Chat now with support
Chat with Support

GPOADmin 5.21 - User Guide

Introducing Quest GPOADmin Configuring GPOADmin Using GPOADmin
Connecting to the Version Control system Navigating the GPOADmin console Search folders Accessing the GPMC extension Configuring user preferences Working with the live environment Working with controlled objects (version control root)
Creating a custom container hierarchy Selecting security, levels of approval, and notification options Viewing the differences between objects Copying/pasting objects Proposing the creation of controlled objects Merging GPOs Restoring an object to a previous version Restoring links to a previous version Managing your links with search and replace Linking GPOs to multiple Scopes of Management Managing compliance issues automatically with remediation rules Validating GPOs Managing GPO revisions with lineage Setting the change window for specific actions Working with registered objects Working with available objects Working with checked out objects Working with objects pending approval and deployment
Checking compliance Editing objects Synchronizing GPOs Exporting and importing
Creating Reports Appendix: Windows PowerShell Commands Appendix: GPOADmin Event Log Appendix: GPOADmin Backup and Recovery Procedures Appendix: Customizing your workflow Appendix: GPOADmin Silent Installation Commands Appendix: Configuring Gmail for Notifications Appendix: Registering GPOADmin for Microsoft 365 Exchange Online Appendix: GPOADmin with SQL Replication About Us

Protecting policy settings based on extensions

If required, you can prevent users from editing policy settings based on one or more policy extensions. Once you have selected the extension to block, if a policy contains any settings from the extension, the policy will fail the validation test and will not be checked in.

* 
NOTE: A blocked extension overrides allowed settings in a Protected Settings policy.
NOTE: The Modify Protected Settings right is required to block file extensions using a Protected Settings policy.

Available extensions include:

•
All Computer Extensions
•
All User Extensions
•
Advanced Audit Configuration
•
Application Control Policies
•
Central Access Policy
•
Data Sources
•
Deployed Printer Connections Policy
•
Devices
•
Disk Quota
•
Drive Maps
•
Environment Variables
•
Files
•
Folder Options
•
Folder Redirection
•
Folders
•
Ini Files
•
Internet Explorer Maintenance
•
Internet Settings
•
IP security
•
Wired Network Policies
•
Local Users and Groups
•
Name Resolution Policy
•
Network Access Protection Client Management
•
Network Options
•
Network Shares
•
Policy-based QoS
•
Power Options
•
Printers
•
Public Key
•
Regional Options
•
Administrative Templates
•
Remote Installation
•
Scheduled Tasks
•
Scripts
•
Security
•
Services
•
Shortcuts
•
Software Installation
•
Software Restriction
•
Start Menu
•
Windows Firewall
•
Windows Registry
•
Wireless Network Policies
To block specific extensions
1
Right-click the required object or container and select Properties.
2
Select the Protected Settings tab and the Blocked Extensions tab.
3
Click to select the extensions that you want to block and click Apply.

Generating Protected Settings policies reports

The following reports are available for Protected Settings policies: Latest, Working Copy, and Differences reports.

To generate a report
1
Select the Protected Settings Root container in the tree view.
2
Right-click the Protected Settings Policy, and select Reports.
3
Select the type of report to run.
* 
NOTE: When a Protected Settings policy is used in GPOADmin, a separate report is generated by the protection process and is generated when the comparison is made between a Protected Settings policy and a GPO.

Using Protected Settings policies

Once Protected Settings policies have been enabled through the Version Control properties and created they need to be applied to a container in GPOADmin.

This is done through new option on all containers that becomes available when the Enable Protected Settings for Group Policy Object is enabled.

To apply a Protected Settings policy
1
Right-click a container and select Properties.
2
Select the Protected Settings tab.
3
Select the Add button.
4
Select the policy to apply and click OK.
The selected protected policy displays in the Assigned Protected Settings policy window with the default validation rule.
* 
NOTE: Inherited policies are displayed as disabled.
5
Select the validation rule that will be used to detect if a user is attempting to use or alter a protected setting, and choose to base it on Settings or a Value.
If you selected Value from the drop-down list, you can now choose the items to check. Select from the following:
None: Items that exist in the policy that do not exist in the Protected Settings Policy are ignored.
User Rights Assignment: Items that exist under the User Rights Assignment in the policy that do not exist in the Protected Settings Policy are included in the validation process and are flagged as Invalid.
All: Items that exist in the policy that do not exist in the Protected Settings Policy are included in the validation process and are flagged as Invalid
A check is made for any similarities between the Protected Settings policy and the GPO being checked in. This can be either based on the settings name or value.
a
Settings defined in the Protected Settings policy are not allowed: If a setting with the same name as a setting in the protected policy is detected in an active GPO, notification is generated. The value does not have to be the same for the setting, just the setting name.
b
Values other than those defined in the Protected Settings policy are not allowed: If there is a setting used in the active GPO that has a value different than the protected value, then a notification is generated.
6
To block the Protected Settings from the parent container, select the Block Protected Settings Inheritance setting. You may want to do this as this container needs a unique protected setting and the setting from the parent would conflict with the new settings being applied.
7
Exclusions can be set for any GPO in the container which may contain protected settings. This allows specific GPOs to be excluded from any protected setting checking. Place a tick in the check box for any of the listed GPOs that you want to exclude from the Protected Settings policy.
8
If necessary, select Include Group Policy Objects in all child containers to allow the checking of all child containers against the assigned protected settings policy.
* 
NOTE: Because there can be GPOs with the same name in GPOADmin, the path of the GPO is also listed to ensure that you select the correct GPO for exclusion.
9
Once you are satisfied with your selections, click Apply and then OK.

Checking a GPO against a Protected Settings policies and blocked extensions

A GPO that resides in a container with Protected Settings enabled will be checked against the protected settings policy when the GPO is checked in using Check-In.

During a check-in, the GPO is checked against the Protected Settings policy and any blocked extensions. Users that have the Modify Protected Settings right on the GPO in question, will have the option to continue with the check in and override the blocked setting or review a report and address the issue.

The report displays with the associated Protected Settings policies and blocked extensions, how many matches were found, and the Validation mode (either setting name or value).

* 
NOTE: The GPO remains checked out until the issue with the Protected Settings policy is rectified and the GPO passes the check.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating