Chat now with support
Chat with Support

GPOADmin 5.17 - User Guide

Introducing Quest GPOADmin Configuring GPOADmin Using GPOADmin
Connecting to the Version Control system Navigating the GPOADmin console Search folders Accessing the GPMC extension Configuring user preferences Working with the live environment Working with controlled objects (version control root)
Creating a custom container hierarchy Selecting security, levels of approval, and notification options Viewing the differences between objects Copying/pasting objects Proposing the creation of controlled objects Merging GPOs Restoring an object to a previous version Restoring links to a previous version Managing your links with search and replace Linking GPOs to multiple Scopes of Management Managing compliance issues automatically with remediation rules Validating GPOs Managing GPO revisions with lineage Setting when users can modify objects Working with registered objects Working with available objects Working with checked out objects Working with objects pending approval and deployment
Checking compliance Editing objects Synchronizing GPOs Exporting and importing
Creating Reports Appendix: Windows PowerShell Commands Appendix: GPOADmin Event Log Appendix: GPOADmin Backup and Recovery Procedures Appendix: Customizing your workflow Appendix: GPOADmin Silent Installation Commands Appendix: Configuring Gmail for Notifications Appendix: Registering GPOADmin for Office 365 Exchange Online Appendix: GPOADmin with SQL Replication About Us

Cloaking a GPO

Cloaking allows you to hide Group Policy Objects (GPOs) from other users. The Cloaking role is not a default role installed with the product, and must be created with the Cloak/Uncloak and View Cloaked rights. By default, Domain Administrators can see all cloaked GPOs.

When a GPO is cloaked using GPOADmin, it is also cloaked in the live environment. Only users with the Cloak/Uncloak or View Cloaked right can see the GPO in the live environment. A cloaked GPO will only be applied to users who have the Cloak/Uncloak or View Cloaked right during group policy processing. All other users will no longer have the GPO applied.

Cloaked GPOs are indicated by a lighter GPO icon.

* 
NOTE: Only GPOs can be cloaked. (You cannot cloak WMI Filters or Scopes of Management).
 
To cloak a GPO using the GPOADmin console
1
Select the GPO you want to cloak from the list of GPOs within the Version Control Root node.
2
Right-click and select Cloak.
Cloaked GPOs are displayed in the Cloaked search folder. Enter a comment and click OK.
* 
NOTE: Users can also have the View Cloaked right only. This means that they can see cloaked GPOs but do not have permission to "uncloak" them. Cloaked GPOs can be viewed in the Search Folders in the GPOADmin console.
To cloak a GPO using the GPMC Extension
1
Select the GPO you want to cloak from the list of GPOs and click Cloak.
2
Enter a comment and click OK.

Locking a GPO

Locking allows you to lock a policy so other users cannot edit it. The Locking role has to be created and consists of the Lock/Unlock right. For example, you may choose to lock the Default Domain Policy and/or Default Domain Controller Policy as any modification to these settings would affect every GPO in the organization.

When a GPO is locked using GPOADmin, it is also locked in the live environment. All users can see the GPO, but no one can edit it.

By default, Domain Administrators can see all locked GPOs and unlock any locked GPO. Locked GPOs are indicated by a lock icon.

* 
NOTE: Only GPOs can be locked. (You cannot lock WMI Filters or Scopes of Management).
To lock a GPO using the GPOADmin console
1
Select the GPO you want to lock from the list of GPOs within the Version Control Root node.
2
Right-click and select Lock.
Locked GPOs are displayed in the Locked search folder.
* 
NOTE: When a user with the right to lock GPOs connects to the GPOADmin console, they will see all locked GPOs. A Locked GPO must be unlocked before any actions can be performed (even if you are a system administrator.) Locked GPOs can be viewed in the Search Folders in the GPOADmin console.
3
Enter a comment and click OK.
To lock a GPO using the GPMC Extension
1
Select the GPO you want to lock from the list of GPOs and click Lock.
2
Enter a comment and click OK.

Establishing Management for an Object

If you have the Modify Managed By right, you can set the user responsible for an object’s management.

* 
NOTE: The Managed By property is a textual field which can be used to sort objects by and as no affect on the objects security.
To set or change the user responsible for an object’s management
1
Expand the Version Control Root node, and select an object.
2
Right-click and select Managed By.
3
Enter or browse for the required account and click OK.
You can also assign management on a container by right-clicking on it an selecting Properties and selecting the required account.
 
* 
NOTE: Any child containers or objects below this container that do not have a managed assigned to them will automatically use this one.

Viewing history

Viewing history

You can easily create a report that displays the historical settings for objects in the Version Control system or a comparison of versions. When you view the history in the GPMC Extension, all events are shown. The GPOADmin console has a filter option that you can use to choose which events to display.

To view the history using the GPOADmin console
1
Expand the Version Control Root node, and the required container.
2
Right-click an object and select Show History.
3
Select a version in the list.
4
Select which, if any, filtering options you would like to apply, then right-click, and select View to view the historical information.
5
To view the difference between various check ins, select the required versions, right-click and select Differences.
6
Click Print to print the report.
Click Save As to save the report in HTML.
7
Click Close.
* 
NOTE: You can also restore links between a GPO and its Scopes of Management from the history view. For more information, see Restoring links to a previous version .
To view the history using the GPMC Extension
1
Select the GPO and click Show History.
The history displays in the bottom pane of the GPO Management tab. You will see the name, version, action, account, date and comment pertaining to the history item.
2
To view the difference between various check ins, select the required versions, right-click and select Differences.
3
Click Print to print the report.
Click Save As to save the report in HTML.
4
Click Close.

For more information on the available reports, see Creating Reports .

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating