable logging.

You can set a registry key that causes Group Policy diagnostic logging to be written to a file named Userenv.log on the client computer. See the section "Monitoring Group Policy with Log Files" in Troubleshooting Group Policy (http://www.microsoft.com/) at the Microsoft Web site.

You can also set a registry key that enables verbose logging to the event log so that you can see it with Event Viewer. For more information, see Event Viewer overview and "Verbose Logging to Event Log" in Troubleshooting Group Policy (http://www.microsoft.com/) at the Microsoft Web site.

For information about editing the registry, see Registry Editor.

Are you having trouble using the Group Policy snap-in?

I need help with the individual Group Policy settings that are included in Administrative Templates.

This information is now part of the Windows online help:

ADM file | Policy settings
System.adm | Open Help for System settings
Wmplayer.adm | Open Help for Windows Media Player settings
Inetres.adm | Open Help for Internet Explorer settings
Conf.adm | Open Help for NetMeeting settings

I cannot open a Group Policy object in the console even though I have Read access to it.

Cause: An administrator must have not just Read access but Full Control of the Group Policy object to open it in the Group Policy console.

Solution: Be a member of a security group with Full Control on the Group Policy object. For example, a domain administrator can manage Active Directory–based Group Policy. An administrator on a computer can edit the local Group Policy object on that computer.

When I try to edit a Group Policy object, I get the "Failed to open the Group Policy object" error.

Cause: This usually is due to a networking problem, specifically, a problem with the domain name system (DNS) configuration.

Solution: Make sure that DNS is working properly. For more information, see DNS.

When I try to edit a Group Policy object, I get the "Missing Active Directory Container" error.

Cause: This is caused by Group Policy attempting to link a Group Policy object to an organizational unit that it cannot find. The organizational unit might be deleted, or it might be created on another domain controller but not replicated to the domain controller that you are using.

Solution: Limit the number of administrators who can make structural changes to Active Directory, or who can edit a Group Policy object, at any one time. Allow changes to replicate before making changes that affect the same organizational unit or Group Policy object.

When I try to edit a Group Policy object, I get the "Snap-in failed to initialize" error.

Cause: This may be happen if Group Policy cannot find framedyn.dll.

Solution: If you use installation scripts, make sure that your scripts place the %windir%\system32\wbem directory in the system path. By default, %windir%\system32\wbem is in the system path already; therefore, you are not likely to encounter this issue if you do not use installation scripts.

Are Group Policy settings not taking effect?

Group Policy is not being applied to users and computers in a security group that contains those users and computers, even though a Group Policy object is linked to an organizational unit that contains that security group.

Cause: This is correct behavior. Group Policy affects only the users and computers that are contained in sites, domains, and organizational units. Group Policy objects are not applied to security groups.

Solution: Link Group Policy objects to sites, domains, and organizational units only. Remember that the location of a security group in Active Directory is unrelated to whether Group Policy applies to the users and computers in that security group.

For more information, see To filter the scope of Group Policy according to security group membership.

Group Policy is not affecting users and computers in a site, domain, or organizational unit.

Cause: Group Policy settings can be prevented, intentionally or inadvertently, from affecting users and computers in several ways. A Group Policy object can be disabled so that it does not affect users, computers, or both. It also must be linked directly to an organizational unit that contains the users and computers, or it must be linked to a parent domain or organizational unit, so that the Group Policy settings apply through inheritance.

When multiple Group Policy objects apply, they are processed in this order: local, site, domain, organizational unit. By default, settings that are applied later have precedence. In addition, Group Policy can be blocked at the level of any organizational unit, or it can be enforced through a setting of No Override that is applied to a particular Group Policy object link.

Finally, the user or computer must belong to one or more security groups that have the appropriate permissions set.

Solution: Make sure that the intended policy is not being blocked.

Make sure that no overriding policy that is set at a higher level of Active Directory has been set to No Override.

If Block and No Override are both used, remember that No Override takes precedence. For more information, see Policy inheritance.

Verify that the user or computer is not a member of any security group for which the Apply Group Policy access control entry (ACE) is set to Deny.

Verify that the user or computer is a member of at least one security group for which the Apply Group Policy access control entry (ACE) is set to Allow.

Verify that the user or computer is a member of at least one security group for which the Read access control entry (ACE) is set to Allow.

For more information, see To filter the scope of Group Policy according to security group membership.

Group Policy is not affecting users and computers in an Active Directory container.

Cause: Group Policy objects cannot be linked to Active Directory containers other than sites, domains, and organizational units.

Solution: Link a Group Policy object to an organizational unit that is a parent to the Active Directory container. Then, by default, those settings are applied to the users and computers in the container through inheritance.

For more information, see To filter the scope of Group Policy according to security group membership.

Group Policy is not taking effect on the local computer.

Cause: Local policies are the weakest. Any Active Directory–based policy can overwrite them.

Solution: Check to see what Group Policy objects are being applied through Active Directory and if those Group Policy objects have settings that are in conflict with the local settings.

Are you having trouble with the Software Installation snap-in?

Software that you assigned to a computer is not available on the computer.

Cause: The client computer has not been restarted.

Solution: Restart the client computer.

Software that you assigned or published to a user is not available on the user's computer.

Cause: The user has not logged off and then logged on.

Solution: Have the user log off and then log on.

Published applications do not appear in Add or Remove Programs in Control Panel.

Cause: Several causes are possible:

  • Group Policy is not applied.
  • Active Directory cannot be accessed.
  • Users do not have any published applications in the Group Policy objects that apply to them.
  • The client is running Terminal Server.

Solution: Investigate each possibility in turn. Note that Software Installation is not supported for Terminal Server clients.

Document activation of a published application does not cause the application to install.

Cause: The administrator did not set autoinstall.

Solution: See To set the autoinstall option for an application.

The user receives an error message such as "The feature you are trying to install cannot be found in the source directory."

Cause: This could be caused by network or permissions problems.

Solution: Make sure that the network is working correctly. Also, see To set permissions for Software Installation.

The user receives an error message such as "This product is not installed" or "Feature ID not registered."

Cause: This could be caused by a user with a roaming user profile logging on to two computers simultaneously, which is an unsupported use of roaming user profiles.

Solution: Have the user log off one computer before logging on to another. That way, the application shortcuts will be updated and valid on the second computer, and they will not give error messages.

After removal of an application, the shortcuts for the application continue to appear on the user's desktop.

Cause: The user has created shortcuts, and Windows Installer does not recognize them.

Solution: The user must remove the shortcuts manually.

A user receives an error message such as "Another installation is already in progress."

Cause: An uninstallation might be taking place in the background, with no user interface presented to the user, or perhaps the user has inadvertently triggered two installations simultaneously, which is not supported.

Solution: The user can try again later.

The user opens an already installed application, and Windows Installer starts.

Cause: An application might be undergoing automatic repair, or a user-required feature is being added.

Solution: No action is required.

A user receives error messages such as "Active Directory will not allow the package to be deployed" or "Cannot prepare package for deployment."

Cause: The package might be corrupted, or there might be a networking problem.

Solution: Use an uncorrupted package. Investigate the possibility of network problems and take appropriate action.

When I click one of the Software Installation icons in the Group Policy console tree, I get the error message "Snap-in failed to initialize."

Cause: This may be happen if Software Installation cannot find framedyn.dll.

Solution: If you use installation scripts, make sure that your scripts place the %windir%\system32\wbem directory in the system path. By default, %windir%\system32\wbem is in the system path already; therefore, you are not likely to encounter this issue if you do not use installation scripts.

Troubleshooting resources on the Internet

For help with troubleshooting known problems, do a keyword search of the Microsoft Knowledge Base. (http://www.microsoft.com/)

See the white paper Troubleshooting Group Policy (http://www.microsoft.com/), which also covers Software Installation troubleshooting issues.

The Microsoft Windows Resource Kits offers articles such as Extending and Troubleshooting Group Policy (http://www.microsoft.com/).

For other sources of information, see Resources.