Mcts 70-640 - Microsoft Official Course Chapter 7 Study Guide – Managing User Desktop With Group Policy

Front 1

What do administrative templates allow you to do?

Back 1

They allow you to control the environment of the operating system and user experience.

(Microsoft, 2011 p. 7-3)

Front 2

How many sets of Administrative Templates are there?

Back 2

2

(Microsoft, 2011 p. 7-3)

Front 3

What are the types of Administrative Templates?

Back 3

- Users

- Computers

(Microsoft, 2011 p. 7-3)

Front 4

What is a result of using the administrative template section of the GPO?

Back 4

You can deploy hundreds of modifications to the registry

(Microsoft, 2011 p. 7-3)

Front 5

What is an administrative template?

Back 5

It is a text file that specifies the registry change to be made and that generates the user interface to configure the Administrative Template Policy settings in the GPME.

(Microsoft, 2011 p. 7-4)

Front 6

The registry edit tool provides a _____________ with which to disable Regedit.exe

Back 6

drop down list

(Microsoft, 2011 p. 7-4)

Front 7

How are Administrative Templates organized?

Back 7

They are organized into sub-folders that deal with specific areas of the environment, such as network, system, and Windows components.

(Microsoft, 2011 p. 7-5)

Front 8

With Administrative Templates the settings in the computer section edit the ______________________

Back 8

HKEY_LOCAL_MACHONE hive in the registry

(Microsoft, 2011 p. 7-5)

Front 9

With Administrative Templates settings in the user section edit the _______________________

Back 9

HKEY_CURRENT_User hive in the registry


(Microsoft, 2011 p. 7-5)

Front 10

If settings exist in both user and computer settings which setting prevails if the two settings conflict?

Back 10

The computer setting wins

(Microsoft, 2011 p. 7-5)

Front 11

What is a .ADM File?

Back 11

In versions of Windows prior to Windows Vista, an administrative template had an .ADM extension.

(Microsoft, 2011 p. 7-5)

Front 12

What are the drawbacks with .ADM files?

Back 12

1. .ADM files must be created for each language used

2. The way they are stored.

Front 13

How is a .ADM file stored?

Back 13

An .ADM File is stored as part of the GPT in the SYSVOL. If an .ADM file is used in multiple GPOs, it is stored multiple times, contributing to SYSVOL bloat. There were also challenges in maintaining version control over .ADM

(Microsoft, 2011 p. 7-5)

Front 14

How would you add classic administrative templates to the GPME

Back 14

right click the Administrative Templates node and
then click Add/Remove Templates

(Microsoft, 2011 p. 7-5)

Front 15

What is an .ADMX/.ADML Files?

Back 15

In Windows Cista, Windows 7, Windows Server 2008 and Windows Server 2008, an administrative template is a pair of XML files, one with an .ADMX extention that specifies changes to be made to the registry and the other with an .ADML extension that provides a language-specific user interface in the GPME.

(Microsoft, 2011 p. 7-5)

Front 16

What happens when changes need to be made to a .ADMX/.ADML?

Back 16

When changes need to be made to settings managed bu the administrative template, they can be made to the single .ADMX file. Any administrators who modifies a GPO that uses the template accesses the same .ADMX file and calls the appropriate .ADML file to populate the users interface.

(Microsoft, 2011 p. 7-5)

Front 17

How do you add .ADMX/,ADML administrative templates to the GPME.

Back 17

Copy the .ADMX file into the 5SystemRoot%/PolicyDefinitions folder on your client or in the central store. Copy the .ADML file into the language-and-region-specific subfolder, such as en-us, of %SystemRoot%\PolicyDefinitions on your client or in the central store.

(Microsoft, 2011 p. 7-5)

Front 18

How would you migrate .ADM files to .ADMX?

Back 18

With the ADMX migrator

http://go.microsoft.com/fwlink/?Linkid=99466

(Microsoft, 2011 p. 7-6)

Front 19

Policies in the Administrative Templates node make changes to the ______________

Back 19

Registry

(Microsoft, 2011 p. 7-7)

Front 20

Settings provided in the Computer Configuration node will modify registry values in the

Back 20

HKEY_LOCAL_MACHINE (HKLM) key the machine where Group Policy is applied.

(Microsoft, 2011 p. 7-7)

Front 21

Name 2 ways to disableRegeditMode

Back 21

1. Regedit UI tool only

2. Also disable regedit /s


(Microsoft, 2011 p. 7-7)

Front 22

What are some Managed Policy Settings Characteristics?

Back 22

- User Interface (UI) is locked; user cannot make a change to the setting.

- Changes are made in one of four registry keys.

- Change and UI lock are "released" when the user/computer falls out of scope


(Microsoft, 2011 p. 7-8)

Front 23

What are some characteristics of unmanaged UI settings?

Back 23

- UI not locked

- Makes a change that is persistent; "tattoos" the registry


(Microsoft, 2011 p. 7-8)

Front 24

Characteristics options for Administrative Templates

Back 24

- managed policy settings

- unmanaged policy setting

- only managed setting shown by default

- change and UI lock are "released" when the user/computer falls out of scope


(Microsoft, 2011 p. 7-8)

Front 25

In administrative templates, what settings are shown by default?

Back 25

managed


(Microsoft, 2011 p. 7-8)

Front 26

How would you view unmanaged policy options in administrative templates?

Back 26

set filter options to view unmanaged settings


(Microsoft, 2011 p. 7-8)

Front 27

What are the four registry keys for managed templates?

Back 27

1. HKLM\Software\Policies (computer settings)

2. HKCU\Software\Policies (user settings)

3. HKLM\Software\Microsoft\Windows\Current Version\Policies (computer settings)

4. HKCU\Software\Microsoft\Windows\Current Version\Policies (user settings)


(Microsoft, 2011 p. 7-8)

Front 28

Can non administrators make changes to the registry keys.

Back 28

These keys are secured so that only administrators can make a change. Together with UI lockout, this means that nonadministrative users will receive the change specified by the policy setting and cannot modify the setting on their computer.

(Microsoft, 2011 p. 7-8)

Front 29

When are changes made by Group Policy Settings and the UI Lockout released?

Back 29

If the user or computer falls out of scope of the GPO. For example, if you delete a GPO, managed policy settings that had applied to a user will be released. This means that, generally, the setting resets to its previous state. Additionally, the UI interface for the setting is enabled.

(Microsoft, 2011 p. 7-8)

Front 30

An unmanaged policy setting makes a change that is _____________ in the registry.

Back 30

Peristant, If the GPO no longer applies, the setting remains. This is often called "tatooing" the registry, in other words, making a permanent change. To reverse the effect of teh policy setting, you must deploy a change that reverts the configuration to the desired state. Additionally, an unmanaged policy setting does not lock the UI for that setting.


(Microsoft, 2011 p. 7-9)

Front 31

How would you control which policy settings are visible in AD?

Back 31

right click Administrative Templates
Click Filter Options
then select from the managed drop-down list


(Microsoft, 2011 p. 7-9)

Front 32

In the Central store .ADM files are

Back 32

- Stored in the GPT

- Leads to version Control and GPO bloat problems

(Microsoft, 2011 p. 7-10)

Front 33

In the Central Store .ADMC/ADML filed are

Back 33

- retrieved from the client

- Problematic if the client doesn't have the appropriate files


(Microsoft, 2011 p. 7-10)

Front 34

In the Central Store how do you remotely create a folder called Policy Definitions on a DC

Back 34

\\contoso.com\SYSVOL\contoso.com\Policies\Policy Definitions


(Microsoft, 2011 p. 7-10)

Front 35

In the Central Store how do you Locally create a folder called Policy Definitions on a DC

Back 35

%SystemRoot%\SYSVOL\contos.com\Policies\PolicyDefinitions

(Microsoft, 2011 p. 7-10)

Front 36

Can you use the central store in mixed mode environments?

Back 36

Yes with systems earlier than windows vista?


(Microsoft, 2011 p. 7-11)

Front 37

Can you use the central store in mixed mode environments to manage groups?

Back 37

You must use Windows Vista, Windows Server 2008, or later to manage Group Policy. That is your administrative workstation must be running a version of Windows.


(Microsoft, 2011 p. 7-11)

Front 38

Can you filter Group Policies based on a specific version of Windows?

Back 38

Yes

(Microsoft, 2011 p. 7-13)

Front 39

What server can you search based on policy-setting comments

Back 39

Windows Server 2008 and higher enables you to add comments to policy settings in the Administrative Templates node. To do so double-click a policy setting and click the comment tab.

(Microsoft, 2011 p. 7-13)

Front 40

What is the starter GPO?

Back 40

new to windows server 2008 is Starter GPO/ A Starter GPO contains administrative Template settings. You can create a new GPO from a starter GPO. A starter GPO is, in effect, a template.

(Microsoft, 2011 p. 7-13)

Front 41

Group Policy preferences expand the range of configurable settings within a GPO and ___________

Back 41

- are not enforced

- enable IT pros to configure, deploy, and manage operating system and application settings that were not managed by using group policy

(Microsoft, 2011 p. 7-20)

Front 42

Four features of group policy preferences?

Back 42

1. Create

2. Delete

3. Replace

4. Update

(Microsoft, 2011 p. 7-20)

Front 43

What is the create feature of group policy preferences?

Back 43

Create a new item on the targeted computer.

(Microsoft, 2011 p. 7-20)

Front 44

What is the delete feature of group policy preferences?

Back 44

Remove an existing item from the targeted computer

(Microsoft, 2011 p. 7-20)

Front 45

What is the replace feature of Group Policy Preferences?

Back 45

Delete and re-create an item on the targeted computer

(Microsoft, 2011 p. 7-20)

Front 46

What is the update feature of Group Policy Preferences?

Back 46

Modify an existing item on the targeted computer.

(Microsoft, 2011 p. 7-20)

Front 47

Windows server 2008 includes more than ____ extensions that expand the range of configurable settings within a GPO.

Back 47

20

(Microsoft, 2011 p. 7-20)

Front 48

What are some benefits of Group Policy Preferences?

Back 48

- Reduces the need for logon scripts

- Limits Configuration Errors

- Minimizes image maintenance

(Microsoft, 2011 p. 7-20)

Front 49

In the common tab: what is the stop processing items in this extension if an error occurs?

Back 49

By default, errors do not prevent Group Policy Preferences from processing the remaining preference items in the same extension. If you want preferences to stop processing additional items if an error occurs, enable this option.

(Microsoft, 2011 p. 7-21)

Front 50

In the common tab: What is the Run in logged-on user's security context?

Back 50

By default, Group Policy preferences process preference items by using the local System account. As a result, these items can only access system environment resources, including network drives, you must enable this option to process the item by using the logged-on account.

(Microsoft, 2011 p. 7-21)

Front 51

In the common tab: What is the Remove this item when it is no longer applied

Back 51

Unlike policy settings, Group Policy does not remove preferences, when the GPO is removed from the user or the computer. Choosing this option changes the default behavior: when the GPO is removed from the user or computer.

(Microsoft, 2011 p. 7-21)

Front 52

In the common tab: What is Apply once and do not reapply?

Back 52

Group policy preferences items during the regular refresh interval, by default. As a result, Group Policy restores preference items, even though users can change the settings once they create.

(Microsoft, 2011 p. 7-21)

Front 53

In the common tab: What is Item Level Targeting?

Back 53

Targeting Determines to which users and computers a preference item applies. Enable this option, and then clic the Targeting button to configure targeting items for the preference item.

(Microsoft, 2011 p. 7-21)

Front 54

What is targeting Control?

Back 54

Item-level targeting determines the user and computers to which Group Policy applies individual preference items within a GPO. You can target different preference items within a single GPO at computer based on different criteria, You can use logical operators to join criteria, For example you can apple a preference if the computer matches a specific IP address range and operating system version.

(Microsoft, 2011 p. 7-22)

Front 55

Where are group Policy Preferences Written?

Back 55

Are written to the normal locations in the registry tha the application or operating system feature uses to store the setting.

(Microsoft, 2011 p. 7-23)

Front 56

Where are the Group Policy Settings Written?

Back 56

Strictly enforce policy settings by writing the settings to areas of the registry that standard users cannot modify

(Microsoft, 2011 p. 7-23)

Front 57

Is the user interface disabled in Group Policy Preferences?

Back 57

No, they Do not cause the application or operating system feature to disable the user interface for the settings they configure.

(Microsoft, 2011 p. 7-23)

Front 58

Is the user Interface disabled In Group Policy Settings?

Back 58

Yes, they Typically disable the user interface for settings that Group Policy is managing.

(Microsoft, 2011 p. 7-23)

Front 59

How often are refresh preferences in Group Policy Preferences refreshed ?

Back 59

Refresh preferences by using the same interval as Group Policy settings by default.

(Microsoft, 2011 p. 7-)

Front 60

How often are refresh policies in Group Policy Settings, refreshed?

Back 60

Refresh policy settings at regular interval

(Microsoft, 2011 p. 7-23)

Front 61

Where are group policy preferences not available?

Back 61

Local computers

(Microsoft, 2011 p. 7-23)

Front 62

Where are Group Policy Settings available?

Back 62

through local group policy

(Microsoft, 2011 p. 7-23)

Front 63

SMS

Back 63

System Management Server

(Microsoft, 2011 p. 7-29)

Front 64

GPSI

Back 64

Group Policy Software Installation

(Microsoft, 2011 p. 7-29)

Front 65

CSE

Back 65

Client Side Extension

(Microsoft, 2011 p. 7-30)

Front 66

.msi

Back 66

Windows installer package

(Microsoft, 2011 p. 7-30)

Front 67

Windows installer package (.msi)

Back 67

- Operationally modified by transform (.mst) or patches (.msp)

- GPSI automatically installs with elevate privileges

(Microsoft, 2011 p. 7-30)

Front 68

.zap

Back 68

Downlevel application package

(Microsoft, 2011 p. 7-30)

Front 69

Downlevel application package is supported by

Back 69

"Publish" option only

(Microsoft, 2011 p. 7-30)

Front 70

What kind of privileges do you need to have to access downlevel application?

Back 70

Admin privileges

(Microsoft, 2011 p. 7-30)

Front 71

.mst

Back 71

Transform files

(Microsoft, 2011 p. 7-30)

Front 72

What are transform files?

Back 72

.mst - These files provide a means for customizing the installation of an application. Some applications provide wizards or templates that permit a user to create transforms. For example, Adobe provides an enterprise deployment tool for Adobe Acrobat Reader that generates a transform. Many enterprises use the transform to configure agreement with the end-user license agreement and to disable certain features of the application, such as automatic updates that involve access to the internet.

(Microsoft, 2011 p. 7-30)

Front 73

.msp

Back 73

update files

(Microsoft, 2011 p. 7-31)

Front 74

What are update files?

Back 74

.msp - These files are used to update an existing .msi file for security updates, bug fixes, and service packs. An .msp file provides instructions about applying the updated files and registry keys in the software patch, service pack, or software update, For example updates to Microsoft Office 2003 and later are provided as .msp files.

(Microsoft, 2011 p. 7-31)

Front 75

How must you deploy .mso and .mst files be deployed?

Back 75

They must be applied to an existing Windows Installer Package.

(Microsoft, 2011 p. 7-31)

Front 76

What are downlevel application packages?

Back 76

GPSI can make limited use of non-MSI applicationfiles (.zap files), also known as down-level application packages that specify the location of the software distribution point (SDP) and the setup command. See knowledge base article 231747 at http://go.microsoft.com/fwlink/?LinkID=214197 for details.

(Microsoft, 2011 p. 7-31)

Front 77

When can GSPI fully manage an application?

Back 77

only if the applications are deployed by using Windows Installer Packages. Other tools, including configuration Manager and SMS, can manage applications that use other deployment mechanisms.

(Microsoft, 2011 p. 7-31)

Front 78

SDP

Back 78

Software Distribution Point

(Microsoft, 2011 p. 7-31)

Front 79

What are software deployment options?

Back 79

- Assign Application to users

- Publish Application to users

- Assign to computers

(Microsoft, 2011 p. 7-32)

Front 80

What happens when you assign applications?

Back 80

When you assign an application to a user, the application's local registry settings, including file name extensions, are updated and it's shortcuts are created on the Start Menu, or desktop, advertising the availability of the application.

(Microsoft, 2011 p. 7-32)

Front 81

What happens when you publish an application?

Back 81

When you publish an application to users, the application does not appear as if it is installed on the users' computer. No shortcuts are visible on the desktop or start menu. Instead, the application appears as an available application for the user to uninstall using Add or Remove Programs in control panel on windows XP system or in programs and features on a Windows Server 2008, Windows Vista, or Windows 7 system. Additionally, the application can be installed when a user opens a file type associated with the application .

(Microsoft, 2011 p. 7-32)

Front 82

Many organizations have found that it is easiest to manage software by

Back 82

linking an application's GPO to the domain and filtering the GPO so that it contains the users and computers to which the application should be deployed.

(Microsoft, 2011 p. 7-38)

Front 83

Steps to maintain software deployed with GPSI?

Back 83

- Redeploy applications

- Upgrade applications

- Remove Applications

(Microsoft, 2011 p. 7-39)

Front 84

Redeploy applications with GPSI

Back 84

- After a successful instal, client will not attempt to reinstall app

- You might make a change to the package

- Package -> All Taks -> Redeploy Applications

(Microsoft, 2011 p. 7-39)

Front 85

Upgrade applications with GPSI?

Back 85

- Create new package in same or different GPO

- Advanced -> Upgrade -> Select Package to upgrade

- Uninstall old version first; or install over old version

(Microsoft, 2011 p. 7-39)

Front 86

Remove Applications with GPSI

Back 86

- Package -> All Tasks -> Remove

- Uninstall immediately (forced removal) or Prevent new installations (optional removal)

- Don't delete or unlink GPO until all clients have applied settings

(Microsoft, 2011 p. 7-39)

Front 87

What is the option to - Immediately uninstall the software from users and computers

Back 87

This option is known as forced removal, causes computers to remove the application. The software installation extension will remove an application when the computer restarts if the application was deployed with a package in the Computer Configuration portion of the GPO. If the package is in the User Configuration portion, the application is uninstalled the next time the user logs on.

(Microsoft, 2011 p. 7-40)

Front 88

What is the option to - Allows users to continue to use the Software, but prevents New Installations.

Back 88

This setting, known as optional removal, causes the software installation extension to avoid adding the package to systems that do not yet have the package installed. Computers that had previously installed the application is uninstalled the next time the user logs on.

(Microsoft, 2011 p. 7-40)

Front 89

What is the option - Uninstall this application when it falls out of the scope of management

Back 89

you can simple delete, disable, or uplink the GPO, and the application will be forcibly removed by all clients that have installed the package with that setting.

(Microsoft, 2011 p. 7-40)

Front 90

A slow link by default fot GPSI is

Back 90

less than 500 kbps

(Microsoft, 2011 p. 7-41)

Front 91

When does a CSE not process

Back 91

By default when GPSI is running over a slow link, less than 500kbps

(Microsoft, 2011 p. 7-41)

Front 92

How do you change slow link processing behavior og each CSE

Back 92

Computer Configuration\Policies\Administrative Templates\System\Group Policy

(Microsoft, 2011 p. 7-41)

Front 93

How do you change the slow link threshold?

Back 93

Computer [or user] Configuration\Policies]Administrative Templates\System]Group Policies

(Microsoft, 2011 p. 7-41)

Front 94

What are the best practices related to Group Policy Management?

Back 94

- MAke comments on GPO settings

- Use Central store for Administrative Templates when having clients with Windows Vista and Windows 7

- Use Group Policy preferences to configure settings not available in Group Policy set of settings

- Use Group Policy Software installation to deploy packages in .msi format to a large number of users or computers.

(Microsoft, 2011 p. 7-47)

Front 95

What is the Group Policy Reporting RSoP Tool?

Back 95

Reporting information about the current polices being delivered to the clients

(Microsoft, 2011 p. 7-48)

Front 96

What is the GPResult tool?

Back 96

A command-line utility that displays RSoP information.

Front 97

What is GPUdate tool

Back 97

Refreshing local and AD DS - Based Group Policy settings via cmd

(Microsoft, 2011 p. 7-48)

Front 98

What is DCGpofix tool

Back 98

Restoring the default group policy objects to their original state after initial installation via cmd

(Microsoft, 2011 p. 7-48)

Front 99

What is the GPOLogView tool

Back 99

Exporting Group Policy-related events from the system and operational logs into text. HTML, or XML file. For use with Windows Vista and later versions via cmd

(Microsoft, 2011 p. 7-48)