Chat now with support
Chat with Support

GPOADmin 5.21 - User Guide

Introducing Quest GPOADmin Configuring GPOADmin Using GPOADmin
Connecting to the Version Control system Navigating the GPOADmin console Search folders Accessing the GPMC extension Configuring user preferences Working with the live environment Working with controlled objects (version control root)
Creating a custom container hierarchy Selecting security, levels of approval, and notification options Viewing the differences between objects Copying/pasting objects Proposing the creation of controlled objects Merging GPOs Restoring an object to a previous version Restoring links to a previous version Managing your links with search and replace Linking GPOs to multiple Scopes of Management Managing compliance issues automatically with remediation rules Validating GPOs Managing GPO revisions with lineage Setting the change window for specific actions Working with registered objects Working with available objects Working with checked out objects Working with objects pending approval and deployment
Checking compliance Editing objects Synchronizing GPOs Exporting and importing
Creating Reports Appendix: Windows PowerShell Commands Appendix: GPOADmin Event Log Appendix: GPOADmin Backup and Recovery Procedures Appendix: Customizing your workflow Appendix: GPOADmin Silent Installation Commands Appendix: Configuring Gmail for Notifications Appendix: Registering GPOADmin for Microsoft 365 Exchange Online Appendix: GPOADmin with SQL Replication About Us

Creating email templates

You can create a custom email template for notifications or email requests (if this option is enabled, see Configuring the Version Control server) and associate it with specific roles. This allows you to standardize the information that is presented to users based on their role within your organization.

You can choose to include attachments and custom subject lines for specified version control actions. For example, you can easily include forms used to track change requests in an external system, risk assessment checklist, or logs in the email.

* 
NOTE:  
•
Administration accounts must be explicitly added to the GPOADmin Administrators group in order for the email template assigned to the System Administrator Role to be used when sending notification to an administrator. You can set this option through the Access tab in the Version Control Options.
•
If notifications are not delivered, check the attachment filters on your mail server.
* 
NOTE: If required, you can modify the information generated by the Watcher Service by creating a new role specifically for it and then customizing an existing template or creating a new template to associate with it.

For example, to ensure that the Watcher Service or server name does not display in the notification message, remove the following section from the template html file:

<tr>

<td class="style3">
Detected on:
</td>
<td>
[MACHINENAME]
</td>

</tr>

The keyword MACHINENAME specifies the computer where Watcher Service is running.

GPOADmin includes a sample template (DefaultNotificationTemplate.html) in the server installation directory. This file should not be moved or modified; however, you can use it as a basis for the creation of new templates.

To select an email template for an existing role
1
Right-click the forest node, and select Options.
2
Select Delegation | Roles, select the require role, and click View Role.
3
Select the Email Template tab.
4
Click Browse to select the template to use for the selected role.
By default, the DefaultNotificationTemplate.html in the server install directory is used by the notification system if the specified custom template cannot be found.
If there are no templates displayed, click Add and browse to where the templates are located. The default template is located at C:\Program Files\Quest\GPOADmin.
5
Select the template and click OK.
6
Select the cost for this template.
If a user is a member of two or more roles which have subscribed to the same notification, the email template associated with the role with the lowest cost is the one used for that user.
For example, User A has subscribed to all event on Version Control Root. They are a member of the Moderators role set on the Version Control Root container and a member of the Administrators Role set on a child container When a version-controlled object is Checked-Out in the child container a notification is sent to them. GPOADmin determines that user A is a member of two roles. The cost that you have applied to the role tells the system which template to use when sending the notification. If the Moderators role has a lowest cost then the cost associated with the Administrators role, then the template associated with the Moderators role is used.
7
To select an attachment to include in the email, select the Attachments tab, click Add, select the action that triggers the attachment inclusion from the list, select the attachment to include by entering its location or browsing to it, and apply the changes.
* 
NOTE: You can optionally use any GPOADmin predefined tag in this field.
To further control the inclusion of attachments, you can use keywords. The attachment is only included if the specified keywords are present in the list of keywords on the version-controlled object.
Enter, enable, disable keywords as required. (Check an existing keyword to have it associated with this attachment and click to clear the keyword to exclude it.)
* 
NOTE: Any attachment with an empty keyword list would always be included for the associated action.
8
To include a subject in the email, select the Subject Lines tab, click Add, select the required action, enter the text that you want included in the Subject Line field, and apply the changes.
To further customize the subject line, you can use tags and keywords.
Tags allow you to include a very specific subject line. For example, if you select Type, Name, and Trustee Name from the drop down list (The “[TYPE] '[NAME]' has been checked in by [TRUSTEENAME]”), the resulting email for a GPO named Sales would be "The GPO 'Sales" has been checked in by domain\user".
Keywords allow you to include a set subject line when the specified keywords are present in the list of keywords on the version-controlled object.
9
Click OK.
10
Click Apply to associate the template.

Working with Protected Settings policies

Protected Settings policies contain settings that you want to control. They are protected in the sense that they contain and identify the settings that may not be altered by users. This provides an added level of security for the policies within your organization. If a user attempts to create, edit, or remove the flagged settings they are stopped.

Protected Settings are identified by examining the difference report between the Protected Settings policies and the Group Policy Object being checked in. The difference is produced by using the Difference Engine in GPOADmin. Once this is completed, the protected setting function searches the difference report for matches based on the specified validation mode.

Protected Settings policies have a modified workflow and follow the typical check-out, edit, and check-in process. As with any other object, when you are ready to make the newly created Protected Settings policy active or edit an existing policy, a request approval action must be initiated.

Once the approval is granted, the Protected Settings policy is available for use.

* 
NOTE: These policies differ from other GPOs in that they are not deployed to the environment.

If a protection issue is detected during check in, users with the Modify Protected Settings right on the GPO in question, have the option to continue with the check in and override the blocked setting or review a report and address the issue.

Protected settings must be:

•
Enabled within the domain
•
Created with the selected settings
•
Applied to the required container within GPOADmin
To enable Protected Settings for Group Policy Objects
1
Right-click the domain and select Options.
2
Select Options | General and select Enable Protected Settings for Group Policy Objects.
3
Click OK.
A new Protected Settings Root container is created to store and manage the Protected Settings policies deployed within your environment.

See also:

•
Rights and role for Protected Settings for GPOs
•
Create a Protected Settings policy
•
Generating Protected Settings policies reports
•
Using Protected Settings policies
•
Checking a GPO against a Protected Settings policies and blocked extensions
•
Validating a GPO against a Protected Settings policies and blocked extensions before a check-in

Rights and role for Protected Settings for GPOs

The Protected Settings for GPOs requires the following rights to control the actions of the Protected Settings tab on containers and provide the ability to export GPOs to create protected settings:

•
Block Protected Settings Inheritance
•
Export Group Policy Objects as Protected Settings Policies
•
Modify Protected Settings Assignments
•
Modify Protected Settings Exclusions
* 
NOTE: These rights are not available until the Protected Settings for Group Policy Objects is enabled through the server properties. See Working with Protected Settings policies .

These rights are automatically assigned to the System Administrator role when Protected Settings are enabled. No other roles, built in or otherwise, are given the Protected Settings rights. They must be assigned.

* 
IMPORTANT: Built-in roles cannot be modified, so if users require these rights then a new role must be created.
To create and assign the required role to the user responsible for managing containers and controlling the settings on the Protected Settings tab for containers
1
Create a role called Prot_All and assign rights listed above and the Read right to this role. No other rights are required for this role.
2
Right-click the Protected Setting container, and select the Security tab. Click Add and add the user who is going to manage the container. Give them the Prot_All role. Do not give them any other roles to the Protected Settings container. Select OK to apply the security changes.
3
Right-click the container that the user is to manage, and select Properties.
4
Select the Security tab, and click Add to add the user account. Give them the User (built-in) and the Prot_All roles. Click Apply and OK.
The user account now has the necessary rights to make all the required changes to the container.

To review why the above roles were created and assigned consider the following:

•
The Prot_All role gives the user the necessary rights to perform any of the Protected Settings functions and because they have the Read right, the user can see what is in the Protected Settings container but cannot change or add anything to the container. The ability to Read is needed so the user can assign a Protected Settings policy to a container or any sub containers being managed.
•
The User role is also given so the user can do the normal actions such as create, check out, edit, and check in a GPO in the container. The role Prot_All has the right, Export Group Policy Objects as Protected Settings policies. The user also needs the Create right which is part of the built-in User role.
Securing protected settings

Protected Settings policies can be further controlled by delegating who has permission to modify protected settings. To secure the protected settings, you can assign a role (that contains the “Modify Protected Settings” right) to a user on the Protected Settings policy. If during the validation process, GPOADmin determines the current user possess this right, the associated Protected Settings policy is excluded from the validation allowing the modification of those protected settings to proceed.

Create a Protected Settings policy

Once the ability to use Protected Settings has been enabled, you can create the policies using one of the following methods:

•
Create a policy directly from the Protected Settings container.
•
Export a GPO to the Protected Settings container.
•
Drag a GPO onto the Protected Settings container.
To create Protected Settings Policy from the Protected Settings container
1
Select the Protected Settings container in the tree view.
2
Right-click and select New | New Protected Settings Policy.
3
Enter a name for the policy. Quest recommends using a naming convention that sets these GPOs apart from other GPOs and make them easily identifiable as protected. For example, PROT_01.
4
Select the domain that the Protected Settings policy will be related to and click Next.
5
In the Settings page, edit the policy and configure the setting you want to protect.
* 
NOTE: You can elect to configure the settings later.
6
Click Finish.
The policy is identified as a Protected Setting Policy type and has the same icon as the Protected Settings container.
At this point, the Protected Settings policy is checked out and has a version of 0.0.
Protected Settings policies have a modified workflow and therefore require workflow processing such as requesting approval during creation.
To export a GPO to the Protected Settings container
1
In the Version Control Root, right-click the GPO you want to export, and select Protected Settings | Export as Protected Settings.
2
Select the version of the GPO you want to make as a Protected Settings policy, and click Next.
3
Review and confirm the version and GPO to export, and click Finish.
The selected GPO exports and then import into the Protected Settings container.
4
Refresh the Protected Settings container.
The newly imported GPO has the same name as the exported GPO. Best practice is to rename it using a naming convention that identifies it as protected. For example, PROT_01.
To create a Protected Settings policy through drag and drop
1
In the Version Control Root, select the GPO you want to use for a Protected Settings policy.
2
Drag it on the Protected Settings container.
The Export Wizard opens.
3
Select the version of the GPO you want to make as a Protected Settings policy, and click Next.
4
Review and confirm the version and GPO to export, and click Finish.
The selected GPO exports and then import into the Protected Settings container.
5
Refresh the Protected Settings container.
6
The newly imported GPO has the same name as the exported GPO. Best practice is to rename it using a naming convention that identifies it as protected. For example, PROT_01.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating