CPES Active Directory Guide
Securing Your Workstations with Group Policies
by Ben Pfountz (netprince@vt.edu)

Background

The default installation of windows 2000 is tweaked for the first time user. This is most obvious the first time a user logs into the system. Features such as the welcome to windows splash screen and network connection wizard can become very annoying to experienced users who log onto a different lab computer every day. The most efficient way to remove most of these annoyances is via Active Directory's Group Policy.

AD's Group Policies are also good for lab functionality. In the CPES computer lab, there are 20 computer systems available for public use. Before group policy, the early morning users would log into a machine and lock the computer whenever they walked away for a few minutes. With AD's Group Policy, we have removed the ability for users to lock the lab computers, while still retaining the ability for Administrators to lock them.

There are two forms of group policy, both of which are distributed from the AD servers within the domain. The computer policy is downloaded to a client computer when the computer is starting up, while the user policy is downloaded when the user is logging in. In CPES, we decided to use group policy's loopback processing to enable computer policy to override group policy depending on which area of the lab a user is visiting. For example, users in the PC lab cannot lock their computers because of the need to share the computers with other users. On the other hand, users in their offices are allowed to lock their own personal computers.

Designing Your Group Policy

There are many decisions to be made when designing a group policy. A good number of the options available in group policy settings could anger your computer users, so be sure to discuss these options with management before enabling them. For example, Internet Explorer can be configured to show a company web site as the home page, and it can prevent users from changing the home page. Some users may complain, but management may decide it is important for the users to see the company web site for important announcements.

The complete list of available Group Policy options can be viewed from any machine by launching the mmc. Choose file, add/remove snap in, Add, Group Policy, Local Computer, Close, and OK.

The CPES Group Policy

• Administrative Tools -> Active Directory Users and Computers
• Right Click domain name (CPES.cpes.vt.edu), choose properties
  • Domain operation mode should be Native mode, since we are no longer using any NT servers
• Select the 'Managed By' tab, and fill in the information
• Select the 'Group Policy' tab
  • This is where the domain wide default group policy is configured
  • OU's group policy will simply modify this policy through inheritance
    • Be sure 'Block Policy Inheritance' is not checked.
  • Instead of modifying the default domain policy, add a new policy below the default policy
    • click new
    • name the policy "CPES strict-default policy"
  • Select the new policy, and click edit
• You can add a policy for every OU you create in the above manner. Policy rules are inherited down the tree, and you can use loop back processing to override the user configuration of a user policy with the user configuration of a computer policy.

NOTE: policy marked in red does not inherit and needs to be set for each group policy you create.