Chat now with support
Chat with Support

GPOADmin 5.21 - User Guide

Introducing Quest GPOADmin Configuring GPOADmin Using GPOADmin
Connecting to the Version Control system Navigating the GPOADmin console Search folders Accessing the GPMC extension Configuring user preferences Working with the live environment Working with controlled objects (version control root)
Creating a custom container hierarchy Selecting security, levels of approval, and notification options Viewing the differences between objects Copying/pasting objects Proposing the creation of controlled objects Merging GPOs Restoring an object to a previous version Restoring links to a previous version Managing your links with search and replace Linking GPOs to multiple Scopes of Management Managing compliance issues automatically with remediation rules Validating GPOs Managing GPO revisions with lineage Setting the change window for specific actions Working with registered objects Working with available objects Working with checked out objects Working with objects pending approval and deployment
Checking compliance Editing objects Synchronizing GPOs Exporting and importing
Creating Reports Appendix: Windows PowerShell Commands Appendix: GPOADmin Event Log Appendix: GPOADmin Backup and Recovery Procedures Appendix: Customizing your workflow Appendix: GPOADmin Silent Installation Commands Appendix: Configuring Gmail for Notifications Appendix: Registering GPOADmin for Microsoft 365 Exchange Online Appendix: GPOADmin with SQL Replication About Us

Checking in controlled objects

Once you have checked out an object and edited its settings (for more information, see Editing objects ), you have the option to:

•
Check in objects in their temporary state for further updates
•
Check in objects and notify Approvers that it is ready to be approved or rejected (For more information, see Requesting approval .)
•
Undo the check out (For more information, see Undoing a check out .)

A check in updates the history of the object within the Version Control system with the changes made while it was checked out. Included with any check-in is a comment and a unique minor version number (such as 1.1).

A check in does not allow the offline changes to go live into the enterprise environment as it must first be approved. Once an object is marked as Pending Approval, it cannot be checked out by any other user of the system.

Multiple check in and check outs are allowed to occur within the system without requiring approval. When a user checks in an object so it is available to another system user, the next user to check out the same object will be working with the current offline version consisting of all changes made to date. After all the users have made their required changes to the offline object it is processed by the approval system to determine if the changes are accepted to go live into the enterprise or not.

To check in an object using the GPOADmin console
1
Expand the Version Control Root node and the required container.
2
Right-click an object and select Check In.
3
Enter a comment if required and click OK.
If the GPO settings are flagged as being protected, users with the Modify Protected Settings right on the GPO in question, have the option to continue with the check in and override the blocked setting or review a report and address the issue. For details on protected settings, see Working with Protected Settings policies.
4
Right-click and select Request Approval if required. Enter a comment and click OK.
To check in a GPO using the GPMC Extension
1
Select the GPO and click Workflow | Check In.
2
Enter a comment if required and click OK.
3
Click Workflow | Request Approval if required. Enter a comment and click OK.

Working with objects pending approval and deployment

Only users with the Deploy permission can make the changes go live in the enterprise. The approval system safeguards the enterprise environment from any unauthorized live changes that could cause unwanted results. For more information on delegating permissions, see Configuring role-based delegation.

The types of requests from users that require approval are

•
Changes to offline objects that are required to go live
•
Creation of new objects
•
Deletion of existing objects
* 
NOTE: Using the Export Wizard, you can test GPOs offline before they are implemented in the live enterprise. For more information, see Exporting and importing .
NOTE: You can view a list of all objects Pending Deployment or Approval in the Search Folders in the GPOADmin console.

For more information, see:

•
Enhanced workflow approval
•
Changing the approval workflow
•
Withdrawing an approval request
•
Approving and rejecting edits
•
Deploying objects (scheduling and associated items)
* 
NOTE: User or groups added as an approver must have Read access on the object requiring approval. Validate and set the appropriate access through the Security tab.

Withdrawing an approval request

Any user who proposes a change to an object can withdraw their own request for approval while the change is in the Pending Approval state.

To withdraw an approval request in the GPOADmin console
1
Right-click an object in the Pending Approval state, and select Withdraw Approval Request.
2
Click OK.
The object is returned to the Available state.
3
Enter a comment and click OK.
To withdraw an approval request in the GPMC Extension
1
Select a GPO in the Pending Approval state, and click Workflow | Withdraw Approval Request.
2
Enter a comment and click OK.

Enhanced workflow approval

You have the option of implementing a further safeguard by designating and modifying multi-level approvers. With this option, the required approvals at all levels must be granted before an object becomes available for deployment in the live environment.

Not everyone in a named group has to approve, just the required number. For example there may be 10 members in Group B but we may require only 3 approvals from that group to satisfy our requirements.

When you create a role within GPOADmin, you now have the option of empowering that role with the Modify Approval Workflow permission.

To grant Modify Approval Workflow permission
1
Select the forest node, right-click and select Properties.
2
Open the Roles tab and select Add New Role.
3
Type the name of the new role and click Next.
4
Scroll down the list of permissions and select the Modify Approval Workflow check box.
5
Once you have granted all relevant permissions, click Finish, click Apply and then OK.
* 
NOTE: You can view an existing role’s rights by selecting the role, selecting View Role, opening the Rights tab, and noting the permissions that have been grated.

Use caution granting this permission. A user with this permission can add, modify or delete the approval workflow a requested change must follow before it modifies the live environment.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating