Windows 10 Administrative Templates

Have you been upgraded to Windows 10 yet? Are you a fan? I am. I've been working with and running Windows 10 on most of my home clients for months now. My work computer just upgraded today with little fan fare. One minor issue where Lenovo had a new Win10 Driver for a mini-port/DisplayLink device. Once I updated that driver all seems lovely!

As you may have seen from Group Policy MVPs and other enthusiasts and writers out there, the Windows 10 Settings spread sheet has arrived. I can't tell you how many times I have anxiously awaited the new spreadsheet. I've read through and studied far too many of these that I like to admit. 

If you haven't used the spreadsheet before don't be over whelmed. It is actually quite whelming, it is not over-whelming, nor is it under-whelming... it is just whelming. I literally yawned as I typed that sentence.

It is however cool and interesting. Knowledge of what settings you can manage for these new clients is super important and this spreadsheet is key to that knowledge.

Some Highlights

If you take a look at and filter on the column called 'New in Windows 10' you will find that there are 201 Administrative Template settings that are labeled as New in Windows 10. 

That is 139 Machine settings and 62 user settings. They are in a lot of ADMX files... 46 files to be close. There is one new setting in the grouppolicy.admx file. One setting to prevent programs from loading untrusted fonts. This setting actually has an interesting 'Audit' mode which allows you to see if blocking untrusted fonts makes bad things happen. Seems interesting, we'll see if it is useful. There are a few AppX related settings, there are many additions to inetres.admx and there are 20 settings in microsoftedge.admx.

Managing Edge will be new and it will interesting to see how people are using the new browser. I'll have to add some Edge customization's to my <gratuitous plug>"Managing Group Policy and Active Directory with PowerShell" session at Spiceworld on September 25th! </gratuitous plug>.

There is a new setting related to Credential Providers. I'm sure my friends at Specops Software will be interested in that one! 

Summary

Just a brief overview, check out the spreadsheet and the actual ADMX files at these links..

• ADMX Files
• Settings Spreadsheet

I'll continue to dive in to see what other interesting stuff is in there. I'll take a look at the security tab and put up an overview soon.

Enjoy!

Kevin

Group Policy Comments

Group Policy comments have great potential. I don't seem them used too frequently. This is unfortunate as they can be a simple way to document your GPOs so that you can quickly determine what the intent of a given bag of configuration settings may be.

The life-cycle of a Group Policy Object is not something that has received a lot of attention over the years. Microsoft's Advanced Group Policy Management is great, but not widely used and doesn't cover some key life-cycle needs. There are some tools out there to help in that area and at SDM Software you can find a couple of very nice solutions to common configuration issues. Take a look at Group Policy Compliance Manager and Group Policy Auditing and Attestation when you get a chance.

But, out of the box, comments are great and it may be helpful to take a few minutes to check them out. I recorded a bit of a stream of conscious discussion, with myself, on Group Policy comments. Take a look. If you have ideas of other topics around configuration, Group Policy, PowerShell and more, let me know. I'm happy to drill into different areas that may be helpful to folks.

Enjoy! 

Kevin

Group Policy 002: The Cmdlets - New-GPO

Simple!

It really is. I want to create a new GPO from PowerShell. Of course there will be work to do later but just get the GPO created. 

I created a brief video walking through the process.

Enjoy!

PowerShell 008 - $Profile

$Profile - what is it good for?

There are many things you can use the profile for in PowerShell. The variable $profile stores the path to the profile loaded when you launch the console or the ISE.

 

 

If you notice the path above you will see the script is called 'Microsoft.PowerShellISE_Profile.ps1'. It is a profile script that will load when you launch the ISE. I almost exclusively use the ISE these days, I have found very few reasons to use the console. That is a different discussion.

 

What is put in the profile script?

Well, that is really the question I've been asking myself. I find that just about every time I launch the ISE I think of something that I need to have available to me. For example I use the Specops PowerShell cmdlets every day. The cmdlets and functions that come through our Deploy products are PowerShell modules. Our Specops Password products expose their commands through PSSnapIns. PSSnapIns and some modules need to be loaded explicitly.

• Add-PSSnapIn -Module specopssoft.specopspasswordpolicy
• Import-Module -Module specopsdeploy

Another thing I do on a regular basis is update the help content. Now this is a bit much for a profile in my experience but it can catch updated content when available. If there are specific modules that you utilize all the time you can update those individually. This command updates the help content.

• Update-Help
• Update-Help -Module Hyper-V

Many of my friends and colleagues use PowerShell and some are true power users. Their profile scripts include quite a bit of automation. These are just simple examples share yours.

 

Starting the console with the focus on a directory that is used for most tasks is also very helpful.

• Set-Location c:\psstuff

How to Update the profile script

The path to the profile script is stored in the $Profile variable. Above you can see the data stored in this variable for the ISE. When you want to edit your profile script simply type

 

 

 

 

This will launch notepad with the profile script.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

And that is that

Save the script, close the ISE and re-launch it. the configuration your have in the script will run. If you haven't updated help content in a while this one can take a while. So use that with the understanding of what it is doing.

Group Policy 001: Intro to the GPMC

Tools

There are multiple tools you use when working with Group Policy. The two primary tools have not changed much since Windows Server 2003 R2. The primary reason is they just work great, do what they are supposed to do and focus on key scenarios. This is a quick overview of the Group Policy Management Console or the GPMC, the first of the two primary tools. A follow-up post will explore the editor or the GPME. 

Group Policy Management Console

The Group Policy Management Console or GPMC is the primary tool for managing Group Policy. This is where you create, link, secure, delegate control, report on, monitor status and more. It is a common tool for network administrators and desktop administrators alike and provides for a lot of scenarios. 

GPMC

In the GPMC you will see all domains and sites defined in your forest. Group Policy is primarily a domain specific technology. Keeping your management within a domain makes things easier but being able to apply policy across the enterprise, regardless of which domain a user or computer happens to be in is a very powerful feature.

The tool itself likes to focus its attention on the domain controller that holds the PDC emulator role. Some of us old people actually had to work with actual PDCs. In tools like GPMC if you choose to focus the attention on a different Domain Controller in your enterprise it is an easy change. Simply access the action menu from the Domain you are focused on and choose 'Change Domain Controller..."

Change DC

Create Group Policy Objects

One important aspect to managing Group Policy is where the data is actually stored. This is important because GP is not the most forgiving of technologies. You want to know where you are placing a GPO and who/what it is affecting. There is a container under the Domain node in the GPMC called "Group Policy Objects". This container is where all GPOs are stored if they are 'linked' or not. I like to create my GPOs in this container and manage linking and delegating during my configuration process. To create a GPO;

1. Right click on the "Group Policy Objects" node and select 'New'
2. Give the GPO a Name 
3. Choose to start from scratch or pick a 'Source Starter GPO' (Starter GPOs will have to be another post)
4. Click OK

New GPO

Select the GPO you created in the list under the 'Group Policy Objects' container. The right hand side of the screen will contain the majority of information you need related to this GPO. The 'Scope' tab shows effectively which users and which computers may be affected by this GPO. I say may simply because there are additional caveats to cover in other posts. It will show which OUs the GPO is linked, what security groups will be affected by thsi GPO and even any WMI filters that will more granularly control application of the GPO.

The 'Details' tab shows version information, ownership, versioning and the GUID that references this GPO. This will be very important in other advanced scenarios. 

The 'Settings' tab shows the native Microsoft settings configured in this Group Policy object. The 'Delegation' tab show which users will have access to this GPO for management purposes. 

And the last tab, 'Status' is the newest piece of functionality here and it will show you the replication status of this GPO across other domain controller.

GPO Details

There is a lot more to cover in the GPMC but for this overview that is a good start. Let's look at editing a Group Policy Object in a follow-up post.