Mcts 70-640 - Microsoft Official Course Chapter 6 Study Guide - Implenting Group Policy Infrastructure

Front 1

What is Configuration Management

Back 1

- A centralized Approach to on or more changes to one or more users or computers

(Microsoft, 2011 p. 6-5)

Front 2

Define the key elements of Configuration Management?

Back 2

- A centralized definition of change, which is known as a setting. The setting brings a user or a computer to a desired state of configuration

- A definition of the user(s) or computer(s) to whom the change applies, which is known as the scope of the change.

- A mechanism or process that ensures that the setting is applied to users and computers within the scope, which is known as the application

(Microsoft, 2011 p. 6-5)

Front 3

What are the key elements of Configuration Management

Back 3

- Setting

- Scope

-Application

- Tools

(Microsoft, 2011 p. 6-5)

Front 4

In configuration management what is the setting

Back 4

Definition of a change configuration

(Microsoft, 2011 p. 6-5)

Front 5

In configuration management what is the scope?

Back 5

A definition of the users or computers to which the change applies

(Microsoft, 2011 p. 6-5)

Front 6

What is the granular definition of change or configuration?

Back 6

- Prevent access to Registry-Editing Tools

-Rename the administrator account

(Microsoft, 2011 p. 6-6)

Front 7

Policy settings are divided by ___________ and ____________

Back 7

- User configuration [users only]

- computer configuration (computer policies) [Computers only]

(Microsoft, 2011 p. 6-6)

Front 8

What are the 3 definitions of a setting?

Back 8

1. Not configured (default)

2. Enabled

3. Disabled

(Microsoft, 2011 p. 6-6)

Front 9

What does the not configured policy setting mean?

Back 9

In a new GPO, every policy setting is set to not configured. This means that the GPO will not modify the existing configuration of that particular setting for a user or computer. If you enable or disable a policy setting, a change will be made to the configuration of users and computers to which the GPO is applied.

(Microsoft, 2011 p. 6-6)

Front 10

What happens if you enable Prevent Access to Registry Editing Tools policy setting?

Back 10

Users will be unable to launch the Regedit.exe Registry editor.

(Microsoft, 2011 p. 6-6)

Front 11

What happens if you disable the Prevent Registry Access to registry Editing Tools policy setting?

Back 11

You ensure that the users can launch the registry Editor. Notice the double negative in this policy setting. You disable a policy that prevents an action, so you allow the action.

(Microsoft, 2011 p. 6-7)

Front 12

With RegEdit can you define whether registry files can be merged silently into a system?

Back 12

Yes

(Microsoft, 2011 p. 6-7)

Front 13

What are some Benefits of Using Group Policy?

Back 13

1. Apply Security Settings

2. Manage Desktop and application settings

3 Deploy Software

4. Manage Folder redirection

5. Configure Network settings

(Microsoft, 2011 p. 6-8)

Front 14

Security settings using Group Policy

Back 14

In Windows server 2008 R2, GPO include a large number of security-related settings that you can get and apply to both users and computer, For example, you can enforce settings for windows firewall and configure Auditing, Encrypting File System policies and other security settings. You can also configure a full set of user rights assignments.

(Microsoft, 2011 p. 6-8)

Front 15

Manage Desktop and Application Settings using Group Policy

Back 15

You can use a group policy to provide a constant desktop application environment to all users in you organization using GPOs, it is possible to configure each setting that affects the look and feel of a user environment and also to configure settings for some applications that support GPOs

(Microsoft, 2011 p. 6-8)

Front 16

Deploy software using Group Policy

Back 16

Group Policies can also be used to deploy software for users or computers. All software that is provided in the .msi format can be developed by using Group Policy. You can enforce automatic software installation or you can let users decide if they want the software to be deployed to their machines or not.

(Microsoft, 2011 p. 6-8)

Front 17

Manage Folder Redirection with Group Policies

Back 17

With folder Redirection, you can easily manage and back up data. By redirecting folders you can ensure that users have access to their data regardless of the computer that they can use to log on. Also, you can centralize all users data to one place on the network server, while still providing the user an experience similar to storing these folders on their computer.

(Microsoft, 2011 p. 6-9)

Front 18

Configure Network Settings with Group Policies

Back 18

Using Group Policies, You can configure various settings on a client computer, For example, you can enforce settings for wireless networks to allow users to connect only to specific SSIDs and with predefined authentication and encryption settings. You can also deploy policies that apply to a wired network setting as well as configure client side of services such as Network Access Protection.

(Microsoft, 2011 p. 6-9)

Front 19

Components of Group Policy Objects

Back 19

- Container for one or more policy setting

- Managed with the GPMC

- Stored in Group Policy Objects container

- Edited with the GPME

- Applied to a specific level in AD DS hieracrchy

(Microsoft, 2011 p. 6-10)

Front 20

WHAT is a GPO

Back 20

Group Policy Object

A GPO is an object that contains one or more policy settings and thereby applies one or more configuration settings for a user or computer

(Microsoft, 2011 p. 6-10)

Front 21

GPO can be managed in the Active Directory by using _____________________________________________________

Back 21

GPMC

Group Policy Management Console

(Microsoft, 2011 p. 6-10)

Front 22

For a GPO to work ___________________

Back 22

it must be applied to the domain, site or OU in the AD DS hierarchy for the settings to take effect

(Microsoft, 2011 p. 6-11)

Front 23

What is a GPO Scope?

Back 23

Definition of objects (users or computers) to which GPO applies

(Microsoft, 2011 p. 6-12)

Front 24

GPO Links

Back 24

- GPO can be linked to multiple sites, domain, or organizational unit (OU) (SDOU)

- GPO link(s) define the maximum scope of GPO

(Microsoft, 2011 p. 6-12)

Front 25

What can you do with Security Group Filtering?

Back 25

- Apply or deny application of GPO to members of global security Group

- Filter application of scope of GPO within its link scope

(Microsoft, 2011 p. 6-12)

Front 26

What does WMI Filtering do?

Back 26

Refine scope of GPO within the link based on WMI Query

(Microsoft, 2011 p. 6-12)

Front 27

WMI

Back 27

Windows Instrument Management

Filters that specify a scope by using characteristics of a system, such as an operating system version of free disk space

Front 28

Two types of GP filters

Back 28

- specify global security groups in which the GPO should not apply

-WMI (Windows Management Systems) specifies what to apply

(Microsoft, 2011 p. 6-12)

Front 29

What are targeted preferences

Back 29

New to Windows server 2008, targeting preference allows you to further refine the scope of preferences within a single GPO.

(Microsoft, 2011 p. 6-12)

Front 30

CSE

Back 30

Client Side Extension

Series of processes that interpret the settings in a GPO ans make appropriate changes to the local computer and the currently logged in user

(Microsoft, 2011 p. 6-13)

Front 31

An important concept about GPOs is the it is ______________ driven

Back 31

Client (pull)

(Microsoft, 2011 p. 6-13)

Front 32

Can you reapply GPO settings if the policy has not changed?

Back 32

Yes you can configure CSEs to reapply policy settings, even if the GPO has not changed at background refresh. To do so, configure a GPO scoped to computers and define the settings n the Computer Configuration\Policies\Administrative Templates\System\ Group Policy node. For Each CSE you want to configure, open its policy processing policy setting such as Registry Policy Processing for the Registry CSE. Click enabled and select the Process even if the group Policy Objects have not been changed check box.

(Microsoft, 2011 p. 6-14)

Front 33

Why do you always enable the Always wait for network at startup and logon policy setting for all windows client?

Back 33

Without this setting, by default windows perform only background refreshes - a client might start up, and a user might log on without receiving the latest policies from the domain

(Microsoft, 2011 p. 6-14)

Front 34

When should you Group Policy Refresh

Back 34

1. When GPOs and their settings are applied

2. Computer Configuration

3. User Configuration

(Microsoft, 2011 p. 6-14)

Front 35

When are policy Settings in computer configuration applied?

Back 35

1. System Startup

2. Every 90-120 minutes

3. Triggered: GPUpdate command

(Microsoft, 2011 p. 6-15)

Front 36

Can you force a policy refresh?

Back 36

Yes, by using GPUpdate command

Front 37

User configuration policies are applied at ___________

Back 37

1. Logon

2. Every 90-120 minutes

3. Triggered: GPUdate command

(Microsoft, 2011 p. 6-15)

Front 38

In Windows Server 2008R2, there are almost _____________ different settings.

Back 38

3,000 different settings

(Microsoft, 2011 p. 6-16)

Front 39

Group Policy settings provide the ______________

Back 39

meaning and purpose of group policy.

(Microsoft, 2011 p. 6-16)

Front 40

Where do you apply the GPO

Back 40

This is known as the scope

(Microsoft, 2011 p. 6-16)

Front 41

When planning Group Policy Applications you should be aware of _____

Back 41

refresh intervals

(Microsoft, 2011 p. 6-16)

Front 42

GPOs are managed through

Back 42

GPO Policy Management Console

(Microsoft, 2011 p. 6-16)

Front 43

Policy settings within a GPO are configured by using __________

Back 43

the GPME

(Microsoft, 2011 p. 6-16)

Front 44

What allows you to manually trigger Group Policy Refresh?

Back 44

GPUdate

Front 45

What allows you to evaluate and model the settings that were applied by group policy?

Back 45

RSop Tool

(Microsoft, 2011 p. 6-16)

Front 46

Group policy settings also known as ____________

Back 46

policies

(Microsoft, 2011 p. 6-17)

Front 47

what are the two major divisions of policy settings?

Back 47

- Computer Settings

- User Setting

(Microsoft, 2011 p. 6-17)

Front 48

What setting applies policy settings to computers regardless of who logs on

Back 48

Computer Configuration Node

(Microsoft, 2011 p. 6-17)

Front 49

What setting applies settings when a user logs on to the computer?

Back 49

The user configuration node.

(Microsoft, 2011 p. 6-17)

Front 50

What is the first node?

Back 50

Software Setting node

(Microsoft, 2011 p. 6-17)

Front 51

What is the softwre setting node

Back 51

The software setting node is the first node. It contains only the software installation extension.

(Microsoft, 2011 p. 6-17)

Front 52

What does the software extension do?

Back 52

This extension helps you specify how applications are installed and maintained within your organization. It provides a place for independent software vendors to add settings. Software deployment with Group Policy is discussed in Module 7.

(Microsoft, 2011 p. 6-17 and 6-18)

Front 53

What is windows setting node?

Back 53

- contained in both computer Configuration and User configuration

- includes the Scripts, Settings, and Policy Based QoS nodes

(Microsoft, 2011 p. 6-18)

Front 54

What does the scripts extension do?

Back 54

enables you to specify the two types of scripts,

-startup/shutdown (in the computer configuration node),
and
- logon/logoff (in the User configuration node)

(Microsoft, 2011 p. 6-18)

Front 55

When a computer first is shut down _____________ process the logoff scrips?

Back 55

CSE first process the logoff scripts

(Microsoft, 2011 p. 6-18)

Front 56

When do you have to adjust the timeout value for a logoff script?

Back 56

By default the timeout value for processing scripts is 10 minutes, so anything that takes longer than that should be adjusted.

(Microsoft, 2011 p. 6-18)

Front 57

What does the security settings node do?

Back 57

Allows a security administrator to configure security by using GPOs

(Microsoft, 2011 p. 6-18)

Front 58

What is the Policy Setting QoS node

Back 58

Defines Policies that manage network traffic

(Microsoft, 2011 p. 6-18)

Front 59

What is the Administrative Template Node

Back 59

contains registry based group policy settings

Front 60

Any setting specified by a domain based GPO will ________________ the setting specified by the local GPOs

Back 60

Override

(Microsoft, 2011 p. 6-21)

Front 61

How many lcal GPOs are in windows 2000 server, Windows XP, Windows server 2003

Back 61

1

(Microsoft, 2011 p. 6-21)

Front 62

What are the multiple GPOs in Windows Vista and beyond

Back 62

- Local GPO
- Administrators GPO
- Non-Administrators GPO
- Per-user GPO:

(Microsoft, 2011 p. 6-21)

Front 63

Local GPO

Back 63

The local GPO exist whether or not the computer is part of the domain, a workgroup, or a non-networked environment

(Microsoft, 2011 p. 6-21)

Front 64

Administators GPO

Back 64

This applies settings for users in administrators group.

(Microsoft, 2011 p. 6-21)

Front 65

Non-adminstrative GPO

Back 65

This applies settings for users not in admin.

(Microsoft, 2011 p. 6-21)

Front 66

Per-User GPO

Back 66

This applies settings for a specific users.

(Microsoft, 2011 p. 6-21)

Front 67

Where are domain based GPO created?

Back 67

Active Directory

(Microsoft, 2011 p. 6-23)

Front 68

Where are Domain-based GPOs stored?

Back 68

Domain Controllers

(Microsoft, 2011 p. 6-23)

Front 69

What are the two default GPOs

Back 69

- Default Domain Policy

-Default Domain Controllers Policy

(Microsoft, 2011 p. 6-23)

Front 70

What is the Default Domain Policy

Back 70

Defines account policies for the domain:Passwod, account, lockout, and kerberos policies

(Microsoft, 2011 p. 6-23)

Front 71

Default Domain Controllers Policy

Back 71

Define auditing policy for domain controllers and Active Directory

(Microsoft, 2011 p. 6-23)

Front 72

What is the breakdownj of Default Domain Policy

Back 72

This GPO is linked to the domain and has no security group or WMI filters. Therefore, it affects all users and computers in the domain, including computers that are domain controllers. This GPO contains policy settings that specify password, accout lockout, and kerberos policies. In module 10, you will learn how to modify the deffault settings in this GPO to align withyour enterprise password and account lockout policies. You should not add unrelated policy settings to this GPO. If you need to configure other settings to applu broadly in your domain, create additional GPOs linkied to the domain.

(Microsoft, 2011 p. 6-23

Front 73

The breakdown of Default domain Cotrollers policy

Back 73

This GPO is linked to the OU of the domain controllers. Because computer accounts for domain controllers are kept exclusively in the Domain Controllers OUm, and other computer accounts should be kept in other OUs, this GPO affects only Domain Controllers. The default Domain Controller GPO should be modified to implement you auditing policies, as you will see in Module 8 through 10.. it should also be modified to assign user rights required on domain controllers.

(Microsoft, 2011 p. 6-23)

Front 74

What are the two componets of Group policy settings

Back 74

- Goup Plicy Cntainer (GPC)

- Group Policy Template (GPT)

(Microsoft, 2011 p. 6-26

Front 75

GPC

Back 75

Group Policy Container

The GPC is an Active Directory Object stored in the Group Policy Objects container within the domain-naming context fof the directory. Like all Active Directoy objects, each GPC includes a globally unique identifier (GUID) attribute that uniquely identifies the objects with Active Directory. The GPC Defines basic Attributes of the GPO, but does not contain any of the settingss. The settings are contained in the GPT.

(Microsoft, 2011 p. 6-26

Front 76

GPT

Back 76

Group Policy Template

A collection of files stored in the SYSVOL of each domain controller in the %SystemRoot%\SYSVOL\Domain\Policies\GPOGUID path, where GPOGUID is the GUID of the GPC.

(Microsoft, 2011 p. 6-26

Front 77

When you make changesw to GPOGUID, where are the changes saved?

Back 77

Ther are saved to the GPT of ther server from which the GPO was opened.

(Microsoft, 2011 p. 6-26

Front 78

What happens by default when the Group Policy refresh occurs?

Back 78

The CSEs apply settings in a GPO only if the GPO has been updated.

(Microsoft, 2011 p. 6-26)

Front 79

How can a group policy client identify an update GPO?

Back 79

By its policy number.

(Microsoft, 2011 p. 6-26)

Front 80

How is the GPO verson number incremented?

Back 80

Each time a change is made.

(Microsoft, 2011 p. 6-26)

Front 81

How is GPO replicated?

Back 81

Group Policy Container and Group Policy Template are both replicated between all domain contollers in Active Directory. However different replication mechanisms are used for these two items.

(Microsoft, 2011 p. 6-26)

Front 82

How is the GPC (Group Policy Container) replicated in Active Directory?

Back 82

by the DRA (directory Repplication Agent).

(Microsoft, 2011 p. 6-26)

Front 83

The DRA (Directory Replication Agent) uses a topology checker known as ____

Back 83

KCC

Knowledge Consistency Checker

(Microsoft, 2011 p. 6-26)

Front 84

How can the KCC (Knowledge Consistency Checker) be defined or refined?

Back 84

Manually

(Microsoft, 2011 p. 6-26)

Front 85

How lonmg does it take for the GPC (Grou Policy Container) to be replicated?

Back 85

Seconds to all domain controllers in a site and is replicated between sites based on your intersite replication configuration.

(Microsoft, 2011 p. 6-27)

Front 86

How is the GPT (Group Policy Template) replicated in SYSVOL?

Back 86

1. The FRS (File Replication Service

2. DFSR (Distribured File System Replication)

(Microsoft, 2011 p. 6-27)

Front 87

When would you use DFSR (Distributed File System, Replication to replicate the GPT (Group Policy Template?

Back 87

If all domain controllers are running Windows Server 2008 or earlier, you can configure SYSVOL replication using DFSR (Distributed File System Replication)

(Microsoft, 2011 p. 6-27)

Front 88

Can the GPC (Group Policy Container) and the GPT(Group Policy Template) become out of sync?

Back 88

Yes, typically, whyen this happens, the GPC will repllicate to a domain controller first. Systems obtained their ordered list of GPOs from the domain controller will identify the new GPC, will attempt to download the GPT, and will notice the version numbers are not the same. A policy processing errror will be recorded in the event logs. if the reverse happens, and the GPO replicates to a domain controller before the GPC, client obtianing their ordered list of GPOs from that domain controller will not be notified of the new GPO until the GPC has replicated.

(Microsoft, 2011 p. 6-27)

Front 89

Copy

By Right Clicking GPO in the GPMC

Back 89

You can copy a GPO and the right-click the Group Policy Objects container and select Past to create a Copy of the GPO. This is useful when you want to create a new GPO in the same domain and start with the same settings as an existing GPO. it is also useful to copy a GPO into another domain, for example, between a test domain and a production domain. To copy a GPO between domains, add the target trusted domain to the GPMC. you must have permission to create GPO between domain, add the target trusted domain to the GPMC. you must have permission to create GPOs in the target domain. When you paste a GPO, you are given the option to copy the access control list (ACL) from the original GPO, which preserves the security filtering, or to use the default ACL for new GPOs in the target domain.

(Microsoft, 2011 p. 6-28)

Front 90

Back up

By right Clicking a GPO in The GPMC

Back 90

As with any critical data, it is important to back up GPOs Because a GPO consists of sever files, objects, permissions and links, managing the backup and restore of GPOs is quite difficult. Luckily, the back up command pulls all those pieces into single place and makes restore a simple task.

(Microsoft, 2011 p. 6-28)

Front 91

Restore from Backup

By right Clicking a GPO in the GPMC

Back 91

Restore an entire GPO, including its files, objects, permissions, and links int the same domain in which the GPO originally existed

(Microsoft, 2011 p. 6-28)

Front 92

Import Settings

by right clicking the GPO in the GPMC

Back 92

Import only the settings from a backed-up GPO. Although this option does not import permissions or links, it can be useful for transferring GPOs between nontrusted domains that cannot use copy and past. If a GPO includes potentially domain-specific settings, including the UNC paths or domain names of security groups, you will be prompted as to whether you want to import those settings as they were backed yo or to use a migration table that maps source to destination names.

(Microsoft, 2011 p. 6-28)

Front 93

Save report

By right clicking the GPO in the GPMC

Back 93

Use this to save an HTML report of the GPO settings

(Microsoft, 2011 p. 6-28)

Front 94

Delete

By right clicking the GPO in GPMC

Back 94

Use the delete a GPO

(Microsoft, 2011 p. 6-28)

Front 95

Rename

By Right Clicking the GPO in the GPMC

Back 95

Use this to rename a GPO

(Microsoft, 2011 p. 6-28)

Front 96

What is the GPO by itself?

Back 96

A collection of configuration instructions that will be processed by the CSEs of which computers will receive and process the GPO and only the computers or users within the scope of a GPO.

(Microsoft, 2011 p. 6-33)

Front 97

What does a GPO link do?

Back 97

Causes policy settings in GPO to apply to users or computers within that container

(Microsoft, 2011 p. 6-35)

Front 98

What can you link.

Back 98

- GPO to site

- domain

-OU (SDOU)

(Microsoft, 2011 p. 6-35)

Front 99

G=Can you link a GPO to multiple sites?

Back 99

yes

(Microsoft, 2011 p. 6-35)

Front 100

Can a link exist in an unused state?

Back 100

Yes in the disable state

(Microsoft, 2011 p. 6-35)

Front 101

If you delete a link is the GPO deleted?

Back 101

The links can be deleted and the GPO remains.

(Microsoft, 2011 p. 6-35)

Front 102

What happens when you link a GPO to a site?

Back 102

the GPO can be applied to multiple domains within a forest.

(Microsoft, 2011 p. 6-35)

Front 103

Site Linked GPOs are stored on _________________

Back 103

domain controllers in the domain in which the GPO was created

(Microsoft, 2011 p. 6-35)

Front 104

What should you consider when implementing a site-linked policy?

Back 104

You must consider policy application when planning your network infrastructure

(Microsoft, 2011 p. 6-35)

Front 105

Where must you place a GPO domain?

Back 105

- the site to which the policy is linked

- a site to which the GPO is linked

or

- ensure WAN has accessibility to domain controller in the GPOs domain

(Microsoft, 2011 p. 6-35)

Front 106

When you first link a GPO what should you do?

Back 106

Define the initial scope of the GPO.

(Microsoft, 2011 p. 6-36)

Front 107

If you apply settings to a GPO, what happens?

Back 107

Changes will apply to all OUs to which the GPO is linked.

(Microsoft, 2011 p. 6-35)

Front 108

What us the Group Policy Processing Order?

Back 108

1. Local Group Policies
2. Site Group Policies
3. Domain Group Policies
4. OU group policies
5. Child OU group Policies

(Microsoft, 2011 p. 6-38)

Front 109

When are the local policies applied in the Group Policy processing?

Back 109

first

(Microsoft, 2011 p. 6-38)

Front 110

What happens when processing multiple site policies?

Back 110

They are processed syncronously

(Microsoft, 2011 p. 6-38)

Front 111

What happens when processing multiple domain policies?

Back 111

They are processed syncronously

(Microsoft, 2011 p. 6-38)

Front 112

What happens when there are multiple OU group policies being processed?

Back 112

They are process synchronously

(Microsoft, 2011 p. 6-38)

Front 113

When applying policies what is the general rule?

Back 113

last policy applied wins

(Microsoft, 2011 p. 6-38)

Front 114

If you link several GPOs to an OU, what order are they specified?

Back 114

In the order the administrator specifies.

(Microsoft, 2011 p. 6-38)

Front 115

The application of GPOs linked to each container results in a cumulative effect called ___________________

Back 115

inheritance

(Microsoft, 2011 p. 6-40)

Front 116

The default inheritance of GPO inheritance is

Back 116

->Local
-->Site
--->Domain
---->OU
----->OU (LSDOU)

(Microsoft, 2011 p. 6-40)

Front 117

What is Link Order ?
(attribute of GPO Link)

Back 117

->Lower number
--> Higher on List
---> Precedent

(Microsoft, 2011 p. 6-40)

Front 118

What is Block inheritance?
(attributes of OU)

Back 118

blocks the processing of GPOs from above

(Microsoft, 2011 p. 6-40)

Front 119

What happens when inheritance is enforced?
(attribute of GPO link)

Back 119

- Enforced GPOs "Blast through" Block inheritance

-Enforced GPO settings win over conflicting settings in lower GPOs

(Microsoft, 2011 p. 6-40)

Front 120

What does the precedence of a GPO determine?

Back 120

It determines which policy settings the client applies.

(Microsoft, 2011 p. 6-40)

Front 121

What is a policy setting set to by default?

Back 121

Not configured

(Microsoft, 2011 p. 6-40)

Front 122

What is the default behavior of Group Policy?

Back 122

is that the GPOs linked to a higher-level container are inherited by lower-level containers

(Microsoft, 2011 p. 6-40)

Front 123

What is the effect of sequential applications of GPOs?

Back 123

Policy Inheritance

(Microsoft, 2011 p. 6-40)

Front 124

By default __________ GPOs have lower precedence than GPOs ____________________________

Back 124

lower precedence than GPOs linked directly to the container

(Microsoft, 2011 p. 6-41)

Front 125

If there are multiple GPOs, ______________ determines their precedence

Back 125

link order

(Microsoft, 2011 p. 6-40)

Front 126

How do you change the precedence of a GPO Link?

Back 126

1. Select the OU,site, or domain in the GPMC console tree.

2. Click the Linked Group Policy Objects tab in the details pane.

3. Select the GPO

4. Us the Up, Down, Move To Top, and Move to Bottom arrows to change the link order of the selected GPO

(Microsoft, 2011 p. 6-41)

Front 127

What is block inheritance

Back 127

Configuring or preventing inheritance of policy settings

(Microsoft, 2011 p. 6-41)

Front 128

What happens when you Enforce a GPO?

Back 128

The GPO takes the highest level of precedence; policy settings in that a GPO will prevail over any conflicting policy settings in other GPOs

(Microsoft, 2011 p. 6-42)

Front 129

The enforced policy option causes the policy to ______________________

Back 129

apply to all objects within its scope

(Microsoft, 2011 p. 6-42)

Front 130

What do you find in the Group Policy Inheritance Tab?

Back 130

shows the GPO takes precedence even over the GPOs linked to the People OU itself.

(Microsoft, 2011 p. 6-42)

Front 131

Where is the Group Policy ACL?

Back 131

Delegation tab --> Advanced

(Microsoft, 2011 p. 6-43)

Front 132

Authenticated users have allow apply group policy is ______________?

Back 132

Default policy permissions

(Microsoft, 2011 p. 6-43)

Front 133

What does the ACL do in a GPO?

Back 133

defines the permissions to the GPO

(Microsoft, 2011 p. 6-43)

Front 134

What are the permissions required for a GPO to apply to a user or computer?

Back 134

- Allow Read Group Policy

-Allow Apply Group Policy

(Microsoft, 2011 p. 6-43)

Front 135

By default, Authenticated users are given the __________________ permission on each new GPO

Back 135

Allow Apply Group Policy

(Microsoft, 2011 p. 6-43)

Front 136

When you deny permissions can you see the exclusion in the security filtering tab?

Back 136

No

(Microsoft, 2011 p. 6-45)

Front 137

What is WMI?

Back 137

is a management infrastructure technology that enables administrators to monitor and control managed objects in the network.

(Microsoft, 2011 p. 6-46)

Front 138

A WMI query is capable of filtering systems based on ________________

Back 138

- Ram
- Processor Speed
- Disk Capacity
- IP Address
_ Operating System Version
- Service Pack level
- List of attributes
- many more

(Microsoft, 2011 p. 6-46)

Front 139

How do you write a WMI Query?

Back 139

WQL

WMI Query Language (WQL)

(Microsoft, 2011 p. 6-46)

Front 140

Three significant caveats regarding WMI Filters

Back 140

1. WMI Queries can be challenging to master
2 WMI filters are expensive in terms of Group Policy Processing performance
3. WMI Filters are not processed by computers running Windows 2000 Server

(Microsoft, 2011 p. 6-48)

Front 141

WHat happens when GPOs are enabled?

Back 141

Both Computer configuration settings and user configuration settings will be processed by CSEs during policy refresh.

(Microsoft, 2011 p. 6-48)

Front 142

What happens when GPO: all settings are disabled

Back 142

CSEs will not process the GPO during policy refresh

(Microsoft, 2011 p. 6-48)

Front 143

What happens when computer configuration settings are disabled in GPOs

Back 143

During Computer Policy refresh, computer configuration settings in the GPO will not be applied.

(Microsoft, 2011 p. 6-49)

Front 144

What happens in GPOs when User configuration settings are disabled?

Back 144

During User policy refresh, user configuration settings in the GPO will not be applied.

(Microsoft, 2011 p. 6-49)

Front 145

What happens with GPOs in an Emergency?

Back 145

You can define a configuration that should take effect in case of an emergency security incident, or other disasters in a GPO and link the GPO so that it is scoped to appropriate users and computers. Then disable the GPO if you require the configuration to be deployed, enable the GPO

(Microsoft, 2011 p. 6-6-49)

Front 146

What formula provides the ability to target within a GPO?

Back 146

scope of targeting + Scope of GPO = Scope

(Microsoft, 2011 p. 6-50)

Front 147

What are the elements of Target Preferences

Back 147

- Targeting within a GPO
- Multiple Options
- Test Effect
- Test Performance Impact

(Microsoft, 2011 p. 6-50)

Front 148

Which operating system introduced preferences?

Back 148

Windows server 2008

(Microsoft, 2011 p. 6-50)

Front 149

What are item-level targeting?

Back 149

Built in scoping mechanism

(Microsoft, 2011 p. 6-50)

Front 150

What do WMI filters and Item level targeting of preference have in common?

Back 150

Requirement of CSE to perform a query and determine whether to apply the settings in a preference item.

(Microsoft, 2011 p. 6-50)

Front 151

item level target may have a impact __________

Back 151

the performance of your system

(Microsoft, 2011 p. 6-51)

Front 152

Where does user settings come from?

Back 152

GPOs scoped to the users object in active directory

(Microsoft, 2011 p. 6-52)

Front 153

VDI

Back 153

Virtual Desktop Infrastructure

(Microsoft, 2011 p. 6-52)

Front 154

RDS

Back 154

Remote Desktop Services

aka

Terminal Services in previous versions

(Microsoft, 2011 p. 6-52)

Front 155

What does loopback policy processing do?

Back 155

alters the default algorithm used by the group Policy Client to obtain the ordered list of GPOs that should be applied to a user's configuration.

(Microsoft, 2011 p. 6-52)

Front 156

What are the settings for loopback processing?

Back 156

- Not Configured

- Enabled

- Disabled

(Microsoft, 2011 p. 6-52)

Front 157

What is the replace mode in Loopback Policy Processing?

Back 157

In this case, the GPO list for the user (obtained in step 5 in the " Group Policy Processing" the next section) is replaced entirely by the GPO list already obtained for the computer start-up (in step 2). The setting in User Configuration Policies of the computer's GPO are applied to the user. The replace mode us useful in a situation such as a classroom where users should receive a standard configuration rather than the configuration applied to those users in a less managed environment,

(Microsoft, 2011 p. 6-53)

Front 158

What is the Merge Mode in Loopback Policy Processing?

Back 158

In this case, the GPO list obtained for the computer at computer startup (step 2 in the Group policy processing" section) is appended to the GPO list obtained for the user when logging on (step 5). Because the GPO list obtained for the computer is applied later, settings in the GPos on the computer's list have precedence if they conflict with settings in the user's list. This mode would be useful to apply additional settings to users ' typical configuration when logging on to a computer in a conference room or reception area, but replace the wallpaper with a standard bitmap and disable the user of certain application or device.

(Microsoft, 2011 p. 6-53)

Front 159

What happens when you combine the loopback processing with security group filtering?

Back 159

the application of user settings during policy refresh sees the credentials of the computer to determine which GPOs to apply as part of the loopback processing. However, the logged- on user must also have the Apply Group Policy permission for the GPO to be successfully applied.

(Microsoft, 2011 p. 6-53)

Front 160

7 steps of the details review of Group Policy Processing

Back 160

1. Computer Starts; RPCSS and MUP are started
2. Group Policy Client Starts and obtains an ordered list of GPOs that are scoped to the computer
3. GPC processes each GPO in order
4. User Logs on
5. Process Repeats for user settings
6. Every 90-120 minutes after startup, computer refresh
7. Every 90-120 minutes after logon, user refresh

(Microsoft, 2011 p. 6-60)

Front 161

What is the ordered list of GPOs?

Back 161

- Local GPOS
- Site GPOs
- Domain GPOs
- OU GPOs
- Enforced GPOs

(Microsoft, 2011 p. 6-53 and 6-54)

Front 162

How are GPOs processed?

Back 162

synchronously in the order specified in the order list

(Microsoft, 2011 p. 6-53)

Front 163

WMI filters are applied to what computers?

Back 163

Any computers running Windows XP or later

(Microsoft, 2011 p. 6-53)

Front 164

If GPOs are applied to the system. ___________trigger to process the GPO settings.

Back 164

CSE

(Microsoft, 2011 p. 6-53)

Front 165

If the child container is configured with the block inheritance option the parent setting is _______________

Back 165

Not inherited unless the GPO link is configured with the Enforced Option

(Microsoft, 2011 p. 6-53)

Front 166

If the parent link is configured with the enforced option, the parent setting _____________

Back 166

has precedence

(Microsoft, 2011 p. 6-61)

Front 167

If a policy setting of GPOs linked to parent containers is Not Configured, and the child OU is also not configured for a child, the child OU setting is _______________

Back 167

also not configured, the resultant policy setting that results from the processing of local GPOs

(Microsoft, 2011 p. 6-61)

Front 168

How often does a computer policy refresh?

Back 168

Every 90 -120 minutes

(Microsoft, 2011 p. 6-62)

Front 169

What is determined a slow link?

Back 169

Less than 500kilobites per second (kbps)

(Microsoft, 2011 p. 6-63)

Front 170

What happens when A Group Policy is disconnected?

Back 170

- settings previously applied will continue to take effect

- Exception includes startup, logon, logoff, and shutdown scripts

(Microsoft, 2011 p. 6-63)

Front 171

Group Policies in windows vista and higher to what?

Back 171

detect new connections and perform group policy refresh if the refresh window was missed while the system was disconnected.

(Microsoft, 2011 p. 6-6-63)

Front 172

Who provides GPSI?

Back 172

Group Policy Software Installation

software installation CPE provides GPSI

(Microsoft, 2011 p. 6-63)

Front 173

If a slow ink is detected software is

Back 173

usually not installed

(Microsoft, 2011 p. 6-63)

Front 174

Can you configure the default slow speed?

Back 174

Yes

(Microsoft, 2011 p. 6-63)

Front 175

If a computer wakes up and realizes the group policy has been missed

Back 175

it will perform a group policy to obtain the GPOs from the domain

(Microsoft, 2011 p. 6-64)

Front 176

Before a GPO can take effect, the Group Policy Container (GPC) in Active Directory must be replicated to____

Back 176

The domain Controller from which the Grou Policy Client Obtains its ordered list of GPOs. Additionally the Group Policy Template (GPT in SYSVOL must replicate to the same domain controller)

(Microsoft, 2011 p. 6-65)

Front 177

If you have added a new group or changed the membership of a group that is used to filter the GPO, that change must be ________

Back 177

replicated, and the change must be in the security token of the computer and the user, which requires a restart (for the computer to update its group membership) or a logoff and logon (for the user to update its group membership.

(Microsoft, 2011 p. 6-65)

Front 178

By default, Windows CP, Windows Vista and Windows 7 client perform background refreshes at

Back 178

start-up and logon

(Microsoft, 2011 p. 6-65)

Front 179

How do you manually refresh a Group Policy?

Back 179

GPUdate [/force][/logoff][/boot]

(Microsoft, 2011 p. 6-65)

Front 180

Most CSEs ________________ settings if GPO has not changed.

Back 180

do not reapply settings if the GPO has not changed.

(Microsoft, 2011 p. 6-65)

Front 181

____________ is the net effect of GPOs applied to a user or computer taking into account GPO links, exceptions, such as Enforced and Block inheritance, and application of security and WMI filters.

Back 181

RSoP

(Microsoft, 2011 p. 6-68)

Front 182

RSoP is also a collection of tools that help you ______________

Back 182

evaluate, model, and troubleshoot the application of Group Policy settings.

Front 183

RSoP Query

Back 183

can search for local or remote computer and report back the exact settings that were applied to the computer and to any user who has logged on to the computer,

Front 184

RSoP Model

Back 184

RSoP can model the policy settings that are anticipated to be applied to a user or computer under a variety of scenarios, including moving the object between OUs or sites or changing the object's group membership.

(Microsoft, 2011 p. 6-68)

Front 185

Requirements to generate RSoP Reports

Back 185

- Administrative credentials on the target computer
- Access ti WMI (firewall)
- User must have logged on at least once

(Microsoft, 2011 p. 6-69)

Front 186

Can you save an RSoP report?

Back 186

Yes

(Microsoft, 2011 p. 6-69)

Front 187

When you view RSoP in advanced mode what happens?

Back 187

Show some settings that do not show in the HTML report

(Microsoft, 2011 p. 6-69)

Front 188

How can you view group policy processing events?

Back 188

GPResults.exe /s ComputerName /h filename

(Microsoft, 2011 p. 6-69)

Front 189

What are the requirements for running Group Policy Wizard?

Back 189

- You must have administrative credentials
- The target computer must be running Windows XP or newer. The group Policy Results wizard cannot access Windows 200 systems.
- You must be able to access WMI on the target computer. This means it must be powered on, connected to the network, and accessible through ports 135 and 445
- The WMI service must be started on the target computer
- If you want to analyze RDoP for a user, that user must have logged on at least once to the computer, it is not necessary for the user to be currently logged on

(Microsoft, 2011 p. 6-69)

Front 190

In AD how do you run RSoP reports?

Back 190

right click Group Policy Resilts
In th GPMC console tree and
than click Group POlicy Reports Wizard

(Microsoft, 2011 p. 6-70)

Front 191

RSoP Report Summary

Back 191

The summary tab displays the status of Group Policy processing at the last refresh. You can identify information that was collected about the system, the GPOs that were applied and denied, security group membership that might have affected GPOs filtered with the security groups. WMI filters that were analyzed, and the status of CSEs.

(Microsoft, 2011 p. 6-70)

Front 192

RSoP Report Settings

Back 192

The settings tab displays the resultant set of policy settings applied to the computer or user. This tab shows you exactly what has happened to the user through the effects of your Group Policy implementation. A tremendous amount of information can be gleaned from the Settings tab, but some data isn't reported, such as IPSec, wireless, and disk quota policy settings,

(Microsoft, 2011 p. 6-70)

Front 193

RSoP Report Policy Events

Back 193

The policy events tab displays group policies events from the event logs of the target computer

(Microsoft, 2011 p. 6-70)

Front 194

How would you generate RSoP reports in command prompt?

Back 194

GPResult.exe

(Microsoft, 2011 p. 6-70)

Front 195

GPResult /scomputername

Back 195

This option specifies the name or IP address of a remote system. If you use a dot (.) as the computer name, or do not include the /s option, the RSoP analysis is performed in the local computer.

(Microsoft, 2011 p. 6-70)

Front 196

GPResult /scope [user |computer]

Back 196

This displays RSoP analysis for user or computer settings. If you omit the /scop option, RSOP analysis includes both user and computer settings.

(Microsoft, 2011 p. 6-71)

Front 197

GPResult /userusername

Back 197

This specifies the name of the user for which RSoP data is to be displayed

(Microsoft, 2011 p. 6-71)

Front 198

GPResult /r

Back 198

This option displays the summary of RSoP data.

(Microsoft, 2011 p. 6-71)

Front 199

GPResult /v

Back 199

This option displays a verbose data, including the details of all policy settings applied to the system. Often, this is more information than you will require for typical Group Policy troubleshooting.

(Microsoft, 2011 p. 6-71)

Front 200

GPResult /z

Back 200

This displays super verbose data, including the details of all policy settings applied to the system. Often, this is more information than you will require for typical Group Policy Troubleshooting.

(Microsoft, 2011 p. 6-71)

Front 201

GPResult /udomain\user/ppassword

Back 201

This provides credentials that are in the Administrators group of a remote system. Without these credentials. GPResult runs by using the credentials with which you are logged on.

(Microsoft, 2011 p. 6-71)

Front 202

GPResult [/x | /h] filename

Back 202

This option saves the reports in the CML or HTML format. These options are availiable in Windows Vist SP1 and later, Windows Server 2008 and later, and Windows 7.

(Microsoft, 2011 p. 6-71)

Front 203

How do you perform Group Policy Modeling in AD?

Back 203

Right click Group Policy Modeling node in the GPMC console treem
Click group policy modeling wizard
than perform steps in the wizard

(Microsoft, 2011 p. 6-71)

Front 204

What does the Group Policy Modeling Wizard do?

Back 204

- Emulates Group Policy application to report anticipated RSoP
- Can be used prior to GPO application
- Recommended in Group Policy design phase

(Microsoft, 2011 p. 6-71)

Front 205

How is modeling performed?

Back 205

by conducting a simulation on a domain controller.

(Microsoft, 2011 p. 6-71)

Front 206

Once connected to a domain controller, what are you asked to specify in Group Policy Modeling?

Back 206

- select user or computer objects to evaluate or specify the OU, site or domain to evaluate
- Choose whether slow lonk processing should be simulated
- Specify to simulate loopback precessing and if so, choose Replace or Merge Mode
- Select Site to simulate
- Select security Groups for the user and for the computer
- Chose which WMI Filters to apply in the simulation of user and computer policy processing

(Microsoft, 2011 p. 6-71)

Front 207

After the settings are specified on a group policy modelling what happens?

Back 207

A report is produced

(Microsoft, 2011 p. 6-71)

Front 208

What do you find in the system log?

Back 208

You will find high-level information about Group Policy, including errors created by the group policy client when it cannot connect to a domain controller or locate GPOs

(Microsoft, 2011 p. 6-74)

Front 209

What are some Policy Event Logs?

Back 209

- System Log

- Application Log

- Group Policy Operational log

(Microsoft, 2011 p. 6-74)

Front 210

What is an application log?

Back 210

Captures the events recorded by CSEs

(Microsoft, 2011 p. 6-74)

Front 211

What is a new log called the Group Policy Operational Log?

Back 211

it provides detailed information about Group Policy Processing

(Microsoft, 2011 p. 6-74)

Front 212

What are 4 best practices for Group Policy Management?

Back 212

1. Name Group Policy Objects, so you can easily identify them by name.

2. Apply Group Policy Objects as high as possible in AD DS hierarchy

3. Use Block Inheritance and Enforced options only when really necessary

4. Make Comments of GPO settings

(Microsoft, 2011 p. 6-81)

Front 213

What is the Group Policy Reporting RSoP Tool?

Back 213

Reporting information about the current policies being delivered to clients.

(Microsoft, 2011 p. 6-81)

Front 214

What is the GPResult tool?

Back 214

A command-line utility that displays RSoP information.

(Microsoft, 2011 p. 6-81)

Front 215

What is th GPU Update tool

Back 215

Refreshing local and AD DS-based Group Policy Settings

(Microsoft, 2011 p. 6-82)

Front 216

What is the Dcgpofix tool?

Back 216

Restoring the Group Policy Objects to their original stat after initial installation.

(Microsoft, 2011 p. 6-82)

Front 217

What is the GPOLogView Tool?

Back 217

Exporting Group Policy-related events from the systen and operational logs into text HTML or XML files. For use with Windows Vista, Windows 7 and later versions

(Microsoft, 2011 p. 6-81)

Front 218

What is the Group Policy Management Scripts?

Back 218

Sample scripts that perform a number of troubleshooting and maintenance tasks.

(Microsoft, 2011 p. 6-81)