Re: Remove GP after a number of mistakes?

Tech-Archive recommends: Speed Up your PC by fixing your registry

I'm a firm believer that you shouldn't edit the default GPO's. I think
leaving them alone is the best thing to do just in case you ever want
to view them. I'm pretty sure that you can copy the default GPO and
rename it if you would like.

As previously mentioned I like to keep things simple. Is it necessary
to create different GPO's for power users, users, restricted users,
etc.? That's a question that you need to answer for yourself.

As far as my network goes, everyone will have the same GP for their
workstations. I don't restrict the use of control panels, start menus
or anything like that for a few reasons.

First of all if I want to take over the machine I want to have access
to everything I need to troubleshoot. I don't want to have to login as
Admin or another admin type account. I want to be able to log in as the
user and do what I need to do. If I need more rights, I can always use
the "Run As" command.

Also I don't like tightening the belt too much because I haven't found
that users can do much harm with access to the control panel. Yes,
there are some things in there that can be messed with, however there
is more than one way to access most of the control panel applets.

As far as software deployment goes it's very interesting how GPO's can
push the necessary apps out to your users. It's a very simple process,
you just point the GPO towards the path of the .MSI (or zap) file,
configure a few simple options and you're all set.

You should definitely download the Microsoft Group Policy Management
Tool. For lack of a better word it's freakin awesome. You can view all
of your GPO's and there's a summary tab which will create an HTML
report of all the settings that you've configured. It's a really sharp
tool.


To summarize here are my thoughts:

Unlink the GPO's you've created.

Play around with GPO's on your server and create some test accounts to
see if your new and improved GPO's work BEFORE implementing them. Test
them on the fake accounts before going into production.

GP is great and if used correctly can really reduce the amount of time
you spend on little annoyances. In the longrun GP themselves will lower
TCO.


Brian Chernicoff

.

Relevant Pages

  • Re: Administrator restricted - Control Panel Missing
    ... If you did not specifically set up Group Policy to restrict access to ... The command net users will display user accounts and net user username will ... type of administrator. ... the control panel was missing. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Automatically logging me in
    ... Automatic logon occurs due to two different reasons: ... There are multiple accounts present, ... If it were a third party app I could see it; the app has been put in ... negates the Control Panel ability to use User Accounts for changing it? ...
    (microsoft.public.windowsxp.basics)
  • Commercial-Style Web Accounts
    ... I'd like to create user accounts on that server for my students ... Apache, Control Panel, Commercial and such), but did not come up with much ... I've also noticed that many commerical Web sellers feature a similar control ...
    (alt.os.linux.suse)
  • Re: Ctl + Alt + Del
    ... I've gone to Control Panel - Use Accounts and attempted to turn the WElcome ... I get a message saying that some software I've installed has disabled Fast ... This behavior is normal when Welcome Screen is disabled in the Control Panel ... Recently though I have been getting the Windows Security box on my screen - ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: adminDSholder being over zealous!
    ... the test accounts are new accounts with no AdminCount ... >> Have just come across a problem with the adminDSholder process which is ... >> domain and the securing of Server Operators and Print Operators doesn't ...
    (microsoft.public.win2000.security)