GPOADmin 5.16 - User Guide

Working with objects pending approval and deployment

Only users with the Deploy permission can make the changes go live in the enterprise. The approval system safeguards the enterprise environment from any unauthorized live changes that could cause unwanted results. For more information on delegating permissions, see Configuring role-based delegation.

The types of requests from users that require approval are

•

Changes to offline objects that are required to go live

•

Creation of new objects

•

Deletion of existing objects


	NOTE: Using the Export Wizard, you can test GPOs offline before they are implemented in the live enterprise. For more information, see Exporting and importing . NOTE: You can view a list of all objects Pending Deployment or Approval in the Search Folders in the GPOADmin console.

For more information, see:

•

Enhanced workflow approval

•

Changing the approval workflow

•

Withdrawing an approval request

•

Approving and rejecting edits

•

Deploying objects (scheduling and associated items)


	NOTE: User or groups added as an approver must have Read access on the object requiring approval. Validate and set the appropriate access through the Security tab.

Withdrawing an approval request

Any user who proposes a change to an object can withdraw their own request for approval while the change is in the Pending Approval state.

To withdraw an approval request in the GPOADmin console

Right-click an object in the Pending Approval state, and select Withdraw Approval Request.

Click OK.

The object is returned to the Available state.

Enter a comment and click OK.

To withdraw an approval request in the GPMC Extension

Select a GPO in the Pending Approval state, and click Workflow | Withdraw Approval Request.

Enter a comment and click OK.

Enhanced workflow approval

You have the option of implementing a further safeguard by designating and modifying multi-level approvers. With this option, the required approvals at all levels must be granted before an object becomes available for deployment in the live environment.

Not everyone in a named group has to approve, just the required number. For example there may be 10 members in Group B but we may require only 3 approvals from that group to satisfy our requirements.

When you create a role within GPOADmin, you now have the option of empowering that role with the Modify Approval Workflow permission.

To grant Modify Approval Workflow permission

Select the forest node, right-click and select Properties.

Open the Roles tab and select Add New Role.

Type the name of the new role and click Next.

Scroll down the list of permissions and select the Modify Approval Workflow check box.

Once you have granted all relevant permissions, click Finish, click Apply and then OK.


	NOTE: You can view an existing role’s rights by selecting the role, selecting View Role, opening the Rights tab, and noting the permissions that have been grated.

Use caution granting this permission. A user with this permission can add, modify or delete the approval workflow a requested change must follow before it modifies the live environment.

Changing the approval workflow

By default, approvals are processed in the order listed on the Approvals tab in the Container or Item Properties. Optionally, approvals can be performed base on count where the any approver can approve at any time. In this case, the item status will change to Pending Deployment once the total number of received approvals equals the total sum of the required approvals.


	NOTE: You can select the Override inherited work flow check box if you want the approvals process for a container to be different from its top level container.

To change an approval workflow

Select a version control container or object, right-click and select Properties.

Open the Approvals tab and select the workflow type you want to manage.

Approval workflows can be set for object creations, deletions, and modifications.

To add a level of approval

Click Add to select a user or group.

Use the arrow keys to the left of the dialog box to alter the order in which the approvals must take place.

If a group is selected, you must specify how many members of that group must approve the item before it can proceed to the next stage.

Once you have all steps added to the new workflow, click Apply, then OK.

To delete a level of approval

Click the "-" button to the right of the level of approval you do not want.


	NOTE: Be certain you want to remove the level as there is no step to ensure you have chosen the correct level - it is removed as soon as you click on the "-" button.