Chat now with support
Chat with Support

GPOADmin 5.18 - User Guide

Introducing Quest GPOADmin Configuring GPOADmin Using GPOADmin
Connecting to the Version Control system Navigating the GPOADmin console Search folders Accessing the GPMC extension Configuring user preferences Working with the live environment Working with controlled objects (version control root)
Creating a custom container hierarchy Selecting security, levels of approval, and notification options Viewing the differences between objects Copying/pasting objects Proposing the creation of controlled objects Merging GPOs Restoring an object to a previous version Restoring links to a previous version Managing your links with search and replace Linking GPOs to multiple Scopes of Management Managing compliance issues automatically with remediation rules Validating GPOs Managing GPO revisions with lineage Setting the change window for specific actions Working with registered objects Working with available objects Working with checked out objects Working with objects pending approval and deployment
Checking compliance Editing objects Synchronizing GPOs Exporting and importing
Creating Reports Appendix: Windows PowerShell Commands Appendix: GPOADmin Event Log Appendix: GPOADmin Backup and Recovery Procedures Appendix: Customizing your workflow Appendix: GPOADmin Silent Installation Commands Appendix: Configuring Gmail for Notifications Appendix: Registering GPOADmin for Office 365 Exchange Online Appendix: GPOADmin with SQL Replication About Us

Creating Group Policy Objects (GPOs)

Users with the appropriate permission can propose the creation of a GPO that does not currently exist in the enterprise environment and have it placed within the Version Control system. If you have starter GPOs within your version control system, you can select one to use as a basis for a new GPO.

When you create a GPO as Workflow Disabled, you are creating it in the context of the user you are logged in as. This GPO sits immediately in the live environment.

* 
NOTE: To work with and edit workflow disabled GPOs, you must have the GPMC Edit, Delete, and Modify Security right as well as the DeleteSubtree right.

When you create a GPO as Workflow Enabled, you create it in the context of the GPOADmin Service Account and this GPO sits awaiting deployment. Once deployed, it sits in the live environment.

To propose the creation of a GPO in the GPOADmin console
1
Expand the Version Control Root node, right-click the required container, and select New | Group Policy Object.
2
Enter a name and select the location for the GPO and click Next.
3
If required, select the Starter GPOs to use as a basis for this new GPO.
4
Click Launch Editor.
5
Make the required edits to the new GPO and close the Group Policy Editor.
6
Modify any additional GPO settings if required and click Next.
7
If required, click Add, enter security filters, and click Next.
8
If required, select WMI filters to apply, and click Finish.
When you make edits and check the GPO in, the version will be updated to version 0.1. This number will increase by.1 until you select to Check In and Request Approval. At this point the GPO is not live.
Once you complete your edits, you can select Check In and Request Approval. If approved and deployed, the new GPO will become available with a version number of 1.0. For more information on the approval and deployment process, see Requesting approval and Deploying objects (scheduling and associated items) .
Users with the delegated rights, can link registered GPOs to Scopes of Management (Sites, Domains, and Organizational Units) and add WMI Filters. For more information about linking GPOs, see Linking GPOs . For information about adding WMI Filters, see Creating WMI filters and Creating Group Policy Objects (GPOs) .
To propose the creation of a GPO in the GPMC Extension
1
Right-click in any blank area of the GPO Management pane and choose New | Group Policy Object.
2
Enter a name and select the location for the GPO and click Next.
3
If required, select the Starter GPOs to use as a basis for this new GPO.
4
Click Launch Editor.
5
Make the required edits to the new GPO and close the Group Policy Editor.
6
Modify any additional GPO settings if required and click Next.
7
If required, click Add, enter security filters, and click Next.
8
If required, select WMI filters to apply, and click Finish.

Creating starter GPOs

Starter GPOs include a collection of Administrative Template policy settings in a single object. They are useful when you want to distribute a GPO with specific settings to other environments. When you create a new GPO from a starter GPO, it inherits all of the Administrative Template policy settings and values of the starter GPO.

There are 2 type of starter GPOs:

•
User-defined starter GPOs which are editable.
•
System starter GPOs which are read-only and provide a baseline of GPO settings.
* 
NOTE:  
•
The Starter GPOs folder is not created by default. To create the Starter GPOs folder, open Group Policy Manager, expand the required Domain | Starter GPOs, and click Create Starter GPOs Folder.|
•
Starter GPOs created within GPOADmin do not set the Initiator UserName and EventSource fields in Change Auditor.
To create a user-defined starter GPO
1
Expand the Version Control Root node, right-click the required container, and select New | Starter GPO.
2
Enter a name and location for the starter GPO, and click Next.
3
Click Launch Editor.
4
Make the required edits to the starter GPO and close the Group Policy Starter GPO Editor and click Finish.
When you make edits and check the starter GPO in, the version will be updated to version 0.1. This number will increase by.1 until you select to Check In and Request Approval. At this point the starter GPO is not live.
Once you complete your edits, you can select Check In and Request Approval. If approved and deployed, the new starter GPO will become available with a version number of 1.0. For more information on the approval and deployment process, see Requesting approval and Deploying objects (scheduling and associated items) .

Creating WMI filters

Using Windows Management Instrumentation (WMI) filters, you can control where GPOs are applied based on the attributes of a target computer.

The WMI filter associated with the GPO is processed on the target computer. The query, in the WMI filter that is linked to a GPO, is evaluated on the target computer.

For example, your filter may be “Select computers that have a processor speed higher than 2 GHz”. If the target computer meets the criteria, the GPO is applied. If not, the GPO is not applied.

* 
NOTE: The WMI filter and the GPO to which it is linked to must be in the same domain.
To propose the creation of a WMI filter
* 
NOTE: WMI filters must be created using the GPOADmin console.
1
Expand the Version Control container where you want to place the new WMI filter.
2
Right-click and select New | WMI Filter.
3
Enter a name for the new WMI filter.
4
Select a domain in which the WMI filter will be created, add a description if required, and click Next.
5
Select a Root Namespace (default: root\CimV2) and enter a valid WQL (Windows Query Language) string in the Query field.
You must have at least one query associated with a WMI Filter to continue.
6
To add an additional query to the filter, select New Query, and specify the Root Namespace and Query as described in Step 5.
7
To delete a query, click the “x” button next to the query in the list.
8
Click Finish.
The WMI Filter must go through the approval and deployment process before it can be applied.For further information, see Requesting approval and Deploying objects (scheduling and associated items) .

Creating scripts

Logon, logoff, Startup and Shutdown scripts contained in the SYSVOLS Scripts folder (and its subfolders) can be registered and will be detected by the Watcher Service and reported as non-compliant.

Users with the appropriate permission can propose the creation of a script that does not currently exist in the enterprise environment and have it placed within the Version Control system.

To propose the creation of a script:
1
Right-click the Version Control container and select New | Script.
2
Enter a descriptive name and domain where the script will be used.
3
Select where you want to deploy the script and click Finish.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating