GPOADmin 5.16 - User Guide

Linking GPOs to multiple Scopes of Management

If required, you can easily take existing registered GPOs and link them to any number of SOMs within your deployment.

Select two or more registered SOMs, right-click and choose Apply Link.

Click the browse button to open the Choose a Group Policy Object dialog.

By default, the links will be applied to all selected Scopes of Management. You can, however, select to remove the application for specific SOMs by clearing the individual check box.

The way in which the link is applied is set through the available options:

If the GPO is not currently linked to a SOM, the default settings are enabled:

•

Enabled: This settings reflects the setting in the Version Control Server properties.

•

Enforced: Not enforced.

•

Link Order: Append link order.

If the GPO is currently linked to one of the selected SOMs, the existing settings for that SOM are displayed.

If required, you can change the individual options or use the top level check box to set the options for all the selected SOMs.


	NOTE: To set the link as a specific link order, uncheck the check box for the specified SOM under the Link Order column, set the required link order using the up and down arrow. If the link order is set to a higher number than the current link count, the link will be appended.

Once you have all your settings in place, click OK.

When the link action completes, the results are displayed in the Link Results dialog. If any of the links failed or an SOM was skipped, an error message displays the details so that you can take corrective action.

Managing compliance issues automatically with remediation rules

You have the option to setup an automatic way to deal with objects that have become non-complaint due to a modification or deletion performed outside of GPOADmin.

By default, the remediation option is set to None (no automatic resolution) at the Version Control Root level. Any remediation option set at this level will filter down to all child objects and containers unless you have specifically configured them to override their parents settings.

Watcher Service requirements

•

The Watcher service is required to perform the compliance remediation actions. If the service is not running all remediation settings will be ignored.

•

If the Watcher service account is not the same account as the GPOADmin service, it must be added to GPOADmin as and Administrative account.

•

Remediation is not support on Protected Settings policies and WMI Filters as these objects are not monitored by the Watcher service.

To configure compliance remediation


	NOTE: Only users with the Set Remediation Rule can set these options.

Right-click the required object or container and select Properties.

Select the Remediation tab and choose how you want to handle objects that have become non-compliant due to a modification or deletion.

If an object has become non-compliant due to:

Available options to resolve the compliance issue

Modification

NOTE: Rollback with links and restore with links only apply to GPOs. All other objects will perform either a rollback or a restore remediation action.

•

•

•

•

NOTE: Restore and Restore with links remediation is not supported on Scopes of Management.

•

Restore

•

Restore with links

•

Unregister

Click OK. Once a rule has been set it will be applied when the object is flagged as non-compliant. If the object does not have a remediation rule applied then the first rule found on a parent container will be applied.

Validating GPOs

To ensure that the GPOs within your system are still required, you can setup an attestation process. If a GPO has not been deployed within the specified date range, an email will be sent to the account designated as its manager to attest to its validity.

This option is supported for SQL and AD / AD LDS as a configuration store and all backup stores.

To configure GPO attestation

Right-click the required object or container and select Properties.

Select the Attestation tab.

Select Enable Attestation.

Set the date range (days, weeks, or months) for a GPO deployment that when exceeded will trigger a notification.

Enter the email notification subject and message.

You can right-click and select Insert Tag to use any of the following pre-defined tags: Action, Comment, Domain Name, Full Path, ID, Last Backup ID, Name, Status, Sub status, Trustee Name, Trustee SID, Type, Version, Version Control ID, Last Deployed On. (See Predefined Tags for tag details.)

Click OK.

The version control system is polled every 24 hours to identify GPOs that have not been deployed within the specified date range. Once identified, the attestaion email notification is sent to the account that is designated as its manager (Managed By property).


	NOTE: If you have GPOs that you do not want to validate, you can select to Override Inherited Attesatation and click to clear the Enable Attestation option.