Chat now with support
Chat with Support

GPOADmin 5.17 - User Guide

Introducing Quest GPOADmin Configuring GPOADmin Using GPOADmin
Connecting to the Version Control system Navigating the GPOADmin console Search folders Accessing the GPMC extension Configuring user preferences Working with the live environment Working with controlled objects (version control root)
Creating a custom container hierarchy Selecting security, levels of approval, and notification options Viewing the differences between objects Copying/pasting objects Proposing the creation of controlled objects Merging GPOs Restoring an object to a previous version Restoring links to a previous version Managing your links with search and replace Linking GPOs to multiple Scopes of Management Managing compliance issues automatically with remediation rules Validating GPOs Managing GPO revisions with lineage Setting when users can modify objects Working with registered objects Working with available objects Working with checked out objects Working with objects pending approval and deployment
Checking compliance Editing objects Synchronizing GPOs Exporting and importing
Creating Reports Appendix: Windows PowerShell Commands Appendix: GPOADmin Event Log Appendix: GPOADmin Backup and Recovery Procedures Appendix: Customizing your workflow Appendix: GPOADmin Silent Installation Commands Appendix: Configuring Gmail for Notifications Appendix: Registering GPOADmin for Office 365 Exchange Online Appendix: GPOADmin with SQL Replication About Us

Linking GPOs

Once GPOs have been created and configured, they must be linked to the appropriate sites, domain, or OU. Before you can link a GPO, you must register and check out the site, domain, or OU. For information on registering Scopes of Management, see Registering objects .

Users with the Link right can link a single GPO with numerous sites, domains, or OUs and link multiple GPOs to a site, domain, or OU. (For more information on setting permissions, see Configuring role-based delegation.)

The Link right grants the user the right to add, modify, and remove links. This right must exist on the GPO and the scope of management being linked.

The Modify Link Properties right grants the right to modify the Enabled and Enforce properties of a GPO Link. This right must exist on the scope of management.

The Edit right, grants the user the right to modify the Link order. This right must exist on the scope of management.

If you link more than one GPO, you must pay attention to their order. The first GPO has the highest precedence because it is processed last. The Link Report and Group Policy Results Report can help you understand the inheritance structure of your group policies.

* 
NOTE: The policies are applied according to the hierarchical structure of Active Directory. You can change the order in which the GPO is applied through the provided arrows.
NOTE: You must have the Link right on each GPO and SOM to which you wish to link.

By default, GPOs affect all users and computers contained within a linked site, domain, or OU. To refine the application of a GPO, see Editing GPOs .

To link GPOs to a single site, domain, or OU
1
Right-click a checked out site, domain, or OU and select Edit.
2
Click New Link to add another GPO.
3
Select the appropriate option to either Enable or Enforce the GPO link.
4
Enable Block Inheritance if required.
You must have the Block Inheritance for SoM links right to enable this option.
5
Click OK.
To link multiple GPOs to multiple sites, domains, or OUs
1
Right-click one or more GPOs and select Link.
Any SOMs that you want to link the GPOs to must be in the available state.
2
In the left pane of the Link dialog box, expand the domains and select the SOMs you want to link to.
3
In the right pane, ensure that the Add check box is selected for the GPOs you want to link.
4
Select the appropriate option to either Enable or Enforce the GPO link. You can use the arrows provided to modify the link order.
5
Click OK.

You can also rollback pre-existing links between GPOs and sites, domains, and OUs when restoring GPOs. For information, see Restoring links to a previous version and Checking compliance .

Synchronizing GPOs

Synchronizing GPOs allows you to automatically push out pre-defined “primary GPO” settings to specified targets both within a forest and between two forests. This allows you to ensure specific GPOs, which are required in every domain, contain the same settings without having to link to a GPO outside of the domain.

You will be able to select one or more GPOs from various domains as synchronization targets for the source GPO. When the source GPO has been successfully deployed, the settings from the last major backup will be imported into each synchronization target GPO.

* 
NOTE: If permissions between forests are not identical, a mapping table is also available to ensure that forest specific settings are covered.
•
Enabling synchronization
•
Working with GPO synchronizations
•
Generating Synchronized GPO report

Enabling synchronization

The ability to synchronize GPOs requires that:

•
It is enabled within the source domain.
•
The source GPO must be workflow-enabled to ensure that any changes can be propagated to the targets. (The targets, however, can be workflow-disabled.)
•
Targets are registered.
•
The source GPO has been deployed at least once.
•
Target synchronization settings are configured.
•
Each domain has a GPOADmin server. Child domains of a parent domain will appear in the client by default. Trusted siblings however will not.
•
The user performing a manual synchronization or setting the synchronization targets has the Synchronize right.
To enable GPO synchronization
1
Right-click the forest and select Options.
2
Select Options| General.
3
Select Enable Group Policy Object Synchronization.
4
Click OK.
Once this has been enabled, you can access the synchronization options by right-clicking a GPO in the Version Control Root and selecting Synchronize.

Working with GPO synchronizations

Keep the following in mind when working with synchronizations:

•
To synchronize during an immediate deployment (a non-scheduled deployment), the user deploying the GPO must have the Synchronize right.
•
The target settings will be overwritten with the settings from the source.
•
If a synchronization is attempted while a target GPO is checked out, the synchronization will fail.
•
If a target is off line, the synchronization will fail.
•
If the source GPO is out of compliance and either a ‘Rollback’ or ‘Incorporate Live’ compliance action will trigger a synchronization.
•
Communicate synchronizations plans to those responsible for GPO administration in other domains.
•
If GPO synchronization is enabled on a targeted GPOADmin server, ensure that the target GPO does not have the source GPO set as a synchronization target. Doing so will place the two GPOs in an endless synchronization loop.
•
When changing the service account, any existing GPO synchronization configuration should be reconfigured to ensure the proper password is used to connect to the target GPOADmin server.
•
All configuration options are available through menu options, right-click context menus, and the editor’s toolbar.
•
Selecting File | Exit closes the Synchronization Editor.
•
Select Edit | Select All allows you to select all the GPO targets listed in the editor.
To set up synchronization
1
In the Version Control Root, right-click the source GPO, and select Synchronize | Set Synchronization Targets.
This will open a dialog where you can add GPO targets and configure their synchronization settings. By default, the server that you are currently connected to will be displayed. It cannot be removed.
2
If required, select Add Servers to include other servers that contain the GPOs that you want to target. Select the server and click Connect. Enter the required credentials and click OK.
* 
NOTE: The credential entered will be stored and used to connect to the associated server during the synchronization process.This allows for the synchronization of GPOs between untrusted domains.
You can also select to remove any servers that have been added. If you do however, any target GPOs setup from this server for synchronization will also be removed.
3
Select the required GPOs and choose Synchronization | Add Synchronization Target to select the required target GPOs. The list of all available GPOs will display.
4
Select the required targets and click OK.
5
If required, we provide the option to setup a migration table by selecting the target and choosing Synchronization | Select Migration Table. From here, you can add (or remove), create, modify the migration tables that are going to be used during the synchronization using the Microsoft Migration Table Editor.
The migration tables, which are xml files, contain the mapping between the source and the target accounts to ensure they have the same access. If permissions are not an issue, the migration table would not be required. It is stored in C:\Program Files\Quest\GPOADmin\MigrationTables.
You are now ready to set the synchronization options.
6
Select the target and choose Synchronization to set the synchronization options. You can choose between the following:
•
Clear Migration table: Clear the tables when no longer required.
•
Use Migration Table Exclusively: If enabled, the migration (import operation) will not proceed if any settings security principals or UNC paths configured within the source GPO do not exist in the migration table.
•
Migrate Security Filters: Migrates any security principals from the security filter that are found in the migration table.
•
Target State: Select the state that you want the target to be in after the synchronization completes. You can choose between Available, Checked Out, Pending Approval, or Deployed. The default is Checked Out.
* 
NOTE: If a target state of Deployed is to be used, it is recommended that this account is a member of the GPOADmin Administrators as they are the only ones who can Approve multiple times.
•
Synchronize Deletions: Select to enable this option, if you want any deleted source GPOs to also be deleted in the target.
•
Set target WMI Filters: Select this option to synchronize WMI filters between domains. You can choose between the following options:
•
None: When you select this option, the WMI filter in the target GPO will not be updated. Use this option to disable previously set WMI Filter synchronizations.
•
Auto-map By Name: When you select this option, if a WMI Filter in the target domain is found with the same name as the WMI Filter linked to the source GPO, it is assigned to the target GPO.
•
Select WMI Filter: This opens a browser that lists all of the WMI Filters in the target domain where the connected account has access. From this list, select the WMI Filter to assign to the target GPO.
7
Once you have your targets set, it is recommended to validate the synchronization targets by selecting the target GPO and clicking Tools | Validate Synchronization Targets.
The synchronization targets are stored using their version control id and their display name. Over the course of time, the name may change or the object may be deleted. During the validation a connection to the target server is made and a check is performed to see if the synchronization target still exists or if the name has changed.
If there is an issue, the target will be displayed with warning icon and a tool-tip to inform you of the issue.
1
If you select to Cancel the editor, the warning will not persist.
2
If you select OK, the warning will remain to alert you that the issues must be addressed. When ready to address the issue, simply select the Correct button at the top of the dialog or right-click and select Correct.
To change the service account used to synchronize GPOs
1
In the Version Control Root, select the source GPO, and choose Synchronization | Set Synchronization Targets.
This opens a dialog that displays the GPO targets and their synchronization settings.
2
Select any one of the target GPOs, choose Tools | Update Credentials, and enter the new credentials.
To perform a manual synchronization
1
Right-click the source GPO and choose Synchronization | Synchronize Now.
This opens the Synchronization Progress dialog and allows you to perform a synchronization without redeploying the source GPO.
2
Select the GPOs to synchronize (or select all using Ctrl + A) and click Synchronize.
* 
NOTE: If nothing is selected, all items will be synchronized.
NOTE: You can also select a target and click the SynchSource header to select all the associated synchronization targets for that item.
The synchronization progress displays if the synchronization is pending, synchronizing, done, failed, or canceled.
* 
NOTE: If the synchronization fails, you can view the error by hovering over the faulted item. You can retry by selecting the Synchronize button again.
3
If required, you can select Export to export the data to a .csv file.
To validate the synchronization results
1
Right-click a GPO that has synchronization targets set and select Synchronize | Validate Synchronization Results.
OR
Right-click a GPO that has synchronization targets set and select Synchronize | Set Synchronization Targets. Then select one or more synchronization targets and choose Validate Synchronization Results.
The Difference report will run comparing each target to the last major version of the source GPO. Settings that do not match the source GPO are displayed as Out-Of-Sync. The Out-Of-Sync status remains until the settings are synchronized.
To retry the synchronization, right-click the out-of-sync targets and choose Synchronize Now.
To validate syncronization results for all synchronization targets
•
In the Version Control Root, select the source GPO, and choose Synchronization | Validate Synchronization Results.
This runs a comparison report comparing the last deployed version of the source GPO to each of the target GPOs. A warning icon is displayed on the tab of the targets that are out-of-sync.
To validate syncronization results for one ore more selected targets
1
In the Version Control Root, select the source GPO, and choose Synchronization | Validate Synchronization Results.
The Synchronization Target dialog displays the GPO targets and their synchronization settings.
2
Select one or more of the existing targets, and choose Tools| Validate Synchronize Results.
To synchronize to one or more individual targets from existing targets
1
In the Version Control Root, select the source GPO, and choose Synchronization | Set Synchronization Targets.
This opens the Synchronization Target dialog that displays the GPO targets and their synchronization settings.
2
Select one or more of the existing targets, and choose Synchronization | Synchronize Now.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating