Chat now with support
Chat with Support

GPOADmin 5.17 - Quick Start Guide

Connect to the Version Control system

Connect to the Version Control system

Because the application has been fully configured by the administrator, users connect to the Version Control system in the following manner:

To connect to the Version Control system
1
Right-click the GPOADmin node and select Connect To.
2
Click New to create a new connection and enter the server name.
3
Select the Version Control server that you want to connect to and click Connect to connect with the current logged on user credentials or select Connect As to enter a new credentials (user name and password).
4
To save the credentials, select the Remember my password check box and click OK.

For more information about saving connections, see “Persisting Connections” in the GPOADmin User Guide.

Register a GPO

Initially all GPOs are unregistered. To add GPOs to the Version Control system, they must be registered.

* 
NOTE: When GPOs are registered they maintain their GPO status (User and Computer settings enabled or disabled), links, security, and WMI filters.
To register a GPO
* 
NOTE: You must have the Register right and been granted access to the Live Environment node to register a GPO.
1
Expand GPOADmin, the forest, Live Environment, and the Domain Controller. Select the Group Policy Objects, right-click a GPO in the right-hand pane, right-click and select Register.
2
Select the container where you want to place the registered object and click OK.
Once objects have been registered, they are located in the selected container under the Version Control Root with their initial version number set to 1.0. They are now available to be checked out and edited.
If you are migrating from an existing Version Control system, you can set the major version number to any number greater than 1.0 in the Initial major version list.

Check out and edit GPOs

* 
TIP: The information in this section applies to workflow-enabled GPOs only. For more information on workflow enabling/disabling, see the Quest GPOADmin User Guide or Online Help.

Before users can edit registered GPOs, the GPOs must be checked out.

The workflow is as follows:

•
Check out the GPO from the system,
•
make the required edits, and
•
check in the changes to the system.
* 
NOTE: The changes are only applied to the live environment after they are approved and deployed.

Version information is updated in the system’s history when the GPO is checked back in. Only one person within the system can check out and work on any GPO at a given time.

* 
NOTE: If you have all required rights, you can approve a GPO from the checked out state and the necessary workflow steps happen automatically.

Checking out a GPO for the first time creates a copy of the original GPO. The copy is an exact duplicate of the original GPO until it passes through the approval process.

To check out a GPO
1
Expand the Version Control Root and select the available GPO.
2
Right-click a GPO and select Check Out.
3
Enter a comment and click OK.
Once you have a GPO checked out, you can edit the settings from the Group Policy Management Editor as well as edit the Security and WMI Filter settings. When you check out a GPO, the changes are made to a copy of the live GPO. Those changes do not affect the GPO settings on the network until the changes are approved and deployed.
To edit a GPO
1
Right-click a checked out GPO and select Edit.
2
Click Launch Editor and make the required changes.
3
If required, select the Security tab and click Add or Remove to modify the current security filter. Enter or search for the required user, computer, or group, and click OK.
4
Click the Advanced button to select advanced permissions.
5
To add or remove a WMI filter, select the WMI Filter tab and choose a filter from the list of available WMI filters. Click OK.
* 
NOTE: You will only see the filters you have permission to access.
You now have the option to check in the GPO to be stored for later use or check in and request approval of the changes.
To check in and request approval
1
Expand the Version Control Root node and select the checked out GPO.
2
Right-click and select Check In.
3
Enter a comment and click OK.
4
Right-click the GPO and select Request Approval.
5
Enter a comment and click OK.
The GPO status will be Pending Approval until the changes are approved or rejected by a user with the appropriate permissions. When the GPO has been approved it is ready to be deployed into the live environment.

Best practices

Best practices

The following best practices exist within GPOADmin:

•
Deploying Cloaked GPOs
Before you deploy a GPO, ensure that it is not cloaked. If you deploy a cloaked GPO, and then later deploy it uncloaked, it will be flagged as non-compliant.
•
Forest Configuration
It is recommended that users who are members of the Enterprise Administrators group configure the forest for version control.
•
Client Installation
Users should be a local administrator on the computer where the client is installed.
•
Remote Forest Management
Although remote forest version control management options are available, it is recommended to manage a forest logged in as a user from the same forest to eliminate any additional trust and security-related considerations.
•
Storage Repository Placement
If using AD LDS or SQL as storage options it is recommended that they are located in the same forest that is being managed to eliminate any additional trust and security-related considerations. It is recommended that AD LDS is used as the configuration store, and a network share as the backup store.
•
Register/Unregister Actions
It is recommended that users who are members of the Enterprise Administrators group perform the register and unregister actions on GPOs within the Version Control system.
•
Naming Conventions
When creating GPOs within the Version Control system, it is possible to enter names that have already been used. However, it is highly recommended to use unique names. You enable the option to use unique names in the Server Properties Options tab.
•
Action Comments
Use descriptive comments to help others easily identify the reasons for performing actions within the Version Control system.
•
Deploying Changes
Ensure each object has the desired settings before approving and deploying any pending modification actions. Once the modification has been approved and deployed, the changes will be applied to the live object. 
•
GPO  Settings - Versions
When running in a mixed mode environment, newer GPO settings are not backwards compatible with older versions of GPMC. For example:
Preferences introduced in Windows Server 2008 are not backwards compatible.
•
Watcher Service
It is recommended that only one GPOADmin Watcher Service be installed per configuration store.
It is recommended that you not install the Watcher Service on a domain controller.
•
Migration Utility
A configuration utility is available that allows you to migrate the configuration store to SQL from an AD/ AD LDS. Before migrating the configuration store, Quest suggests that you test the migration to ensure that all objects migrate according to your specifications. To validate the migration, run the command with the /t option. This gathers all the information that will be committed to the SQL database but does not commit any changes.
•
Configuration Store Selection
The best practice is to use AD LDS as the configuration store. However, in large environments, SQL server is the recommended option. Quest uses the following criteria to define large environments:
•
Domains with more than 500 registered objects that run searches on a regular basis.
•
More than 500 registered containers.
•
Containers with objects nested more than 3 levels deep.
These are guidelines and should not be considered as an exhaustive list.
 
 
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating