Modifying A Gpo

By Author: iris
Total Articles: 286
Comment this article

Plan Group Policy settings sparingly—justify the selection of each setting as you would the creation CompTIA Security+ certification of a domain or OU. Choose settings based on their ability to help you to simplify the administration of computers and users.
Build GPOs by using a decentralized or a centralized design. A decentralized design uses a base GPO applied to the domain, which contains policy settings for as many users and computers in the domain as possible. Then this design uses additional GPOs tailored to the common requirements of each OU and applied to the appropriate OUs. A centralized design uses a single GPO containing all policy settings for the associated site, domain, or OU.
Administrative control of GPOs can be delegated by using a centralized, decentralized, or task-based administrative control design. In the centralized design, administration of Group Policy is delegated only to top-level OU administrators. In the decentralized design, administration of Group Policy is delegated to top-level and to second-level OU administrators. In the task-based design, ...
... administration of specific group policies is delegated to administrators that handle the associated specific tasks.

Before taking the exam, review the key points and terms that are presented in this chapter. You need to know this information.
Why does the policy affect only GPLabUserO?
GPLabUserO is the only user account that is not specifically filtered from receiving the policy, and GPLabUserl and GPLabUser2 are not in or subordinate to the container to which the policy is applied. GPLabUserS is a member of a group that is specifically filtered from receiving the policy.
28. How could you configure your Active Directory objects to ensure that all four
GPLabUser accounts were subject to the Server+ GPLabRemoveRun GPO?
First, you need to ensure that all user accounts are in a container that receives the GPO. You can do this by moving GPUserl and GPUser2 to the GPLab OU. Second, you must ensure that the security filtering doesn't affect GPUser2 and GPUserS. To do this, either remove the secu?rity filtering by allowing GPLabGroup2 to apply the GPO, or remove GPUser2 and GPUserS from GPLabGroup2.
What is the difference between Block Policy Inheritance and No Override?
Block Policy Inheritance is applied directly to the site, domain, or OU. It is not applied to GPOs, nor is it applied to GPO links. Thus Block Policy Inheritance deflects all Group Policy settings that reach the site, domain, or OU from above (by way of linkage to parents in the Active Direc?tory hierarchy) no matter what GPOs those settings originate from. GPO links set to No Override are always applied and cannot be blocked using the Block Policy Inheritance option.
Any GPO linked to a site, domain, or OU (not the local GPO) can be set to No Override, so that none of its policy settings can be overwritten by any other GPO during the processing of group policies. When more than one GPO has been set to No Override, the one highest in the Active Directory hierarchy (or higher in the hierarchy specified by the administrator at each fixed level in certification exam papers Active Directory) takes precedence. No Override is applied to the GPO link.