立即与支持人员聊天
与支持团队交流

GPOADmin 5.19 - User Guide

Introducing Quest GPOADmin Configuring GPOADmin Using GPOADmin
Connecting to the Version Control system Navigating the GPOADmin console Search folders Accessing the GPMC extension Configuring user preferences Working with the live environment Working with controlled objects (version control root)
Creating a custom container hierarchy Selecting security, levels of approval, and notification options Viewing the differences between objects Copying/pasting objects Proposing the creation of controlled objects Merging GPOs Restoring an object to a previous version Restoring links to a previous version Managing your links with search and replace Linking GPOs to multiple Scopes of Management Managing compliance issues automatically with remediation rules Validating GPOs Managing GPO revisions with lineage Setting the change window for specific actions Working with registered objects Working with available objects Working with checked out objects Working with objects pending approval and deployment
Checking compliance Editing objects Synchronizing GPOs Exporting and importing
Creating Reports Appendix: Windows PowerShell Commands Appendix: GPOADmin Event Log Appendix: GPOADmin Backup and Recovery Procedures Appendix: Customizing your workflow Appendix: GPOADmin Silent Installation Commands Appendix: Configuring Gmail for Notifications Appendix: Registering GPOADmin for Office 365 Exchange Online Appendix: GPOADmin with SQL Replication About Us

Editing GPOs

Editing GPOs

Once you have a GPO checked out, you can edit its settings within the Group Policy Editor, create security and WMI filters, and enable/disable computer and user settings.

* 
NOTE: The editor will first attempt to be launched as the user logged into GPOADmin. If that fails, you need to select to Run As and specify credentials of a user who has access to GPMC.

Because you can only link GPOs to sites, domains, and OUs, setting up security filters helps you to refine the application of GPO settings to a group, user, or computer.

* 
NOTE: The users and computers that you select while setting up security filtering must have both Read and Apply Group Policy (AGP) permissions on the GPO.

When you check out a GPO, the changes you make are to a copy of the live GPO. The changes that you make do not affect the GPO settings in the enterprise until it is approved and deployed.

See also Removing persistent registry settings.To edit GPO settings
1
Right-click a checked out GPO, and select Edit.
2
Click Launch Editor, make the required changes, and close the Group Policy Editor.
When you register GPOs, the GPO status (Enabled/Disabled Computer and User settings) will be maintained. However, if required, you can also easily change these settings from within the Version Control system.
3
Select or clear the user and computer setting options as required.
4
If required, select the Security tab and click Add, enter or search for the required user, computer, or group, and click OK.
To change the current security filters, select the required entry, and click Remove.
5
Click the Advanced button to select advanced permissions.
* 
NOTE: This option will only be available to those with the Administrator role or users who have been assigned both the Modify Security Filter and Modify System-Provided Security rights.
6
To link the GPO to a pre-existing WMI filter in the domain, select the WMI Filter tab and choose the filter from the list.
* 
NOTE: You will only see the filters you have permission to access.
Upon approval the link will be added to the GPO.
To remove any existing WMI filtering select None.
If the GPO was previously linked to a WMI filter, the GPO will be unlinked from the filter upon approval.
7
Click OK.
You now have the option to check in the GPO to be stored for later use or check in and request approval of the changes. See Checking in controlled objects and Requesting approval for more information.

Removing persistent registry settings

Some GPO settings create registry entries when they are processed. When these settings are removed and the policy is processed, their corresponding registry entries may not be removed from client computers.

GPOADmin notifies you when potentially persistent registry values exist and allows you to remove them.

* 
NOTE: Because this option removes registry data when the policy is processed, you must take care to ensure that you do not remove settings set by other policies.
To remove these settings
1
Right-click a checked out GPO, and select Edit.
2
Click the Registry Cleanup button.
The registry settings that persist as a result of removing GPO settings will display. Settings that are unavailable will never persist as the Group Policy processing engine resets these settings before processing the GPO.
3
Select the registry settings that you want to remove when the policy is re-processed, and click OK.

Editing Intune objects (Configuration profiles and Compliance policies)

Once you have a Intune objects checked out, you can edit its settings and select the user or device group to receive the profile and policies.

* 
NOTE:  
•
See the Quick Start Guide for the required minimum permissions, rights, and roles.
•
GPOADmin does not support:
•
iOS/iPadOS Security Assessment (Education) template from Intune Configuration profiles.
•
Settings Catalog for Intune Configuration profiles.
•
Certificate references for Intune Configuration profiles.
To edit Intune objects and assignments
1
Right-click a checked out Intune object, and select Edit.
2
From the Settings tab, click Launch Editor.
3
Update the settings and save your changes. For information on assigning groups, refer to Microsoft documentation.
4
Select the Assignments tab to include and exclude users and device groups from the selected Intune object.
* 
NOTE: The Modify Intune Assignments right is required to edit the Intune object assignment. For more information see Configuring role-based delegation.
5
Clicking Add or Remove opens the Azure AD Groups dialog where you can select the required groups. You have the option of locating groups by entering their name in the search bar. Groups that have been previously added display as disabled. For information on assigning groups, refer to Microsoft documentation.
6
Click OK. You now have the option to check in the edited Intune object settings. See Checking in controlled objects for more information.

Editing WMI filters

* 
NOTE: You must edit WMI filters using the GPOADmin console.
To edit a WMI filter
1
Expand the Version Control Root and the required container. Select the WMI filter you want to edit within the version control container node in which it exists.
2
Right-click the WMI filter and select Edit.
3
Edit the settings of the WMI filter.
4
Click OK.
You now have the option to check in the WMI filter to be stored for later use or check in and request approval of the changes.

For information on creating WMI filters, see Creating WMI filters .

相关文档

The document was helpful.

选择评级

I easily found the information I needed.

选择评级