Windows Server: Group Policy Administration and

Troubleshooting

Module 1: Fundamentals of Management

Microsoft Confidential
Conditions and Terms of Use
Microsoft Confidential
This training package is proprietary and confidential, and is intended only for uses described in the training materials. Content and software
is provided to you under a Non-Disclosure Agreement and cannot be distributed. Copying or disclosing all or any portion of the content
and/or software included in such packages is strictly prohibited.
The contents of this package are for informational and training purposes only and are provided "as is" without warranty of any kind,
whether express or implied, including but not limited to the implied warranties of merchantability, fitness for a particular purpose, and non-
infringement.
Training package content, including URLs and other Internet Web site references, is subject to change without notice. Because Microsoft
must respond to changing market conditions, the content should not be interpreted to be a commitment on the part of Microsoft, and
Microsoft cannot guarantee the accuracy of any information presented after the date of publication. Unless otherwise noted, the companies,
organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious, and no
association with any real company, organization, product, domain name, e-mail address, logo, person, place, or event is intended or should
be inferred.

Copyright and Trademarks

2013 Microsoft Corporation. All rights reserved.
Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this
document. Except as expressly provided in written license agreement from Microsoft, the furnishing of this document does not give you any
license to these patents, trademarks, copyrights, or other intellectual property.
Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this
document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic,
mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.
For more information, see Use of Microsoft Copyrighted Content at
http://www.microsoft.com/about/legal/permissions/
Microsoft, Internet Explorer, and Windows are either registered trademarks or trademarks of Microsoft Corporation in the United
States and/or other countries. Other Microsoft products mentioned herein may be either registered trademarks or trademarks of Microsoft
Corporation in the United States and/or other countries. All other trademarks are property of their respective owners.
 Module Agenda
Lesson 1: Group Policy Management Console
Lesson 2: Security Compliance Manager
Lesson 3: Advanced Group Policy Management (AGPM)

2 Microsoft Confidential
Windows Server: Group Policy Administration and
Troubleshooting

Module 1: Fundamentals of Management

Lesson 1: Group Policy Management Console

Microsoft Confidential
 Group Policy Management Console Objectives
Understand how to work with the console
Understand the features of the GPMC
Introduce PowerShell for group policy
Understand the installation process
Explain the creation of policies
Understand delegation processes
Explain best practices for planning

4 Microsoft Confidential
 Group Policy Management Overview
Group Policy Management Console
Group Policy Management Console Installation
Group Policy Management
Delegation
Group Policy Planning

5 Microsoft Confidential
 Group Policy Management Console
GPMC Essentials
Key Features
Architecture
Scriptable APIs
Performance Improvements

6 Microsoft Confidential
 GPMC Essentials?
Primary tool for GPO management
Built into the Server OS
Included in the Remote Server Administration Tools (RSAT)
for clients
Version of GPMC to use

7 Microsoft Confidential
 Common Key Features
GUI for managing Group Policy
Reporting
Search and filtering
Resultant Set of Policy (RSOP) Integration
Backup/Restore
Import/Export
Copy/Paste
Default Target

8 Microsoft Confidential
 Architecture

11 Microsoft Confidential
 Scriptable APIs
PowerShell, Scripting or .Net
Many PowerShell cmdlets for GPO
Get-Help *-GP*
Backup-GPO
Get-GPOReport
Invoke-GPUpdate [-RandomDelayinMinutes]
Remove-GPLink
Set-GPPermission
Many others
Web updated help files

17 Microsoft Confidential
 Performance Improvements
Legacy GPMC versions wrote item by item changes
Small data changes
Many individual changes
Very slow
Current GPMC uses write buffering
Condenses change transmission frequency
99.4% performance improvement

20 Microsoft Confidential
 Group Policy Management Console Installation
Installing on Clients
Installing on Servers

22 Microsoft Confidential
 Installing On Clients

23 Microsoft Confidential
 Installing On Servers

24 Microsoft Confidential
 Group Policy Management
Group Policy Objects Properties
Group Policy Properties
Organizational Unit Properties
Organizational Unit Attributes
Group Policy Link Properties
Containers and Links

25 Microsoft Confidential
 Group Policy Objects Properties
New
Back Up all
Manage Backups
Open Migration Table Editor

26 Microsoft Confidential
 Group Policy Properties
Edit
GPO Status
Backup
Restore from Backup
Import Settings
Save Report

28 Microsoft Confidential
 Organizational Unit Properties
Create a GPO in this domain and Link it here
Link an Existing GPO
Block Inheritance
Group Policy Update
Group Policy Modelling Wizard

29 Microsoft Confidential
 Search
Domain Level
Search Item
Display Name
GPO Link
Security Group
WMI Filter
User Configuration
Computer Configuration
GUID

30 Microsoft Confidential
 Group Policy Link Properties

31 Microsoft Confidential
 Containers and Links
Container objects cannot have Group Policies linked
No gPLink Attribute or gPOptions
Default domain join location is Computers container
Use RedirUsr or RedirCmp to redirect
WellKnownObjects attribute in the domains Naming Context (DN)
eg.: DC=<Domain>,DC=<Domain>

32 Microsoft Confidential
 Delegation
Delegate Control
Delegate Policies
Delegating Creation of Policy
Advanced Security

33 Microsoft Confidential
 Delegate Control

34 Microsoft Confidential
 Delegate Policies
Delegation Tab
Permission
Link GPOs
Perform Group Policy Modeling Analyses
Read Group Policy Results data

35 Microsoft Confidential
 Delegating Creation of Policy
Three Methods
Setting the delegation within GPMC and rights
Group Policy Owners Creators
Advanced Group Policy Management Editor

36 Microsoft Confidential
 Advanced Security
Read and Apply Group Policy
DA and EA do not have Apply Group Policy
Authenticated Users

37 Microsoft Confidential
 Group Policy Planning
Planning Considerations
Planning Best Practice Guidelines

38 Microsoft Confidential
 Planning Considerations
Administrative Model
Security Requirements
Delegation type
Policy Volume
Simplicity

39 Microsoft Confidential
 Planning Best Practice Guidelines
Choose Stable upper-level OU names
Implement Standard setting Policies
Leverage Inheritance
Minimize unique circumstances
Security Filtering, Enforcing Policies, Block Inheritance and WMI
Object Class Separation
Avoid changing default policies
Disable non-required policy components
Avoid assigning cross domain policies

43 Microsoft Confidential
 Group Policy Management Review
Group Policy Management Console
Group Policy Management Console Installation
Group Policy Management
Delegation
Group Policy Planning

46 Microsoft Confidential
Windows Server: Group Policy Administration and
Troubleshooting

Module 1: Fundamentals of Management

Lesson 2: Security Compliance Manager

Microsoft Confidential
 Security Compliance Manager Objectives
Understand the Security Configuration Manager
Installation of Security Compliance Manager
Using Security Compliance Manager

48 Microsoft Confidential
 Security Compliance Manager Overview

What is the Security Compliance Manager

Installing the Security Compliance Manager
Using the Security Compliance Manager

49 Microsoft Confidential
 What is the Security Compliance Manager
Integration with the System Center 2012
Gold master support
Configure stand-alone machines
Updated security guides
Compare against industry best practices

50 Microsoft Confidential
 Installing the Security Compliance Manager

Installation of Security Compliance

Prerequisites
Installing SCM
Installing SQL Express
Finish The Install

51 Microsoft Confidential
 Installation of Security Compliance Manager

Installation Procedure
Microsoft_Security_Compliance_Manager_Setup.exe
LocalGPO.msi
This tool is designed to manage the local Group Policy of a computer

52 Microsoft Confidential
 Prerequisites
Supported operating systems
Windows 7, Windows 8
Microsoft Visual C++ 2010 Redistributable package
Microsoft Word or Microsoft Word Viewer
Microsoft Office Compatibility Pack for Word, Excel, and
PowerPoint File Formats

53 Microsoft Confidential
 Installing SCM

54 Microsoft Confidential
 Installing SQL Express

55 Microsoft Confidential
 Finish the Install

56 Microsoft Confidential
 Using the Security Compliance Manager

Security Compliance Manager

Security Guides
Demonstration

57 Microsoft Confidential
 Using Security Compliance Manager

58 Microsoft Confidential
 Security Guides

Available for multiple versions

Office
Windows Client
Windows Server
Exchange
Internet Explorer

59 Microsoft Confidential
Demonstration

Using the Security Compliance Manager

A Look around the tool
Examine the existing templates

60 Microsoft Confidential
 Security Compliance Manager Review

What is the Security Compliance Manager

Installing the Security Compliance Manager
Using the Security Compliance Manager

61 Microsoft Confidential
Windows Server: Group Policy Administration and
Troubleshooting

Module 1: Fundamentals of Management

Lesson 3: Advanced Group Policy Management

(AGPM)

Microsoft Confidential
 AGPM Objectives
Understand MDOP components
Understand the features of Advanced Group Policy
Management
Understand the extended features of Advanced Group
Policy Management
Explain how Advanced Group Policy Management works

63 Microsoft Confidential
 Advanced Group Policy Management Overview
Microsoft Desktop Optimization Pack (MDOP)
AGPM Features
AGPM principles
Installing the Advanced Group Policy Manager
Troubleshooting

64 Microsoft Confidential
 Microsoft Desktop Optimization Pack (MDOP)

Application Virtualization (App-V)

User Experience Virtualization(UE-V)
Microsoft Enterprise Desktop
Virtualization(MED-V)
Microsoft Bit locker Administration
and Monitoring (MBAM)
Advanced Group Policy Management
(AGPM)
Diagnostics and Recovery Toolset
(DART)

65 Microsoft Confidential
 AGPM Features
Core AGPM Features
Extended Features

67 Microsoft Confidential
 Core AGPM Features
Extension of the GPMC
Role based delegation
Check-out/Check-in
Offline editing
Change control
Historical track of changes
Deployment process
Roll-back and Roll-forward
Recycle bin
Advanced GPO Link Restore
SMTP notifications

68 Microsoft Confidential
 Extended Features
Allows Listening Port modification
Versions of policies can be limited in the store
SMTP over SSL can be used
Available in 11 Languages
Import/Export between AGPM server to AGPM server
Enhanced reporting for changes in the archive
Compatibility

70 Microsoft Confidential
 AGPM Principles
How does it work?
Less Privilege Service Account
AGPM Architecture
Checkout Process

72 Microsoft Confidential
 How does it work?

AGPM Client AGPM Service Domain Controller

Service account
Performs the write
to AD.

Production GPOs

Offline GPOs

AGPM Archive

73 Microsoft Confidential
 Least Privilege Service account

Does not require domain admin

Full access to the AGPM archive folder
Full access to the local computer's temp folder
(%systemroot%\temp)
Full access to GPOs created prior to using AGPM
Must be a member of the Group Policy Creator Owners and
Backup Operators Group
Removing all account rights

74 Microsoft Confidential
 AGPM Architecture

76 Microsoft Confidential
 Checkout Process
When checking out a Group Policy object the following
occurs:
Advanced Group Policy Server Service Generates a new GUID
Copies the GPO from the archive to the temp folder
Connects to Active Directory
Creates an unlinked GPO called [AGPM]<Policy Name>
Connects to SYSVOL
Creates a new folder using the new GUID as the name
All edits occur
When checked in, the changes are written to the AGPM database
Changes are only written to production GPO once approved

78 Microsoft Confidential
 Installing the Advanced Group Policy Manager
Installation Procedure
Managing AGPM server
Using AGPM server

79 Microsoft Confidential
 Installation Procedure

Create the Service Account

Separate Client and server agent
Can be installed on the same
machine
Install the Server agent first,
then the client agent
Install Server on the same site as
the PDCe
AGPM version 4 Service pack 1
needed for Windows Server
2012

80 Microsoft Confidential
 Managing AGPM Server
Uncontrolled GPOs are in Production environment only
Use Controlled tab to add GPO into vault
Makes a copy of GPO
All edits to controlled GPO are made offline
Once controlled, they are managed by AGPM
Only the account that installed the tool and the AGPM service
account retain permissions

82 Microsoft Confidential
Demonstration

Using AGPM Server

A walkthrough of the management console
Check out, edit and check in policies
Deploying policies
Generation of reports and reviewing historical changes
View difference reports
Deleting policies from the archive

85 Microsoft Confidential
 Troubleshooting
Troubleshooting AGPM
Modifying AGPM Configuration

86 Microsoft Confidential
 Troubleshooting AGPM
Event Logging
AGPMServ.log/AGPM.log can be enabled
To enable via the registry
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\AGPM
TraceLevel Type: REG_DWORD
The following Data Values are used:
0 = No tracing (Same effect as if this registry entry does not exist.)
1 = Trace errors
2 = Trace errors and warnings
3 = Trace errors, warnings, and general information
4 = Trace all information
For Servers: %ProgramData%\Microsoft\AGPM\agpmserv.log
For Clients: %LocalAppData%\Microsoft\AGPM\agpm.log
To enable via AGPM.ADMX file
Computer Configuration\Administrative Templates\Windows
Components\AGPM Logging
Set to Enabled

87 Microsoft Confidential
 Modifying AGPM Configuration
Many hidden settings are stored in XML
%CommonAppData%\Microsoft\AGPM\gpostate.xml

Modify the listening port for AGPM

Use UI where possible
Change the XML files directly
agpm:port="4600"

89 Microsoft Confidential
 Advanced Group Policy Management Review
Microsoft Desktop Optimization Pack (MDOP)
AGPM Features
AGPM principles
Installing the Advanced Group Policy Manager
Troubleshooting

90 Microsoft Confidential
Lab

Labs

91 Microsoft Confidential
 Review
In the module, we looked at:
Group Policy Management Console
Security Compliance Manager
Advanced Group Policy Management (AGPM)

92 Microsoft Confidential
 2013 Microsoft Corporation. All rights reserved.

Microsoft Confidential