Chat now with support
Chat with Support

GPOADmin 5.21 - User Guide

Introducing Quest GPOADmin Configuring GPOADmin Using GPOADmin
Connecting to the Version Control system Navigating the GPOADmin console Search folders Accessing the GPMC extension Configuring user preferences Working with the live environment Working with controlled objects (version control root)
Creating a custom container hierarchy Selecting security, levels of approval, and notification options Viewing the differences between objects Copying/pasting objects Proposing the creation of controlled objects Merging GPOs Restoring an object to a previous version Restoring links to a previous version Managing your links with search and replace Linking GPOs to multiple Scopes of Management Managing compliance issues automatically with remediation rules Validating GPOs Managing GPO revisions with lineage Setting the change window for specific actions Working with registered objects Working with available objects Working with checked out objects Working with objects pending approval and deployment
Checking compliance Editing objects Synchronizing GPOs Exporting and importing
Creating Reports Appendix: Windows PowerShell Commands Appendix: GPOADmin Event Log Appendix: GPOADmin Backup and Recovery Procedures Appendix: Customizing your workflow Appendix: GPOADmin Silent Installation Commands Appendix: Configuring Gmail for Notifications Appendix: Registering GPOADmin for Microsoft 365 Exchange Online Appendix: GPOADmin with SQL Replication About Us

Change approval process

All changes made within the Version Control system are not rolled out into the online Active Directory environment until assigned users approve and deploy them.

You can enforce a multi-approval process at the container and object level so that all changes made to the live production environment are approved by all approvers. Ensuring the approval process uses the combined agreement of multiple approvers rather than just one provides better security.

Deploying changes within the system is a critical process that affects the live environment. To minimize the impact of disruption, perform this when the impact to users is minimal as the changes to the GPO might alter the behavior of particular systems.

To avoid any issues, you can schedule the deployment of the changes for a specific date and time that best suits your needs.

For detailed information, see Approving and rejecting edits and Deploying objects (scheduling and associated items) .

Role-based delegation

GPOADmin users can create and define roles that consist of a set of roles to perform actions on the Version Control system. These roles can delegate users-specific access to resources within the system. GPOADmin includes predefined built-in roles (Moderator, System Administrator, and User), and granular roles users can define through a custom role. For a list of roles, see Configuring role-based delegation.

For more information, see Configuring the Version Control server and Configuring role-based delegation .

Table 1. Custom s
 
Users with this can...

Version Controlled Objects
•
Block Inheritance for SoM links
•
Cloak/Uncloak
•
Compliance Action
•
Create
•
Delegate Security
•
Delete
•
Delete links outside of workflow
•
Deploy
•
Edit
•
Edit Lineage
•
Enable and Disable Workflow
•
Export
•
Label
•
Link
•
Lock/Unlock
•
Modify Approval Workflow
•
Modify Keywords
•
Modify Managed By
•
Modify System-Provided Security
•
Modify Security Filter
•
Read
•
Register
•
Run Contextual Reports
•
Run Reports
•
Set Remediation Rules
•
Synchronize
•
Undo Check-out
•
Unregister
•
View Cloaked

Version Control Containers
•
Create Subcontainers
•
Delegate Container Security
•
Delete Container
•
Rename Container

Protected Settings

 
•
Block Protected Settings Inheritance
•
Export Group Policy Objects as Protected Settings Policies
•
Modify Protected Settings
•
Modify Protected Settings Assignments
•
Modify Protected Settings Baseline Assignments
•
Modify Protected Settings Exclusions

Notification system

GPOADmin contains a rich notification system that allows users to control a wide variety of Version Control events, sending details by email as the events occur.

Users can subscribe to the notification service, which is based on a granular defined event trigger such as Register, Check In, Create, and Delete for each object under the Version Control system. For approve and reject notifications, the email includes information on who was the last to approve any changes and the date of the last approved change.

Reports are included in notification emails when more details are required. For example, check-in notifications come with a settings report (to show the settings that were checked in) and a difference report (to show the differences between this version and the last version).

In addition, Administrators can delegate notifications to users who do not use GPOADmin, but who for business reasons, must be notified when an object is created, modified, or deleted.

For detailed information, see Selecting events on which to be notified, Adding notifications for users, and Configuring user preferences.

GPO ACL editor

A security group, user, or computer must have both Read and Apply Group Policy permissions for a policy to be applied. By default, all users and computers have these permissions for all new GPOs. They inherit these permissions from their membership in the group Authenticated Users. In GPOADmin, aside from changing the Security Filter, you can also manage the permissions of a particular group. For example, if you do not want a GPO applied to a group of users you can easily configure the permission on a particular GPO (“Deny Apply Group Policy”) so that it is not applied to the group of users.

For more information, see Selecting security, levels of approval, and notification options .

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating