Group Policy Management Console

Group Policy Management Console (GPMC) is a scriptable Microsoft Management Console (MMC) snap-in, providing a single administrative tool for managing Group Policy across the enterprise. GPMC is the standard tool for managing Group Policy.

For help with specific tasks, see:

  • Get Started Using the GPMC

  • Edit, Filter, and Comment Policy Settings

  • Configure, Target, and Comment Preference Items

  • Back Up, Restore, Import, and Copy Group Policy Objects

  • Control the Scope of Group Policy Objects

  • Use Resultant Set of Policy to Manage Group Policy

  • Delegate Permissions for Group Policy

  • Use Windows PowerShell to Manage Group Policy

For help with troubleshooting and additional resources, see:

  • Resources for the GPMC


Get Started Using the GPMC

This section includes these topics:

  • Open the GPMC

  • Customize the GPMC User Interface

  • Working with Group Policy Objects

  • Set Up Domains, Forests, and Sites

  • View, Print, and Save a Report of Group Policy Object Settings

Additional References

Microsoft Windows Server TechCenter


Install the GPMC

The Group Policy Management Console (GPMC) is included with Windows Server® 2008 and later. However, this feature is not installed with the operating system. Use Server Manager to install the GPMC.

Install the GPMC using the user interface

Install the GPMC using the command line

Install the GPMC using the user interface

To install the GPMC using the Server Manager user interface

  1. To open Server Manager, click Start and then point to Administrative Tools. Click Server Manager.

  2. In the console tree, click Features. In the Features pane, click Add Features.

  3. In the Add Feature Wizard dialog box, select Group Policy Management Console from the list of available features. Click Install.

  4. Close Server Manager when the installation completes.

Install the GPMC using the command line

To install the GPMC using the command line

  1. Open a command prompt as an administrator.

  2. In the command prompt type ServerManagerCmd -install gpmc.

  3. Close the command prompt when the installation completes.

Additional references

  • Open the GPMC

  • Customize the GPMC User Interface

  • Working with Group Policy Objects

  • Working with Starter GPOs

  • Set Up Domains, Forests, and Sites


Open the GPMC

You can start Group Policy Management Console (GPMC) using one of two methods.

To start GPMC

  • Do either of the following:

    • Press the Windows logo key + R to open the RUN dialog box. Type gpmc.msc in the text box, and then click OK or press ENTER.

    • Click Start, click All Programs, click Accessories, and then click Run. Type gpmc.msc in the text box, and then click OK or press ENTER.

Additional references

Get Started Using the GPMC


Customize the GPMC User Interface

You can customize the Group Policy Management Console (GPMC) user interface (UI) by performing the procedures in this topic.

To set user interface options

  1. Open the GPMC.

  2. On the View menu, click Options.

  3. Click one or more of the following tabs to customize the GPMC UI:

    On the Columns tab:

    1. Select a table from the Table location list.

    2. In Columns displayed in this order, add a check next to each column that should be displayed.

    3. Select a column and use the Move Up and Move Down buttons to set the order of columns.

    4. Repeat steps 2 and 3 for each table in the Table location list that you want to change, and then click OK.

    5. On by default, Save customized column order and sizes makes column order and size selections persistent. Clear this check box if you do not want the selections to persist.

    On the Reporting tab, select one of the following options:

    • To specify that GPMC should use the local .adm files, select Default. If an .adm file is not found locally, GPMC will search the Group Policy objects (GPO) folder in the sysvol folder.

    • To specify a custom location that takes precedence over the default locations, select Custom, and then enter the location where the .adm files are stored.

      Important

      This procedure applies only to .adm files and not the ADMX files in Windows® 7 or Windows Vista®. The ADMX file location is not configurable. The GPMC automatically reads ADMX files from either the local store or the domain-based central store.

    On the General tab, select one of the following options:

    • To display only forests or domains that have two-way trusts to the user's domain, select Enable trust checking. This setting is selected by default.

    • To show domain name controller names in parentheses after each domain in the GPMC, select Show domain controllers after domain names.

    • To display a confirmation dialog box to distinguish between GPOs and GPO links every time a GPO or GPO link is selected in the GPMC, select Show confirmation dialog box to distinguish between GPOs and GPO links. This setting is selected by default.

Additional considerations

  • The GPMC uses files that have .adm, .admx, and .adml extensions to display the friendly names of policy settings when generating HTML reports for GPOs, Group Policy Modeling, and Group Policy Results. These options let you control the location from which the GPMC reads only .adm files.

  • If you add or change an .adm or ADMX file in an existing location, you must restart GPMC for the GPMC to display the change in the .adm or .admx file when displaying HTML reports.

  • The GPMC never copies the .adm or ADMX files to the sysvol folder.

Additional references

Get Started Using the GPMC


Working with Group Policy Objects

  • Create and Edit a Group Policy Object

  • Search for a Group Policy Object

  • Delete a Group Policy Object

  • Comment a Group Policy Object

Additional references

Get Started Using the GPMC


Create and Edit a Group Policy Object

You can use the Group Policy Management Console (GPMC) to create and edit Group Policy objects (GPOs).

Creating and editing a Group Policy object

  • Create a Group Policy object

  • Edit a Group Policy object

Note

You can also create a GPO from a Starter GPO. For more information, see Create a New GPO from a Starter GPO.
To create a Group Policy object

  1. In the GPMC console tree, right-click Group Policy Objects in the forest and domain in which you want to create a GPO.

  2. Click New.

  3. In the New GPO dialog box, specify a name for the new GPO, and then click OK.

To edit a Group Policy object

  1. In the GPMC console tree, double-click Group Policy Objects in the forest and domain containing the GPO that you want to edit.

  2. Right-click the GPO, and then click Edit.

  3. In the console tree, edit the settings as appropriate.

    Important

    The Default Domain Policy GPO and Default Domain Controllers Policy GPO are vital to the health of any domain. As a best practice, you should not edit the Default Domain Controllers Policy GPO or the Default Domain Policy GPO, except in the following cases:

    • Account policy settings are required to be configured in the Default Domain GPO.

    • If you install applications on domain controllers requiring modifications to User Rights or Audit policy settings, you must modify the policy settings in the Default Domain Controllers Policy GPO.

Additional considerations

  • When you create a GPO, it will not have an effect until it is linked to a site, domain, or organizational unit (OU).

  • By default only domain administrators, enterprise administrators, and members of the Group Policy creator owners group can create and edit GPOs.

  • To edit IPSec policy settings from within a GPO, you must be a member of the domain administrators group.

  • You can also edit a GPO by right-clicking the name of the GPO in any container in which it is linked, and then clicking Edit.

Additional references

Working with Group Policy Objects


Search for a Group Policy Object

To search for a Group Policy object

  1. In the Group Policy Management Console (GPMC) console tree, double-click the forest containing the domain where you want to search for a Group Policy object (GPO). Double-click Domains, right-click the domain, and then click Search.

  2. In the Search for Group Policy objects dialog box, in the Search for GPOs in this domain box, select a domain or select All domains shown in this forest.

  3. In the Search item box, select the type of object on which you want to base your search.

    If you select Security Group, the Select User, Computer, or Group dialog box appears. Specify the appropriate object type, location of the object, and object name, and then click OK.

    You can choose GPO-links on the Search item dropdown menu to find unlinked GPOs and GPOs linked across domains.

  4. In the Condition box, select the condition that you want to use in the search.

  5. In the Value box, select or specify the value that you want to use to filter the search, and then click Add.

  6. Repeat Steps 4 and 5 until you complete the definition of all search criteria, and then click Search.

  7. When search results are returned, do one of the following:

    • To save the search results, click Save results and then, in the Save GPO Search Results dialog box, specify the file name for the saved results, and then click Save.

    • To navigate to a GPO found in the search, double-click the GPO in the search results list.

    • To clear the search results, click Clear.

Additional considerations

  • You can also open the search dialog box by right-clicking a forest and then clicking Search. In this case, the search for GPOs in this domain box defaults to All domains shown in this forest.

  • If a policy setting is enabled and then all the policy settings in that extension are removed, there can be false-positive search results for certain types of settings. This happens because the GPO has the extension listed as active. The extensions with this behavior are Security Settings, Software Installation, Folder Redirection, Internet Explorer Maintenance, and Encrypting File System (EFS).

Additional references

Working with Group Policy Objects


Delete a Group Policy Object

To delete a GPO

  1. In the Group Policy Management Console (GPMC) console tree, double-click Group Policy Objects in the forest and domain containing the Group Policy object (GPO) that you want to delete.

  2. Right-click the GPO, and then click Delete.

  3. When prompted to confirm the deletion, click OK.

Additional considerations

  • To delete a GPO, you must have Edit Settings, Delete, and Modify Security permissions for the GPO.

  • When you delete a GPO, GPMC attempts to delete all links to that GPO in the domain of the GPO. If you do not have rights to delete a link, the GPO will be deleted, but the link will remain. Links from other domains and sites are not deleted. The link to a deleted GPO appears in GPMC as Not Found. To delete Not Found links, you must have permission on the site, domain, or organizational unit containing the link.

  • You cannot delete the Default Domain Controllers Policy GPO or the Default Domain Policy GPO.

Additional references

Working with Group Policy Objects


Comment a Group Policy Object

You can include comments for each Group Policy object. You can use this space to document the Group Policy object and why its implementation is important to your environment. Commenting GPOs allows you to later use keyword filter to help you quickly find GPOs with matching keywords.

Adding a comment to a Group Policy object

  1. Open the Group Policy Management Console. Expand the Group Policy Objects node.

  2. Right-click the Group Policy object you want to comment and then click Edit.

  3. In the console tree, right-click the name of the Group Policy object and then click Properties.

  4. Click the Comment tab.

  5. Type your comments in the Comment box.

  6. Click OK

Additional references

Working with Group Policy Objects


Working with Starter GPOs

Starter Group Policy objects derive from a Group Policy object (GPO), and provide the ability to store a collection of Administrative Template policy settings in a single object. You can import and export Starter GPOs, which makes them easy to distribute to other environments. When you create a new GPO from a Starter GPO, the new GPO has all of the Administrative Template policy settings and their values that were defined in the Starter GPO.

This section includes these topics:

  • Create and Edit a Starter GPO

  • Delete a Starter GPO

  • Create a New GPO from a Starter GPO

  • Back Up and Restore a Starter GPO

  • View, Print, and Save a Report of Starter GPO Settings

  • Import and Export Starter GPOs

  • Comment a Starter GPO


Create and Edit a Starter GPO

The Group Policy Management Console (GPMC) stores Starter GPOs in a folder named StarterGPOs, located on the shared sysvol folder found on domain controllers.

Note

GPMC searches for this folder when you click Starter GPOs in the user interface. When the folder does not exist, GPMC displays a Create Starter GPOs Folder button. Click Create Starter GPOs Folder to create the Starter GPOs storage location.

Creating and editing a Starter GPO

  • Create a Starter GPO

  • Edit a Starter GPO
Create a Starter GPO

  1. Open the Group Policy Management Console.

  2. Right-click Starter GPOs and then click New.

  3. In the New Starter GPO dialog box, type the name of the Starter GPO in the Name box. Optionally, you can type comments in the Comments box.

  4. Click OK.
Edit a Starter GPO

  1. Open the Group Policy Management Console. Expand the Starter GPOs node.

  2. Right-click the Starter GPO you want to edit and then click Edit.

  3. In the console tree, click the folder under Administrative Templates that contains the policy settings you want to configure.

  4. In the Setting column, click the name for a policy setting to read a description of the policy setting.

  5. To change a policy setting, double-click the name of the policy setting.

  6. In the policy setting dialog box, click one of the following:

    • Not Configured: The registry is not modified.

    • Enabled: The registry reflects that the policy setting is selected.

    • Disabled: The registry reflects that the policy setting is not selected.

  7. Select any other available options, and then click OK.

Additional considerations

  • System Starter GPOs are read only. For more information, see System Starter GPOs.

Additional references

Working with Starter GPOs


Copy a Starter GPO

Copying a Starter GPO

  1. Open the Group Policy Management Console. Expand the Starter GPOs node.

  2. Right-click the Starter GPO you want to copy and then click Copy.

  3. Right-click the Starter GPO node and then click Paste.

  4. Click OK.

Additional references

Working with Starter GPOs


Delete a Starter GPO

Delete a Starter GPO

  1. Open the Group Policy Management Console. Expand the Starter GPOs node.

  2. Right-click the Starter GPO you want to delete and then click Delete.

  3. Click OK to confirm the deletion.

Additional references

Working with Starter GPOs


Create a New GPO from a Starter GPO

There are two ways to create a new Group Policy object from a Starter GPO. You can create a new Group Policy object from a Starter GPO at the Starter GPOs node or at the Group Policy objects node.

Create a new GPO from a Starter GPO at the Starter GPOs node

  1. Open the Group Policy Management Console. Expand the Starter GPOs node.

  2. Right-click the Starter GPO you want to use to create a new Group Policy object and then click New GPO from Starter GPO.

  3. In the New GPO dialog box, type the name of the new Group Policy object in the Name box.

  4. Click OK.

Create a new GPO from a Starter GPO at the Group Policy objects node

  1. Open the Group Policy Management Console. Right-click the Group Policy Objects node.

  2. In the New GPO dialog box, type the name of the new Group Policy object in the Name box.

  3. Select the Starter GPO from the Source Starter GPO list that you want to use to create a new Group Policy object.

  4. Click OK.

Additional references

Working with Starter GPOs


Back Up and Restore a Starter GPO

Backing up a Starter GPO

  1. Open the Group Policy Management Console. Expand the Starter GPOs node.

  2. To back up a single Starter GPO, right-click the Starter GPO, and then click Back Up. To back up all Starter GPOs in the domain, right-click Starter GPOs and click Back Up All.

  3. In the Backup Starter GPO dialog box, in the Location box, enter the path for the location where you want to store the Starter GPO backups. Or click Browse, locate the folder in which you want to store the Starter GPO backups, and then click OK.

  4. In the Description box, type a description for the Starter GPOs that you want to back up, and then click Back Up. If you are backing up multiple Starter GPOs, the description will apply to all Starter GPOs you back up.

  5. After the operation completes, click OK.

    Important

    To secure backed-up Starter GPOs, ensure that only authorized administrators have permission to access the folder to which you are backing up the Starter GPOs.
Restoring a Starter GPO

  1. Open the Group Policy Management Console. Expand the Starter GPOs node.

  2. Right-click Starter GPOs and then click Manage Backups.

  3. In the Manage Backups dialog box, in the Backup location box, type the path for the backup folder. You can also use Browse to locate the backup folder.

  4. In the Backed up Starter GPOs box, select the Starter GPO that you want to restore from the list of Starter GPO backups shown, and then click Restore.

  5. When prompted to confirm the restore operation, click OK.

  6. After the operation completes, click OK and then click Close.

Additional references

Working with Starter GPOs


View, Print, and Save a Report of Starter GPO Settings

To view, print, and save a report of Starter GPO settings

  1. Open the Group Policy Management Console. Expand the Starter GPOs node.

  2. Click the Starter GPO that has the settings you want to view.

  3. Click the Settings tab to view reports in GPMC.

  4. If you want to print or save the report, right-click the settings report in the results pane and do one of the following:

    • Select Print to print the report.

    • Select Save Report to save the report.

      Note

      To customize the information displayed in a report, click Show or Hide to display only the data you want to view or print.

Additional references

Working with Starter GPOs


Import and Export Starter GPOs

The import and export feature of Starter GPOs makes it easy to share Starter GPOs with other environments.

Importing a Starter GPO

  1. Open the Group Policy Management Console. Click the Starter GPOs node.

  2. Click Load Cabinet. Then click Browse for CAB.

  3. Use the Load Starter GPO dialog box to locate the Starter GPO cabinet you want to load. Click the file name and then click Open.

  4. Click OK to complete the import.

Exporting a Starter GPO

  1. Open the Group Policy Management Console. Click the Starter GPOs node.

  2. Click Save as Cabinet.

  3. In the Save Starter GPO as Cabinet window, type the name of the file in the File name box. Optionally, you can click Browse Folders if you want to change the location where the cabinet file is saved.

  4. Click Save.

Additional references

Working with Starter GPOs


Comment a Starter GPO

You can include comments for each Starter GPO. You can use this text box to further document the intended use of the Starter GPO or the name of the user who last updated the Starter GPO. Commenting Starter GPOs allows you to later use keyword filter to help you quickly find a Starter GPO with matching keywords.

Adding a Comment to a Starter Group Policy object

  1. Open the Group Policy Management Console. Expand the Starter GPOs node.

  2. Right-click the Starter GPO you want to comment and then click Edit.

  3. In the console tree, right-click the name of the Starter GPO and then click Properties.

  4. Click the Comment tab.

  5. Type your comments in the Comment box.

  6. Click OK.

Additional considerations

  • System Starter GPOs are read only. For more information, see System Starter GPOs.

Additional references

Working with Starter GPOs


System Starter GPOs

System Starter Group Policy objects (GPOs) are read-only Starter GPOs that provide a baseline of settings for a specific scenario. Like Starter GPOs, they derive from a GPO, provide the ability to store a collection of Administrative Template policy settings in a single object, and can be imported. You can determine whether a Starter GPO is a System Starter GPO by viewing the Starter GPO type on the Details tab of the Starter GPO.

A variety of System Starter GPOs are included with Windows Server® 2008 R2. For information about the recommended use of each System Starter GPO, see the Comment on the Details tab for that Starter GPO.

Additional references

Working with Starter GPOs


Set Up Domains, Forests, and Sites

  • Add a Domain

  • Specify a Domain Controller

  • Add a Forest

  • Add a Site

Additional references

Get Started Using the GPMC


Add a Domain

After performing this procedure, you can view and manage an existing Active Directory domain using Group Policy Management Console (GPMC).

To add a domain in GPMC

  1. In the GPMC console tree, double-click the forest to which you want to add a domain, right-click Domains, and then click Show Domains.

  2. In the Show Domains dialog box, select the check box next to each domain to be added to GPMC, and then click OK.

Additional considerations

  • Adding a domain to GPMC does not actually create a new domain in Active Directory.

  • Domains are always shown as peers of each other, regardless of their actual relationship.

  • You can use the Add Forest function to add externally trusted domains.

Additional references

  • Set Up Domains, Forests, and Sites

  • Add a Forest


Specify a Domain Controller

To specify a domain controller

  1. In the Group Policy Management Console (GPMC) console tree, perform one of the following actions:

    • If you want to specify the domain controller for a domain, double-click the forest containing the domain of interest, double-click Domains, right-click the domain of interest, and then click Change Domain Controller.

    • If you want to specify the domain controller for a site, double-click the forest that contains the sites of interest, right-click Sites, and then click Change Domain Controller. In the Look in this domain drop-down list of the Change Domain Controller dialog box, select the domain in which the domain controller resides.

  2. Select the domain controller option from the Change Domain Controller dialog box and click OK.

Additional considerations

  • All operations performed in a domain on Group Policy objects, security groups, and organizational units use the domain controller that you specify for the domain.

  • All operations performed on links to sites use the domain controller that you specify for the sites.

Additioanl references

  • Set Up Domains, Forests, and Sites


Add a Forest

To add a forest

  1. In the Group Policy Management Console (GPMC) console tree, right-click Group Policy Management, and then click Add Forest.

  2. In the Add Forest dialog box, type the DNS or NetBIOS name of any domain in the forest, and then click OK.

You can specify either the DNS name or the NetBIOS name of any domain in the forest. If you specify a NetBIOS name, you must confirm that the NetBIOS name corresponds to the DNS name of the domain.

Additional considerations

  • Adding a forest to GPMC does not create a new forest in Active Directory.

  • Group Policy objects cannot be linked outside a forest.

  • GPMC supports management of multiple forests from within the console, when there is trust between the target forest and the forest of your user object.

  • You can use the Add Forest function to add externally trusted domains, even if you do not have forest trust with the entire forest. However, you must have trust between the domain you want to add and the domain of your user object.

Additional references

  • Set Up Domains, Forests, and Sites


Add a Site

To add a site

  1. In the Group Policy Management Console (GPMC) console tree, double-click the forest in which you want to add a site, right-click Sites, and then click Show Sites.

  2. In the Show Sites dialog box, select the check box next to each site you wish to display in the console tree, and then click OK.

Additional considerations

  • Sites do not appear in the console tree unless you explicitly add them.

Additional references

  • Set Up Domains, Forests, and Sites


View, Print, and Save a Report of Group Policy Object Settings

To view, print, and save a report of Group Policy object settings

  1. In the Group Policy Management Console (GPMC) console tree, double-click the forest containing the domain or organizational unit that contains the Group Policy object (GPO) with which you want to work, and then select the GPO.

  2. Click the Settings tab to view reports in GPMC.

  3. If you want to print or save the report, right-click the settings report in the results pane and do one of the following:

    • Select Print to print the report.

    • Select Save Report to save the report.

      Note

      To customize the information displayed in a report, click Show or Hide to display only the data you want to view or print.

Additional considerations

  • To view a description of a setting in Administrative Templates, click the setting name in the report.

  • From within GPMC, it is not possible to use the keyboard to navigate inside an HTML report. To navigate inside the HTML report, save the report to a file and then use Microsoft Internet Explorer to view the report.

Additional references

  • Get Started Using the GPMC


Edit, Filter, and Comment Policy Settings

  • Administrative Template Policy Settings

  • Classic Administrative Templates

  • Editing Software Settings

  • Using Startup, Shutdown, Logon, and Logoff Scripts

  • Using Folder Redirection


Administrative Template Policy Settings

Administrative Templates are registry-based policy settings that appear under the Administrative Templates node of both the Computer and User Configuration nodes. This hierarchy is created when the Group Policy Management Console reads XML-based Administrative Template files (.admx).

This section includes these topics:

  • Edit Administrative Template Policy Settings

  • Filtering Administrative Template Policy Settings

  • Add Comments to Administrative Template Policy Settings


Edit Administrative Template Policy Settings

To edit Administrative Template policy settings

  1. Open the Group Policy Management Console. Right-click the Group Policy object you want to edit and then click Edit.

  2. In the console tree, click the folder under Administrative Templates that contains the policy settings you want to configure.

  3. In the Setting column, click the name for a policy setting to read a description of the policy setting.

  4. To change that policy setting, double-click the name of the policy setting.

  5. On the policy setting dialog box, click one of the following:

    • Not Configured: The registry is not modified.

    • Enabled: The registry reflects that the policy setting is selected.

    • Disabled: The registry reflects that the policy setting is not selected.

  6. Select any other options, and then click OK.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • Settings for HKEY_LOCAL_MACHINE are under Computer Configuration, and settings for HKEY_CURRENT_USER are under User Configuration.

  • If computer policy conflicts with user policy, computer policy generally takes precedence. However, if application authors disregard this convention, Group Policy cannot enforce it.

  • Administrative Template policy settings are also known as registry-based policy settings.


Filtering Administrative Template Policy Settings

The Group Policy Management Console provides the option to filter Administrative Template policy settings based on:

  • Managed, Configured, or Commented policy settings.

  • Keywords within the title, Help text, or comment of policy settings.

  • Platform or application requirements of policy settings.

Apply filters on Administrative Template policy settings when you want to find a specific policy setting or when you want to limit the number of policy settings displayed in the Group Policy Management Console.

This section includes these topics:

  • Filter by Using Property filters

  • Filter by Using Keyword Filters

  • Filter by Using Requirement Filters


Filter by Using Property filters

The Group Policy Management Console allows you to change the criteria for displaying Administrative Template policy settings. By default, the editor displays all policy settings, including unmanaged policy settings. However, you can use property filters to change how the Group Policy Management Console displays Administrative Template policy settings.

There are three inclusive property filters that you can use to filter Administrative Templates. These property filters include:

  • Managed

  • Configured

  • Commented

Managed

There are two kinds of Administrative Template policy settings: Managed and Unmanaged. The Group Policy service governs Managed policy settings and removes a policy setting when it is no longer within scope of the user or computer.

The Group Policy service does not govern unmanaged policy settings. These policy settings are persistent. The Group Policy service does not remove unmanaged policy settings, even if the policy setting is not within scope of the user or computer. Typically, you use these types of policy settings to set preferences for operating system components that are not policy enabled. You can also use unmanaged policy settings for application settings.

The Managed property filter has three states: Any, Yes, and No. Setting this property filter to Any causes the Group Policy Management Console to display all Administrative Template policy settings. Setting this property filter to Yes causes the editor to show only managed Administrative Template policy settings, hiding all unmanaged Administrative Template policy settings. Setting this property filter to No causes the editor to show only unmanaged Administrative Template policy settings, hiding all managed Administrative Template policy settings.

To set the Administrative Templates Managed property filter

  1. Open the Group Policy Management Console. Right-click the Group Policy object you want to edit and then click Edit.

  2. Right-click Administrative Templates located under Computer Configuration\Policies or User Configuration\Policies. Click Filter Options.

  3. In the Managed list, click the appropriate filter.

  4. Click OK to apply the new filter settings, and close the Filter Options dialog box.

Configured

You can configure Administrative Template policy settings to one of three states: Not Configured, Enabled, and Disabled. Not Configured is the default state for all policy settings. Policy settings set to Not Configured do not affect users or computers. Enabling an Administrative Template policy setting activates the policy setting. When Enabled, the action described in the title of the policy setting applies to the user or computer. When Disabled, the opposite action described in the title of the policy setting applies to the user or computer. Usually Not Configured and Disabled policy settings produce the same results. The difference is that Not Configured policy settings do not apply to the user, but Disabled policy settings apply to a user.

Each Administrative Template policy setting provides detailed information about its Enabled, Disabled, and Not Configured states. You can view this information in the Help pane of each Administrative Template policy setting. Or, you can view this information for the selected policy setting in the Extended View of the editor.

The Configured property filter has three states: Any, Yes, and No. Setting this property filter to Any causes the Group Policy Management Console to display all Administrative Template policy settings and is the default setting for this filter. Setting this property filter to Yes causes the editor to show only configured Administrative Template policy settings, hiding not configured policy settings. Setting this property filter to No causes the editor to show only not configured Administrative Template policy settings, hiding configured policy settings.

To set the Administrative Templates Configured property filter

  1. Open the Group Policy Management Console. Right-click the Group Policy object you want to edit and then click Edit.

  2. Right-click Administrative Templates located under Computer Configuration\Policies or User Configuration\Policies. Click Filter Options.

  3. In the Configured list, click the appropriate filter.

  4. Click OK to apply the new filter settings, and close the Filter Options dialog box.

Commented

Each Administrative Template policy setting has a comment property. The Commented property allows you to enter text associated with a specific policy setting.

The Commented property filter has three states: Any, Yes, and No. Setting this property filter to Any causes the Group Policy Management Editor to display all Administrative Template policy settings and is the default setting for this filter. Setting this proper filter to Yes causes the editor to show only commented Administrative Template policy settings, hiding policy settings without comments. Setting this property filter to No causes the editor to show only Administrative Template policy settings without comments, hiding commented policy settings.

To set the Administrative Templates Commented property filter

  1. Open the Group Policy Management Console. Right-click the Group Policy object you want to edit and then click Edit.

  2. Right-click Administrative Templates located under Computer Configuration\Policies or User Configuration\Policies. Click Filter Options.

  3. In the Commented list, click the appropriate filter.

  4. Click OK to apply the new filter settings and close the Filter Options dialog box.

Additional considerations

  • Filters are inclusive; therefore, select items you want to display rather than items you want to be removed.

  • Filters do not work with Classic Administrative Templates.


Filter by Using Keyword Filters

The Group Policy Management Console allows you to change the criteria for displaying Administrative Template policy settings. By default, the editor displays all policy settings, including preference settings (previously referred to as unmanaged policy settings). However, you can use keyword filters to change how the Group Policy Management Editor displays Administrative Template policy settings.

To set the Administrative Templates Keyword filter

  1. Open the Group Policy Management Console. Right-click the Group Policy object you want to edit and then click Edit.

  2. Right-click Administrative Templates located under Computer Configuration or User Configuration. Click Filter Options.

  3. Select the Enable Keyword Filters check box.

  4. Type one or more keywords in the Filter for word(s) box.

  5. In the Search Criteria list, click the appropriate filter:

    • Any: The filter includes any of the words in the Filter for word(s) box.

    • All: The filter includes all of the words in the Filter for word(s) box.

    • Exact: The filter includes exact matches of the words in the Filter for word(s) box.

  6. Select the appropriate check boxes next to Within.

    • Policy Setting Title: The filter includes searching the title of the policy setting.

    • Help Text: The filter includes searching the Help text of the policy setting.

    • Comment: The filter includes searching the comment of the policy setting

  7. Click OK to apply the new filter settings and close the Filter Options dialog box.

Additional considerations

  • Filters are inclusive; therefore, select items you want to display rather than items you want to be removed.

  • Filters do not work with Classic Administrative Templates.


Filter by Using Requirement Filters

The Group Policy Management Console allows you to change the criteria for displaying Administrative Template policy settings. By default, the editor displays all policy settings, including preference settings (previously referred to as unmanaged policy settings). However, you can use requirement filters to change how the Group Policy Management Console displays Administrative Template policy settings.

To set the Administrative Templates Requirement filter

  1. Open the Group Policy Management Console. Right-click the Group Policy object you want to edit and then click Edit.

  2. Right-click Administrative Templates located under Computer Configuration or User Configuration. Click Filter Options.

  3. Select the Enable Requirements Filters check box.

  4. Type one or more keywords in the Filter for word(s) box.

  5. In the Select the desired platform and application filter(s) list, click the appropriate filter:

    • Include settings that match any of the selected platforms.

    • Include settings that match all of the selected platforms.

      Note

      You can click Select All to select all of the items in the list, or you can click Clear All to clear all of the items in the list.

  6. Click OK to apply the new filter settings and close the Filter Options dialog box.

Additional considerations

  • Filters are inclusive; therefore, select items you want to display rather than items you want to be removed.

  • Filters do not work with Classic Administrative Templates.


Add Comments to Administrative Template Policy Settings

You can include comments for each Administrative Template policy setting. You can use this space to further document the policy setting and why its implementation is important to your environment. Commenting policy settings allows you to later use keyword filters to help you quickly find policy settings with matching keywords.

To comment an Administrative Template policy setting

  1. Open the Group Policy Management Console. Right-click the Group Policy object you want to edit and then click Edit.

  2. In the console tree, click the folder under Administrative Templates that contains the policy settings you want to configure.

  3. In the Setting column, double-click the name for the policy setting.

  4. Type your comments in the Comment box.

  5. Click OK.


Classic Administrative Templates

Classic Administrative Template files (also known as ADM files) do not use an XML format. Earlier versions of the Group Policy Management tool (previously titled Group Policy Object Editor) displayed these settings under the Administrative Templates node.

The current version of Administrative Template files (known as ADMX files) use XML. The Group Policy Management Console displays these settings under the Administrative Templates node. However, the Group Policy Management Console still recognizes ADM files and displays these settings under the Classic Administrative Templates node, which is a child node of Administrative Templates.

This section contains these topics:

Add or Remove Classic Administrative Templates

Filtering Classic Administrative Templates


Add or Remove Classic Administrative Templates

To add or remove Classic Administrative Templates (.adm files)

  1. Open the Group Policy Management Console. Right-click the Group Policy object you want to edit and then click Edit.

  2. In the console tree, under either Computer Configuration or User Configuration, right-click Administrative Templates.

  3. Click Add/Remove Templates.

  4. Do one of the following:

    • To add a template, click Add. In the Policy Templates dialog box, click the template you want to add, and then click Open.

    • To remove a template, in the Current Policy Templates list, click the template, and then click Remove.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.


Filtering Classic Administrative Templates

The Group Policy Management Console displays all Classic Administrative Templates policy settings under the Classic Administrative Templates node, which is a subfolder of Administrative Templates. This view includes both managed policy settings and preference settings included in any Classic Administrative Templates (also known as ADM files).The filtering options included in the Group Policy Management Console apply only to Administrative Templates (ADMX files) and do not apply to Classic Administrative Templates.


Editing Software Settings

Group Policy Software Installation enables you to provide on-demand software installation and automatic repair of applications. Group Policy offers a convenient method for delivering software, especially if you are already using Group Policy for other purposes such as securing your client and server computers.

This section contains these topics:

  • Open Group Policy Software Installation

  • Set Options for Group Policy Software Installation

  • Work with Applications

  • Set Application Properties

  • Add or Remove Modifications for an Application Package


Open Group Policy Software Installation

To open Group Policy Software Installation

  1. Open the Group Policy Management Console. Right-click the Group Policy object you want to edit and then click Edit.

  2. To assign software applications to computers, in the console tree expand Computer Configuration\Policies. To assign or publish software applications to users, in the console tree expand User Configuration\Policies.

  3. Expand Software Settings, and then click Software installation.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.


Set Options for Group Policy Software Installation

This section contains these topics:

  • Set Group Policy Software Installation Defaults

  • Specify Automatic Installation Options Based on File Name Extension

  • Specify Categories in Which to Manage Applications


Set Group Policy Software Installation Defaults

To add software installation packages to user settings, you can either publish or assign them. Published packages are available for installation by users in the selected site, domain, or organizational unit by using either Add or Remove Programs in Control Panel or file activation. Users in the selected site, domain, or organizational unit receive assigned packages the next time they log on (for assignment to users) or when the computer restarts (for assignment to computers).

To set Group Policy Software Installation defaults

  1. Open Group Policy Software Installation. (In the console tree, right-click Software installation.)

  2. Click Properties, and on the General tab specify the following options:

    • In Default package location, specify the default software distribution point.

    • In New packages, specify how to add new packages to user settings. By default, packages can either be published or assigned. (To computers, they can only be assigned). If you want to select these options for each package, click Display the Deploy Software dialog box. For even more control on a per-package basis, click Advanced.

    • In Installation user interface options, click Basic or Maximum, depending on how apparent you want the installation process to be to users.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.


Specify Automatic Installation Options Based on File Name Extension

To specify automatic installation options based on file name extension

  1. Open Group Policy Software Installation. (In the console tree, right-click Software installation.)

  2. In the console tree, right-click Software installation.

  3. Click Properties, and then click the File Extensions tab.

  4. On the File Extensions tab, specify the following options:

    • Select file extension: Displays a list of all available file name extensions for the managed software. When an extension is selected, all applications in Active Directory that are associated with the selected file name extension are displayed in the Application precedence list box. For example, many applications can be associated with the .htm file extension, such as Microsoft Word, Microsoft Internet Explorer, and Netscape Communicator.

    • Application precedence: Lists all the applications that are associated with the selected file name extension. You can determine precedence by using the Up and Down buttons to set the order of the applications.

    • Up: Moves the selected application higher in the precedence list. The application at the top of the list is automatically installed if a document with the selected file name extension is invoked before the application has been installed. The Up button is unavailable when the selected application is at the top of the precedence list.

    • Down: Moves the selected application lower in the priority list. The Down button is unavailable when the selected application is at the bottom of the precedence list.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • When you upgrade an application, turn off automatic installation for the older version.


Specify Categories in Which to Manage Applications

To specify categories in which to manage applications

  1. Open Group Policy Software Installation.

  2. In the console tree, right-click Software installation.

  3. Click Properties, and then click the Categories tab.

  4. To create or change the list of categories under which programs appear in Add or Remove Programs in Control Panel, do any of the following:

    • To create a new category, click Add, and then type the new category name. If you do not have permission to add categories, the Add button is unavailable.

    • To modify an existing category, click the category that you want to modify, click Modify, and then change the text of the selected category. If you do not have permission to edit categories, the Modify button is unavailable.

    • To remove a category from the Categories list, click the category name, and then click Remove. If you do not have permission to edit categories, the Remove button is unavailable.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • The changes that you make to the application categories apply throughout the domain in which this Group Policy object is stored.


Work with Applications

This section contains these topics:

  • Assign an Application

  • Publish an Application

  • Upgrade an Application

  • Remove a Managed Application

For more information about Group Policy Software Installation, see Install the GPMC.


Assign an Application

To assign an application

  1. Open Group Policy Software Installation.

  2. In the console tree, right-click Software installation, point to New, and then click Package.

  3. In the Open dialog box, use the search boxes to find the application you want to deploy, click the Windows Installer package, and then click Open.

  4. In the Deploy Software dialog box, click Assigned, and then click OK.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • The Open dialog box shows the packages that are located at a software distribution point that you specify as the default.

  • If the Windows Installer package is located on a different shared network directory, navigate to the correct software distribution point in the Open dialog box, click the package, and then click Open.

  • Administrators are responsible for securing that location using technologies such as IPSEC and using file servers with mutual authentication such as Kerberos to prevent spoofing or tampering on the wire.


Publish an Application

To publish an application

  1. Open Group Policy Software Installation.

  2. Right-click in the results pane, point to New, and then click Package.

  3. In the Open dialog box, use the search boxes to find the package you want to publish, click the Windows Installer package to be published, and then click Open.

  4. In the Deploy Software dialog box, click Published.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • Packages can be published only to users, not to computers.

  • The Open dialog box shows the packages that are located at a software distribution point that you specify as the default.

  • If the Windows Installer package is located on a different shared network directory, navigate to the correct software distribution point in the Open dialog box, click the package, and then click Open.

  • Administrators are responsible for securing that location using technologies such as IPSEC and using file servers with mutual authentication such as Kerberos to prevent spoofing or tampering on the wire.

  • The application is available for users to install either by using Add or Remove Programs in Control Panel or by opening a file with a file name extension that you have associated with the application.


Upgrade an Application

To upgrade an application

  1. Open Group Policy Software Installation.

  2. In the results pane, right-click the new Windows Installer upgrade package (that is, not the package to be upgraded).

  3. Click Properties, and then click the Upgrades tab.

  4. Click Add to create or add to the list of packages that you want to upgrade with the new upgrade package.

  5. In the Add Upgrade Package dialog box, under Choose a package from, do one of the following:

    • Click Current Group Policy object.

    • Click A specific GPO, click Browse, and then click the Group Policy object (GPO) that you want to upgrade.

  6. Review the list of packages under Package to upgrade, which lists all of the other packages that are assigned or published within the selected GPO.

  7. Click the package that you want to upgrade, and then do one of the following:

    • To replace an application with a completely different application (perhaps an application from a different vendor), click Uninstall the existing package, then install the upgrade package.

    • To install a newer version of the same product while retaining the user's application preferences, document type associations, and the like, click Package can upgrade over the existing package.

  8. (Optional) To make the upgrade mandatory, on the Upgrades tab, select the Required upgrade for existing packages check box.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • Before you can perform this procedure, you must first assign or publish the upgrade package.

  • Depending on the GPO, the list of packages under Package to upgrade might have zero or more entries. If this is an upgrade under Computer Configuration in the Group Policy console tree, the Required upgrade for existing packages check box is selected and unavailable because packages can only be assigned to computers—they cannot be published.


Remove a Managed Application

To remove a managed application

  1. Open Group Policy Software Installation.

  2. In the results pane, right-click the application that you want to remove, point to All Tasks, and then click Remove.

  3. In the Remove Software dialog box, click one of the following removal methods:

    • To specify that the application should be removed the next time a user logs on or restarts the computer, click Immediately uninstall the software from users and computers.

    • To specify that users can continue to use the application if they have already installed it, click Allow users to continue to use the software, but prevent new installations. If users have removed the application or if they have never installed it, they will not be able to install it.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.


Set Application Properties

This section contains these topics:

  • Edit Installation Options for Applications

  • Specify Application Categories for Add or Remove Programs in Control Panel

  • Set the Autoinstall Option for an Application

  • Set Permissions for Group Policy Software Installation

Additional resources

Editing Software Settings


Edit Installation Options for Applications

To edit installation options for applications

  1. Open Group Policy Software Installation.

  2. In the results pane, right-click the application for which you want to edit installation options, and then click Properties.

  3. In the Properties dialog box for the application, click the Deployment tab.

  4. On the Deployment tab, click one of the following options under Deployment type:

    • Published: Users in the selected site, domain, or organizational unit can install the application by using either Add or Remove Programs in Control Panel or file activation.

    • Assigned: Users in the selected site, domain, or organizational unit receive this application the next time they log on (for assignment to users) or when the computer restarts (for assignment to computers).

  5. Under Deployment options, select the check boxes for the following options that you want:

    • Autoinstall this application by file extension activation: Select this option if you want to use the application precedence for the file name extension as it is determined on the File Extensions tab in the Software installation properties dialog box. If the application is not already installed, selecting this option causes the application to be installed when the user opens a file with this file association (for example, by double-clicking the file).

    • Uninstall this application when it falls out of the scope of management: Select this option if you want the application to be removed when users log on, or when computers start up, if they have moved to a site, domain, or organizational unit for which the application is not deployed.

    • Do not display this package in Add or Remove Programs in Control Panel: This option removes the most obvious method for users to uninstall the application. This option may be useful from time to time during the software life cycle.

    • Install this application at logon: This option fully installs the application, using the package defaults. Note that the package defaults themselves might call for installation of all features or of only some features.

  6. Under Installation user interface options, click one of the following options:

    • Basic: Only progress bars and errors are displayed.

    • Maximum: The entire user interface that is supported by the package is displayed.

  7. If you want to set the following advanced options, click Advanced:

    • Ignore language when deploying this package: Select this check box if you are installing an application whose language differs from the language of the operating system.

    • Remove existing installs of this product for users, if the product was not installed by Group Policy–based Software Installation: This option might be useful, for example, if company policy does not allow users to install applications from their own compact discs.

    • Make this 32-bit X86 application available to Win64 machines: Specifies whether the 32-bit application should be assigned or published to 64-bit computers.

    • Include OLE class and product information: Specifies whether to deploy information about COM components with the package so that software on the client can install them from Active Directory as needed, in a manner similar to activation by file extension.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • The Advanced Deployment Options dialog box, which appears when you click Advanced, provides advanced diagnostic information that can be useful for troubleshooting. The following table lists and describes this information.

Field | Data
Product code | A globally unique identifier (GUID) representing the product
Deployment count | The number of times the package has been deployed in this Group Policy object
Script name | The full network path, including GUIDs, to the application assignment script (.aas file)


Specify Application Categories for Add or Remove Programs in Control Panel

To specify application categories for Add or Remove Programs in Control Panel

  1. Open Group Policy Software Installation.

  2. In the results pane, right-click the managed application for which you want to set categories, and then click Properties.

  3. In the Properties dialog box for the application, click the Categories tab.

  4. On the Categories tab, do either of the following:

    • To associate an application category that has been defined for your organization with this application, click a category in the Available Categories list, and then click Select.

    • To remove a category that is associated with this application, click a category in the Selected categories list, and then click Remove.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • Because assigned applications do not appear in Add or Remove Programs in Control Panel, the categories that you set in this dialog box generally pertain to published applications only. The application appears in the selected categories in Add or Remove Programs, which the user can use to install the application.

  • Do not use this procedure to create or remove categories. Use this procedure to associate applications with existing categories.


Set the Autoinstall Option for an Application

To set the autoinstall option for an application

  1. Open Group Policy Software Installation.

  2. In the console tree, click Software installation.

  3. In the results pane, right-click the application that you want to be installed automatically when the user tries to open a file with the associated extension.

  4. Click Properties, and then click the Deployment tab.

  5. Under Deployment options, select the Auto-install this application by file extension activation check box, and then click OK. This option is recommended, and it is selected by default.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • The autoinstall option will only apply if there is not currently an application for the associated extension.


Set Permissions for Group Policy Software Installation

To set permissions for Group Policy Software Installation

  1. Open the Group Policy object (GPO) that you want to edit.

  2. In the console tree, right-click the icon or name of the GPO, and then click Properties.

  3. Click the Security tab, and in the Group or user names box, click the security group for which you want to set permissions.

  4. Do any of the following:

    • To change the set of security groups that has permissions on this GPO, click Add or Remove to add or remove security groups.

    • If the security group represents administrators (who manage software for users and computers in the organization), in the Permissions box for the selected security group, select the Allow check box for Full Control, and then click OK.

    • If the security group represents users (who use software that is assigned or published by an administrator), in the Permissions box for the selected security group, select the Allow check box for both Apply Group Policy and Read, and then click OK.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • The permissions that you set in this procedure pertain only to the GPO. In addition, the network must have a shared folder (a software distribution point) containing the packages to be installed. Administrators must have Full Control of the software distribution point, and users must have Read permission.


Add or Remove Modifications for an Application Package

To add or remove modifications for an application package

  1. Open Group Policy Software Installation.

  2. In the console tree, right-click Software installation, point to New, and then click Package.

  3. In the Open dialog box, click the Windows Installer package, and then click Open.

  4. In the Deploy Software dialog box, click Advanced, and then click OK.

  5. In the Properties dialog box for the package, click the Modifications tab.

  6. Do any of the following:

    • To add modifications, click Add. In the Open dialog box, browse to the transform file (.mst), and then click Open.

    • To remove modifications, on the Modifications tab, click the modification that you want to remove, and then click Remove. Repeat this step until you have removed each modification that you do not want.

  7. When you are sure that the modifications are configured the way you want them, click OK.

    Important

    Do not click OK until you have finished configuring the modifications. When you click OK, the package is assigned or published immediately. If the modifications are not properly configured, you will have to uninstall the package or upgrade the package with a correctly configured version.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • The Open dialog box shows the packages that are located at a software distribution point that you specify as the default.

  • If the Windows Installer package is located on a different shared network directory, navigate to the correct software distribution point in the Open dialog box, click the package, and then click Open.

  • Modifications (.mst files) are applied to Windows Installer packages (which have the .msi extension) in an order that you specify. This order must be determined before the application is assigned or published.

  • You can add multiple modifications, which are also called transforms. The transforms are applied in the order that you specify in the Modifications list, from top to bottom. To rearrange the list, click a transform in the list, and then click Move Up or Move Down.


Using Startup, Shutdown, Logon, and Logoff Scripts

Group Policy allows you to associate one or more scripting files to four triggered events:

  • Computer startup

  • Computer shutdown

  • User logon

  • User logoff

  • You can use Windows PowerShell scripts, or author scripts in any other language supported by the client computer. Windows Script Host (WSH) supported languages and command files are also used, including VBScript and Jscript.

  • This section contains these topics:

    Set Up Scripts on the Domain Controller

    Assign Computer Startup Scripts

    Assign Computer Shutdown Scripts

    Assign User Logon Scripts

    Assign User Logoff Scripts

Additional considerations

For more information about scripting see the Group Policy Script Center (http://go.microsoft.com/fwlink/?LinkID=66013).


Set Up Scripts on the Domain Controller

To set up scripts on the domain controller

  • Copy the script and dependent files to the Netlogon shared folder on the domain controller.

Additional considerations

You must be a member of the Domain Administrators security group to configure scripts on a domain controller.


Assign Computer Startup Scripts

To assign computer startup scripts

  1. Open the Group Policy Management Console (GPMC). Right-click the Group Policy object (GPO) you want to edit, and then click Edit.

  2. In the console tree, click Scripts (Startup/Shutdown). The path is Computer Configuration\Policies\Windows Settings\Scripts (Startup/Shutdown).

  3. In the results pane, double-click Startup.

  4. In the Startup Properties dialog box, click Add.

  5. In the Add a Script dialog box, do the following:

    • In Script Name, type the path of the script, or click Browse to search for the script file in the Netlogon shared folder on the domain controller.

    • In Script Parameters, type any parameters that you want, exactly as you would type them on the command line. For example, if your script includes parameters called //logo (display banner) and //I (interactive mode), type //logo //I.

  6. In the Startup Properties dialog box, specify the options that you want:

    • Startup Scripts for <Group Policy object>: Lists all the scripts that currently are assigned to the selected GPO. If you assign multiple scripts, the scripts are processed in the order that you specify. To move a script up in the list, click it, and then click Up. To move a script down in the list, click it, and then click Down.

    • Add: Opens the Add a Script dialog box, where you can specify any additional scripts to use.

    • Edit: Opens the Edit Script dialog box, where you can change script information, such as name and parameters.

    • Remove: Removes the selected script from the Startup Scripts list.

    • Show Files: Displays the script files that are stored in the selected GPO.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • Startup scripts are run under the Local System account, and they have the full rights that are associated with being able to run under the Local System account.

  • In Windows® 7 and Windows Vista®, startup scripts are run asynchronously, by default. This is a different behavior from earlier operating systems.

  • Setting startup scripts to run synchronously may cause the boot process to run slowly.

  • In Windows 7 and Windows Vista, startup scripts that run asynchronously will not be visible. Enabling the Run Startup Scripts Visible Group Policy setting has no effect when you are running startup scripts asynchronously.


Assign Computer Shutdown Scripts

To assign computer shutdown scripts

  1. Open the Group Policy Management Console. Right-click the Group Policy object you want to edit, and then click Edit.

  2. In the console tree, click Scripts (Startup/Shutdown). The path is Computer Configuration\Policies\Windows Settings\Scripts (Startup/Shutdown).

  3. In the results pane, expand Shutdown.

  4. In the Shutdown Properties dialog box, click Add.

  5. In the Add a Script dialog box, do the following:

    • In Script Name, type the path of the script, or click Browse to search for the script file in the Netlogon shared folder on the domain controller.

    • In Script Parameters, type any parameters that you want, exactly as you would type them on the command line. For example, if your script includes parameters called //logo (display banner) and //I (interactive mode), type //logo //I.

  6. In the Shutdown Properties dialog box, specify the options that you want:

    • Shutdown Scripts for <Group Policy object>: Lists all the scripts that are currently assigned to the selected Group Policy object (GPO). If you assign multiple scripts, the scripts are processed in the order that you specify. To move a script up in the list, click it, and then click Up. To move a script down in the list, click it, and then click Down.

    • Add: Opens the Add a Script dialog box, where you can specify any additional scripts to use.

    • Edit: Opens the Edit Script dialog box, where you can change script information, such as name and parameters.

    • Remove: Removes the selected script from the Shutdown Scripts list.

    • Show Files: Displays the script files that are stored in the selected GPO.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • Shutdown scripts are run as Local System, and they have the full rights that are associated with being able to run as Local System.

  • Setting shutdown scripts to run synchronously may cause the shutdown process to run slowly.


Assign User Logon Scripts

To assign user logon scripts

  1. Open the Group Policy Management Console. Right-click the Group Policy object you want to edit, and then click Edit.

  2. In the console tree, click Scripts (Logon/Logoff). The path is User Configuration\Policies\Windows Settings\Scripts (Logon/Logoff).

  3. In the results pane, expand Logon.

  4. In the Logon Properties dialog box, click Add.

  5. In the Add a Script dialog box, do the following:

    • In Script Name, type the path of the script, or click Browse to search for the script file in the Netlogon shared folder on the domain controller.

    • In Script Parameters, type any parameters that you want, exactly as you would type them on the command line. For example, if your script includes parameters called //logo (display banner) and //I (interactive mode), type //logo //I.

  6. In the Logon Properties dialog box, specify the options that you want:

    • Logon Scripts for <Group Policy object>: Lists all the scripts that currently are assigned to the selected Group Policy object (GPO). If you assign multiple scripts, the scripts are processed in the order that you specify. To move a script up in the list, click it, and then click Up. To move a script down in the list, click it, and then click Down.

    • Add: Opens the Add a Script dialog box, where you can specify any additional scripts to use.

    • Edit: Opens the Edit Script dialog box, where you can change script information, such as name and parameters.

    • Remove: Removes the selected script from the Logon Scripts list.

    • Show Files: Displays the script files that are stored in the selected GPO.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • Setting logon scripts to run synchronously may cause the logon process to run slowly.

  • Logon scripts are run as User, not Administrator, and their rights are limited accordingly.


Assign User Logoff Scripts

To assign user logoff scripts

  1. Open the Group Policy Management Console. Right-click the Group Policy object you want to edit, and then click Edit.

  2. In the console tree, click Scripts (Logon/Logoff). The path is User Configuration\Policies\Windows Settings\Scripts (Logon/Logoff).

  3. In the results pane, expand Logoff.

  4. In the Logoff Properties dialog box, click Add.

  5. In the Add a Script dialog box, do the following:

    • In Script Name, type the path of the script, or click Browse to search for the script file in the Netlogon shared folder on the domain controller.

    • In Script Parameters, type any parameters that you want, exactly as you would type them on the command line. For example, if your script includes parameters called //logo (display banner) and //I (interactive mode), type //logo //I.

  6. In the Logoff Properties dialog box, specify the options the you want:

    • Logoff Scripts for <Group Policy object>: Lists all the scripts that currently are assigned to the selected Group Policy object (GPO). If you assign multiple scripts, the scripts are processed in the order that you specify. To move a script up in the list, click it, and then click Up. To move a script down in the list, click it, and then click Down.

    • Add: Opens the Add a Script dialog box, where you can specify any additional scripts to use.

    • Edit: Opens the Edit Script dialog box, where you can change script information, such as name and parameters.

    • Remove: Removes the selected script from the Logoff Scripts list.

    • Show Files: Displays the script files that are stored in the selected GPO.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • Logoff scripts are run as User, not Administrator, and their rights are limited accordingly.

  • Setting logoff scripts to run synchronously may cause the logoff process to run slowly.


Using Folder Redirection

Using Folder Redirection

Folder Redirection enables you to redirect the location of specific folders within user profiles to a new location, such as a shared network location. Folder redirection is used in the process of administering user profiles and roaming user profiles. You can configure Folder Redirection using the Group Policy Management Console to redirect specific user profile folders, as well as edit Folder Redirection policy settings.

This section includes these topics:

  • Folder Redirection Overview

  • Specify the Location of Folders in a User Profile

Additional considerations

  • For more information about User Profiles and Folder Redirection, go to http://go.microsoft.com/fwlink/?LinkID=66003.


Folder Redirection Overview

Folder Redirection

User settings and user files are typically stored in the local user profile, under the Users folder. The files in local user profiles can be accessed only from the current computer, which makes it difficult for users who use more than one computer to work with their data and synchronize settings between multiple computers. Two technologies exist to address this problem: Roaming Profiles and Folder Redirection. Both technologies have their advantages, and they can be used separately or together to create a seamless user experience from one computer to another. They also provide additional options for administrators managing user data.

Folder Redirection lets administrators redirect the path of a folder to a new location. The location can be a folder on the local computer or a directory on a network file share. Users can work with documents on a server as if the documents were based on a local drive. The documents in the folder are available to the user from any computer on the network. Folder Redirection is located under Windows Settings in the console tree when you edit domain-based Group Policy by using the Group Policy Management Console (GPMC). The path is [Group Policy Object Name]\User Configuration\Policies\Windows Settings\Folder Redirection.

Recent changes to Folder Redirection

Folder Redirection now includes the following features:

  • The ability to redirect more folders in the user profile folders than in earlier Windows operating systems. This includes the Contacts, Downloads, Favorites, Links, Music, Saved Games, Searches, and Videos folders.

  • The ability to apply settings for redirected folders to Windows® 2000, Windows 2000 Server®, Windows XP, and Windows Server 2003 computers. You have the option to apply the settings that you configure on Windows Server® 2008 R2, Windows® 7, Windows Server 2008, or Windows Vista® only to computers that are running those operating systems, or to apply them to computers that are running earlier Windows operating systems also. For these earlier Windows operating systems, you can apply these settings to folders that can be redirected. These are the Application Data, Desktop, My Documents, My Pictures, and Start Menu folders. This option is available in the Settings tab in the Properties for the folder, under Select the redirection settings for [FolderName].

  • The option to have the Music, Pictures, and Videos folders follow the Documents folder. In Windows operating systems earlier than Windows Vista, these folders were subfolders of the Documents folder. By configuring this option, you resolve any issues related to naming and folder structure differences between and earlier and more recent Windows operating systems. This option is available in the Target tab in the Properties for the folder, under Settings.

  • The ability to redirect the Start Menu folder to a specific path for all users. In Windows XP, the Start Menu folder could be redirected only to a shared target folder.

Note

This capability is new only to the Start Menu folder. All other redirectable folders in Windows Vista and later versions can also be redirected to a specific path for all users.

Folders that can be redirected

You can use the GPMC to redirect folders.

Folder in Windows 7 and Windows Vista | Equivalent Folder in Earlier Windows Operating Systems
AppData/Roaming | Application Data
Contacts | Not Applicable
Desktop | Desktop
Documents | My Documents
Downloads | Not Applicable
Favorites | Not Applicable
Links | Not Applicable
Music | Not Applicable
Pictures | My Pictures
Saved Games | Not Applicable
Searches | Not Applicable
Start Menu | Start Menu
Videos | Not Applicable

Advantages of Folder Redirection

  • Even if users log on to different computers on the network, their data is always available.

  • Offline File technology (which is turned on by default) gives users access to the folder even when they are not connected to the network. This is especially useful for people who use portable computers.

  • Data that is stored in a network folder can be backed up as part of routine system administration. This is safer because it requires no action by the user.

  • If you use Roaming User Profiles, you can use Folder Redirection to reduce the total size of your Roaming Profile and make the user logon and logoff process more efficient for the end-user. When you deploy Folder Redirection with Roaming User Profiles, the data synchronized with Folder Redirection is not part of the roaming profile and is synchronized in the background by using Offline Files after the user has logged on. Therefore, the user does not have to wait for this data to be synchronized when they log on or log off as is the case with Roaming User Profiles.

  • Data that is specific to a user can be redirected to a different hard disk on the user's local computer from the hard disk that holds the operating system files. This makes the user's data safer in case the operating system has to be reinstalled.

  • As an administrator, you can use Group Policy to set disk quotas, limiting how much space is taken up by user profile folders.

Selecting a Folder Redirection target

The Target tab of the folder's Properties box enables you to select the location of the redirected folder on a network or in the local user profile. You can choose between the following settings:

  • Basic—Redirect everyone's folder to the same location. This setting enables you to redirect everyone's folder to the same location and is applied to all users included in the Group Policy object (GPO). For this setting, you have the following options in specifying a target folder location:

    • Create a folder for each user under the root path. This option creates a folder in the form \\server\share\User Account Name\Folder Name. Each user has a unique path for their redirected folder.

Note

If you enable the Also apply redirection policy to Windows 2000, Windows 2000 Server, Windows XP, and Windows Server 2003 operating systems option on the Settings tab, this option is not available for the Start Menu folder.

  • Redirect to the following location. This option uses an explicit path for the redirection location. This can cause multiple users to share the same path for the redirected folder.

  • Redirect to the local user profile location. This option moves the location of the folder to the local user profile under the Users folder.

  • Advanced—Specify locations for various user groups. This setting enables you to specify redirection behavior for the folder based on the security group memberships for the GPO.

  • Follow the Documents folder. This option is available only for the Music, Pictures, and Videos folders. This option resolves any issues related to naming and folder structure differences between Windows 7 and Windows Vista, and earlier Windows operating systems. If you choose this option, you cannot configure any additional redirection options or policy removal options for these folders, and settings are inherited from the Documents folder.

Note

This behavior also occurs by default if you enable the Also apply redirection policy to Windows 2000, Windows 2000 Server, Windows XP, and Windows Server 2003 operating systems option on the Settings tab when you configure redirection settings for the Documents folder.

  • Not configured. This is the default setting. This setting specifies that policy-based folder redirection was removed for that GPO and the folders are redirected to the local user profile location or stay where they are based on the redirection options selected if any existing redirection policies were set. No changes are being made to the current location of this folder.

Configuring additional settings for the redirected folder

In the Settings tab in the Properties box for a folder, you can enable these settings:

  • Grant the user exclusive rights. This setting is enabled by default and is a recommended setting. This setting specifies that the administrator and other users do not have permissions to access this folder.

  • Move the contents of [FolderName] to the new location. This setting moves all the data the user has in the local folder to the shared folder on the network.

  • Also apply redirection policy to Windows 2000, Windows 2000 Server, Windows XP, and Windows Server 2003 operating systems. This enables folder redirection to work withWindows 7 and Windows Vista, and earlier Windows operating systems. This option applies only to redirectable folders in earlier Windows operating systems, which are the Application Data, Desktop, My Documents, My Pictures, and Start Menu folders.

Note

The AppData/Roaming (previously Application Data in earlier Windows operating systems) folder in Windows Vista now contains several folders that were previously under the root folder of the User Profile folder in earlier Windows operating systems. For example, in earlier Windows operating systems, the Start Menu folder was not under the Application Data folder. It might not make sense to redirect all the folders under Application Data when you enable the Also apply redirection policy to Windows 2000, Windows 2000 Server, Windows XP, and Windows Server 2003 operating systems setting. Therefore, if you choose this setting, Windows 7 and Windows Vista do not redirect the following folders automatically: Start Menu, Network Shortcuts, Printer Shortcuts, Templates, Cookies, Sent To. If you do not choose this setting, Windows 7 and Windows Vista automatically redirect all folders under the Application Data folder.

  • Policy Removal. The following table summarizes the behavior of redirected folders and their contents when the GPO no longer applies, based on your selections for policy removal. The following policy removal options are available in the Settings tab, under Policy Removal.

Policy Removal option Selected setting Result

Redirect the folder back to the user profile location when policy is removed

Enabled

  • The folder returns to its user profile location.

  • The contents are copied, not moved, back to the user profile location.

  • The contents are not deleted from the redirected location.

  • The user continues to have access to the contents, but only on the local computer.

Redirect the folder back to the user profile location when policy is removed

Disabled

  • The folder returns to its user profile location.

  • The contents are not copied or moved to the user profile location.

Note

If the contents of a folder are not copied to the user profile location, the user cannot see them.

Leave the folder in the new location when policy is removed

Either Enabled or Disabled
  • The folder remains at its redirected location.

  • The contents remain at the redirected location.

  • The user continues to have access to the contents at the redirected folder.

Additional considerations

  • For step-by-step information about how to use folder redirection, see Specify the Location of Folders in a User Profile.


Specify the Location of Folders in a User Profile

You can use Group Policy to specify another location (in other words, "redirect" the location) for folders within user profiles. You can redirect folders either to one location for everyone or to different locations based on the security group membership of users. You can also configure additional settings for the redirected folder. The settings that you can configure include whether to grant exclusive user rights to the folder, move the contents of the folder to the new location, apply redirection policy to earlier Windows operating systems, or specify system behavior if the policy is removed.

To specify the location of folders in a user profile

  1. In the Group Policy Management Console (GPMC) tree, right-click the Group Policy object (GPO) that is linked to the site, domain, or organizational unit that contains the users whose user profile folders you want to redirect, and then click Edit.

  2. In the Group Policy Management Editor window, right-click the user profile folder that you want to redirect. The path of the user profile folder is User Configuration\Policies\Windows Settings\Folder Redirection\UserProfileFolderName

  3. In the Target tab, under Settings, choose one of the following settings, follow the steps for that setting, and then click OK:

    Basic—Redirect everyone's folder to the same location

    1. Under Target folder location, select a location.

    2. If you want to redirect the folder to a specific location, select Create a folder for each user under the root path or Redirect to the following location, and then click Browse to specify a location.

    3. If you want to specify additional redirection settings for the folder, click the Settings tab to configure any of the following settings, and then click OK:

    • Grant the user exclusive rights to the folder (selected by default).

    • Move the contents of the folder to the new location (selected by default).

    • Apply redirection policy from Windows® 7 or Windows Vista® to earlier Windows operating systems.

    • Specify policy removal settings (Leave the folder in the new location when policy is removed is selected by default).

    Advanced—Specify locations for various user groups

    1. Under Security Group Membership, click Add.

    2. Under Security Group Membership, click Browse to find the security group.

    3. Under Target folder location, select a location.

    4. If you want to redirect the folder to a specific location, select Create a folder for each user under the root path or Redirect to the following location, and then click Browse to specify a location.

    5. If you want to specify additional redirection settings for the folder, click the Settings tab to configure any of the following settings, and then click OK:

    • Grant the user exclusive rights to [FolderName] (selected by default).

    • Move the contents of [FolderName] to the new location (selected by default).

    • Also apply redirection policy to Windows 2000, Windows 2000 Server, Windows XP, and Windows Server 2003 operating systems.

    • Specify Policy Removal settings (Leave the folder in the new location when policy is removed is selected by default).

    Follow the documents folder

    This option is available only for the Music, Pictures, and Videos folders. This selection follows any settings that you make for the Documents folder, and resolves any issues related to naming and folder structure differences between Windows 7 and Windows Vista, and earlier Windows operating systems. If you choose this option, you cannot configure any additional redirection options or policy removal options for these folders, and settings will be inherited from the Documents folder.

    Not configured

    This is the default setting. No changes are made to the current location of this folder.

Additional considerations

  • To complete this procedure, you must be logged on as a member of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group.

  • For more information about settings and configuration options for Folder Redirection, see Folder Redirection Overview.

  • You can also use the GPMC to configure the following Folder Redirection policy settings:

    • Use localized subfolder names when redirecting Start and My Documents—This policy is located in the following paths: Computer Configuration\Policies\Administrative Templates\System\Folder Redirection, or User Configuration\Policies\Administrative Templates\System\Folder Redirection.

    • Do not automatically make redirected folders available offline—This policy is located in the following path: User Configuration\Policies\Administrative Templates\System\Folder Redirection.

  • For more information about User Profiles and Folder Redirection, see http://go.microsoft.com/fwlink/?LinkId=66003.


Configure, Target, and Comment Preference Items

The Group Policy Management Console allows you to configure preferences when you edit any domain-based Group Policy object. The Preferences node appears under Computer Configuration and User Configuration. The editor displays preference extensions under two categories: Windows Settings and Control Panel Settings.

Preference extensions under Windows Settings include:

  • Applications Extension: Configure settings for applications.

  • Drive Maps Extension: Create, modify, or delete mapped drives, and configure the visibility of all drives.

  • Environment Extension: Create, modify, or delete environment variables.

  • Files Extension: Copy, modify the attributes of, replace, or delete files.

  • Folders Extension: Create, modify, or delete folders.

  • Ini Files Extension: Add, replace, or delete sections or properties in configuration settings (.ini) or setup information (.inf) files.

  • Network Shares Extension: Create, modify, or delete ("un-share") shares.

  • Registry Extension: Copy registry settings and apply them to other computers. Create, replace, or delete registry settings.

  • Shortcuts Extension: Create, modify, or delete shortcuts.

Preference extensions under Control Panel Settings include:

  • Data Sources Extension: Create, modify, or delete Open Database Connectivity (ODBC) data source names.

  • Devices Extension: Enable or disable hardware devices or classes of devices.

  • Folder Options Extension: Configure folder options; create, modify, or delete Open With associations for file name extensions; create, modify, or delete file name extensions associated with a type of files.

  • Internet Settings Extension: Modify user-configurable Internet settings.

  • Local Users and Groups Extension: Create, modify, or delete local users and groups.

  • Network Options Extension: Create, modify, or delete virtual private networking (VPN) or dial-up networking connections.

  • Power Options Extension: Modify power options and create, modify, or delete power schemes.

  • Printers Extension: Create, modify, or delete TCP/IP, shared, and local printer connections.

  • Regional Options Extension: Modify regional options.

  • Scheduled Tasks Extension: Create, modify, or delete scheduled or immediate tasks.

  • Services Extension: Modify services.

  • Start Menu Extension: Modify Start menu options.


Overview of Preferences

Group Policy Preferences, introduced in Windows Server® 2008, provide more than twenty Group Policy extensions that expand the range of configurable preference settings in a Group Policy object (GPO). Group Policy lets you manage drive mappings, registry settings, local users and groups, services, files, and folders without the need to learn a scripting language.

Preferences let you manage all these additional settings by using the familiar Group Policy Management Console (GPMC). Within most preference items, the user interface mimics the relevant end-user interface for configuring these settings. This makes configuration more intuitive.

Within each GPO, you can create multiple preference items with each preference extension. Targeting options give you with more precise control over how Windows applies preference settings. By using item-level targeting, you can configure each GPO to be appropriate to more users and computers.

The GPMC lets you configure preferences when you edit any domain-based GPO. The Preferences node appears under Computer Configuration and User Configuration.

Additional references

  • Configure, Target, and Comment Preference Items


Windows Settings

The Group Policy Management Console allows you to configure preferences when you edit any domain-based Group Policy object. The Preferences node appears under Computer Configuration and User Configuration. The editor displays preference extensions under two categories: Windows Settings and Control Panel Settings.

Preference extensions under Windows Settings include:

  • Applications Extension: Configure settings for applications.

  • Drive Maps Extension: Create, modify, or delete mapped drives, and configure the visibility of all drives.

  • Environment Extension: Create, modify, or delete environment variables.

  • Files Extension: Copy, modify the attributes of, replace, or delete files.

  • Folders Extension: Create, modify, or delete folders.

  • Ini Files Extension: Add, replace, or delete sections or properties in configuration settings (.ini) or setup information (.inf) files.

  • Network Shares Extension: Create, modify, or delete ("un-share") shares.

  • Registry Extension: Copy registry settings and apply them to other computers. Create, replace, or delete registry settings.

  • Shortcuts Extension: Create, modify, or delete shortcuts.

Additional references

  • Configure, Target, and Comment Preference Items


Applications Extension

Group Policy includes the Applications preference extension. For users, this extension allows you to configure settings for a specific version of an application for which you have installed a preference plug-in. The available settings vary with the application and version.

Software developers can create plug-ins for other applications using the Group Policy Software Development Kit (http://go.microsoft.com/fwlink/?LinkId=144).

Getting started

You can create and configure Application preference items for any domain-based Group Policy object (GPO). You configure the settings by editing a GPO using the Group Policy Management Console. When editing a GPO, you can find this preference extension at the following location:

User Configuration

└ Preferences

└ Windows Settings

└ Applications

Important

You must install a preference plug-in before you can create and configure Application preference items.

For information about how to use this extension to create and configure a preference item, see the following topics:

  • Configure an Application Item

  • Configure Common Options


Configure an Application Item

Application preference items allow you to configure settings for a specific version of an application for which you have installed a preference plug-in.

Software developers can create plug-ins for other applications using the Group Policy Software Development Kit (http://go.microsoft.com/fwlink/?LinkId=144).

Creating an Application item

To create a new application preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under User Configuration, expand the Preferences folder, and then expand the Windows Settings folder.

  3. Right-click the Applications node, point to New, and select an application.

  4. In the Properties dialog box, enter application settings for Group Policy to configure.

  5. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  6. Click OK. The new preference item appears in the details pane.

Additional considerations

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Applications Extension


Drive Maps Extension

Group Policy includes the Drive Maps preference extension. For users, this extension allows you to:

  • Create dynamic drive mappings to network shares.

  • Create dynamic drive mappings to network shares using alternate user credentials.

  • Modify mapped drives and their properties.

  • Delete a single mapped drive.

  • Delete all mapped drives or all mapped drives from a designated drive letter onward.

  • Hide or show a single drive or all drives, both mapped and physical.

Getting started

You can create and configure Mapped Drive preference items for any domain-based Group Policy object (GPO). You configure the settings by editing a GPO using the Group Policy Management Console. When editing a GPO, you can find this preference extension at the following location:

User Configuration

└ Preferences

└ Windows Settings

└ Drive Maps

For information about how to use this extension to create and configure a preference item, see the following topics:

  • Configure a Mapped Drive Item

  • Configure Common Options


Configure a Mapped Drive Item

Drive Map preference items allow you to create, replace, update, and delete mapped drives and their associated properties. Before you create a Drive Map preference item, you should review the behavior of each type of action possible with this extension.

Creating a Mapped Drive item

To create a new Mapped Drive preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under User Configuration, expand the Preferences folder, and then expand the Windows Settings folder.

  3. Right-click the Drive Maps node, point to New, and select Mapped Drive.

  4. In the New Drive Properties dialog box, select an Action for Group Policy to perform. (For more information, see "Actions" in this topic.)

  5. Enter drive map settings for Group Policy to configure or remove. (For more information, see "Drive map settings" in this topic.)

  6. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  7. Click OK. The new preference item appears in the details pane.

Actions

This type of preference item provides a choice of four actions: Create, Replace, Update, and Delete. The behavior of the preference item varies with the action selected and whether the drive letter already exists.

Create | Create a new mapped drive for users.
Delete | Remove a mapped drive for users.
Replace | Delete and recreate mapped drives for users. The net result of the Replace action is to overwrite all existing settings associated with the mapped drive. If the drive mapping does not exist, then the Replace action creates a new drive mapping.
Update | Modify settings of an existing mapped drive for users. This action differs from Replace in that it only updates settings defined within the preference item. All other settings remain as configured on the mapped drive. If the drive mapping does not exist, then the Update action creates a new drive mapping.

Drive map settings

Location

To configure a new drive mapping or recreate a drive mapping, type a fully qualified UNC path for the network share (such as \\server\sharename, \\server\hiddenshare$, or \\server\sharename\foldername).

This field accepts preference processing variables. Press F3 to display a list of variables from which you can select.

To modify an existing drive mapping (identified by drive letter), leave this field blank.

This option is available only if the action selected is Create, Replace, or Update.

Reconnect

To save this mapped drive in the user's settings and attempt to restore it at each subsequent logon, select this check box. Otherwise, the drive is mapped, but not saved in the user's settings.

This option is available only if the action selected is Create, Replace, or Update.

Label as

To provide a descriptive label that appears next to the drive letter, type the label in this field.

This field accepts preference processing variables. Press F3 to display a list of variables from which you can select.

This option is available only if the action selected is Create, Replace, or Update.

Drive Letter

Select the mapped drives (identified by drive letter) to configure:

  • To assign the first available drive letter to the mapped drive, select Use first available, starting at, and then select a drive letter at which to begin checking for availability. This option is available only if the action selected is Create, Replace, or Update.

  • To assign a specific drive letter to the mapped drive, select Use, and then select a drive letter. This option is available only if the action selected is Create, Replace, or Update, and if you have typed a location.

  • To modify an existing drive mapping (identified by drive letter), select Existing, and then select a drive letter. This option is available only if the Location field is blank, and the action selected is Update.

  • To delete all drive mappings from a particular drive letter onward, select Delete all, starting at, and then select a drive letter at which to begin deleting drive mappings. Physical drives are skipped without error. This option is available only if the action selected is Delete.

  • To delete a specific mapped drive, select Delete, and then select the drive letter. This option is available only if the action selected is Delete.

Connect as

To implement a drive mapping using credentials other than those of the currently logged on user, type the credentials to be used. This option is available only if the action selected is Create, Replace, or Update.

Security Note

This password is stored as part of the GPO in SYSVOL and is discoverable, although obscured. If you choose to store passwords in preference items, you should consider creating dedicated accounts for this purpose, and never store administrative passwords in preference items.

Hide/Show this drive

Configure the visibility of the mapped drive:

  • To make no change to the visibility of the mapped drive, select No change. This does not take precedence over the Hide/Show all drives setting.

  • To prevent the drive from being displayed in Windows Explorer, select Hide this drive. This takes precedence over the Hide/Show all drives setting.

  • To allow this drive to be displayed in Windows Explorer, select Show this drive. This takes precedence over the Hide/Show all drives setting.

This option is available only if the action selected is Create, Replace, or Update.

Hide/Show all drives

Configure the visibility of all mapped and physical drives in Windows Explorer. The options are comparable to those for Hide/Show this drive, but apply globally to all drives.

Additional considerations

  • Hide/Show this drive options have precedence over Hide/Show all drives. For example, if a Drive Map preference item has the Hide/Show this drive option set to Hide this drive and the Hide/Show all drives option set to Show all drives, then all drives are visible except the drive designated as hidden.

  • You can use a Drive Map preference item to configure the visibility of a physical drive rather than a mapped drive. To do so, select the Update action, leave the Location field blank, select the drive letter of the physical drive, and then configure the Hide/Show this drive and Hide/Show all drives options.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Drive Maps Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Environment Extension

Group Policy includes the Environment preference extension. For computers or users, this extension allows you to:

  • Create persistent user or system environment variables.

  • Modify environment variables. For example:

    • Modify the command prompt (by modifying the PROMPT system variable).

    • Modify the location of the TEMP folder (by modifying the TEMP system variable).

    • Replace the value of the entire PATH variable.

    • Add semicolon-delimited segments to the PATH variable.

    • Delete semicolon-delimited segments from the PATH variable.

    • Change the text case of semicolon-delimited segments of the PATH variable.

  • Delete environment variables.

Note

You can apply an Environment Variable targeting item to other preference items to restrict their application based on the value of the variable.

Getting started

You can create and configure Environment Variable preference items for any domain-based Group Policy object (GPO). You configure the settings by editing a GPO using the Group Policy Management Console. When editing a GPO, you can find this preference extension at the following location:

Computer Configuration or User Configuration

└ Preferences

└ Windows Settings

└ Environment

For information about how to use this extension to create and configure a preference item, see the following topics:

  • Configure an Environment Variable Item

  • Configure Common Options


Configure an Environment Variable Item

Environment Variable preference items allow you to create, update, replace, and delete user and system environment variables or semicolon-delimited segments of the PATH variable. Before you create an Environment Variable preference item, you should review the behavior of each type of action possible with this extension.

Creating an Environment Variable item

To create a new Environment Variable preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration or User Configuration, expand the Preferences folder, and then expand the Windows Settings folder.

  3. Right-click the Environment node, point to New, and select Environment Variable.

  4. In the New Environment Variable Properties dialog box, select an Action for Group Policy to perform. (For more information, see "Actions" in this topic.)

  5. Enter environment variable settings for Group Policy to configure or remove. (For more information, see "Environment variable settings" in this topic.)

  6. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  7. Click OK. The new preference item appears in the details pane.

Actions

This type of preference item provides a choice of four actions: Create, Replace, Update, and Delete. The behavior of the preference item varies with the action selected and whether the environment variable already exists.

Create | Create a new environment variable or to add a semicolon-delimited segment to the PATH variable for computers or users.
Delete | Remove an environment variable or to delete a semicolon-delimited segment from the PATH variable from computers or users.
Replace | Delete and recreate an environment variable. The net result of the Replace action is to overwrite all existing settings associated with the environment variable. Applying this action to a segment of the PATH variable has no practical effect, other than potentially changing the text case of the segment. If the environment variable does not exist, then the Replace action creates a new environment variable.
Update | Modify settings of an existing environment variable. This action differs from Replace in that it only updates settings defined within the preference item. All other settings remain as configured on the environment variable. Applying this action to a segment of the PATH variable has no practical effect, other than potentially changing the text case of the segment. If the environment variable does not exist, then the Update action creates a new environment variable.

Environment variable settings

User Variable

To cause the environment variable to affect each user independently, select this setting for an Environment preference item under User Configuration. The environment variable is stored in the registry in HKEY_CURRENT_USER.

To cause the environment variable to affect only the default user of the computer, select this setting for an Environment preference item under Computer Configuration.

System Variable

To cause the environment variable to affect all users of the computer, select this setting. The environment variable is stored in the registry in HKEY_LOCAL_MACHINE.

Name

Type a name for the environment variable to which the action is applied. To select the PATH variable, leave this field blank.

PATH

To create or replace the value of the PATH variable or to add or delete a semicolon-delimited segment of the value of the PATH variable, select this check box. This option is available only when System Variable is selected.

Partial

To add or delete a semicolon-delimited segment of the value of the PATH variable, select this check box. This option is available only when System Variable and PATH are selected.

Value

Type the value for the environment variable. This field accepts variables.

If PATH is selected, type a semicolon-delimited list of folder paths for Windows to use to find files.

If Partial is selected, type one segment of the PATH variable, omitting the semicolon delimiter.

Additional considerations

  • If you want to restrict the scope of multiple preference items with a complex set of targeting items, you can simplify configuration by using an environment variable. For example, create an Environment Variable preference item that generates a new environment variable with a value of 1, and apply the targeting items to it. To apply the same targeting to other preference items, add an Environment Variable targeting item to those preference items, and configure it to require a value of 1 for the variable that you created using an Environment Variable preference item.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Environment Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Files Extension

Group Policy includes the Files preference extension. For computers or users, this extension allows you to:

  • Copy a file (or multiple files in one folder) to a new location and then configure the attributes of those files. New subfolders are created as necessary.

  • Delete a file (or multiple files in one folder) and replace it with a copy of a file from a source folder.

  • Modify the attributes of a file (or multiple files in one folder).

  • Delete a file (or multiple files in one folder).

  • Modify the attributes of, replace, or delete all files with a particular extension in one folder.

  • Modify the attributes of, replace, or delete all files in a particular folder.

Note

To configure folders rather than individual files, see Folders Extension.

Getting started

You can create and configure File preference items for any domain-based Group Policy object (GPO). You configure the settings by editing a GPO using the Group Policy Management Console. When editing a GPO, you can find this preference extension at the following location:

Computer Configuration or User Configuration

└ Preferences

└ Windows Settings

└ Files

For information about how to use this extension to create and configure a preference item, see the following topics:

  • Configure a File Item

  • Configure Common Options


Configure a File Item

File preference items allow you to copy, modify the attributes of, replace, and delete files. (To configure folders rather than individual files, see Folders Extension.) Before you create a File preference item, you should review the behavior of each type of action possible with this extension.

Creating a File item

To create a new File preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration or User Configuration, expand the Preferences folder, and then expand the Windows Settings folder.

  3. Right-click the Files node, point to New, and select File.

  4. In the New File Properties dialog box, select an Action for Group Policy to perform. (For more information, see "Actions" in this topic.)

  5. Enter file settings for Group Policy to configure or remove. (For more information, see "File settings" in this topic.)

  6. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  7. Click OK. The new preference item appears in the details pane.

Actions

This type of preference item provides a choice of four actions: Create, Replace, Update, and Delete. The behavior of the preference item varies with the action selected and whether the file already exists.

Create | Copy a file (or multiple files in one folder) from a source location to a destination location if it does not already exist at the destination, and then configure the attributes of those files for computers or users.
Delete | Remove a file (or multiple files in one folder) for computers or users.
Replace | Delete a file (or multiple files in one folder), replace it with another file or files, and configure the attributes of those files for computers or users. The net result of the Replace action is to overwrite the files at the destination location. If the file does not exist at the destination, then the Replace action copies the file from the source location to the destination.
Update | Modify settings of an existing file (or multiple files in one folder) for computers or users. This action differs from Replace in that it only updates file attributes defined within the preference item. All other file attributes remain as configured on the file. If the file does not exist, then the Update action copies the file from the source location to the destination.

File settings

Source file(s)

Type the location from which to copy the Source file(s). This location can be a fully qualified UNC path or a path on a local or mapped drive from the perspective of the client. This field can contain variables.

This field can also contain single character (?) and multiple character (*) wildcards, allowing you to copy or modify multiple files.

This option is available only if the action selected is Create, Replace, or Update.

Destination file

Type the location to which to copy a file or the location of the file to be modified. This location can be a fully qualified UNC path or a path on a local or mapped drive from the perspective of the client. Parent folders are created as necessary. You must include the file name, and you can change the file name by providing a different name for it than specified in the Source file(s) field.

This option is available only if the action selected is Create, Replace, or Update and the Source files(s) does not include wildcards.

Destination folder

Type the location of the folder to which to copy files or the location of the files to be modified. This location can be a fully qualified UNC path or a path on a local or mapped drive from the perspective of the client. Parent folders are created as necessary.

This option is available only if the action selected is Create, Replace, or Update and the Source files(s) includes wildcards.

Delete file(s)

To delete a file, type the path for the file from the perspective of the client.

To delete multiple files within a folder, incorporate single character (?) and multiple character (*) wildcards in the file name.

This option is available only if the action selected is Delete.

Suppress errors on individual file actions

To allow multiple files to transfer even if one or more individual files fail to transfer, select this check box. Only errors due to an attempt to replace, delete, or configure attributes of a file are suppressed. Such errors may be due to the file being in use, access being denied, or the source file not being found. With this option selected, such errors can only be detected in the trace file. This option is distinct from the default preference error suppression that can be overridden on the Common tab.

Attributes

To configure file system attributes for the files being transferred, select the appropriate check boxes in the Attributes box. Unchecked attributes are removed from the file at the destination.

Additional considerations

  • Many incremental backup systems use the Archive attribute to determine whether a file or folder has been created or changed and to back up the file or folder. For this reason, Archive is selected by default to select the Archive attribute on any modified folder.

  • If the Common tab option to Remove this item when it is no longer applied is selected, the destination file is deleted if it is a single file. In a multiple file operation, no files are deleted.

  • By default, a file preference item has access to all objects with the SYSTEM Access Control Entry (ACE). To change this item to run with end-user permissions (if under User Configuration), change the security context on the Common tab.

  • A file preference item resets the Read Only attribute of any destination file if necessary to accomplish the specified task.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Files Extension


Folders Extension

Group Policy includes the Folders preference extension. For computers or users, this extension allows you to:

  • Create a folder and configure its attributes.

  • Modify a folder and configure its attributes.

  • Delete a folder and its contents.

  • Delete a folder only if it is empty.

  • Delete all files within a folder (such as a temporary files folder) without deleting the folder.

  • Delete all files within a folder without deleting subfolders.

Note

To configure individual files rather than folders, see Files Extension.

Getting started

You can create and configure Folder preference items for any domain-based Group Policy object (GPO). You configure the settings by editing a GPO using the Group Policy Management Console. When editing a GPO, you can find this preference extension at the following location:

Computer Configuration or User Configuration

└ Preferences

└ Windows Settings

└ Folders

For information about how to use this extension to create and configure a preference item, see the following topics:

  • Configure a Folder Item

  • Configure Common Options


Configure a Folder Item

Folder preference items allow you to create, update, replace, and delete folders and their contents. (To configure individual files rather than folders, see Files Extension.) Before you create a Folder preference item, you should review the behavior of each type of action possible with this extension.

Creating a Folder item

To create a new Folder preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration or User Configuration, expand the Preferences folder, and then expand the Windows Settings folder.

  3. Right-click the Folders node, point to New, and select Folder.

  4. In the New Folder Properties dialog box, select an Action for Group Policy to perform. (For more information, see "Actions" in this topic.)

  5. Enter folder settings for Group Policy to configure or remove. (For more information, see "Folder settings" in this topic.)

  6. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  7. Click OK. The new preference item appears in the details pane.

Actions

This type of preference item provides a choice of four actions: Create, Replace, Update, and Delete. The behavior of the preference item varies with the action selected and whether the folder already exists.

Create | Create a new folder for computers or users.
Delete | Remove a folder for computers or users.
Replace | Delete and recreate a folder for computers or users. The net result of the Replace action is to delete the contents of an existing folder and to overwrite all existing settings associated with the folder. If the folder does not exist, then the Replace action creates a new folder.
Update | Modify an existing folder for computers or users. This action differs from Replace in that it only updates settings defined within the preference item. All other settings remain as configured on the folder. If the folder does not exist, then the Update action creates a new folder.

Folder settings

Path

Type a path for the folder from the perspective of the client. Do not include quotes or a trailing slash. This field can contain variables.

Attributes

To configure file system attributes for the folder, select the appropriate check boxes.

These options are available only when the action selected is Create, Replace, or Update.

Options for Delete or Replace actions

Select a combination of options to control which files and folders are deleted. If the Replace action is selected, the folder is recreated after these options have been processed unless deletion is prevented. The effect of these options varies depending on the combination of options selected. For more information, see "Additional considerations."

These options are available only when the action selected is Replace or Delete.

Available options include:

  • Ignore errors for files/folders that cannot be deleted: If this option is cleared, an error is returned if the Folder item attempts to delete a folder that is not empty, a file that is open, a file or folder for which the user does not have permission, or any other file or folder that cannot be deleted. If selected, this option suppresses any error messages that occur because files or folders cannot be deleted.

  • Allow deletion of read-only files/folders: If this option is cleared, the Folder item is prevented from deleting read-only files and folders. If selected, this option clears the read-only attribute of files and folders that this Folder item attempts to delete.

  • Delete all files in the folder(s): If this option is cleared, the Folder item cannot delete files within folders. If selected, this option deletes all files within this folder that are allowed to be deleted. If Recursively delete all subfolders is selected as well, then all files that are allowed to be deleted within all subfolders are also deleted.

  • Recursively delete all subfolders (if emptied): If this option is cleared, the Folder item is prevented from deleting subfolders within the folder. If this option is selected, the lowest level of subfolders is deleted if they are empty, repeating for each parent folder until reaching the folder specified in the Path field. Whether subfolders are empty is evaluated after the option to Delete all files in the folder(s) has been processed.

  • Delete this folder (if emptied): If this option is cleared, the Folder item is prevented from deleting the folder specified in the Path field. If this option is selected, the folder specified in the Path field is deleted if it is empty. Whether this folder is empty is evaluated after the options to Delete all files in the folder(s) and Recursively delete all subfolders have been processed.

Additional considerations

  • Common combinations of options for Delete or Replace actions include:

    • Delete the folder only if it is empty: Select Delete this folder and Allow deletion of read-only files/folders. To prevent an error if the folder contains files and cannot be deleted, select Ignore errors.

    • Delete the folder and all files and subfolders within: Select Delete this folder, Recursively delete all subfolders, Delete all files in the folder(s), and Allow deletion of read-only files/folders.

    • Delete all empty subfolders within the folder: Select Recursively delete all subfolders and Allow deletion of read-only files/folders. To prevent an error if the folder contains files and cannot be deleted, select Ignore errors.

    • Delete all files within the folder, but not subfolders or files within subfolders: Select Delete all files in the folder(s) and Allow deletion of read-only files/folders.

    • Delete all files and subfolders within the folder: Select Recursively delete all subfolders, Delete all files in the folder(s), and Allow deletion of read-only files/folders.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Folders Extension


Ini Files Extension

Group Policy includes the Ini Files preference extension. For computers and groups of computers or for users and groups of users, this extension allows you to:

  • Add a property to a configuration settings (.ini) or setup information (.inf) file.

  • Replace a property in an .ini or .inf file.

  • Delete a property from an .ini or .inf file.

  • Delete a section from an .ini or .inf file.

  • Delete an .ini or .inf file.

Note

To copy any type of file to a new location or to modify its attributes, see the Files Extension.

Getting started

You can create and configure Ini File preference items for any domain-based Group Policy object (GPO). You configure the settings by editing a GPO using the Group Policy Management Console. When editing a GPO, you can find this preference extension at the following location:

Computer Configuration or User Configuration

└ Preferences

└ Windows Settings

└ Ini Files

For information about how to use this extension to create and configure a preference item, see the following topics:

  • Configure an Ini File Item

  • Configure Common Options


Configure an Ini File Item

Ini File preference items allow you to add or replace a property in a configuration settings (.ini) file or setup information (.inf) file, or to delete a property, section, or entire .ini or .inf file. (To copy any type of file to a new location or to modify its attributes, see the Files Extension.)

Each section in an .ini or .inf file uses the following format:

[SectionName]
PropertyName1=PropertyValue1
PropertyName2=PropertyValue2

Before you create an Ini File preference item, you should review the behavior of each action possible with this extension.

Creating an Ini File item

To create a new Ini File preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration or User Configuration, expand the Preferences folder, and then expand the Windows Settings folder.

  3. Right-click the Ini Files node, point to New, and select Ini File.

  4. In the New Ini File Properties dialog box, select an Action for Group Policy to perform. (For more information, see "Actions" in this topic.)

  5. Enter configuration settings (.ini) or setup information (.inf) file settings for Group Policy to configure or remove. (For more information, see "Ini file settings" in this topic.)

  6. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  7. Click OK. The new preference item appears in the details pane.

Actions

This type of preference item provides a choice of four actions: Create, Replace, Update, and Delete. The behavior of the preference item varies with the action selected and whether the property already exists.

Create | Add and configure a property in an .ini or .inf file for computers or users. If the file does not exist, it is created.
Delete | Remove a property or a section from an .ini or .inf file, or delete an .ini or .inf file for computers or users.
Replace | Delete and recreate a property in an .ini or .inf file for computers or users. The net result of the Replace action is to overwrite the property. If the property does not exist, then the Replace action creates the property.
Update | This action has the same effect as Replace.

Ini file settings

File Path

Enter the path of an .ini or .inf file from the perspective of the client. Do not include quotes. If the file and parent folders do not exist, they are created.

Section Name

Type the name of the section within the file in which to configure a property or from which to delete a property. To delete the entire .ini or .inf file, leave this field blank.

Property Name

Type the name of the property to configure or delete. To delete the entire section of the file or the entire file, leave this field blank.

Property Value

Type a value for the property. Values may include quotation marks, but quotation marks are typically removed from the values when they are read by an application or the operating system. All values are interpreted as text.

This option is available only if the action selected is Create, Replace, or Update.

Important
  • If this field is left blank, the property is configured with an empty value, which is interpreted as if the property did not exist.
  • This field is disabled until you specify the property.

Additional considerations

  • The Section Name, Property Name, and Property Value fields are each disabled until you type text in the preceding field.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Ini Files Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Network Shares Extension

Group Policy includes the Network Shares preference extension. For computers, this extension allows you to:

  • Create a share and configure its properties.

  • Modify the folder path for a share by replacing the share.

  • Delete ("un-share") or modify the user limit, Access-Based Enumeration, and comment for:

    • A share.

    • All shares except hidden shares.

    • All hidden shares except administrative drive-letter shares.

    • All administrative drive-letter shares.

    • All shares.

Notes
  • Network Share items create, modify, or delete share points, but do not create or delete the folders to which they point. For a share point to be created, the folder to be shared must already exist on computers to which the Group Policy object is applied. When a share is deleted, the share point leading to the folder is removed, but the folder and its contents are not deleted.
  • For information on how to use a Folder preference item to create or delete folders using Group Policy, see Folders Extension.

Getting started

You can create and configure Network Share preference items for any domain-based Group Policy object (GPO). You configure the settings by editing a GPO using the Group Policy Management Console. When editing a GPO, you can find this preference extension at the following location:

Computer Configuration

└ Preferences

└ Windows Settings

└ Network Shares

For information about how to use this extension to create and configure a preference item, see the following topics:

  • Configure a Network Share Item

  • Configure Common Options


Configure a Network Share Item

Network Share preference items let you create, update, replace, and delete shares. Before you create a Network Share preference item, you should review the behavior of each type of action possible with this extension.

Creating a Network Share item

To create a new Network Share preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration, expand the Preferences folder, and then expand the Windows Settings folder.

  3. Right-click the Network Shares node, point to New, and select Network Share.

  4. In the New Network Share Properties dialog box, select an Action for Group Policy to perform. (For more information, see "Actions" in this topic.)

  5. Enter network share settings for Group Policy to configure or remove. (For more information, see "Network share settings" in this topic.)

  6. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  7. Click OK. The new preference item appears in the details pane.

Actions

This type of preference item provides a choice of four actions: Create, Replace, Update, and Delete. The behavior of the preference item varies with the action selected and whether the share already exists.

Create | Create a new share for computers.
Delete | Remove ("un-share") a share from computers.
Replace | Delete and re-create a share. The net result of the Replace action is to overwrite all existing settings associated with the share. If the share does not exist, then the Replace action creates a new share.
Update | Modify settings of a share. This action differs from Replace because it only updates settings that are defined within the preference item. All other settings remain as configured on the share. If the share does not exist, then the Update action creates a new share.

Network share settings

Share name

Enter a name for the share.

This field accepts preference processing variables. Press F3 to display a list of variables from which you can select.

This option is available except when you have selected Action Modifiers and the action is Delete or Update.

Folder path

Enter a path of an existing folder to which the share will point.

This field accepts preference processing variables. Press F3 to display a list of variables from which you can select.

This option is available except when you have selected Action Modifiers and the action is Delete or Update.

Comment

Type text to be displayed in the Comment field of the share. If the action selected is Update, the share already exists, and this field is left blank, then the existing comment is left unchanged.

This field accepts preference processing variables. Press F3 to display a list of variables from which you can select.

This option is available only if the action selected is Create, Replace, or Update.

Action Modifiers

You can modify or delete all shares of a particular type rather than a single share. These options are available only if the action selected is Update or Delete.

  • To modify or delete all shares that are not hidden (having a name ending in $) or special (SYSVOL and NETLOGON), select Update or Delete all regular shares.

  • To modify or delete all hidden shares except administrative drive-letter shares, ADMIN$, FAX$, IPC$, and PRINT$, select Update or Delete all hidden non-administrative shares.

  • To modify or delete all administrative drive-letter shares (named with a drive letter followed by $), select Update or Delete all administrative drive-letter shares.

Note

Special shares (SYSVOL and NETLOGON) and administrative shares other than drive-letter shares (ADMIN$, FAX$, IPC$, and PRINT$) can be modified individually by selecting the Update action and specifying the share name.

User limit

Configure the number of users allowed to be simultaneously connected to the share.

  • To restrict the number of users, select Allow this number of users and enter the maximum to allow.

  • To make the number of users unrestricted, select Maximum allowed.

  • To leave the allowed number of users unchanged when updating a share, select No change.

    Note

    If creating or replacing a share, selecting No change configures the number of users as the maximum allowed.

These options are available only if the action selected is Create, Replace, or Update.

Access-based Enumeration

Configure the visibility of folders within the share.

  • To make folders within the share visible only to those who have read access, select Enable.

  • To make folders within the share visible to all users, select Disable.

  • To leave the visibility of folders within the share unchanged when you update a share, select No change.

This option is available only if the action selected is Create, Replace, or Update.

Additional considerations

  • Network Share items create, modify, or delete share points, but do not create or delete the folders to which they point. For a share point to be created, the folder to be shared must already exist on computers to which the Group Policy object is applied. When a share is deleted, the share point leading to the folder is removed, but the folder and its contents are not deleted.

  • For information on how to use a Folder preference item to create or delete folders using Group Policy, see Folders Extension.

  • Access-Based Enumeration options take effect only if the computers hosting shared folders have the Windows Server® 2003 Service Pack 1 or later or Windows Server® 2008 R2 or Windows Server 2008 operating system installed.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Network Shares Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Registry Extension

Group Policy includes the Registry preference extension. For computers or users, this extension allows you to:

  • Copy multiple registry settings from a computer and apply those settings to other computers.

  • Create, replace, or delete an individual registry value.

  • Create an empty key, delete a key, or delete all values and subkeys in a key.

  • Create collections (folders) to organize Registry preference items in the Group Policy Management Console, and so you can apply the same targeting to multiple Registry items.

  • Create collections in the Group Policy Management Console that mirror the structure of keys in the registry on a selected computer.

Getting started

You can create and configure Registry preference items for any domain-based Group Policy object (GPO). You configure the settings by editing a GPO using the Group Policy Management Console. When editing a GPO, you can find this preference extension at the following location:

Computer Configuration or User Configuration

└ Preferences

└ Windows Settings

└ Registry

For information about how to use this extension to create and configure a preference item, see the following topics:

  • Create Multiple Registry Items Using the Registry Wizard

  • Configure a Registry Item

  • Configure Common Options

  • Organize Registry Items


Create Multiple Registry Items Using the Registry Wizard

The Registry Wizard allows you to create multiple Registry preference items based upon registry settings that you select on a computer. The Registry preference items have the same registry keys and values as those that you select, although you can modify them after creation. The wizard organizes the Registry items in a collection (folder) structure that mimics the structure of the registry. Each Registry item generated by the wizard allows you to configure a key or a value in the Windows registry.

To create multiple Registry preference items

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration or User Configuration, expand the Preferences folder, and then expand the Windows Settings folder.

  3. Right-click the Registry node, point to New, and select Registry Wizard.

  4. Select the computer on which the desired registry settings exist (or on which similar settings you will modify exist), then click Next.

  5. Browse to and select the check box for each key or value from which you want to create a Registry preference item. Select the check box for a key only if you want to create a Registry item for the key rather than for a value within the key.

  6. Click Finish. The settings that you selected appear as preference items in the Registry Wizard Values collection.

  7. Right-click the Registry Wizard Values collection in the console tree, click Rename, and type a descriptive name for the collection.

Additional considerations

  • You can modify the settings in the individual Registry preference items created by the Registry Wizard. For more information, see Configure a Registry Item.

  • You can reorganize Registry preference items and collections by dragging them into collections that you create. The structure of collections of Registry preference items has no impact on the position of keys and values in the Windows registry. For more information, see Organize Registry Items.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Registry Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Configure a Registry Item

Registry preference items allow you to create, update, replace, and delete keys and values (including name, type, and data) in the Windows registry. Before you create a Registry preference item, you should review the behavior of each type of action possible with this extension.

Creating a Registry item

To create a new Registry preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration or User Configuration, expand the Preferences folder, and then expand the Windows Settings folder.

  3. Right-click the Registry node, point to New, and select Registry Item.

  4. In the New Registry Item dialog box, select an Action for Group Policy to perform. (For more information, see "Actions" in this topic.)

  5. Enter registry settings for Group Policy to configure or remove. (For more information, see "Registry settings" in this topic.)

  6. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  7. Click OK. The new preference item appears in the details pane.

Actions

This type of preference item provides a choice of four actions: Create, Replace, Update, and Delete. The behavior of the preference item varies with the action selected and whether the registry key or value already exists.

Create | Create a new registry value or key for computers or users.
Delete | Remove a registry value or a registry key and all of its values and subkeys for computers or users.
Replace | Delete and recreate a registry value or key for computers or users. If the target is a registry value, the net result of the Replace action is to overwrite all existing settings associated with the registry value. If the target is a registry key, the net result is to delete all values and subkeys in the key, leaving only a default value name with no data. If the registry value or key does not exist, then the Replace action creates a new registry value or key.
Update | Modify settings of an existing registry value or key for computers or users. This action differs from Replace in that it only updates settings defined within the preference item. All other settings remain as configured in the registry value or key. If the registry value or key does not exist, then the Update action creates a new registry value or key.

Registry settings

You can click the Browse button next to the Key Path field to navigate to the registry value or key to be configured.

…

If the registry value or key that you want to configure exists on this computer, click … to browse to the value or key. The remaining fields in the Properties dialog box are populated based on your selection. You can edit the values in those fields.

To select a key without specifying a value (or if the value does not yet exist), click the key in the tree at the top of the window, and then click Select.

Hive

If you did not browse to a value or key, select the hive for the registry key.

  • HKEY_CLASSES_ROOT is an alias for HKEY_LOCAL_MACHINE\Software\Classes.

  • HKEY_CURRENT_USER is an alias for HKEY_USERS\logged-on user's hive. HKEY_USERS\.Default is used when HKEY_CURRENT_USER is configured under computer configuration.

  • HKEY_LOCAL_MACHINE is the default option for computer policy. These settings affect all users of the computer.

  • HKEY_USERS is the default option for user policy. These settings affect individual users.

  • HEKY_CURRENT_CONFIG is an alias for HEKY_LOCAL_MACHINE\System\CurrentControlSet\Hardware Profiles\Current.

Key Path

If you did not browse to a value or key, type the key path. Do not include the hive or a leading or trailing slash.

This field accepts preference processing variables. Press F3 to display a list of variables from which you can select.

Value name

To configure a value, either select the Default checkbox to configure the default value for the key or type the name of the value to configure. To configure only a key, leave this field blank.

This field accepts preference processing variables. Press F3 to display a list of variables from which you can select.

Value type

To configure a value, select the value type. To configure only a key, leave this field blank.

This option is available only if the action selected is Create, Replace, or Update and if you have entered a Value name.

Value data

To configure value data, type the data for the registry value. To configure only a key, leave this field blank.

This field accepts preference processing variables. Press F3 to display a list of variables from which you can select.

This option is available only if the action selected is Create, Replace, or Update and if you have selected a Value type.

Additional considerations

  • Using the Registry Wizard, you can create multiple Registry preference items based upon registry settings that you select. For more information, see Create Multiple Registry Items Using the Registry Wizard.

  • You can organize Registry preference items by dragging them into collections that you create. The structure of collections of Registry preference items has no impact on the position of keys and values in the Windows registry. For more information, see Organize Registry Items.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Registry Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Organize Registry Items

You can organize Registry preference items into folders called collections so that you can apply the same targeting to all Registry items in the collection, or to mimic the structure of settings in the registry. The structure of collections of Registry preference items has no impact on the position of keys and values in the Windows registry.

To create a new collection of Registry preference items

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration or User Configuration, expand the Preferences folder, and then expand the Windows Settings folder.

  3. Right-click the Registry node or a collection folder beneath the node, point to New, and select Collection Item.

  4. Type a name for the collection folder.

  5. The new collection folder appears in the console tree.

  6. Right-click the collection folder, point to New, and click Registry Item or Collection Item to create a registry item or a subfolder within this collection folder, or drag existing Registry items or collections into this collection folder.

Additional considerations

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Registry Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Shortcuts Extension

Group Policy includes the Shortcuts preference extension. For computers or users, this extension allows you to:

  • Create a shortcut.

  • Modify the properties of a shortcut.

  • Delete a shortcut.

Getting started

You can create and configure Shortcut preference items for any domain-based Group Policy object (GPO). You configure the settings by editing a GPO using the Group Policy Management Console. When editing a GPO, you can find this preference extension at the following location:

Computer Configuration or User Configuration

└ Preferences

└ Windows Settings

└ Shortcuts

For information about how to use this extension to create and configure a preference item, see the following topics:

  • Configure a Shortcut Item

  • Configure Common Options


Configure a Shortcut Item

Shortcut preference items allow you to configure a shortcut to a file system object (such as a file, folder, drive, share, or computer), a shell object (such as a printer, desktop item, or control panel item), or a URL (such as a Web page or an FTP site). Before you create a Shortcut preference item, you should review the behavior of each type of action possible with this extension.

Creating a Shortcut item

To create a new Shortcut preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration or User Configuration, expand the Preferences folder, and then expand the Windows Settings folder.

  3. Right-click the Shortcuts node, point to New, and select Shortcut.

  4. In the New Shortcut Properties dialog box, select an Action for Group Policy to perform. (For more information, see "Actions" in this topic.)

  5. Enter shortcut settings for Group Policy to configure or remove. (For more information, see "Shortcut settings" in this topic.)

  6. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  7. Click OK. The new preference item appears in the details pane.

Actions

This type of preference item provides a choice of four actions: Create, Replace, Update, and Delete. The behavior of the preference item varies with the action selected and whether the shortcut already exists.

Create | Create a new shortcut for computers or users.
Delete | Remove a shortcut for computers or users.
Replace | Delete and recreate a shortcut for computers or users. The net result of the Replace action is to overwrite the existing shortcut. If the shortcut does not exist, then the Replace action creates a new shortcut.
Update | Modify settings of an existing shortcut for computers or users. This action differs from Replace in that it only updates shortcut settings defined within the preference item. All other settings remain as configured in the shortcut. If the shortcut does not exist, then the Update action creates a new shortcut.

Shortcut settings

Name

Type a display name for the shortcut. If modifying or deleting a shortcut, the name entered must match the name of the existing shortcut.

Target Type

Select the type of target to which the shortcut points. If modifying or deleting a shortcut, the target type selected must match that of the existing shortcut.

If the shortcut can be addressed:

  • Using a Windows path (such as a file, folder, drive, share, or computer), click File System Object.

  • Using a URL (such as a Web page, Web site, or FTP site), click URL.

  • As an object within the Windows shell (such as a printer, desktop or control panel item, file, folder, share, computer, or network resource), click Shell Object.

Location

Select the location where the shortcut is to appear on the computers targeted by this preference item. Locations other than All Users are relative to the logged-on user. If modifying an existing shortcut, the location selected must match that of the existing shortcut. This field accepts preference processing variables. Press F3 to display a list of variables from which you can select.

To place the shortcut in a subfolder at the location, enter the subfolder path in the Name field followed by the display name. (For example, to place a shortcut with the display name My Shortcut in the MyCorp subfolder of Explorer Favorites, type MyCorp\My Shortcut for the Name and select Explorer Favorites for Location.)

If selecting <Specify full path>, type the full path followed by the display name in the Name field. (For example, to place a shortcut with the display name My Shortcut in the MyCorp subfolder of Program Files, type %ProgramFilesDir%\MyCorp\My Shortcut for the Name and select <Specify full path> for Location.)

Target Path

Enter a local path, UNC path, or drive letter to which the shortcut will lead. This field accepts preference processing variables. Press F3 to display a list of variables from which you can select.

This option is available only if the Target Type selected is File System Object and the action is Create, Replace, or Update.

Target URL

Enter a URL to which the shortcut will lead. This field accepts preference processing variables. Press F3 to display a list of variables from which you can select.

This option is available only if the Target Type selected is URL and the action is Create, Replace, or Update.

Target Object

Select the shell object (such as a printer, desktop or control panel item, file, folder, share, computer, or network resource) to which the shortcut will lead.

This option is available only if the Target Type selected is Shell Object and the action is Create, Replace, or Update.

Arguments

Type any arguments to be used when opening the target file or folder.

This option is available only if the Target Type selected is File System Object and the action is Create, Replace, or Update.

Start in

To specify a working directory that contains files required by the target, type the path for the folder. Do not include quotes or a trailing slash. This field accepts preference processing variables. Press F3 to display a list of variables from which you can select.

This option is available only if the Target Type selected is File System Object and the action is Create, Replace, or Update.

Shortcut key

To provide a keyboard shortcut for launching the shortcut, click the Shortcut key field and press the key combination. (To remove the keyboard shortcut, press DELETE or BACKSPACE.)

This option is available only if the action is Create, Replace, or Update.

Run

Select the size of the window in which to open the target of the shortcut.

This option is available only if the Target Type selected is File System Object or Shell Object and the action is Create, Replace, or Update.

Comment

To display a tooltip when the mouse pointer pauses on the shortcut, type the text for the tooltip. This field accepts preference processing variables. Press F3 to display a list of variables from which you can select.

This option is available only if the Target Type selected is File System Object or Shell Object and the action is Create, Replace, or Update.

Icon file path and Icon index

To specify an icon for the shortcut other than the default for the type, browse to an icon file and select an icon. (You can also type the full path for an icon file, and then type an icon index.) Do not include quotes. The Icon file path field accepts preference processing variables. Press F3 to display a list of variables from which you can select.

These options are available only if the action is Create, Replace, or Update.

Additional considerations

  • Because mapped drives exist only for users, if any path in the configuration for a shortcut includes a mapped drive, the Shortcut preference item must be under User Configuration, the drive letter must exist before the Shortcut item is processed, and Run in logged-on user's security context must be selected on the Common tab.

  • By default, variables in the Target path are resolved by Group Policy before the shortcut is created or modified. To include the variable rather than its resolved value in the shortcut (so that the variable is resolved in the environment on the computers to which this Shortcut item is applied), use unresolved variable syntax, such as %<ProgramFiles>% in place of %ProgramFiles%.

    Because unresolved variable syntax is resolved in the environment of computers to which the Shortcut item is applied, use only environment variables (rather than preference processing variables).

  • User specific paths resolve to .default when applying a shortcut item to the computer.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Shortcuts Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Control Panel Settings

The Group Policy Management Console allows you to configure preferences when you edit any domain-based Group Policy object. The preferences node appears under Computer Configuration and User Configuration. The editor displays preference extensions under two categories: Windows Settings and Control Panel Settings.

Preference extensions under Control Panel Settings include:

  • Data Sources Extension: Create, modify, or delete Open Database Connectivity (ODBC) data source names.

  • Devices Extension: Enable or disable hardware devices or classes of devices.

  • Folder Options Extension: Configure folder options; create, modify, or delete Open With associations for file name extensions; create, modify, or delete file name extensions associated with a type of files.

  • Internet Settings Extension: Modify user-configurable Internet settings.

  • Local Users and Groups Extension: Create, modify, or delete local users and groups.

  • Network Options Extension: Create, modify, or delete virtual private networking (VPN) or dial-up networking connections.

  • Power Options Extension: Modify power options and create, modify, or delete power schemes.

  • Printers Extension: Create, modify, or delete TCP/IP, shared, and local printer connections.

  • Regional Options Extension: Modify regional options.

  • Scheduled Tasks Extension: Create, modify, or delete scheduled or immediate tasks.

  • Services Extension: Modify services.

  • Start Menu Extension: Modify Start menu options.

Additional references

  • Configure, Target, and Comment Preference Items


Data Sources Extension

Group Policy includes the Data Sources preference extension. This extension allows you to centrally configure Open Database Connectivity (ODBC) data source names for user or computers.

Getting started

You can create and configure Data Source preference items for any domain-based Group Policy object (GPO). You configure the settings by editing a GPO using the Group Policy Management Console. When editing a GPO, you can find this preference extension at the following location:

Computer Configuration or User Configuration

└ Preferences

└ Control Panel Settings

└ Data Sources

For information about how to use this extension to create and configure a preference item, see the following topics:

  • Configure a Data Source Item

  • Configure Common Options


Configure a Data Source Item

Data source preference items allow you to create, update, replace, and delete user and system data sources. Data sources store information about how to connect to a data provider. Before you create a Data Source preference item, you should review the behavior of each type of action possible with this extension.

Creating a Data Source item

To create a new Data Source preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration or User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Data Sources node, point to New, and select Data Source.

  4. In the New Data Source Properties dialog box, select an Action for Group Policy to perform. (For more information, see "Actions" in this topic.)

  5. Enter data source settings for Group Policy to configure or remove. (For more information, see "Data source settings" in this topic.)

  6. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  7. Click OK. The new preference item appears in the details pane.

Actions

This type of preference item provides a choice of four actions: Create, Replace, Update, and Delete. The behavior of the preference item varies with the action selected and whether a data source with the same name exists.

Create | Create a new data source name for the user or computer. If the data source exists, then do not modify it.
Delete | Remove a data source name from the user or computer. The extension performs no action if the data source does not exist.
Replace | Delete and recreate a data source name for the user or computer. The net result of the Replace action overwrites all existing settings associated with the data source name. If the data source name does not exist, then the Replace action creates the new data source name.
Update | Modify settings of an existing data source name. This action differs from replace in that it only updates settings defined within the preference item. All other settings remain as they were previously configured. If the data source name does not exist, then the Update action creates a new data source name.

Data source settings

User Data Source or System Data Source

Select the visibility of the data source name. User data sources are available to users receiving the preference item. System data sources are available to all the users of the computer (including the Local System).

Data Source Name

Type the name used to identify the data source. This field accepts preference processing variables. Press F3 to display a list of variables from which you can select. You can import a local data source name into the Data Source preference item. Click Browse (…) to display a list of the data sources names on the current computer.

Important

Attributes are automatically populated when importing an existing data source name into a Data Source preference item.

Driver

Type the name of the ODBC driver used to connect to the data provider. Click Browse (…) to choose from a list of ODBC drivers.

Description

Provide text used to describe the data source. This field accepts preference processing variables. Press F3 to display a list of variables from which you can select.

User Name

Type the user name used to connect to the indicated data provider.

Password

Type the password used to connect to the indicated data provider. Type the same password in the Confirm Password box.

Security Note

This password is stored as part of the GPO in SYSVOL and is discoverable, although obscured. If you choose to store passwords in preference items, you should consider creating dedicated accounts for this purpose, and never store administrative passwords in preference items.

Attributes

Data Source item attributes allow you to supply additional information for the data provider. Each attribute consists of an attribute name and its associated value.

  • Click Add to create new attributes in the Data Source item.

  • Click Remove to delete existing attributes.

  • Click Change to alter the attribute name or value.

Important

Attributes are automatically populated when importing an existing data source name into a Data Source preference item.

Additional considerations

  • Use the Update action to add or overwrite attributes of existing data source names.

  • Use the Replace action to remove attributes from existing data source names.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Data Sources Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Devices Extension

Group Policy includes the Devices preference extension. This extension allows you to centrally enable or disable classes of or specific types of hardware devices for users or computers.

Getting started

You can create and configure Device preference items for any domain-based Group Policy object (GPO). You configure the settings by editing a GPO using the Group Policy Management Console. When editing a GPO, you can find this preference extension at the following location:

Computer Configuration or User Configuration

└ Preferences

└ Control Panel Settings

└ Devices

For information about how to use this extension to create and configure a preference item, see the following topics:

  • Configure a Device Item

  • Configure Common Options


Configure a Device Item

Device preference items allow you to enable or disable classes of or types of hardware devices. Device classes allow you to enable or disable a broader ranger of device types. Device types allow you to enable or disable a specific type of hardware device. For example, disabling the device class DVD/CD-ROM drives disables all hardware devices within the selected class. Disabling the device type MS CD/DVD-ROM ATA Device only disables hardware devices of that type, not the entire class. Before you create a Device preference item, you should review the behavior of each type of action possible with this extension.

Important

Make certain to test Device preference items before deploying them to a production environment. Disabling devices has the potential to render Windows inoperable.

Creating a Device item

To create a new Device preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration or User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Devices node, point to New, and select Device.

  4. In the New Device Properties dialog box, select an Action for Group Policy to perform. (For more information, see "Actions" in this topic.)

  5. Enter device settings for Group Policy to configure or remove. (For more information, see "Device settings" in this topic.)

  6. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  7. Click OK. The new preference item appears in the details pane.

Actions

Use this device (enable) | Enable a matching device class or device type.
Do not use this device (disable) | Disable a matching device class or device type.

Device settings

Device class | This setting contains the name of the enabled or disabled device class. DVD/CD-ROM drives is an example of a device class. Click Browse (…) to choose from a list of the device classes available on your computer.
Device type | This setting contains the name of the enabled or disabled device type. MS CD/DVD-ROM ATA Device is an example of a device type. To select a Device type, click Browse (…) next to the Device class box. Expand a device class to show the list of device types available on your computer.

Additional considerations

  • Device preference items applied to computers affect all users of the targeted computer. Apply preference items to users if you want controls which users have device class or types enabled or disabled.

  • Some devices appearing in Device Manager cannot be disabled.

  • Disabling a device takes effect immediately. However, there may be some delays with Device Manager showing the device class or item as disabled. Check the properties of the device for the current status.

  • The Remove this item when it is no longer applied is available only when the item action is set to Do not use this device (disabled). Removing the preference item enables the device.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Devices Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Folder Options Extension

Group Policy includes the Folder Options extension. This extension allows you to configure various Windows Explorer settings such as file type and application start-up associations, and folder view options.

Getting started

You can create and configure File Type, Open With, and Folder Options preference items for any domain-based Group Policy object (GPO). You configure the settings by editing a GPO using the Group Policy Management Console. When editing a GPO, you can find this preference extension at the following location:

Computer Configuration or User Configuration

└ Preferences

└ Control Panel Settings

└ Folder Options

For information about how to use this extension to create and configure a preference item, see the following topics:

  • Configure a Folder Options Item (Windows Vista and later versions)

  • Configure an Open With Item

  • Configure a File Type Item

  • Configure a Folder Options Item (Windows XP)

  • Configure Common Options


Configure a Folder Options Item (Windows Vista and later versions)

The Folder Options (Windows Vista® and later) preference item lets you configure different settings for the Windows Explorer folder view. The Folder Options preference extension uses the Update action to process Folder Options items.

Creating a Folder Options (Windows Vista and later) item

To create a new Folder Options preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Folder Options node, point to New, and select Folder Options (Windows Vista and later).

  4. In the New Folder Options Properties dialog box, enter folder options settings for Group Policy to configure. (For more information, see Enable and Disable Settings in a Preference Item.)

  5. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  6. Click OK. The new preference item appears in the details pane.

Additional considerations

  • Folder Options (Windows Vista and later) items apply to computers that are running Windows Server® 2008 R2, Windows® 7, Windows Server 2008 or Windows Vista. Use the Folder Options (Windows XP) item to configure folder option settings for computers that are running Windows Server 2003 and Windows XP.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Folder Options Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Configure an Open With Item

The Open With preference item allows you to create, configure, and delete an Open With association with a specific file name extension. Before you create an Open With preference item, you should review the behavior of each type of action possible with the extension.

Creating an Open With item

To create a new Open With preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Folder Options node, point to New, and select Open With.

  4. In the New Open With Properties dialog box, select an Action for Group Policy to perform. (For more information, see "Actions" in this topic.)

  5. Enter Open With settings for Group Policy to configure or remove. (For more information, see "Open With settings" in this topic.)

  6. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  7. Click OK. The new preference item appears in the details pane.

Actions

This type of preference item provides a choice of four actions: Create, Replace, Update, and Delete. The behavior of the preference item varies with the action selected and whether the Open With association already exists.

Create | Create a new Open With association. If a file name extension in the Open With item exists within the user's profile, then the new association is not created.
Delete | Remove an existing Open With association. An association exists when the file name extension in the Open With item exists within the user's profile. No action is performed if the association does not exist.
Replace | Delete and recreate an Open With association. The net result of the Replace action overwrites all existing settings associated with the Open With association. If the Open With association does not exist, then the Replace action creates a new Open With association.
Update | Modify an Open With association. The action differs from Replace in that it updates the settings defined within the preference item. All other settings remain as they were previously configured. If the Open With association does not exist, then the Update action creates a new Open With association.

Open With settings

File name extension

Type the extension of the file to associate with the specified application. Press F3 to display a list of variables from which you can select.

Note

You do not need to insert the period before the file name extension.

Associated Program

Type the path and name of the application you want to associate with the file name extension. Alternatively, you can click Browse (…) and select the application. Press F3 to display a list of variables from which you can select.

Set as default

Select this check box to make the associated application the default application Windows uses to open the file name extension.

Additional considerations

  • Open With appears on the Windows Explorer's shortcut menu when there is more than one Open With association.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Folder Options Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Configure a File Type Item

The File Type preference item allows you to create, configure, and delete file name extensions associated with a particular class of files (such as text documents). Additionally, the preference item allows you to associate applications for opening, editing, and other actions as well as icons to file specific file types. Before you create a File Type preference item, you should review the behavior of each type of action possible with the item.

Creating a File Type item

To create a new File Type preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Folder Options node, point to New, and select File Type.

  4. In the New File Type Properties dialog box, select an Action for Group Policy to perform. (For more information, see "Actions" in this topic.)

  5. Enter file type settings for Group Policy to configure or remove. (For more information, see "File type settings" in this topic.)

  6. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  7. Click OK. The new preference item appears in the details pane.

Actions

This type of preference item provides a choice of four actions: Create, Replace, Update, and Delete. The behavior of the preference item varies with the action selected and whether the file type association already exists.

Create | Create a new file type association. If the file name extension in the file type item is registered on the computer, then the new file type association is not created.
Delete | Remove an existing file type association. An association exists when the file name extension in the file type item is registered on the computer. No action is performed if the association does not exist.
Replace | Delete and recreate the file type association. The net result of the Replace action overwrites all existing settings associated with the file type association. If the file type association does not exist, then the Replace action creates a new file type association.
Update | Modify a file type association. The action differs from Replace in that it updates the settings defined within the preference item. All other settings remain as they were previously configured. If the file type association does not exist, then the Update action creates a new file type association.

File type settings

File extension

Type the extension of the file to associate with the specified application. Press F3 to display a list of variables from which you can select.

Note

You do not need to insert the period before the file name extension.

Associated class

Choose from the list of registered classes the one you want to associate with the file type. Press F3 to display a list of variables from which you can select.

Configure class settings

Select Configure class settings to configure advanced class settings.

  • To associate a file icon with the file name extension, type the full path in the Icon file path. Alternatively, you can Browse (…) to the file location. Browsing to the file location automatically populates the Icon Index box.

  • To associate applications for opening, editing, and other actions upon this specific file type, click New. Type the name of the command Windows displays on the shortcut menu and the program Windows launches along with any required specifications. Click OK.

Additional considerations

  • Each subaction configured replaces in full any subaction of the same name that was previously registered under the Associated class. Apart from overwriting a subaction, this item does not support removing subactions, or other items in the Actions list.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Folder Options Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Configure a Folder Options Item (Windows XP)

The Folder Options (Windows XP) preference item lets you configure various settings for the Windows Explorer folder view. The Folder Options preference extension uses the Update action to process Folder Options items.

Creating a Folder Options (Windows XP) item

To create a new Folder Options preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Folder Options node, point to New, and select Folder Options (XP).

  4. In the New Folder Options Properties dialog box, enter folder options settings for Group Policy to configure. (For more information, see Enable and Disable Settings in a Preference Item.)

  5. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  6. Click OK. The new preference item appears in the details pane.

Additional considerations

  • Folder Options (Windows XP) items apply to computers that are running Windows Server 2003 and Windows XP. Use the Folder Options (Windows Vista® and later) item to configure folder option settings for computers that are running Windows Server® 2008 R2, Windows® 7, Windows Server 2008, or Windows Vista.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Folder Options Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Internet Settings Extension

Group Policy includes the Internet Settings preference extension. For users, this extension allows you to:

  • Require a specific configuration of Internet settings.

  • Configure an initial configuration of Internet settings, but allow end users to make changes.

  • Configure several Internet settings while leaving others to the discretion of each end user. (For example, you can specify proxy server settings while allowing users to modify accessibility options.)

Getting started

You can create and configure Internet Explorer preference items for any domain-based Group Policy object (GPO). You configure the settings by editing a GPO using the Group Policy Management Console. When editing a GPO, you can find this preference extension at the following location:

User Configuration

└ Preferences

└ Control Panel Settings

└ Internet Settings

For information about how to use this extension to create and configure a preference item, see the following topics:

  • Configure an Internet Explorer 8 Item

  • Configure an Internet Explorer 7 Item

  • Configure an Internet Explorer 5 and 6 Item

  • Configure Common Options


Configure an Internet Explorer 8 Item

Internet Explorer 8 preference items let you update Internet options for Internet Explorer 8. Internet Explorer preference items do not provide a selection of actions because the only possible action is Update.

Creating an Internet Explorer item

To create a new Internet Explorer preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Internet Settings node, point to New, and select Internet Explorer 8.

  4. In the New Internet Explorer 8 Properties dialog box, enter Internet options for Group Policy to configure. (For more information, see Enable and Disable Settings in a Preference Item.)

  5. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  6. Click OK. The new preference item appears in the details pane.

Additional considerations

  • Settings that cannot be enabled or disabled are unavailable. You cannot configure these settings by using an Internet Explorer preference item.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Internet Settings Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Configure an Internet Explorer 7 Item

Internet Explorer 7 preference items allow you to update Internet options for Internet Explorer 7. Internet Explorer preference items do not provide a selection of actions because the only possible action is Update.

Creating an Internet Explorer item

To create a new Internet Explorer preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Internet Settings node, point to New, and select Internet Explorer 7.

  4. In the New Internet Explorer 7 Properties dialog box, enter Internet options for Group Policy to configure. (For more information, see Enable and Disable Settings in a Preference Item.)

  5. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  6. Click OK. The new preference item appears in the details pane.

Additional considerations

  • Settings that cannot be enabled or disabled are unavailable. You cannot configure these settings using an Internet Explorer preference item.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Internet Settings Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Configure an Internet Explorer 5 and 6 Item

Internet Explorer 5 and 6 preference items allow you to update Internet options for Internet Explorer 5 and 6. Internet Explorer preference items do not provide a selection of actions because the only possible action is Update.

Creating an Internet Explorer item

To create a new Internet Explorer preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Internet Settings node, point to New, and select Internet Explorer 5 and 6.

  4. In the New Internet Explorer 5 and 6 Properties dialog box, enter Internet options for Group Policy to configure. (For more information, see Enable and Disable Settings in a Preference Item.)

  5. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  6. Click OK. The new preference item appears in the details pane.

Additional considerations

  • Settings that cannot be enabled or disabled are unavailable. You cannot configure these settings using an Internet Explorer preference item.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Internet Settings Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Local Users and Groups Extension

Group Policy includes the Local Users and Groups preference extension. This extension allows you to centrally manage local users and groups on domain member computers.

Getting started

You can create and configure Local User and Local Group preference items for any domain-based Group Policy object (GPO). You configure the settings by editing a GPO using the Group Policy Management Console. When editing a GPO, you can find this preference extension at the following location:

Computer Configuration or User Configuration

└ Preferences

└ Control Panel Settings

└ Local Users and Groups

For information about how to use this extension to create and configure a preference item, see the following topics:

  • Configure a Local Group Item

  • Configure a Local User Item

  • Configure Common Options


Configure a Local Group Item

Local Group preference items allow you to centrally create, delete, and rename local groups. Also, you can use these preference items to change local group memberships. Before you create a local group preference item, you should review the behavior of each type of action possible with the extension.

Creating a Local Group item

To create a new Local Group preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration or User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Local Users and Groups node, point to New, and select Local Group.

  4. In the New Local Group Properties dialog box, select an Action for Group Policy to perform. (For more information, see "Actions" in this topic.)

  5. Enter local group settings for Group Policy to configure or remove. (For more information, see "Local group settings" in this topic.)

  6. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  7. Click OK. The new preference item appears in the details pane.

Actions

This type of preference item provides a choice of four actions: Create, Replace, Update, and Delete. The behavior of the preference item varies with the action selected and whether a group with the same name exists.

Create

Create a new local group on the local computer. If the local group exists, then do not modify it.

Delete

Remove a local group with the matching name from the local computer. The extension performs no action if the group does not exist.

Replace

Delete and recreate a local group with the matching name for the local computer. The net result of the Replace action overwrites all existing settings associated with the local group. If the local group does not exist, then the Replace action creates a new local group.

Important

Windows assigns each group a security identifier (SID). Windows uses this information to determine if a group is allowed to access a particular resource. Use caution when using the Replace action as the newly created group has a new SID. This may prevent groups from having access to resources.

Update

Rename or modify settings, including group membership, of an existing group. This action differs from Replace in that it updates the settings defined within the preference item. All other settings remain as they were previously configured. If the local group does not exist, then the Update action creates a new local group.

Important

The Update action does not change the SID of the group.

Local Group settings

Group Name

Type the name of the targeted local group. The preference extension creates a new group with this name if the group does not exist. If the group exists, the preference extension uses the group with this name as the target of the requested action.

Rename to:

Type in the new name of the local group. This option is only available when using the Update action. The preference extension renames the group with the name that matches in the Group Name box to the name provided in the Rename to box.

Description

Text used to describe the purpose or use of the local group. Press F3 to display a list of variables from which you can select.

Add the current user

Use this setting to include the currently logged on user as a member of the local group.

Note

This setting is available only when editing the preference item under User Configuration.

Remove the current user

Use this setting to delete the currently logged on user's membership in the local group.

Note

This setting is available only when editing the preference item under User Configuration.

Do not configure for the current user

Use this setting if you do not want the currently logged-on user added to or removed from the local group.

Note

This setting is available only when editing the preference item under User Configuration.

Delete all member users

Use this setting to remove all the user accounts that are members of the local group. The preference extension performs this work prior to processing the members list defined in the preference item.

Delete all member groups

Use this setting to remove all the group accounts that are members of the local group. The preference extension performs this work prior to processing the members list defined in the preference item.

Add

Click Add to enter a new member item to the members list.

  • Type the name of the user or group you want to include in the member item, or click Browse (…) to select a user or group.

  • Choose from the Action list the desired action for the member item:

    • Add to this group: Adds the named member to the local group.

    • Remove from this group: Removes the named member from the local group.

Remove

Click Remove to delete the currently selected member item from the member list.

Change

Click Change to modify the currently selected member item.

  • Type the name of the user or group you want to include in the member item, or click Browse (…) to select a user or group.

  • Choose from the Action list the desired action for the member item:

    • Add to this group: Adds the named member to the local group.

    • Remove from this group: Removes the named member from the local group.

Additional considerations

  • Group memberships for the current user take effect during the next user logon.

  • The Local Group item action Replace deletes the existing local group and creates a new local group, which includes a new security identifier.

  • The Local Group item action Update modifies the settings of a local group, but does not change the security identifier of the local group.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Local Users and Groups Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Configure a Local User Item

Local User preference items allow you to centrally create, delete, and rename local users. Also, you can use this preference item to change local user passwords. Before you create a local user preference item, you should review the behavior of each type of action possible with the extension.

Creating a Local User item

To create a new Local User preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration or User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Local Users and Groups node, point to New, and select Local User.

  4. In the New Local User dialog box, select an Action for Group Policy to perform. (For more information, see "Actions" in this topic.)

  5. Enter local user settings for Group Policy to configure or remove. (For more information, see "Local user settings" in this topic.)

  6. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  7. Click OK. The new preference item appears in the details pane.

Actions

This type of preference item provides a choice of four actions: Create, Replace, Update, and Delete. The behavior of the preference item varies with the action selected and whether a user with the same name (or, for built-in accounts, security identifier [SID]) exists.

Create

Create a new local user on the local computer. If the local user exists, then do not modify it.

Delete

Remove a local user with the matching name from the local computer. The extension performs no action if the local user does not exist.

Replace

Delete and recreate a local user with the matching name for the local computer. The net result of the Replace action overwrites all existing settings associated with the local user. If the local user does not exist, then the Replace action creates a new local user.

Important

Windows assigns each user a SID. Windows uses this information to determine if a user is allowed to access a particular resource. Use caution when using the Replace action as the newly created user has a new SID. This may prevent users from having access to resources.

Update

Rename a user or modify user settings. This action differs from Replace in that it updates the settings defined within the preference item. All other settings remain as they were previously configured. If the local user does not exist, then the Update action creates a new local user.

Important

The Update action does not change the SID of the user.

Local User settings

User Name

Type the name of the targeted local user. The preference extension creates a new user with this name if the user does not exist. If the user exists, the preference extension uses the user with this name as the target of the requested action.

Rename to:

Type the new name of the local user. This option is only available when using the Update action. The preference extension renames the user with the name that matches in the User Name box to the name provided in the Rename to box.

Full name

Text used to display the full name of the local user. Press F3 to display a list of variables from which you can select.

Description

Text used to describe the purpose or use of the local user. Press F3 to display a list of variables from which you can select.

Password

Type the password used when creating, replacing, or updating a local user. Type the same password in the Confirm Password box

Security Note

This password is stored as part of the GPO in SYSVOL and is discoverable, although obscured. If you choose to store passwords in preference items, you should consider creating dedicated accounts for this purpose, and never store administrative passwords in preference items.

User must change password at next logon

Use this setting if you want to force the newly created or updated local user to change their password at their next logon.

Account is disabled

Use this setting if you want to disable the newly created or updated local user.

Account never expires

Use this setting if you do not want the newly created or updated local user account to expire. Deselect the setting to force the newly created or updated local user account to expire. Then, choose an expiration date from the Account expires list.

Additional considerations

  • The Local User item action Replace deletes the existing local user and creates a new local user, which includes a new security identifier

  • The Local User item action Update modifies the settings of a local user, but does not change the security identifier of the local user.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Local Users and Groups Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Network Options Extension

Group Policy includes the Network Options preference extension. This extension allows you to configure virtual private network (VPN) or dial-up networking connections.

Getting started

You can create and configure VPN connection and dial-up networking connection preference items for any domain-based Group Policy object (GPO). You configure the settings by editing a GPO using the Group Policy Management Console. When editing a GPO, you can find this preference extension at the following location:

Computer Configuration or User Configuration

└ Preferences

└ Control Panel Settings

└ Network Options

For information about how to use this extension to create and configure a preference item, see the following topics:

  • Configure a Dial-Up Networking Connection Item

  • Configure a Virtual Private Network Connection Item

  • Configure Common Options


Configure a Dial-Up Networking Connection Item

The Network Options extension allows you to centrally create, modify, and delete dial-up networking and virtual private network (VPN) connections. Before you create a network option preference item, you should review the behavior of each type of action possible with the extension.

Creating a Dial-Up Connection item

To create a new Dial-Up Connection preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration or User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Network Options node, point to New, and select Dial-Up Connection.

  4. On the Dial-Up Connection tab, select an Action for Group Policy to perform. (For more information, see "Actions" in this topic.)

  5. Enter dial-up networking connection settings for Group Policy to configure or remove. (For more information, see "Dial-up networking connection settings" in this topic.)

  6. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  7. Click OK. The new preference item appears in the details pane.

Actions

This type of preference item provides a choice of four actions: Create, Replace, Update, and Delete. The behavior of the preference item varies with the action selected and whether the dial-up networking connection already exists.

Create | Create a new network connection. If a connection with the same name exists, then do not modify it.
Delete | Remove a network connection with the same name. The extension performs no action if the connection does not exist.
Replace | Delete and recreate the network connection. The net result of the Replace action overwrites all existing settings associated with the connection. If the connection does not exist, then the Replace action creates a new connection.
Update | Rename or modify a network connection. The action differs from Replace in that it updates the settings defined within the preference item. All other settings remain as they were previously configured. If the connection does not exist, then the Update action creates a new connection.

Dial-up networking connection settings

User connection | Use this setting to make the newly created or updated connection visible only to the applied user.
All users connection | Use this setting to make the newly created or updated connection visible to all users on the computer.
Connection Name | Text used to name the connection. Press F3 to display a list of variables from which you can select. You can import a dial-up networking connection into the Dial-Up Connection preference item. Click Browse (…) to display a list of dial-up connections for the current computer.
Phone Number | Text used to indicate the phone number the connection uses. Press F3 to display a list of variables from which you can select.

Additional considerations

  • Dial-Up Connection preference items and VPN Connection preference items are not supported in a Server Core installation of the Windows Server® 2008 R2 or Windows Server 2008 operating systems.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Network Options Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Configure a Virtual Private Network Connection Item

The Network Options extension allows you to centrally create, modify, and delete dial-up networking and virtual private network (VPN) connections. Before you create a network option preference item, you should review the behavior of each type of action possible with the extension.

Creating a VPN Connection item

To create a new VPN Connection preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration or User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Network Options node, point to New, and select VPN Connection.

  4. In the New VPN Properties dialog box, select an Action for Group Policy to perform. (For more information, see "Actions" in this topic.)

  5. Enter VPN connection settings for Group Policy to configure or remove. (For more information, see "Virtual private network connection settings" in this topic.)

  6. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  7. Click OK. The new preference item appears in the details pane.

Actions

This type of preference item provides a choice of four actions: Create, Replace, Update, and Delete. The behavior of the preference item varies with the action selected and whether the VPN connection already exists.

Create | Create a new network connection. If the connection with the same name exists, then do not modify it.
Delete | Remove a network connection with the same name. The extension performs no action if the connection does not exist.
Replace | Delete and recreate the network connection. The net result of the Replace action overwrites all existing settings associated with the connection. If the connection does not exist, then the Replace action creates a new connection.
Update | Rename or modify a network connection. The action differs from Replace because it updates the settings defined within the preference item. All other settings remain as they were previously configured. If the connection does not exist, then the Update action creates a new connection.

Virtual private network connection settings

User connection

Use this setting to make the newly created or updated connection visible only to the applied user.

All users connection

Use this setting to make the newly created or updated connection visible to all users on the computer.

Connection Name

Text used to name the connection. Press F3 to display a list of variables from which you can select. You can import a virtual private network connection into a virtual private network preference item. Click Browse (…) to display a list of virtual private network connections from the current computer.

IP Address or DNS name

Type the IP address of the remote computer. Or, select the Use DNS name box and type the fully qualified domain name of the remote computer.

Note

IPv6 addresses are not supported.

Dial another connection first

Type the name of the dial-up network connection that this connection established prior to connecting to the virtual private network.

Show icon in notification area when connected

Displays an animated icon in the notification area when connected.

Options tab

Use the Options tab to choose dialing and redialing options for the VPN Connection preference item.

Security tab

The Security tab provides Typical and Advanced security settings associated for the VPN Connection preference item. Use these settings to determine password security, data encryption, and authentication protocols.

Networking tab

Use the Network tab to choose the type of VPN connection for the preference item.

Additional considerations

  • Dial-Up Connection preference items and VPN Connection preference items are not supported in a Server Core installation of the Windows Server® 2008 R2 or Windows Server 2008 operating systems.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Network Options Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Power Options Extension

Group Policy includes the Power Options preference extension. This extension allows you to configure power options for users or computers.

Getting started

You can create and configure Power Plan, Power Options, and Power Scheme preference items for any domain-based Group Policy object (GPO). You configure the settings by editing a GPO using the Group Policy Management Console. When editing a GPO, you can find this preference extension at the following location:

Computer Configuration or User Configuration

└ Preferences

└ Control Panel Settings

└ Power Options

For information about how to use this extension to create and configure a preference item, see the following topics:

  • Configure a Power Plan Item (Windows Vista and later)

  • Configure a Power Options Item (Windows XP)

  • Configure a Power Scheme Item (Windows XP)

  • Configure Common Options


Configure a Power Plan Item (Windows Vista and later)

Power Plan (Windows Vista® and later) preference items configure sleep and display options for managing power consumption for Windows Server® 2008 R2, Windows® 7, Windows Server 2008, and Windows Vista.

You configure Power Plan items just as you would configure advanced power settings in Power Options in Control Panel.

Creating a Power Plan (Windows Vista and later) item

To create a new Power Plan preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration or User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Power Options node, point to New, and select Power Plan (Windows Vista and later).

  4. In the New Power Plan (Windows Vista and later) Properties dialog box, enter power options settings for Group Policy to configure. (For more information, see Enable and Disable Settings in a Preference Item.)

  5. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  6. Click OK. The new preference item appears in the details pane.

Actions

This type of preference item provides a choice of four actions: Create, Replace, Update, and Delete. The behavior of the preference item varies with the action selected and whether the power plan already exists.

Create | Create a newly configured power plan. If a power plan with the same name as the Power Plan item exists, then the existing power plan is not changed.
Delete | Remove a power plan with the same name as the Power Plan preference item. The extension performs no action if the power plan does not exist. Built-in power plans cannot be deleted.
Replace | Delete and re-create the named power plan. The net result of the Replace action overwrites all existing settings associated with the power plan. If the power plan does not exist, then the Replace action creates a newly configured power plan. Built-in power plans cannot be replaced.
Update | Modify a power plan. The action differs from Replace because it updates the settings that are defined within the preference item. All other settings remain as they were previously configured. If the power plan does not exist, then the Update action creates a new power plan.

Additional considerations

  • If a user Power Plan item processes after a computer Power Plan item, user settings replace the active settings, which may have been made active previously by a computer or user Power Plan item.

  • The local administrator and Power Users administrative group can manually change their power settings by using Control Panel; other users cannot. Regardless, the settings configured for users become active when they log on and remain so even after they log off.

  • Settings that are applied to the computer become active when the computer is started without a logged-on user. However, Power Plan preference items, which support Group Policy background updates, can reset power settings when computer policy is applied without a logged-on user.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Power Options Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Configure a Power Options Item (Windows XP)

The Power Options preference item configures how Windows Server® 2003 and Windows® XP responds to power events such as pressing the power or sleep button, closing the lid on portable computers, or returning from standby.

Power Options preference items configure only Windows Server 2003 or Windows XP power options. To configure Power Options for Windows Server® 2008 R2, Windows Server 2008, Windows 7, and Windows Vista®, use the Power Management Administrative Template Settings found under:

Computer Configuration

└ Policies

└ Administrative Templates

└ System

└ Power Management

You configure Power Options items just as you would in Power Options in Control Panel. A Power Options item does not include an item action.

Creating a Power Options (Windows XP) item

To create a new Power Options preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration or User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Power Options node, point to New, and select Power Options (Windows XP).

  4. In the New Power Options Properties dialog box, enter power options settings for Group Policy to configure. (For more information, see Enable and Disable Settings in a Preference Item.)

  5. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  6. Click OK. The new preference item appears in the details pane.

Additional considerations

  • If a user Power Options item processes after a computer Power Options item, user settings replace the active settings, which may have been made active previously by a computer or user Power Options item.

  • The local administrator and Power Users administrative group can manually change their power settings using the control panel; other users cannot. Regardless, the settings configured for users become active when they log on and remain so even after they log off.

  • Settings applied to the computer become active when the computer is started without a logged-on user. However, Power Options preference items, which support Group Policy background refreshes, can reset power settings when computer policy is applied without a logged-on user.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Power Options Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Configure a Power Scheme Item (Windows XP)

The Power Scheme preference item configures settings in a Windows Server® 2003 or Windows® XP power scheme—a group of power management settings combined under a name. Power schemes control how Windows manages hardware power consumption following a period of inactivity. Before you create a Power Scheme, you should review the behavior of each type of action possible with the extension. You configure power scheme items just as you would in Power Options in Control Panel.

Note

Use Power Option preference items to configure how Windows Server 2003 or Windows XP respond to power events.

Creating a Windows XP Power Scheme item

To create a new Power Scheme preference item for Windows XP

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration or User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Power Options node, point to New, and select Power Scheme (Windows XP).

  4. In the New Power Scheme Properties dialog box, select an Action for Group Policy to perform. (For more information, see "Actions" in this topic.)

  5. Enter power scheme settings for Group Policy to configure. (For more information, see Enable and Disable Settings in a Preference Item.)

  6. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  7. Click OK. The new preference item appears in the details pane.

Actions

This type of preference item provides a choice of four actions: Create, Replace, Update, and Delete. The behavior of the preference item varies with the action selected and whether the power scheme already exists.

Create | Create a newly configured Power Scheme. If a power scheme with the same name as the Power Scheme item exists, then the existing Power Scheme is not modified.
Delete | Remove a Power Scheme with the same name as the Power Scheme preference item. The extension performs no action if the Power Scheme does not exist.
Replace | Delete and recreate the named power scheme. The net result of the Replace action overwrites all existing settings associated with the power scheme. If the power scheme does not exist, then the Replace action creates a newly configured power scheme.
Update | Modify a power scheme. The action differs from Replace in that it updates the settings defined within the preference item. All other settings remain as they were previously configured. If the power scheme does not exist, then the Update action creates a new power scheme.

Additional considerations

  • If a user Power Scheme item processes after a computer Power Scheme item, user power scheme settings replace the active settings, which may have been made active previously by a computer or user Power Scheme item.

  • The local administrator and Power Users administrative group can manually change their power scheme settings using the control panel; other users cannot. Regardless, the settings configured for users become active when they log on and remain so even after they log off.

  • Settings applied to the computer become active when the computer is started without a logged-on user. However, Power Scheme preference items, which support Group Policy background refreshes, can reset power scheme settings when computer policy is applied without a logged-on user.

  • Power scheme settings control which values are contained within the specified power scheme. When creating new power schemes, disabled values are pulled from the default power scheme for the computer or user. The New Power Scheme properties dialog box selects the standard settings for any power scheme selected in the Power Schemes list.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Power Options Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Printers Extension

Group Policy includes the Printers preference extension. This extension allows you to create, configure, and delete local, shared, and TCP/IP printers.

Getting started

You can create and configure Printer preference items for any domain-based Group Policy object (GPO). You configure the settings by editing a GPO using the Group Policy Management Console. When editing a GPO, you can find this preference extension at the following location:

Computer Configuration or User Configuration

└ Preferences

└ Control Panel Settings

└ Printers

For information about how to use this extension to create and configure a preference item, see the following topics:

  • Configure a Local Printer Item

  • Configure a Shared Printer Item

  • Configure a TCP/IP Printer Item

  • Configure Common Options


Configure a Local Printer Item

The Printers preference extension allows you to create, configure, and delete local printers by using the Local Printer preference item. Before you create a Local Printer preference item, you should review the behavior of each type of action possible with the extension.

Creating a Local Printer item

To create a new Local Printer preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration or User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Printers node, point to New, and select Local Printer.

  4. In the New Local Printer Properties dialog box, select an Action for Group Policy to perform. (For more information, see "Actions" in this topic.)

  5. Enter local printer settings for Group Policy to configure or remove. (For more information, see "Local printer settings" in this topic.)

  6. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  7. Click OK. The new preference item appears in the details pane.

Actions

This type of preference item provides a choice of four actions: Create, Replace, Update, and Delete. The behavior of the preference item varies with the action selected and whether the printer connection already exists.

Create

Create a new local printer. If a local printer with the same name exists, then it does not modify it.

Delete

Remove a local printer with the same name. The extension performs no action if the local printer does not exist.

Important

This action does not remove the printer driver. It only removes the local printer.

Replace

Delete and recreate the local printer. The net result of the Replace action overwrites all existing settings associated with the local printer. If the local printer does not exist, then the Replace action creates a new local printer.

Update

Rename or modify a local printer. The action differs from Replace in that it updates the settings defined within the preference item. All other settings remain as they were previously configured. If the local printer does not exist, then the Update action creates a new local printer.

Local Printer settings

Connection Name | Type the name of the targeted local printer. The preference extension creates a new local printer with this name if the local printer does not exist. If the printer exists, the preference extension uses the local printer with this name as the target of the requested action. Press F3 to display a list of variables from which you can select.
Port | Choose a local port from the supplied list or type the name of the local port.
Printer path | Type or click Browse (…) to choose a fully qualified UNC path of a shared printer connection. The preference extension uses this shared connection as an installation source for the printer driver. The actual printer should be physically connected to the workstation.
Set this printer as the default printer | Select this check box to make the local printer the default Windows printer for the current user.
Location | Type text to describe where the printer is located. This information appears in the printer's Location box. Press F3 to display a list of variables from which you can select.
Comment | Type text that provides additional comments about the printer. This information appears in the printer's Comments box. Press F3 to display a list of variables from which you can select.

Additional considerations

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Printers Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Configure a Shared Printer Item

The Printers preference extension allows you to create, configure and delete shared printer connections by using the Shared Printers preference item. Before you create a Shared Printer preference item, you should review the behavior of each type of action possible with the extension.

Creating a Shared Printer item

To create a new Shared Printer preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Printers node, point to New, and select Shared Printer.

  4. In the New Shared Printer Properties dialog box, select an Action for Group Policy to perform. (For more information, see "Actions" in this topic.)

  5. Enter shared printer settings for Group Policy to configure or remove. (For more information, see "Shared printer settings" in this topic.)

  6. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  7. Click OK. The new preference item appears in the details pane.

Actions

This type of preference item provides a choice of four actions: Create, Replace, Update, and Delete. The behavior of the preference item varies with the action selected and whether the printer connection already exists.

Create

Create a new shared printer connection. If a local printer with the same name exists, then it does not modify it.

Delete

Remove a shared printer connection with the same share path. The extension performs no action if the shared printer connection does not exist.

Important

This action does not remove the printer driver. It only removes the shared printer connection.

Replace

Delete and recreate the shared printer connection. The net result of the Replace action overwrites all existing settings associated with the shared printer connection. If the shared printer connection does not exist, then the Replace action creates a new shared printer connection.

Update

Modify a shared printer connection. The action differs from Replace in that it updates the settings defined within the preference item. All other settings remain as they were previously configured. If the shared printer connection does not exist, then the Update action creates a new shared printer connection.

Shared Printer settings

Share path

Type or click Browse (…) to choose a fully qualified UNC path of a shared printer.

Set this printer as the default printer

Select this check box to make the shared printer connection the default Windows printer for the current user.

Only if a local printer is not present

Select this check box to bypass changing the default printer if there is a local printer configured on the computer. This setting is unavailable until you select the Set this printer as the default printer check box.

Important

A local printer is any printer that is not connected to a shared network printer. This includes physical printers connected to parallel, serial, and USB ports, TCP/IP printers, and virtual printers installed through software.

Delete all shared printer connections

Select this check box if you want to delete all shared printer connections for the current user. This setting is available only when the preference item's action is set to Delete

Local Port

Choose a local port to which you want the shared connection mapped. This setting is optional.

Important

When the Local Port box contains a value and the preference item action is set to Delete, the preference extension deletes the shared printer connection associated with that local port.

Reconnect

Select this check box if you want the shared printer connection persistent. This option is unavailable until you choose a value from the Local Port list.

Unmap all local ports

Select this check box if you want shared printer connections from all local ports. This setting is available only when the preference item's action is set to Delete.

Additional considerations

  • When processing shared printer items, the Printers extension always installs the printer driver in the security context specified on the Common tab.

  • Shared Printer items always use the security context of the current user to map printer connections and set the default printer status.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Printers Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Configure a TCP/IP Printer Item

The Printers preference extension allows you to create, configure, and delete TCP/IP printers by using the TCP/IP Printer preference item. Before you create a TCP/IP Printer preference item, you should review the behavior of each type of action possible with the extension.

Creating a TCP/IP Printer item

To create a new TCP/IP Printer preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration or User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Printers node, point to New, and select TCP/IP Printer.

  4. In the New TCP/IP Printer Properties dialog box, select an Action for Group Policy to perform. (For more information, see "Actions" in this topic.)

  5. Enter TCP/IP printer settings for Group Policy to configure or remove. (For more information, see "TCP/IP printer settings" in this topic.)

  6. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  7. Click OK. The new preference item appears in the details pane.

Actions

This type of preference item provides a choice of four actions: Create, Replace, Update, and Delete. The behavior of the preference item varies with the action selected and whether the printer connection already exists.

Create

Create a new TCP/IP printer connection. If a TCP/IP printer connection with the same IP address exists, then it does not modify it.

Delete

Remove a TCP/IP printer connection with the same IP address. The extension performs no action if the TCP/IP printer connection does not exist.

Important

This action does not remove the printer driver or port. It only removes the TCP/IP printer connection.

Replace

Delete and recreate the TCP/IP printer connection. The net result of the Replace action overwrites all existing settings associated with the TCP/IP printer connection. If the TCP/IP printer connection does not exist, then the Replace action creates a new TCP/IP printer connection.

Update

Modify a TCP/IP printer connection. The action differs from Replace in that it updates the settings defined within the preference item. All other settings remain as they were previously configured. If the TCP/IP printer connection does not exist, then the Update action creates a new TCP/IP printer connection.

TCP/IP Printer settings

IP Address or DNS name

Type the IP address of the remote printer. Or select the Use DNS name check box and type the fully qualified domain name of the remote printer.

Important

The Printers preference extension uses the TCP/IP address or the DNS Name to determine if a TCP/IP printer exists when a Local Name is not provided.

Note

IPv6 addresses are not supported.

Local Name

Type the local name of the targeted TCP/IP printer connection. The preference extension creates a new TCP/IP printer connection with this name if one does not exist. If a TCP/IP printer connection with this name exists, the preference extension uses the TCP/IP printer with this name as the target of the requested action. Press F3 to display a list of variables from which you can select.

Important

The Printers preference extension uses Local Name to determine if a TCP/IP printer exists when a Local Name is provided. Otherwise, the preference extension uses the TCP/IP address or the DNS Name to determine if the TCP/IP connection exits.

Printer path

Type a fully qualified UNC path or click Browse (…) to choose a fully qualified UNC path of a shared printer connection. The preference extension uses this shared connection as an installation source for the printer driver.

Set this printer as the default printer

Select this check box to make the local printer the default Windows printer for the current user.

Only if a local printer is not present

Select this check box to bypass changing the default printer if there is a local printer configured on the computer. This setting is unavailable until you select the Set this printer as the default printer check box.

Important

A local printer is any printer that is not connected to a shared network printer. This includes physical printers connected to parallel, serial, and USB ports, TCP/IP printers, and virtual printers installed through software.

Delete all IP printer connections

Select this check box if you want to delete all TCP/IP printer connections for the current user. This setting is available only when the preference item's action is set to Delete

Location

Type text to describe where the printer is located. This information appears in the printer's Location box. Press F3 to display a list of variables from which you can select.

Comment

Type text that provides additional comments about the printer. This information appears in the printer's Comments box. Press F3 to display a list of variables from which you can select.

Port Settings

Use the Port Settings to configure the port settings beyond the standard default settings. The available settings include Protocol, Raw Settings, LPR Settings, and SNMP Status.

Additional considerations

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Printers Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Regional Options Extension

Group Policy includes the Regional Options preference extension. This extension allows you to configure how most applications format numbers, currencies, dates, and times.

Getting started

You can create and configure Regional Options preference items in any domain-based Group Policy object (GPO). You configure the settings by editing a GPO using the Group Policy Management Console. When editing a GPO, you can find this preference extension at the following location:

User Configuration

└ Preferences

└ Control Panel Settings

└ Regional Options

For information about how to use this extension to create and configure a preference item, see the following topics:

  • Configure a Regional Options Item

  • Configure Common Options


Configure a Regional Options Item

You configure Regional Options just as you would in Regional and Language Options in Control Panel. Select the User Locale on the Regional Options tab. This selection resets the values on the remaining tabs; however, you can then modify the remaining values.

Note

Unlike other preference extensions, you can only update Regional Options preference items. For this reason, the preference item does not provide a choice of actions.

Creating a Regional Options item

To create a new Regional Options preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Regional Options node, point to New, and select Regional Options.

  4. In the New Regional Options Properties dialog box, enter regional options settings for Group Policy to configure or remove. (For more information, see Enable and Disable Settings in a Preference Item.)

  5. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  6. Click OK. The new preference item appears in the details pane.

Additional considerations

  • Settings that are unavailable cannot be enabled or disabled. You cannot configure these settings using a Regional Options preference item.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Regional Options Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Scheduled Tasks Extension

Group Policy includes the Scheduled Tasks preference extension. For computers and users, this extension allows you to:

  • Create, modify, or delete a scheduled task.

  • Run a command immediately upon the next refresh of Group Policy or upon every refresh of Group Policy.

  • Automate periodic maintenance, such as virus scans, backups, synchronization, and disk cleanup.

  • Wake computers from standby, and refresh Group Policy to update settings.

  • Launch a process at user logon without running it from a logon script.

Getting started

You can create and configure Scheduled Task or Immediate Task preference items for any domain-based Group Policy object (GPO). You configure the settings by editing a GPO using the Group Policy Management Console. When editing a GPO, you can find this preference extension at the following location:

Computer Configuration or User Configuration

└ Preferences

└ Control Panel Settings

└ Scheduled Tasks

For information about how to use this extension to create and configure a preference item, see the following topics:

  • Configure a Scheduled Task Item (Windows Vista and later versions)

  • Configure an Immediate Task Item (Windows Vista and later versions)

  • Configure a Scheduled Task Item

  • Configure an Immediate Task Item (Windows XP)

  • Configure Common Options


Configure a Scheduled Task Item (Windows Vista and later versions)

For computers that are running Windows Server® 2008 R2, Windows® 7, Windows Server 2008, or Windows Vista®, Scheduled Task (Windows Vista and later) preference items let you create, replace, update, and delete tasks and their associated properties. Before you create a Scheduled Task preference item, you should review the behavior of action possible with this extension.

Configuring a Scheduled Task (Windows Vista and later) item

To create a new Scheduled Task preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration or User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Scheduled Tasks node, point to New, and select Scheduled Task (Windows Vista and later).

  4. In the New Task (Windows Vista and later) Properties dialog box, select an Action for Group Policy to perform. (For more information, see "Actions" in this topic.)

  5. Enter a Name for the task to be configured or deleted. (For more information, see "General task settings" in this topic.)

  6. If creating, updating, or replacing a task:

    1. On the General tab, and configure security options for the task. (For more information, see "General task settings" in this topic.)

    2. Click the Triggers tab, and configure when the task begins and with what frequency it runs. (For more information, see "Triggers" in this topic.)

    3. Click the Actions tab, and configure one or more actions for the task to perform, such as starting a program, sending an e-mail, or displaying a message. (For more information, see "Task actions" in this topic.)

    4. Click the Conditions tab, and configure the conditions required for the task to run other than those specified on the Triggers tab. (For more information, see "Other task settings" in this topic.)

    5. Click the Settings tab, and enter any additional task settings for Group Policy to configure. (For more information, see "Other task settings" in this topic.)

  7. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  8. Click OK. The new preference item appears in the details pane.

Actions

This type of preference item provides a choice of four actions: Create, Replace, Update, and Delete. The behavior of the preference item varies with the action selected and whether the task already exists.

Create | Create a new scheduled task for users or computers.
Delete | Remove a scheduled task for users or computers.
Replace | Delete and re-create scheduled tasks for users or computers. The net result of the Replace action is to overwrite all existing settings associated with the task. If the task does not exist, then the Replace action creates a new scheduled task.
Update | Modify the settings of an existing scheduled task for users or computers. This action differs from Replace because it only updates settings that are defined within the preference item. All other settings remain as configured in the task. If the task does not exist, then the Update action creates a new scheduled task.

General task settings

Note

All text fields accept preference processing variables. Press F3 to display a list of variables from which you can select.

Name

Type a name for the task. This name will appear in the list of tasks in Task Scheduler under Administrative Tools. To change or delete a task, this name must match the name of the existing task as it appears in Task Scheduler. Preference items that configure tasks with the same task name can conflict.

Description

Type a description of the task. This description is visible for users or computers to which this preference item is applied.

Security options

Configure the security context under which the task is run.

  • If the preference item is part of Computer Configuration, by default the task is run in the security context of the SYSTEM account.

  • If the preference item is part of User Configuration, by default the task is run in the security context of the logged-on user. Unless you provide credentials, the task is run only if the user is logged on to the computer, but can continue after the user logs off.

  • To run a task under the security context of a specified account (regardless of whether that account is logged on), click Change User or Group, enter credentials for the account, and then click Run whether user is logged on or not.

Security Note

This password is stored as part of the GPO in SYSVOL and is discoverable, although obscured. If you choose to store passwords in preference items, you should consider creating dedicated accounts for this purpose, and never store administrative passwords in preference items.

Hidden

Configure whether the task is hidden by default. In Task Scheduler, end-users can click View and Show Hidden Tasks to display hidden tasks.

Configure for

For computers that are running Windows Server 2008 R2, Windows 7, Windows Server 2008, or Windows Vista, you can restrict the options displayed to those that are also available in previous operating systems. Doing this does not configure the task or the preference item to run on earlier operating systems.

Triggers

If creating, updating, or replacing a task, configure when the task begins and the frequency with which to run the task on the Triggers tab. For a task scheduled to run daily, weekly, monthly, or one time only, select the start time at which to begin the task.

Configure any optional scheduling settings desired:

  • To configure a daily, weekly, or monthly task to run only during a specific range of dates, click the New button, specify the frequency, enter a Start date, select the Expire check box, and enter an End date.

  • To run the task more frequently than daily, click the New button, select Repeat task every, and configure the frequency and end time or duration.

  • Select the Enabled check box so that the task can run. To configure a trigger without letting it run, clear this check box.

Task actions

Note

All text fields accept preference processing variables. Press F3 to display a list of variables from which you can select.

A task can start a program, send an e-mail, or display a message. If configuring a task to start a program, on the Actions tab click New, select Start a program, and configure the following options:

Program/script | Enter the command to be run, excluding any arguments.
Add arguments (optional) | Type any command-line arguments required.
Start in (optional) | To specify the working directory for the command being run (typically to ensure the correct resolution of any relative file names), type the working directory used when the task is run. Do not include quotation marks or a trailing slash.

Other task settings

By configuring options on the Conditions tab, you can restrict the conditions under which a task can run or wake the computer to run a task. On the Settings tab, you can configure options to manage the behavior of the task upon completion, to manage the behavior of the task if a problem occurs, or to manage the behavior of the task if an instance of the task is already running.

Additional considerations

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Scheduled Tasks Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Configure an Immediate Task Item (Windows Vista and later versions)

For computers that are running Windows Server® 2008 R2, Windows® 7, Windows Server 2008, or Windows Vista®, Immediate Task (Windows Vista and later) preference items allow you to create tasks to be run immediately upon the refresh of Group Policy that are then removed. Immediate Task preference items do not provide a selection of actions or triggers because they always create a task and then delete it after it has run.

Configuring an Immediate Task (Windows Vista and later) item

To create a new Immediate Task preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration or User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Scheduled Tasks node, point to New, and select Immediate Task (Windows Vista and later).

  4. In the New Task (Windows Vista and later) Properties dialog box, select an Action for Group Policy to perform. (For more information, see "Actions" in this topic.)

  5. Enter task settings for Group Policy to configure:

    1. On the General tab, enter a Name for the task to be configured, and configure security options for the task. (For more information, see "General task settings" in this topic.)

    2. Click the Conditions tab, and configure the conditions required for the task to run. (For more information, see "Other task settings" in this topic.)

    3. Click the Settings tab, and enter any additional task settings for Group Policy to configure. (For more information, see "Other task settings" in this topic.)

  6. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  7. Click OK. The new preference item appears in the details pane.

General task settings

Note

All text fields accept preference processing variables. Press F3 to display a list of variables from which you can select.

Name

Type a name for the task. This name will appear in the list of tasks in Task Scheduler under Administrative Tools. To modify or delete a task, this name must match the name of the existing task as it appears in Task Scheduler. Preference items configuring tasks with the same task name can conflict.

Description

Type a description of the task. This description is visible for users or computers to which this preference item is applied.

Security options

Configure the security context under which the task is run.

  • If the preference item is part of Computer Configuration, by default the task is run in the security context of the SYSTEM account.

  • If the preference item is part of User Configuration, by default the task is run in the security context of the logged-on user. Unless you provide credentials, the task is run only if the user is logged on to the computer, but can continue after the user logs off.

  • To run a task under the security context of a specified account (regardless of whether that account is logged on), click Change User or Group, enter credentials for the account, and then click Run whether user is logged on or not.

Security Note

This password is stored as part of the GPO in SYSVOL and is discoverable, although obscured. If you choose to store passwords in preference items, you should consider creating dedicated accounts for this purpose, and never store administrative passwords in preference items.

Hidden

Configure whether the task is hidden by default. In Task Scheduler, end-users can click View and Show Hidden Tasks to display hidden tasks.

Configure for

For computers that are running Windows Server 2008 R2, Windows 7, Windows Server 2008, or Windows Vista, you can restrict the options displayed to those that are also available in earlier operating systems. However, doing this does not configure the task or the preference item to run on earlier operating systems.

Task actions

Note

All text fields accept preference processing variables. Press F3 to display a list of variables from which you can select.

A task can start a program, send an e-mail, or display a message. If configuring a task to start a program, on the Actions tab click New, select Start a program, and configure the following options:

Program/script | Enter the command to be run, excluding any arguments.
Add arguments (optional) | Type any command-line arguments required.
Start in (optional) | To specify the working directory for the command being run (typically to ensure the correct resolution of any relative file names), type the working directory used when the task is run. Do not include quotation marks or a trailing slash.

Other task settings

By configuring options on the Conditions tab, you can restrict the conditions under which a task can run or wake the computer to run a task. On the Settings tab, you can configure options to manage the behavior of the task upon completion, to manage the behavior of the task if a problem occurs, or to manage the behavior of the task if an instance of the task is already running.

Additional considerations

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Scheduled Tasks Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Configure a Scheduled Task Item

For computers that are running Windows Server® 2008 R2, Windows® 7, Windows Server 2008, Windows Vista®, Windows Server 2003, or Windows XP, Scheduled Task preference items let you create, replace, update, and delete scheduled tasks and their associated properties. Before you create a Scheduled Task preference item, you should review the behavior of each type of action possible with this extension.

Configuring a Scheduled Task item

To create a new Scheduled Task preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration or User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Scheduled Tasks node, point to New, and select Scheduled Task.

  4. In the New Scheduled Task Properties dialog box, select an Action for Group Policy to perform. (For more information, see "Actions" in this topic.)

  5. On the Task tab, enter task settings for Group Policy to configure or remove. (For more information, see "Task settings" in this topic.)

  6. If creating, updating, or replacing a task:

    1. Click the Schedule tab, and configure one or more schedules for the task. (For more information, see "Schedule settings" in this topic.)

    2. Click the Settings tab, and enter any additional task settings for Group Policy to configure. (For more information, see "Other scheduled task settings" in this topic.)

  7. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  8. Click OK. The new preference item appears in the details pane.

Actions

This type of preference item provides a choice of four actions: Create, Replace, Update, and Delete. The behavior of the preference item varies with the action selected and whether the scheduled task already exists.

Create | Create a new scheduled task for users or computers.
Delete | Remove a scheduled task for users or computers.
Replace | Delete and re-create scheduled tasks for users or computers. The net result of the Replace action is to overwrite all existing settings associated with the scheduled task. If the scheduled task does not exist, then the Replace action creates a new scheduled task.
Update | Modify settings of an existing scheduled task for users or computers. This action differs from Replace because it only updates settings that are defined within the preference item. All other settings remain as configured in the scheduled task. If the scheduled task does not exist, then the Update action creates a new scheduled task.

Task settings

Note

All text fields accept preference processing variables. Press F3 to display a list of variables from which you can select.

Name

Type a name for the scheduled task. This name will appear in the list of scheduled tasks in Control Panel for users or computers. To modify or delete a task, this name must match the name of the existing task as it appears in Control Panel for computers or users. Preference items configuring tasks with the same task name can conflict.

Run

Type the command to be run, excluding any arguments.

This field is available only if the action selected is Create, Replace, or Update.

Arguments

Type any command-line arguments required.

This field is available only if the action selected is Create, Replace, or Update.

Start in

To specify the working directory for the command being run (typically to ensure the correct resolution of any relative file names), type the working directory used when the task is run. Do not include quotation marks or a trailing slash.

This field is available only if the action selected is Create, Replace, or Update.

Comments

Type a description of the task. This description is visible for users or computers to which this preference item is applied.

This field is available only if the action selected is Create, Replace, or Update.

Run as

Configure the security context under which the task is run.

  • If the preference item is part of Computer Configuration, by default the task is run in the security context of the SYSTEM account.

  • If the preference item is part of User Configuration, by default the task is run in the security context of the logged-on user. The task is run only if the user is logged on to the computer, but can continue after the user logs off.

  • To run a task under the security context of a specified account (enabling the task to run regardless of whether that account is logged on), select the Run as check box and enter credentials for the account.

Security Note

This password is stored as part of the GPO in SYSVOL and is discoverable, although obscured. If you choose to store passwords in preference items, you should consider creating dedicated accounts for this purpose, and never store administrative passwords in preference items.

These fields are available only if the action selected is Create, Replace, or Update.

Enabled

Select this check box so that the task will run. To configure the task for users or computers without letting it run, clear this check box.

This check box is available only if the action selected is Create, Replace, or Update.

Schedule settings

If creating, updating, or replacing a task, configure the frequency with which to run the task on the Schedule tab. For a task scheduled to be run daily, weekly, monthly, or one time only, select the start time at which to begin the task.

Configure any optional scheduling settings desired:

  • To let a daily, weekly, or monthly task run only during a specific range of dates, click the Advanced button, and select a Start Date and End Date.

  • To run the task repeatedly, click the Advanced button, select Repeat task, and configure the frequency and end time or duration.

  • You can configure multiple schedules. To do this, select the Show multiple schedules check box. For the first schedule that you want to create, select a frequency, start time, and any advanced options for the task. Click New to add another schedule to the list, and then configure settings for it. Any schedule modifications are applied to the schedule currently viewed, but all the schedules are run.

    Note

    To return to a single schedule display, delete all except one of the schedules in the list, and then clear the Show multiple schedules check box.

Other scheduled task settings

If creating, updating, or replacing a task, configure settings to manage the behavior of the task upon completion, if the computer is being used, or under specific power conditions on the Settings tab.

Additional considerations

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Scheduled Tasks Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Configure an Immediate Task Item (Windows XP)

For computers running Windows Server® 2003 or Windows® XP, Immediate Task preference items allow you to create tasks to be run immediately upon the refresh of Group Policy—and then removed. Immediate Task preference items do not provide a selection of actions because they always create a task and then delete it after it has run.

Configuring an Immediate Task (Windows XP) item

To create a new Immediate Task preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration or User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Scheduled Tasks node, point to New, and select Immediate Task (Windows XP).

  4. In the New Immediate Task (Windows XP) Properties dialog box, enter task settings for Group Policy to configure or remove. (For more information, see "Task settings" in this topic.)

  5. Click the Settings tab, and enter any additional task settings for Group Policy to configure. (For more information, see "Other immediate task settings" in this topic.)

  6. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  7. Click OK. The new preference item appears in the details pane.

Task settings

Note

All text fields accept preference processing variables. Press F3 to display a list of variables from which you can select.

Name

Type a name for the immediate task. This name will appear in the list of immediate tasks in the Control Panel for users or computers. Preference items configuring tasks with the same task name can conflict.

Run

Type the command to be run, not including any arguments.

Arguments

Type any command-line arguments required.

Start in

To specify the working directory for the command being run (typically to ensure the correct resolution of any relative file names), type the working directory used for the task when launched. Do not include quotation marks or a trailing slash.

Comments

Type a description of the task. This description is visible for users or computers to which this preference item is applied.

Run as

Configure the security context under which the task is run.

  • If the preference item is part of Computer Configuration, by default the task is run in the security context of the SYSTEM account.

  • If the preference item is part of User Configuration, by default the task is run in the security context of the logged-on user. The task is run only if the user is logged on to the computer, but can continue after the user logs off.

  • To run a task under the security context of a specified account (enabling the task to run regardless of whether that account is logged on), select the Run as check box and enter credentials for the account.

Security Note

This password is stored as part of the GPO in SYSVOL and is discoverable, although obscured. If you choose to store passwords in preference items, you should consider creating dedicated accounts for this purpose, and never store administrative passwords in preference items.

Other immediate task settings

On the Settings tab, configure settings to manage the behavior of the task upon completion, if the computer is in use, or under specific power conditions.

Additional considerations

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Scheduled Tasks Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Services Extension

Group Policy includes the Services preference extension. This extension allows you to configure services presently installed on computers

Getting started

You can create and configure Service preference items in any domain-based Group Policy object (GPO). You configure the settings by editing a GPO using the Group Policy Management Console. When editing a GPO, you can find this preference extension at the following location:

Computer Configuration

└ Preferences

└ Control Panel Settings

└ Services

For information about how to use this extension to create and configure a preference item, see the following topics:

  • Configure a Service Item

  • Configure Common Options


Configure a Service Item

The Services preference extension allows you to configure existing services on computers by using a Service preference item. Before you create a Service preference item, you should review the behavior of each type of action possible with the extension.

Creating a Service item

To create a new Service preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Services node, point to New, and select Service.

  4. In the New Service Properties dialog box, select an Action for Group Policy to perform. (For more information, see "Service actions" in this topic.)

  5. Enter service settings for Group Policy to configure or remove. (For more information, see "Service settings" in this topic.)

  6. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  7. Click OK. The new preference item appears in the details pane.

Service actions

No change | Using this action does not change the running status of the named service.
Start service | Use this action to start the named service. This action has no effect if the named service is running.
Stop service | Use this action to stop the named service. This action has no effect if the named service is stopped.
Restart service | Use this action to stop and restart the named service.
Restart service if required | Use this action to stop and restart the named service if there is a configuration action that requires a restart.
Note

Starting and stopping a service occurs after the preference extension processes all other configuration settings. It is this reason that services cannot be started or restarted if the Startup mode is set to disabled.

Service settings

Startup

Choose the startup type for the service

  • No change: Use this setting when you do not want to change the startup type.

  • Automatic: Use this setting to configure the service to automatically start during the boot and logon process.

  • Disabled: Use this setting to disable the service. Disabling the service prevents the service from starting.

  • Automatic (Delayed Start): Use this setting to configure the service to automatically start during the boot and logon process. The startup of the service is briefly delayed during the logon process to increase logon performance.

Service name

Type the unique name for the service, or click Browse (…) to select a service from a list of installed services on the current computer.

Important

A service's unique name does not always match its display name. For example, the unique name of the Server service is LanmanServer.

Wait timeout if service is locked

Type a timeout value in seconds the preference extension waits to write configuration data, if the service is locked or transitioning from a stop, started, or restarted state,

Log on as: No change

Use this setting to keep the service's logon credentials as previously configured.

Log on as: Local System account

Use this setting to change the service's logon credentials to the Local System account.

Allow service to interact with desktop

Select this check box to allow the service to interact with the desktop. This setting is unavailable until you click the Local System account option.

Log on as: This account

Use this setting to change the service's logon credentials to a specific local or domain user. This account and Password settings become available once you click this option.

This account

Type or click browse (…) for the user name you are using for the service's logon credentials.

Password

Type the password used to authenticate the user. Type the same password in the Confirm Password box.

Security Note

This password is stored as part of the GPO in SYSVOL and is discoverable, although obscured. If you choose to store passwords in preference items, you should consider creating dedicated accounts for this purpose, and never store administrative passwords in preference items.

Recovery actions

Configure how the computer responds if the service fails after one, two, or more attempts.

No Change | Use this setting when you do not want to change the recovery action of a service failure. The preference extension does not modify the recovery action when this setting is selected.
Take No Action | Use this setting to configure the service not to respond to a failing condition.
Restart the Service | Use this setting to configure the service to restart under the failing condition.
Restart the Computer | Use this setting to configure the service to restart the computer under the failing condition.

Recovery settings

Restart fail count after | Type the number of days that must pass before the service fail count is reset. This setting is available when at least one of the recovery actions is set to any setting other than No Change.
Start service after | Type the number of minutes that must pass before the failing service is restarted. This setting is available only when at least one of the recovery actions is set to Restart the Service.
Program | Type the full path for the program you want launched in response to the recovery action Run a Program. Or, you can Browse (…) for the application. Use the Command line parameters box to provide additional command line arguments for the program. This setting is available only when at least one of the recovery actions is set to Run a Program.
Restart Computer Options | Click Restart Computer Options to set that wait time before restarting a service. Also, you can provide a message to broadcast to network computers to alert users of the pending computer restart.

Additional considerations

  • Use the format .\username to specify a local user account on multiple computers.

  • Use the format domain\username to specific a domain account.

  • A password is required for all user account names except accounts for which the domain portion of the user credentials begins with NT AUTHORITY.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Services Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Start Menu Extension

Group Policy includes the Start Menu preference extension. For users, this extension allows you to:

  • Require a specific configuration of the Start menu.

  • Configure an initial configuration of the Start menu, but allow end users to make changes.

  • Configure several Start menu settings while leaving others to the discretion of each end user.

Note

To add a shortcut to, modify a shortcut on, or remove a shortcut from the Start menu, use a Shortcut preference item. For more information, see Shortcuts Extension.

Getting started

You can create and configure Start Menu preference items for any domain-based Group Policy object (GPO). You configure the settings by editing a GPO using the Group Policy Management Console. When editing a GPO, you can find this preference extension at the following location:

User Configuration

└ Preferences

└ Control Panel Settings

└ Start Menu

For information about how to use this extension to create and configure a preference item, see the following topics:

  • Configure a Start Menu Item (Windows Vista and later versions)

  • Configure a Start Menu Item (Windows XP)

  • Configure Common Options


Configure a Start Menu Item (Windows Vista and later versions)

Start Menu (Windows Vista® and later) preference items let you update the Start menu for computers that are running the Windows Server® 2008 R2, Windows® 7, Windows Server 2008, or Windows Vista operating systems. Start Menu preference items do not provide a selection of actions because the only possible action is Update.

Creating a Start Menu (Windows Vista and later) item

To create a new Start Menu preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Start Menu node, point to New, and select Start Menu (Windows Vista and later).

  4. In the New Start Menu (Windows Vista and later) Properties dialog box, enter Start menu options for Group Policy to configure. (For more information, see Enable and Disable Settings in a Preference Item.)

  5. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  6. Click OK. The new preference item appears in the details pane.

Additional considerations

  • Settings that are unavailable cannot be enabled or disabled. You cannot configure these settings by using a Start Menu preference item.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Start Menu Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Configure a Start Menu Item (Windows XP)

Start Menu (Windows® XP) preference items allow you to update the Start menu for computers running the Windows Server® 2003 or Windows XP operating system. Start Menu preference items do not provide a selection of actions because the only possible action is Update.

Creating a Start Menu (Windows XP) item

To create a new Start Menu preference item

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under User Configuration, expand the Preferences folder, and then expand the Control Panel Settings folder.

  3. Right-click the Start Menu node, point to New, and select Start Menu (Windows XP).

  4. In the New Start Menu (Windows XP) Properties dialog box, enter Start menu options for Group Policy to configure. (For more information, see Enable and Disable Settings in a Preference Item.)

  5. Click the Common tab, configure any options, and then type your comments in the Description box. (For more information, see Configure Common Options.)

  6. Click OK. The new preference item appears in the details pane.

Additional considerations

  • Settings that are unavailable cannot be enabled or disabled. You cannot configure these settings using a Start Menu preference item.

  • You can use item-level targeting to change the scope of preference items.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Start Menu Extension

  • For additional information on configuring settings in Windows, see the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=91710).


Preference Item-Level Targeting

You can use item-level targeting to change the scope of individual preference items, so they apply only to selected users or computers. Within a single Group Policy object (GPO), you can include multiple preference items, each customized for selected users or computers and each targeted to apply settings only to the relevant users or computers.

Each targeting item results in a value of either true or false. You can apply multiple targeting items to a preference item and select the logical operation (AND or OR) by which to combine each targeting item with the preceding one. If the combined value of all targeting items for a preference item is false, then the settings in the preference item are not applied to the user or computer. Using targeting collections, you can also create parenthetical expressions.

Configuring a targeting item

To target an existing preference item so it applies only to specific users or computers

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should contain the new preference item, and then click Edit.

  2. In the console tree under Computer Configuration or User Configuration, expand the Preferences folder, and then browse to the preference extension.

  3. Double-click the node for the preference extension, and then right-click the preference item and click Properties.

  4. In the Properties dialog box, click the Common tab.

  5. Select Item-level targeting, and then click Targeting.

    1. Click New Item, click a type of targeting item to apply to the preference item, and then configure settings for the targeting item.

      Notes
      • To change the value of the targeting item to its opposite, on the Item Options menu, click Is Not.
      • Text fields accept preference processing variables. Press F3 to display a list of variables from which you can select.
      • To provide a custom name for the targeting item, on the Item Options menu, click Label, and type a Name.
      • To provide a comment for a targeting item, on the Item Options menu, click Label, and type a Comment.
    2. If configuring multiple targeting items, on the Item Options menu, click the logical operation (And or Or) by which to combine the results of the preference item with the preceding preference item.

      Note

      To create a parenthetical expression, click Add Collection. (For more information, see Targeting Collection.)

    3. Repeat for each targeting item to apply.

  6. Click OK, and then click OK in the Properties dialog box.

Types of targeting items

You can configure the following types of targeting items:

  • Battery Present Targeting

  • Computer Name Targeting

  • CPU Speed Targeting

  • Date Match Targeting

  • Disk Space Targeting

  • Domain Targeting

  • Environment Variable Targeting

  • File Match Targeting

  • IP Address Range Targeting

  • Language Targeting

  • LDAP Query Targeting

  • MAC Address Range Targeting

  • MSI Query Targeting

  • Network Connection Targeting
  • Operating System Targeting

  • Organizational Unit Targeting

  • PCMCIA Present Targeting

  • Portable Computer Targeting

  • Processing Mode Targeting

  • RAM Targeting

  • Registry Match Targeting

  • Security Group Targeting

  • Site Targeting

  • Terminal Session Targeting

  • Time Range Targeting

  • User Targeting

  • WMI Query Targeting

Additional considerations

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • If you want to restrict the scope of multiple preference items with a complex set of targeting items, you can simplify configuration by using an environment variable. For example, create an Environment Variable preference item that generates a new environment variable with a value of 1, and apply the targeting items to it. To apply the same targeting to other preference items, add an Environment Variable targeting item to those preference items, and configure it to require a value of 1 for the variable that you created using an Environment Variable preference item.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Configure, Target, and Comment Preference Items

  • Configure Common Options


Battery Present Targeting

A Battery Present targeting item allows a preference item to be applied to computers or users only if one or more batteries are present in the processing computer. If Is Not is selected, it allows the preference item to be applied only if the processing computer does not have one or more batteries present.

Additional considerations

  • If an uninterruptible power supply (UPS) is connected to the processing computer, a Battery Present targeting item may detect the UPS and identify it as a battery.

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • This targeting item can be useful for portable computer detection.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Preference Item-Level Targeting

  • PCMCIA Present Targeting

  • Portable Computer Targeting


Computer Name Targeting

A Computer Name targeting item allows a preference item to be applied to computers or users only if the computer's name matches the specified computer name in the targeting item. If Is Not is selected, it allows the preference item to be applied only if the computer's name does not match the specified computer name in the targeting item.

Computer name

The computer name against which the name of the computer is compared. Matching is not case sensitive.

Note

The Computer name box accepts preference processing variables. Press F3 to display a list of variables from which you can select.

NetBIOS

If this option is clicked, the targeting item compares the specified name to the NetBIOS name of the computer (as specified in the %ComputerName% variable).

DNS

If this option is clicked, the targeting item resolves the specified name into one or more IP addresses using the Windows name resolution behavior in effect on the computer. The targeting item then compares the list of IP addresses obtained to all IP addresses bound to all network adapters on the computer. If a single match exists, the targeting item returns a value of true.

Notes
  • You must choose either NetBIOS or DNS.
  • There is no required format for the computer name except that it must be resolvable to an IP address.

Additional considerations

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • Boxes in Computer Name (NetBIOS only), Domain, Site, Terminal Session, and User (if not matched by SID) targeting items accept single character (?) and multiple character (*) wildcards.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Preference Item-Level Targeting


CPU Speed Targeting

A CPU Speed targeting item allows a preference item to be applied to computers or users only if the processing computer's CPU speed is greater than or equal to the value specified in the targeting item. If Is Not is selected, it allows the preference item to be applied only if the processing computer's CPU speed is less than or equal to the value specified in the targeting item.

MHz

The speed against which the CPU of the computer is compared, in megahertz (MHz).

Note

The MHz box accepts preference processing variables. Press F3 to display a list of variables from which you can select.

Additional considerations

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Preference Item-Level Targeting


Date Match Targeting

A Date Match targeting item allows a preference item to be applied to computers or users only if the day or date matches that specified in the targeting item. If Is Not is selected, it allows the preference item to be applied only if the day or date does not match that specified in the targeting item.

Weekly | If you select this option, the preference item is applied only on the day of the week that you specify in the targeting item.
Monthly | If you select this option, the preference item is applied only on the day that you specify in the targeting item.
On date | If you select this option, the preference item is applied only on the date that you specify in the targeting item. If you select Every year, the preference item is applied each year only on the month and day that you specify.

Additional considerations

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Preference Item-Level Targeting


Disk Space Targeting

A Disk Space targeting item allows a preference item to be applied to computers or users only if the processing computer's available disk space is greater than or equal to the amount specified in the targeting item. If Is Not is selected, it allows the preference item to be applied only if the processing computer's available disk space is less than or equal to the amount specified in the targeting item.

Free disk space

The amount of space (in gigabytes [GB]) against which the free space of the specified drive is compared. Decimal values (for example, .5) are allowed.

Note

The Free disk space box accepts preference processing variables. Press F3 to display a list of variables from which you can select.

Drive letter

Either the system drive or a specific drive letter. The system drive option directs the targeting item to use the SYSTEMDRIVE environment variable to determine the drive letter. The specified drive letter may be a mapped network drive.

Additional considerations

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Preference Item-Level Targeting


Domain Targeting

A Domain targeting item allows a preference item to be applied to computers or users only if the user is logged on to or the computer is a member of the domain specified in the targeting item. If Is Not is selected, it allows the preference item to be applied only if the user is not logged on to or the computer is not a member of the domain specified in the targeting item

Domain name

The NetBIOS name with which to compare domain membership.

Note

The Domain name box accepts preference processing variables. Press F3 to display a list of variables from which you can select.

User logged on to domain

If this option is clicked, the targeting item compares the specified domain name to the domain to which the end user is logged on. This is also the domain of which the end user is a member and uses the %LogonDomain% variable for comparison.

Note

This option is available only for preference items under User Configuration.

Computer in domain

If this option is clicked, the targeting item compares the specified domain name with the domain to which the computer belongs. It uses the %DomainName% variable for comparison.

Note

You must choose either User logged on to domain or Computer in domain.

Additional considerations

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • Boxes in Computer Name (NetBIOS only), Domain, Site, Terminal Session, and User (if not matched by SID) targeting items accept single character (?) and multiple character (*) wildcards.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Preference Item-Level Targeting


Environment Variable Targeting

An Environment Variable targeting item allows a preference item to be applied to computers or users only if the environment variable and value specified in the targeting item are equal. If Is Not is selected, it allows the preference item to be applied only if the environment variable and value specified in the targeting item are not equal or if the environment variable does not exist.

Name

The name of the environment variable to which the value is compared. Matching of variable names is not case sensitive.

Note

The variable name cannot be a variable.

Value

The value to compare to the specified environment variable.

Note

The Value box accepts preference processing variables. Press F3 to display a list of variables from which you can select.

Additional considerations

  • If you want to restrict the scope of multiple preference items with a complex set of targeting items, you can simplify configuration by using an environment variable. For example, create an Environment Variable preference item that generates a new environment variable with a value of 1, and apply the targeting items to it. To apply the same targeting to other preference items, add an Environment Variable targeting item to those preference items, and configure it to require a value of 1 for the variable that you created using an Environment Variable preference item.

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Preference Item-Level Targeting


File Match Targeting

A File Match targeting item allows a preference item to be applied to computers or users only if the file or folder specified in the targeting item exists, or only if the file exists and is a version within the range specified in the targeting item. If Is Not is selected, it allows the preference item to be applied only if the file or folder specified in the targeting item does not exist, or only if the version of the file is not within the range specified in the targeting item.

Match type

Criteria by which to evaluate a file or folder:

  • File exists or Folder exists: If this option is selected, the targeting item returns true if the file or folder specified in the Path box exists.

  • Match file version: If this option is selected, the targeting item returns true if the file specified in the Path box exists, has a version resource, and the version is within the version range specified.

Path

The path for a file or folder. If you select Match file version, you must type the path for a file.

Note

The Path box accepts preference processing variables. Press F3 to display a list of variables from which you can select.

Version range

If you select Match file version, enter a version range to match. Each version segment must be greater than or equal to zero and less than or equal to 65535.

For example, to specify a version greater than or equal to 1.0 but less than 8.5.1, select >=, type 1 in the box on the left (replacing the first 0), select <, and replace the first three zeros in the box on the right with 8, 5, and 1.

Note

The Version range is only displayed if you select Match file version.

Additional considerations

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Preference Item-Level Targeting


IP Address Range Targeting

An IP Address Range targeting item allows a preference item to be applied to computers or users only if the processing computer's IP address is within the range specified in the targeting item. If Is Not is selected, it allows the preference item to be applied only if the processing computer's IP address is not within the range specified in the targeting item.

IP address range

The range against which the processing computer's IP address is compared. Range starting points and ending points are inclusive. You can specify a single address by typing the same value in both boxes.

Additional considerations

  • IPv6 addresses are not supported.

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Preference Item-Level Targeting


Language Targeting

A Language targeting item allows a preference item to be applied to computers or users only if the locale specified in the targeting item is installed on the processing computer. Additional options allow you to restrict the targeting to the user's or computer's locale. If Is Not is selected, it allows the preference item to be applied only if the processing computer's locale does not match the specified locale in the targeting item.

Note

A locale is composed of a language and, in some cases, a geographic area in which the language is spoken or the alphabet used. For example, French (Canada) is a locale composed of the language French and the geographic area Canada.

Language

The locale that the targeting item compares to the locale of the processing computer.

Note

If User or System check boxes are cleared, then the targeting item allows the associated policy item to apply if the specified locale is installed on the processing computer. Use Regional and Language Options from Control Panel to view the list of installed locales.

User

If you select this check box, you restrict the targeting of the item to include the user's locale.

Important

This option is disabled in preference items under Computer Configuration.

System

If you select this check box, you restrict the targeting of the item to include the locale of the operating system.

Native

If you select this check box, you restrict the targeting of the item to include the specified locale of the file NTDLL.DLL

Additional considerations

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Preference Item-Level Targeting


LDAP Query Targeting

An LDAP Query targeting item allows a preference item to be applied to computers or users only if the LDAP query returns a value for the attribute specified in the targeting item. If Is Not is selected, it allows the preference item to be applied only if the LDAP query does not return a value for the attribute specified in the targeting item.

Filter

The LDAP search used by the targeting item. All subcontainers are searched. If you want to search for a non-container object, leave this box blank and specify the full location to the non-container object in the Bindings box. Providing this value in the targeting item is optional.

Example:

This LDAP filter finds all users with last names that start with the letter A.
(&(objectClass=user)(sn= A*))

Binding

The path for a container in which the search is performed. The object must be a container if a Filter is specified, or an error occurs. If the Binding cannot be satisfied, an error results.

Note

Binding prefixes are case sensitive and must be in upper case (LDAP).

Example:

  • This example binds to the root of the namespace.
    LDAP:

  • This example binds to the root of the Global Catalog.
    GC:

  • This example binds to a specific server.
    LDAP://servername

  • This example binds to a specific container by its distinguished name.
    LDAP://CN=LabUser1,OU=LAB,DC=contoso,DC=com

Attribute

The specified attribute value returned from the search. Providing this value in the targeting item is optional.

Example:

This example shows how to specify the canonical name attribute.
cn

Environment variable name

The name of the environment variable to which the targeting item sets the value of the Attribute, if one is found. Providing this value in the targeting item is optional.

Important

This option supports only the following Active Directory data types. Other data types may succeed but return empty values.
ADSTYPE_DN_STRING
ADSTYPE_CASE_EXACT_STRING
ADSTYPE_CASE_IGNORE_STRING
ADSTYPE_PRINTABLE_STRING
ADSTYPE_NUMERIC_STRING
ADSTYPE_OBJECT_CLASS
ADSTYPE_BOOLEAN

Note

If the returned attribute value is a multivalued attribute, the first item in the list of values is assigned to the environment variable.

Additional considerations

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • Preference items are available only in domain-based GPOs.

  • LDAP Query targeting items use the subtree search option.

  • LDAP Query targeting items do not chase referrals.

Additional references

  • Preference Item-Level Targeting


MAC Address Range Targeting

A MAC Address Range targeting item allows a preference item to be applied to computers or users only if any of the processing computer's MAC addresses are within the range specified in the targeting item. If Is Not is selected, it allows the preference item to be applied only if none of the processing computer's MAC addresses are within the range specified in the targeting item.

MAC address range

The range against which the processing computer's MAC addresses are compared. Range starting points and ending points are inclusive. You can specify a single address by typing the same value in both boxes.

Additional considerations

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Preference Item-Level Targeting


MSI Query Targeting

A Microsoft® Windows® Installer Query targeting item allows a preference item to be applied to computers or users only if certain aspects of a product, update, or component installed by Windows Installer on the processing computer match the specified criteria in the targeting item. If Is Not is selected, it allows the preference item to be applied only if certain aspects of a product, update, or component installed by Windows Installer on the processing computer do not match the specified criteria in the targeting item.

Query type

The targeting item allows the associated preference item to process if:

  • Target exists

    • Product: The product with the specified Product code is installed.

    • Patch: The update with the specified Patch code is installed.

    • Component: The keyfile of a component with the specified Component code is installed.

  • Version match

    • Product: The product with the specified Product code is within the specified version range.

    • Component: The keyfile of a component with the specified Component code is within the specified version range.

  • Get property or Get information

    • Product: The product with the specified Product code is installed.

    • Component: The keyfile of a component with the specified Component code is installed.

    The property or information item is stored in the specified variable.

  • Match property or Match information

    The property or information item matches the specified value in the targeting item, and:

    • Product: The product with the specified Product code is installed.

    • Component: The keyfile of a component with the specified Component code is installed.

    Note

    The targeting item does not allow the preference item to process if the property or information item has no value.

Target type

Defines the target of the Windows Installer query as an installed product, an installed update, or a component.

Additional considerations

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Preference Item-Level Targeting


Network Connection Targeting

A Network Connection targeting item allows a preference item to be applied to users only if a network connection of the type specified in the targeting item is connected. If Is Not is selected, it allows the preference item to be applied only if no network connection of the type specified in the targeting item is connected.

Note

Network Connection targeting items detect whether a type of network connection exists, not whether the user is logged on through a connection of that type.

Connection type

The network connection type that the targeting item detects:

  • Any (includes only those network connection types listed below)

  • Telephone modem accessed through a COM port

  • ISDN card with corresponding NDISWAN driver installed

  • X.25 card with corresponding NDISWAN driver installed

  • Virtual Private Network (VPN)

  • Asynchronous Transfer Mode (ATM)

  • Frame Relay

  • Sonet

  • Switched 56K access

  • Infrared Data Association (IrDA) device

  • Serial Port direct connection

  • Parallel Port direct connection

  • Generic

  • Packet Assembler/Disassembler

  • PPP over Ethernet (PPPoE)

If Any is selected, the targeting item allows a preference item to be applied to users only if a network connection of at least one of the types in the Connection type list is connected. If Is Not is also selected, it allows the preference item to be applied only if no network connections of any of the connection types listed above are connected.

Additional considerations

  • Network Connection targeting is available only for preference items under User Configuration.

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Preference Item-Level Targeting


Operating System Targeting

An Operating System targeting item allows a preference item to be applied to computers or users only if the processing computer's operating system's product name, release, edition, or computer role matches those specified in the targeting item. If Is Not is selected, it allows the preference item to be applied only if the operating system's product name, release, edition, or computer role does not match those specified in the targeting item.

Product

The product name of the operating system.

Edition

The edition of the product such as Enterprise, Standard, or Web.

Release

The release of the product. If the desired service pack does not appear in the list, type the full name of the service pack in the box (for example, Service Pack 3).

Computer role

The role of the computer. A computer that is running Windows has one of three roles:

  • Workstation: A domain-joined computer that is running any release of Windows® 7, Windows Vista®, or Windows XP.

  • Member Server: A domain-joined computer that is running any release of Windows Server® 2008 R2, Windows Server 2008, or Windows Server 2003.

  • Domain Controller: A computer running any release of Windows Server 2008 R2, Windows Server 2008, or Windows Server 2003 that hosts Active Directory® directory service for the domain.

Additional considerations

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Preference Item-Level Targeting


Organizational Unit Targeting

An Organizational Unit targeting item allows a preference item to be applied to computers or users only if the user or computer is a member of the organizational unit (OU) specified in the targeting item. If Is Not is selected, it allows the preference item to be applied only if the user or computer is a not member of the OU specified in the targeting item.

Organizational unit

The OU for which to detect membership. Matching is not case sensitive. You can specify an OU that is unqualified (MySubUnit), partially qualified (OU=MyOrgUnit,OU=MySubUnit), or fully qualified (OU=MyOrgUnit,OU=MySubUnit,DC=MyDC,DC=MyCompany,DC=com).

Note

The Organizational unit box accepts preference processing variables. Press F3 to display a list of variables from which you can select.

Direct member only

If this check box is selected, the targeting item returns true only if the user or computer is a direct member of the specified OU. If the user or computer inherited membership, the targeting item returns false.

User in OU

If this option is clicked, the targeting item compares the specified OU to the OU of which the user is a member.

Note

This option is available only for preference items under User Configuration.

Computer in OU

If this option is clicked, the targeting item compares the specified OU to the OU of which the computer is a member.

Note

You must choose either User in OU or Computer in OU.

Additional considerations

  • If a user or computer is not a member of an OU, but is a member of a security group that is a member of the OU, the user or computer is not a member of the OU.

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Preference Item-Level Targeting


PCMCIA Present Targeting

A PCMCIA Present targeting item allows a preference item to be applied to computers or users only if the processing computer has at least one PCMCIA slot present. If Is Not is selected, it allows the preference item to be applied only if the processing computer does not have any PCMCIA slots present.

Additional considerations

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • A PCMCIA slot is considered present when the drivers for the slot are installed and the slot is functioning correctly.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Preference Item-Level Targeting

  • Battery Present Targeting

  • Portable Computer Targeting


Portable Computer Targeting

A Portable Computer targeting item allows a preference item to be applied to computers or users only if the processing computer is identified as a portable computer in the current hardware profile on the processing computer, or if the processing computer is identified as a portable computer with the docking state specified in the targeting item. When Is Not is selected, the targeting item allows the preference item to be applied only if the processing computer is not identified as a portable computer in the current hardware profile on the processing computer, or if the docking state of the processing computer differs from the docking state specified in the targeting item.

Docking state

To allow the preference item to be applied only if the processing computer is portable and has a specified docking state, select a docking state. You can select any combination of docking states:

  • Docked

  • Undocked

  • Unknown

Note

Selecting a docking state in the targeting item is optional. If no states or all states are selected, then the targeting item detects only whether the processing computer is a portable computer.

Additional considerations

  • Battery Present and PCMCIA Present targeting can also be useful for targeting portable computers.

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Preference Item-Level Targeting


Processing Mode Targeting

A Processing Mode targeting item allows a preference item to be applied to computers or users only if the Group Policy processing mode or conditions on the processing computer match at least one of those specified in the targeting item. If Is Not is selected, it allows the preference item to be applied only if the Group Policy processing mode or conditions on the processing computer do not match any of those specified in the targeting item.

Synchronous

If this check box is selected, the targeting item determines whether Group Policy is being processed synchronously. Synchronous processing ensures that Computer startup and User logon Group Policy processing complete before allowing the user to log on or showing the user's desktop, respectively.

Asynchronous

If this check box is selected, the targeting item determines whether Group Policy is being processed asynchronously. Asynchronous processing allows the user to log on while computer Group Policy processes. Also, it allows the user's desktop to load (after logging on) while user Group Policy processes.

Background

If this check box is selected, the targeting item determines whether Group Policy is being processed in the background. Background Group Policy processing, also known as "background refresh," occurs every 90 to 120 minutes to apply new Group Policy settings to the user or computer.

Processing conditions

For any of the following check boxes that are selected, the targeting item determines whether that processing condition is in effect:

  • Forced refresh: The background refresh was forced.

  • Link transition: A change in link speed occurred between the current application and an earlier application of Group Policy.

  • No changes: No new Group Policy settings are applied to the computer or user.

  • RSoP transition: A change in RSoP logging occurred between the current application and an earlier application of Group Policy.

  • Slow link: Group Policy is applying over a slow network connection.

  • Safe boot: Windows is operating in safe mode.

  • Verbose logging: Verbose logging is enabled.

Additional considerations

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Preference Item-Level Targeting


RAM Targeting

A RAM targeting item allows a preference item to be applied to computers or users only if the total amount of physical memory in the processing computer is greater than or equal to the amount specified in the targeting item. If Is Not is selected, it allows the preference item to be applied only if the total amount of physical memory in the processing computer is less than the amount specified in the targeting item.

MB

The total amount of physical memory entered in megabytes (MB). One gigabyte (GB) of physical memory is entered as 1024. Four gigabytes of physical memory are entered as 4096.

Note

The MB box accepts preference processing variables. Press F3 to display a list of variables from which you can select.

Additional considerations

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Preference Item-Level Targeting


Registry Match Targeting

A Registry Match targeting item allows a preference item to be applied to computers or users only if the registry key or value specified in the targeting item exists, if the registry value contains the data specified in the targeting item, or if the version number in the registry value is within the range specified in the targeting item. If the targeting item allows the preference item and if Get value data is selected in the targeting item, then the targeting item saves the value data of the specified registry value to the environment variable specified in the targeting item. If Is Not is selected, it allows the preference item to be applied only if the registry key or value specified in the targeting item does not exist, if the registry value does not contain the data specified in the targeting item, or if the version number in the registry value is not within the range specified in the targeting item.

Match type

Criteria by which to evaluate a registry value or key:

  • Key exists: Allows the preference item to be applied if the specified registry key exists.

  • Value exists: Allows the preference item to be applied if the specified registry value exists.

  • Match value data: Allows the preference item to be applied if the specified registry value exists and matches the specified value.

    Value data match type: Allows the preference item to be applied if:

    • Any: The registry value exists and matches the specified value.

    • Substring match: The registry value exists and contains the specified substring.

    • Version match: The string version number found in the registry value specified falls within the range specified.

  • Get value data: Allows the preference item to be applied if the registry value exists and matches the specified value type. Additionally, saves the value data for that registry value to the specified environment variable.

Hive

The registry hive for the value or key to be matched.

Note

You can click the Browse button in the targeting item to select an existing registry hive, key path, and value.

Key path

The registry key to be matched, omitting the hive name.

Note

The Key Path box accepts preference processing variables. Press F3 to display a list of variables from which you can select.

Value name

The value name to be matched. To specify the default value for the key, select the Default name check box.

Notes
  • The Value name box accepts preference processing variables. Press F3 to display a list of variables from which you can select.
  • This option is available only if the match type is Value exists, Match value data, Decimal format, Substring match, Version match, or Get value data.

Value type

The value type to be matched. To disregard the value type, select Any.

Note

This option is available only if the match type is Value exists, Match value data, Decimal format, Substring match, Version match, or Get value data.

Value data

The value data to be matched.

Note

This option is available only if the match type is Match value data, Decimal format, or Substring match.

Variable name

The name of the environment variable to which the registry value data is saved if the targeting item allows the preference item to be applied.

Note

This option is available only if the match type is Get value data.

Version range

A version range to compare to the period-delimited or comma-delimited version string in the value data for the specified registry value. Each version segment must be greater than or equal to zero and less than or equal to 65535.

For example, to specify a version greater than or equal to 1.0 but less than 8.5.1, select >=, type 1 in the box on the left (replacing the first 0), select <, and replace the first three zeros in the box on the right with 8, 5, and 1.

Note

This option is available only if the match type is Version match.

Additional considerations

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Preference Item-Level Targeting


Security Group Targeting

A Security Group targeting item allows a preference item to be applied to computers or users only if the processing computer or user is a member of the group specified in the targeting item and optionally only if the specified group is the primary group for the processing computer or user. If Is Not is selected, it allows the preference item to be applied only if the processing computer or user is not a member of the group specified in the targeting item and optionally only if the specified group is not the primary group for the processing computer or user.

Group

This box contains the name of the selected security group. Click Browse to select the security group. You cannot type directly in this text box.

Important

The name of the group is presented for reference purposes, but is not used for determining membership. If a group name is changed, the original group name remains in the targeting item.

Primary group

If you select this check box, the targeting item processes the associated preference item only if the specified group is the primary group of the processing user.

Note

This option is disabled when Computer in group is selected.

User in group

If selected, the target item processes the associated preference item when the processing user is a member of the group specified in Group.

Note

This option is disabled in computer preference items.

Computer in group

If selected, the target item processes the associated preference item when the processing computer is a member of the group specified in Group.

Supported groups

Domain groups:

  • Global groups

  • Universal groups

Local groups:

  • Local groups (including built-in groups)

  • Domain local

  • Well-known

Additional considerations

  • Security Group targeting items use the group's security identifier to determine group membership and not the display name of the group.

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Preference Item-Level Targeting


Site Targeting

A Site targeting item allows a preference item to be applied to computers or users only if the processing computer is in the site in Active Directory specified in the targeting item. If Is Not is selected, it allows the preference item to be applied only if the processing computer is not in the site in Active Directory specified in the targeting item.

Site

The site name against which the site in which the processing computer resides is compared. Matching is not text case sensitive.

Note

The Site box accepts preference processing variables. Press F3 to display a list of variables from which you can select.

Additional considerations

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • Boxes in Computer Name (NetBIOS only), Domain, Site, Terminal Session, and User (if not matched by SID) targeting items accept single character (?) and multiple character (*) wildcards.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Preference Item-Level Targeting


Targeting Collection

The targeting items applied to a preference item are evaluated as a logical expression. A targeting collection allows you create a parenthetical grouping within that expression. You can nest one targeting collection within another to create more complex logical expressions.

A targeting collection allows a preference item to be applied to computers or users only if the collection of targeting items specified results in a value of true. If Is Not is selected, it allows the preference item to be applied only if the collection of targeting items specified results in a value of false.

Additional considerations

  • If you want to restrict the scope of multiple preference items with a complex set of targeting items, you can simplify configuration by using an environment variable. For example, create an Environment Variable preference item that generates a new environment variable with a value of 1, and apply the targeting items to it. To apply the same targeting to other preference items, add an Environment Variable targeting item to those preference items, and configure it to require a value of 1 for the variable that you created using an Environment Variable preference item.

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Preference Item-Level Targeting


Terminal Session Targeting

A Terminal Session targeting item allows a preference item to be applied to users only if the processing user is logged on to a terminal session with the settings specified in the targeting item. If Is Not is selected, it allows the preference item to be applied only if the user is not logged on to a terminal session or the user is logged on to a terminal session without the settings specified in the targeting item.

Type or protocol
  • Any: Any type of terminal session.

  • Remote Desktop Services: A Remote Desktop Protocol (RDP) based Remote Desktop Services session, including Remote Desktop.

Note

Terminal Session targeting is not available when configuring computer Group Policy settings.

Parameter
  • Any: Targeting is not restricted by parameter.

  • Application name: The published name of the application.

  • Client name: The name of the computer from which the user is connecting to the terminal session.

  • Initial program: The path and name of the initial program.

  • Session name: The name of the terminal session used by the user. A typical Remote Desktop Services session name begins with "RDP_tpc" and is immediately followed by a numerical value.

  • Working directory: The working directory for the session, which is located on the server.

  • Client TCP/IP address: The address range of the client computer's TCP/IP address.

    Note

    IPv6 addresses are not supported.

Parameter value

The value required for the Parameter. If the Parameter is Any, this option is not available.

Additional considerations

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • Boxes in Computer Name (NetBIOS only), Domain, Site, Terminal Session, and User (if not matched by SID) targeting items accept single character (?) and multiple character (*) wildcards.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Preference Item-Level Targeting


Time Range Targeting

A Time Range targeting item allows a preference item to be applied to computers or users only if the current time on the end user's computer is within the time range specified in the targeting item. If Is Not is selected, it allows the preference item to be applied only if the current time on the end user's computer is not within the range specified in the targeting item.

Time range

The time range against which the current time is compared. If the time in the box on the left is later in the day than the time in the box on the right, then the time in the box on the right is considered to be during the next day.

Additional considerations

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Preference Item-Level Targeting


User Targeting

A User targeting item allows a preference item to be applied to users only if the processing user is the user specified in the targeting item. If Is Not is selected, it allows the preference item to be applied only if the processing user is not the user specified in the targeting item.

User

The user name or security identifier (SID) against which the processing user is compared. Matching is not case sensitive.

  • If Match by SID is selected, you must browse to select the user. Although the domain and user name of that user at the time of selection are displayed, the targeting item saves the user's SID for comparison to that of the processing user.

  • If Match by SID is cleared, you can browse to or type a user name. Do not include the domain name. The targeting item compares the specified user name to that of the processing user.

    Note

    The User box accepts preference processing variables. Press F3 to display a list of variables from which you can select.

Additional considerations

  • User targeting is available only for preference items under User Configuration.

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • Boxes in Computer Name (NetBIOS only), Domain, Site, Terminal Session, and User (if not matched by SID) targeting items accept single character (?) and multiple character (*) wildcards.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Preference Item-Level Targeting


WMI Query Targeting

A WMI Query targeting item allows a preference item to be applied to computers or users only if the processing computer evaluates the WMI query as true. If Is Not is selected, it allows the preference item to be applied only if the processing computer evaluates the WMI query as false.

Query | The WMI query text Example The targeting item allows the associated preference item to process if the computer's time zone is set to the Eastern Time zone. Select * from win32_timezone where bias = -300
Namespace | The WMI namespace in which to execute the query. The default value is Root\cimv2.
Property | The name of a specific property to assign to a variable. Providing this value in the targeting item is optional.
Variable name | The name of the environment variable to which the targeting item sets the value of the Property, if one is found. Providing this value in the targeting item is optional.

Additional considerations

  • To reposition a targeting item within the list of targeting items that you have applied to a preference item, either drag the targeting item to a new position, or select the targeting item and then click the Move Up arrow or Move Down arrow.

  • Preference items are available only in domain-based GPOs.

Additional references

  • Preference Item-Level Targeting


Configure Common Options

Many Group Policy preference items share common options. Each preference item displays these options on the Common tab. The common options are consistent among the preference extensions and allow you to control the error handling for a particular extension, the security context the extension uses when processing user configuration settings, the scope and application of preference items, and item-level targeting, which provides filtering at the preference item level, in addition to Group Policy filtering.

Configuring common options

Common options include:

  • Stop processing items in this extension if an error occurs on this item

  • Run in logged-on user's security context (user policy option)

  • Remove this item when it is no longer applied

  • Apply once and do not reapply

  • Item-level targeting

Stop processing items in this extension if an error occurs on this item

Each preference extension can contain one or more preference items.

  • By default, a failing preference item does not prevent other preference items in the same extension from processing.

  • If the Stop processing items in this extension if an error occurs on this item option is selected, a failing preference item prevents remaining preference items within the extension from processing. This change in behavior is limited to the hosting Group Policy object (GPO) and does not extend to other GPOs.

    Important

    Preference extensions start processing preference items from the bottom of the list and work their way to the top. Preference items successfully applied prior to the failing preference item are applied. The preference extension only stops processing preference items that follow the failing preference item.

Run in logged-on user's security context (user policy option)

There are two security contexts in which Group Policy applies user preferences: the SYSTEM account and the logged-on user.

  • By default, Group Policy processes user preferences using the security context of the SYSTEM account. In this security context, the preference extension is limited to environment variables and system resources available only to the computer.

  • If the Run in logged-on user's security context option is selected, it changes the security context under which the preference item is processed. The preference extension processes preference items in the security context of the logged-on user. This allows the preference extension to access resources as the user rather than the computer. This can be especially important when using drive maps or other preferences in which the computer may not have permissions to resources or when using environment variables. The value of many environment variables differs when evaluated in a security context other than the logged-on user.

Remove this item when it is no longer applied

Group Policy applies policy settings and preference items to users and computers. You determine which users and computers receive these items by linking one or more Group Policy objects (GPOs) to Active Directory sites, domains, or organizational units. User and computer objects that reside in these containers receive policy settings and preference items defined in the linked GPOs because they are within the scope of the GPO.

  • Unlike policy settings, by default preference items are not removed when the hosting GPO becomes out of scope for the user or computer.

  • If the Remove this item when it is no longer applied option is selected, it changes this behavior. After selecting this option, the preference extension determines if the preference item should not apply to targeted users or computers (out of scope). If the preference extension determines the preference item is out of scope, it removes the settings associated with the preference item.

    Important

    Selecting this option changes the action to Replace. During Group Policy application, the preference extension recreates (deletes and creates) the results of the preference item. When the preference item is out of scope for the user or computer, the results of the preference item are deleted, but not created. Preference items can become out of scope by using item-level targeting or by higher-level Group Policy filters such as WMI and security group filters.

    Note

    The Remove this item when it is no longer applied option is not available when the preference item action is set to Delete.

Apply once and do not reapply

Preference items are applied when Group Policy refreshes.

  • By default, the results of preference items are rewritten each time Group Policy refreshes. This ensures that the results of the preference items are consistent with what the administrator designated in the Group Policy object.

  • If the Apply once and do not reapply option is selected, it changes this behavior, so the preference extension applies the results of the preference item to the user or computer only once. This option is useful when you do not want the results of a preference item to reapply.

Item-level targeting

Group Policy provides filters to control which policy settings and preference items apply to users and computers. Preferences provide an additional layer of filtering called targeting. Item-level targeting allows you to control if a preference item applies to a group of users or computers. For more information, see Preference Item-Level Targeting.

Additional references

  • Windows Settings

  • Control Panel Settings


Enable and Disable Settings in a Preference Item

In addition to enabling and disabling preference items within a Group Policy object (GPO), you can individually enable and disable underlined settings or settings preceded by a circle within a preference item.

The underlining or circle of the setting indicates whether it is currently enabled or disabled:

Enabled setting | Enabled setting | A setting with a solid green underline or a green circle is enabled. The preference extension applies this setting's value to the user or computer.
Disabled setting | Disabled setting | A setting with a dashed red underline or red circle with a slash is disabled. The preference extension does not apply this setting's value to the user or computer.

You can enable or disable these settings within a preference item by pressing function keys:

F5 | Enable all settings on the current tab.
F6 | Enable the currently selected setting.
F7 | Disable the currently selected setting.
F8 | Disable all settings on the current tab.

Additional references

  • Folder Options Extension

  • Internet Settings Extension

  • Power Options Extension

  • Regional Options Extension

  • Start Menu Extension


Variables in Preference Items

Preference extensions support Windows environment variables and generate a number of additional process environment variables. Any variable may be used in a configuration parameter value. Each Help document states whether variables are supported in a specific field.

Note

By using Registry Match Targeting targeting items, you can define variables at client run-time, and have these control behavior by using the Environment Variable Targeting targeting items or as values in a preference item setting.

Windows environment variables

The Windows environment is a list of variables saved as name/value pairs. To see the current list of variables, type SET at the command prompt. Each process, including the desktop, has a list of variables unique to the process. When one process starts another, normally a copy of the environment of the starting process is passed to the started process. Typically, environment variable names are enclosed between two percent signs (for example, %ProgramFiles%). Windows resolves the environment variable when an application requests the value associated to the name.

Preference process variables

Preference extensions implement the process variables that are listed here.

Note

Variables are not case-sensitive.

%AppDataDir% | The current user's Application Data directory.
%BinaryComputerSid% | The SID of the computer in hexadecimal format.
%BinaryUserSid% | The SID of the current user in hexadecimal format.
%CommonAppdataDir% | The "all users" Application Data directory.
%CommonDesktopDir% | The "all users" Desktop directory.
%CommonFavoritesDir% | The "all users" Explorer Favorites directory.
%CommonProgramsDir% | The "all users" Programs directory.
%CommonStartMenuDir% | The "all users" Start Menu directory.
%CommonStartUpDir% | The "all users" Startup directory.
%ComputerName% | The NetBIOS name of the computer.
%CurrentProcessId% | The numeric identity of the main client process.
%CurrentThreadId% | The numeric identity of the main client thread.
%DateTime% | The current time (UTC).
%DateTimeEx% | The current time (UTC) with milliseconds.
%DesktopDir% | The current user's desktop directory.
%DomainName% | The domain name or workgroup of the computer.
%FavoritesDir% | The current user's Explorer Favorites directory.
%LastError% | The last error code encountered during configuration.
%LastErrorText% | The last error code text description.
%LdapComputerSid% | The SID of the computer in LDAP escaped binary format.
%LdapUserSid% | The SID of the current user in LDAP escaped binary format.
%LocalTime% | The current local time.
%LocalTimeEx% | The current local time with milliseconds.
%LogonDomain% | The domain of the current user.
%LogonServer% | The domain controller that authenticated the current user.
%LogonUser% | The user name of the current user.
%LogonUserSid% | The SID of the current user.
%MacAddress% | The first detected MAC address on the computer.
%NetPlacesDir% | The current user's My Network Places directory.
%OsVersion% | The operating system: Windows Server® 2008 R2, Windows® 7, Windows Server® 2008, Windows Vista®, Windows Server 2003, Windows XP, or Unknown.
%ProgramFilesDir% | The Windows Program Files directory.
%ProgramsDir% | The current user's Programs directory.
%RecentDocumentsDir% | The current user's Recent Documents directory.
%ResultCode% | The client's exit code.
%ResultText% | The client's exit code text description.
%ReversedComputerSid% | The SID of the computer in reversed byte order hexadecimal format.
%ReversedUserSid% | The SID of the current user in reversed byte order hexadecimal format.
%SendToDir% | The current user's Send to directory.
%StartMenuDir% | The current user's Start Menu directory.
%StartUpDir% | The current user's Startup directory.
%SystemDir% | The Windows system directory.
%SystemDrive% | The name of the drive from which the operating system is running.
%TempDir% | The current user's Temp directory as determined by Windows API.
%TimeStamp% | The time stamp of the configurations being implemented.
%TraceFile% | The path/name of the trace file.
%WindowsDir% | The Windows directory.

Preference extensions provide a list of variables from which you can choose to insert into text boxes. You can open the dialog box from any text box that is:

  • Not disabled.

  • Not read-only.

  • Not restricted to a numeric value.

To enter a variable

  1. Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that contains the preference item that you want to configure, and then click Edit.

  2. Position the cursor in the desired box.

    • To enter a preference process variable, press F3, select a variable from the list, and then click Select to insert the variable in the box.

    • To enter an existing Windows environment variable, type the variable in the box.

      Note

      You can prevent the resolution of a variable before it is applied to client computers (so that the variable instead of the resolved value appears in the preference setting on client computers). To do this for a preference process variable, clear the Resolve Variable check box. This inserts <> between the % % delimiters and the variable name (for example, %<ProgramFiles>%). Preference extensions remove < > characters from the text and leave the unresolved variable. You can also use this syntax with a Windows environment variable.

Additional references

  • Configure, Target, and Comment Preference Items


Back Up, Restore, Import, and Copy Group Policy Objects

  • Back Up a Group Policy Object

  • Restore a Deleted or Previous Version of an Existing Group Policy Object

  • Copy a Group Policy Object

  • Import Settings from a Group Policy Object

  • Work with Migration Tables


Back Up a Group Policy Object

To back up a Group Policy object

  1. In the Group Policy Management Console (GPMC) console tree, open Group Policy Objects in the forest and domain containing the Group Policy object (GPO) to back up.

  2. To back up a single GPO, right-click the GPO, and then click Back Up. To back up all GPOs in the domain, right-click Group Policy objects and click Back Up All.

  3. In the Backup Group Policy object dialog box, in the Location box, enter the path for the location in which you want to store the GPO backups, or click Browse, locate the folder in which you want to store the GPO backups, and then click OK.

  4. In the Description box, type a description for the GPOs that you want to back up, and then click Back Up. If you are backing up multiple GPOs, the description will apply to all GPOs you back up.

  5. After the operation completes, click OK.

    Important

    To secure backed-up GPOs, ensure that only authorized administrators have permission to access the folder to which you are exporting the GPOs.

Additional considerations

  • You must have Read permissions on the GPO and Write permissions on the folder containing the GPO backup to perform this procedure.

  • The backup function also serves as the export capability for GPOs.

Additional references

  • Back Up, Restore, Import, and Copy Group Policy Objects


Restore a Deleted or Previous Version of an Existing Group Policy Object

To restore a deleted or previous version of an existing Group Policy object

  1. In the Group Policy Management Console (GPMC) console tree, in the forest and domain containing the Group Policy object (GPO) that you want to restore, locate Group Policy Objects.

  2. Right-click Group Policy Objects and then click Manage Backups.

  3. In the Manage Backups dialog box, in the Backup location box, type the path for the backup folder. You can also use Browse to locate the backup folder.

  4. In the Backed up GPOs box, select the GPO that you want to restore from the list of GPO backups shown, and then click Restore.

  5. When prompted to confirm the restore operation, click OK.

  6. After the operation completes, click OK and then click Close.

Additional considerations

  • You must have privileges to create GPOs in the domain and Read permissions on the file system location of the backed-up GPO to restore a GPO that has been deleted.

  • You can also restore an existing or deleted GPO using the Manage Backups function by right-clicking Domains.

Additional references

  • Back Up, Restore, Import, and Copy Group Policy Objects


Copy a Group Policy Object

You can copy a Group Policy object (GPO) either by using the drag-and-drop method or right-click method. Both methods are described in this topic.

To copy a Group Policy object (drag-and-drop method)

  1. In the Group Policy Management Console (GPMC) console tree, click the Group Policy object (GPO) that you want to copy.

  2. Do one of the following:

    • To create a copy of the GPO on the same domain as the source GPO, drag and drop the GPO you want to copy to Group Policy Objects, select a permissions option under Specify the permissions for the new GPO, and then click OK.

    • To create a copy of the GPO in a different domain, double-click the destination domain, then drag and drop the GPO you want to copy to Group Policy objects. Answer all the questions in the cross-domain copying wizard that appears, and then click Finish.

To copy a Group Policy object (right-click method)

  1. In the GPMC console tree, right-click the GPO that you want to copy, and then click Copy.

  2. Do one of the following:

    • To create a copy of the GPO in the same domain as the source GPO, right-click Group Policy objects, click Paste, specify permissions for the new GPO in the Copy GPO box, and then click OK.

    • To create a copy of the GPO in a different domain, double-click the destination domain, right-click Group Policy objects, and then click Paste. Answer all the questions in the cross-domain copying wizard that appears, and then click Finish.

Additional considerations

  • You must have privileges to create GPOs in the destination domain to complete this procedure.

  • For copy operations to another domain, you may need to specify a migration table.

Additional references

  • Back Up, Restore, Import, and Copy Group Policy Objects

  • Work with Migration Tables


Import Settings from a Group Policy Object

To import settings from a Group Policy object

  1. In the Group Policy Management Console (GPMC) console tree, expand the Group Policy Objects node in the forest and domain containing the Group Policy object (GPO) to import settings.

  2. Right-click the GPO and click Import Settings.

  3. Follow the instructions in the Import Settings Wizard.

Additional considerations

  • To complete this procedure, you must have Edit permissions on the GPO into which you want to import settings.

  • For import operations to another domain or forest, you may need to specify a migration table.

Additional references

  • Back Up, Restore, Import, and Copy Group Policy Objects

  • Work with Migration Tables


Work with Migration Tables

A migration table is used when you copy or import a Group Policy object (GPO) from one domain or forest to another. The key challenge when migrating Group Policy objects (GPOs) from one domain or forest to another is that some information in the GPO is actually specific to the domain or forest where the GPO is defined. When transferring the GPO to a new domain or forest, it may not always be desirable, or even possible, to use the same settings. You can use a migration table to reference users, groups, computers, and UNC paths in the source GPO to new values in the destination GPO.

You can create migration tables using the Migration Table Editor.

This section includes these topics:

  • Automatically Populate a Migration Table from a Group Policy Object

  • Create a Migration Table

Additional referneces

  • Back Up, Restore, Import, and Copy Group Policy Objects

  • For more information about GPMC migration tables, go to http://go.microsoft.com/fwlink/?LinkID=63300.


Automatically Populate a Migration Table from a Group Policy Object

You can use the migration table editor to scan one or more Group Policy objects (GPOs) or backup GPOs, extract all references to security principals and UNC paths, and automatically enter these items in the migration table as source name entries.

To automatically populate a migration table from a GPO

  1. Open the migration table editor.

  2. From the Tools menu, click Populate from GPO.

  3. In the Look in this domain drop-down list, select the domain that contains the GPO.

  4. In the Group Policy objects list, click the GPO or GPOs from which you want to populate the migration table, select Include security principals from the DACL on the GPO during scan if appropriate, and then click OK.
To automatically populate a migration table from a backup GPO

  1. Open the migration table editor.

  2. From the Tools menu, click Populate from Backup.

  3. In the Backup location drop-down box, type the path of the folder that contains the backup GPO, or click Browse to locate the folder.

  4. In the Backed up GPOs list, select one or more backed-up GPOs, select Show only the latest version of each GPO or Include security principals from the DACL on the GPO if appropriate, and then click OK.

Additional considerations

  • To complete the migration table for either of these procedures, you need to adjust only the destination values. By default, the destination name for each entry will be set to Same as source when you use either of the Populate options.

Additional references

  • Work with Migration Tables


Create a Migration Table

To create a migration table

  1. In the Group Policy Management Console (GPMC) console tree, double-click the forest from which you want to create a migration table.

  2. Do either of the following:

    • Right-click Domains and then click Open Migration Table Editor.

    • Right-click Group Policy objects, and then click Open Migration Table Editor.

  3. Specify a source you want to include in the migration table by doing the following:

    1. Under Source Name, type the source name or right-click the cell and click Browse to find and then specify the object type, location, and name.

      If you enter the source name manually, you must type the exact name of the User, Computer, Group, or UNC Path referenced in the source GPO (for example, TestDomain\PolicyAdmins or \\server1\publicshare). The type of the source name must match the source type specified in the migration table.

      Security principals can be specified using any of the following formats:

      UPN: For example, someone@contoso.com.

      SAM: For example, contoso\someone.

      DNS: For example, contoso.com\someone.

      Free text: For example, someone. You must specify the type as Free Text or SID.

      SID: For example, S-1-11-111111111-111111111-1111111111-1112. You must specify the type as Free Text or SID.

    2. Under Source Type, specify the type of source in the cell adjacent to the source name cell by using the drop-down list and selecting the appropriate type. If you have used Browse to find the source name, the source type is entered by default.

    3. Under Destination Name, type the destination name or right-click the cell adjacent to the source name and source type cells, and then do one of the following:

      Click Browse to find a user, computer, or group.

      Point to Set Destination, and then click the appropriate selection. You cannot use the No Destination option for UNC paths.

  4. Repeat Step 3 for each source you want to include in the migration table.

  5. Click File, and then click Save.

  6. Specify the location where you want to save the migration table, and then click Save.

Additional considerations

  • You can use the migration table editor to check that destination entries can be resolved. If destination entries do not resolve in the migration table, then the copy or import operation might fail. To validate your migration table, from the Tools menu, click Validate.

Additional references

  • Work with Migration Tables


Control the Scope of Group Policy Objects

  • Link a Group Policy Object

  • Filter Using Security Groups

  • Enforce a Group Policy Object Link

  • Disable User or Computer Settings in a Group Policy Object

  • Disable a Group Policy Object Link

  • Work with WMI Filters

  • Block Inheritance

Additional references

  • Group Policy TechCenter


Link a Group Policy Object

To link a GPO

  1. In the Group Policy Management Console (GPMC) console tree, locate the site, domain, or organizational unit (OU) to which you want to link a Group Policy object (GPO)

  2. Do one of the following:

    • To link an existing GPO, right-click the domain or OU within the domain, and then click Link an Existing GPO. In the Select GPO dialog box, click the GPO that you want to link, and then click OK.

    • To link a new GPO, right-click the domain or OU within a domain, and then click Create a GPO in this domain, and link it here. In the Name box, type a name for the new GPO, and then click OK.

Additional considerations

  • To link an existing GPO to a site, domain, or OU, you must have Link GPOs permission on that site, domain, or OU. By default, only domain administrators and enterprise administrators have this privilege for domains and OUs. Enterprise administrators and domain administrators of the forest root domain have this privilege for sites.

  • To create and link a GPO, you must have Link GPOs permissions on the desired domain or organizational unit, and you must have permission to create GPOs in that domain. By default, only domain administrators, enterprise administrators, and Group Policy Creator owners have permission to create GPOs.

  • The Create a GPO in this domain, and link it here option is not available for sites. The administrator can create a GPO in any domain in the forest, and then use the Link an Existing GPO option to link it to the site.

Additional references

  • Control the Scope of Group Policy Objects


Filter Using Security Groups

To filter using security groups

  1. In the Group Policy Management Console (GPMC) console tree, expand Group Policy Objects and click the Group Policy object (GPO) to which you want to apply security filtering.

  2. In the results pane, on the Scope tab, click Add.

  3. In the Enter the object name to select box, type the name of the group, user, or computer that you want to add to the security filter. Click OK.

Additional considerations

  • In order to ensure that only members of the group or groups you added in Step 3 can receive the settings in this GPO, you will need to remove Authenticated Users if this group appears in the Scope tab. Click the Scope tab, select this group, and then click Remove.

  • You must have Edit settings, delete, and modify security permissions on the GPO to perform these procedures.

  • The settings in a GPO will apply only to users and computers that are contained in the domain, organizational unit, or organizational units to which the GPO is linked, and that are specified in or are members of a group that are specified in Security Filtering.

Additional references

  • Control the Scope of Group Policy Objects


Enforce a Group Policy Object Link

To enforce a Group Policy object link

  1. In the Group Policy Management Console (GPMC) console tree, double-click the forest containing the domain, site, or organizational unit (OU) containing the link you want to enforce, and then do one of the following:

    • To enforce a GPO link at the domain level, double-click Domains, and then double-click the domain containing the GPO link.

    • To enforce a GPO link at the OU level, double-click Domains, double-click the domain containing the OU, and then double-click the OU containing the GPO link.

    • To enforce a GPO link at the site level, double-click Sites, and double-click the site containing the GPO link.

  2. Right-click the GPO link, and then click Enforced to enable or disable enforcing the link. A check mark next to Enforced indicates that the link is enforced.

Additional considerations

  • You must have Link GPOs permission for the domain, site, or organizational unit containing the GPO link to complete this procedure.

  • To determine whether a GPO link is enforced, you can also click the GPO link and look at the information in the Links section of the Scope tab.

Additional references

  • Control the Scope of Group Policy Objects


Disable User or Computer Settings in a Group Policy Object

To disable user or computer settings in a Group Policy object

  1. In the Group Policy Management Console (GPMC) console tree, double-click the forest containing the domain or organizational unit (OU) that contains the Group Policy object (GPO).

  2. Double-click the domain or OU.

  3. Right-click the GPO that contains the user or computer settings you want to disable, point to GPO Status, and then do one of the following:

    • Click User settings disabled to disable user settings for the GPO.

    • Click Computer settings disabled to disable computer settings for the GPO.

  4. A check mark next to User settings disabled or Computer settings disabled indicates that user or computer settings are disabled.

Additional considerations

  • You must have Edit permission on the GPO to complete this procedure.

  • You can also modify GPO Status from the Details tab of a GPO.

Additional references

  • Control the Scope of Group Policy Objects


Disable a Group Policy Object Link

To disable a Group Policy object link

  • In the Group Policy Management Console (GPMC) console tree, double-click to expand the forest containing the domain, site, or organizational unit (OU) containing the link you want to disable, and then do one of the following:

    Right-click the GPO link. A check mark next to Link Enabled indicates that the link is enabled.

    Click Link Enabled to disable the link. No check mark will be displayed when the link is disabled.

Additional considerations

  • You must have Link GPOs permission for the domain, site, or OU to complete this procedure.

  • You can also click the GPO link and look at the information in the Links section of the Scope tab to determine if a GPO link is enabled.

Additional references

  • Control the Scope of Group Policy Objects


Work with WMI Filters

Windows Management Instrumentation (WMI) filters allow you to dynamically determine the scope of Group Policy objects (GPOs), based on attributes of the target computer.

When a GPO that is linked to a WMI filter is applied on the target computer, the filter is evaluated on the target computer. If the WMI filter evaluates to false, the GPO is not applied (unless the client computer is running Windows 2000, in which case the filter is ignored and the GPO is always applied). If the WMI filter evaluates to true, the GPO is applied.

This section includes the following topics:

  • Create a WMI Filter

  • Import a WMI Filter

  • Export a WMI Filter

  • Copy a WMI Filter

  • Link a WMI Filter to a Group Policy Object

Additional references

  • Control the Scope of Group Policy Objects


Create a WMI Filter

Do the following procedure to create a WMI filter.

To create a WMI filter

  1. In the Group Policy Management Console (GPMC) console tree, right-click WMI Filters in the forest and domain in which you want to create a WMI filter.

  2. Click New.

  3. In the New WMI Filter dialog box, type a name for the new WMI Filter in the Name box, and type a description of the filter in the Description box.

  4. Click Add.

  5. In the WMI Query dialog box, either leave the default namespace (root\CIMv2) or enter another namespace by doing one of the following:

    • In the Namespace box, type the name of the namespace that you want to use for the WMI query.

    • Click Browse, select a namespace from the list, and then click OK.

  6. Type a WMI query in the Query box, and then click OK.

  7. To add more queries, repeat Steps 4 through 6 to add each query.

  8. After adding all queries, click Save.

Additional considerations

  • You must have privileges to create WMI filters in the domain in which you want to create the filter. By default, the Domain Administrators, Enterprise Administrators, and Group Policy Creator Owners groups have this permission.

  • WMI Filters is only available if at least one domain controller in the domain is running Microsoft Windows Server™ 2003. The same is true for WMI Filtering on the Scope tab for Group Policy Objects.

  • To delete a WMI filter, in the console tree, right-click the WMI filter and then click Delete. When asked to confirm whether you want to delete the WMI filter, click Yes.

  • WMI Filters are not evaluated on Microsoft Windows® 2000. A GPO targeted to a Windows 2000 machine will always apply the GPO regardless of the query associated with the WMI Filter (the filter is ignored)

Additional references

  • Work with WMI Filters


Import a WMI Filter

Import a WMI Filter

  1. In the Group Policy Management Console (GPMC) console tree, right-click WMI Filters in the forest and domain into which you want to import a WMI filter.

  2. Click Import.

  3. In the Import WMI Filter dialog box, enter the .mof file that contains the WMI filter you want to import, and then click Open.

  4. In the Import WMI Filter dialog box, specify the appropriate information in the Name and Description boxes, and then do one of the following:

    • To import the WMI filter without changing it, click Import.

    • To change the WMI filter and then import it, click Edit, make the appropriate changes to the namespace or query, click OK, and then click Import.

Additional considerations

  • You must have privileges to create WMI filters in the domain in which you want to create the filter to complete this procedure. By default the Domain Administrators, Enterprise Administrators, and Group Policy Creator Owners groups have this permission.

  • WMI Filters is only available if at least one domain controller in the domain is running Microsoft Windows Server 2003. The same is true for WMI Filtering on the Scope tab for Group Policy objects.

  • Importing a WMI filter creates a new filter instead of modifying an existing filter.

Additional references

  • Work with WMI Filters


Export a WMI Filter

Export a WMI filter

  1. In the Group Policy Management Console (GPMC) console tree, right-click the WMI filter that you want to export, and then click Export.

  2. In the Export WMI filter dialog box, select a secure file system location from the Save in drop-down list box, type a name for the filter that you want to export, and then click Save.

Important

To secure exported WMI filters, ensure that only authorized administrators have permission to access the folder to which you are exporting the filter.

Additional considerations

  • WMI Filters are only available if at least one domain controller in the domain is running Microsoft Windows Server 2003. The same is true for WMI Filtering on the Scope tab for Group Policy objects.

  • You can also export a WMI filter by clicking WMI Filters and, in the results pane, clicking the Contents tab, right-clicking the filter name, and then clicking Export.

  • GPMC can import only .mof files that contain a single WMI filter.

Additional references

  • Work with WMI Filters


Copy a WMI Filter

To copy a WMI Filter

  1. In the Group Policy Management Console (GPMC) console tree, click the WMI filter in the forest and domain containing the WMI filter that you want to copy.

  2. Right-click the WMI filter you want to copy, and then click Copy.

  3. In the destination domain, right-click WMI Filters, and then click Paste.

Additional considerations

  • To complete this procedure, you must have privileges to create WMI filters in the domain in which you want to create the filter. By default, the Domain Administrators, Enterprise Administrators, and Group Policy Creator Owners groups have this permission.

  • WMI Filters is only available if at least one domain controller in the domain is running Microsoft Windows Server 2003. The same is true for WMI Filtering on the Scope tab for Group Policy objects.

Additional references

  • Work with WMI Filters


Link a WMI Filter to a Group Policy Object

To link a WMI filter to a Group Policy object

  1. In the Group Policy Management Console (GPMC) console tree, double-click Group Policy Objects in the forest and domain containing the Group Policy object (GPO) to which you want to link a WMI filter.

  2. Click the GPO.

  3. In the results pane, on the Scope tab, under WMI Filtering, select a WMI filter from the drop-down list.

  4. When prompted to confirm the selection, click Yes.

Additional considerations

  • To link a WMI filter to a GPO, you must have Edit permissions on the GPO.

  • Only one WMI filter can be linked to a GPO, and you can only link a WMI filter to a GPO in the same domain.

  • WMI Filters and WMI Filtering on the Scope tab for GPOs are available only if at least one domain controller in the domain is running Microsoft Windows Server 2003.

Additional references

  • Work with WMI Filters


Block Inheritance

You can block inheritance for a domain or organizational unit. Blocking inheritance prevents Group Policy objects (GPOs) that are linked to higher sites, domains, or organizational units from being automatically inherited by the child-level.

To block inheritance

  1. In the Group Policy Management Console (GPMC) console tree, double-click the forest containing the domain or organizational unit (OU) for which you want to block inheritance for GPO links, and then do one of the following:

    • To block inheritance of the GPO links of an entire domain, double-click Domains, and then right-click the domain.

    • To block inheritance for an OU, double-click Domains, double-click the domain containing the OU, and then right-click the OU.

  2. Click Block Inheritance.

Additional considerations

  • To complete this procedure, you must have Link GPOs permission for the domain or OU.

  • If a domain or OU is set to block inheritance, it will appear with a blue exclamation mark in the console tree.

  • GPO links that are enforced cannot be blocked from the parent container.

Additional reference

  • Control the Scope of Group Policy Objects


Use Resultant Set of Policy to Manage Group Policy

  • Determine Resultant Set of Policy

  • Simulate Resultant Set of Policy Using Group Policy Modeling


Determine Resultant Set of Policy

To determine Resultant Set of Policy

  1. In the Group Policy Management Console (GPMC) console tree, double-click the forest in which you want to create a Group Policy Results query, right-click Group Policy Results, and then click Group Policy Results Wizard.

  2. In the Group Policy Results Wizard, click Next and enter the appropriate information.

  3. After you complete the wizard, click Finish.

  4. If you want to print or save the report, right-click the settings report in the details pane and do one of the following:

    • Select Print to print the report.

    • Select Save Report to save the report.

Additional considerations

  • To access Group Policy Results data for a user or computer, you must have Read Group Policy Results Data permission on the domain or organizational unit that contains the user or computer, or you must be a member of a local administrator's group on the targeted computer.

  • If you run Group Policy Results on a computer that does not support Group Policy Preferences and you select a destination computer that does support Group Policy Preferences, the Group Policy Preferences settings of the destination computer will not appear in the report results.

  • To customize the information displayed in a report, click Show or Hide to display only the data you want to view or print.

  • Within the GPMC, you cannot use the keyboard to navigate inside an HTML report. To browse inside the HTML report, save the report to a file and then use Internet Explorer to view the report.

  • If you open a previously saved console and want to save a Group Policy Modeling or Group Policy Results report in XML, rerun the report by using the Rerun Query option.

  • To view a saved report in a Web browser, you must use Internet Explorer® 6 or later.

  • Group Policy Results is supported only on computers running Windows XP and later.

Additional references

  • Use Resultant Set of Policy to Manage Group Policy


Simulate Resultant Set of Policy Using Group Policy Modeling

To simulate Resultant Set of Policy using Group Policy Modeling

  1. Open the Group Policy Management Console (GPMC). In the console tree, double-click the forest in which you want to create a Group Policy Modeling query, right-click Group Policy Modeling, and then click Group Policy Modeling Wizard.

  2. In the Group Policy Modeling Wizard, click Next, and then type the appropriate information.

  3. When you are finished, click Finish.

  4. If you want to print or save the report, right-click the settings report in the details pane and do one of the following:

    • Select Print to print the report.

    • Select Save Report to save the report.

Additional considerations

  • To create a Group Policy Modeling query, you must have the Perform Group Policy Modeling Analyses permission on the domain or organizational unit that contains the objects on which you want to run the query.

  • Group Policy Modeling is available only if at least one domain controller in the forest is running Microsoft Windows Server 2003.

  • If you run Group Policy Modeling in an environment that supports Group Policy Preferences, the following requirements must be met for the Group Policy Preferences settings to appear in the report results:

    • The computer from which you run Group Policy Modeling must run Windows Server® 2008 R2 or Windows Server® 2008.

    • In mixed environments that use domain controllers that run Windows Server 2008 R2 or Windows Server 2008, and domain controllers that run Windows Server 2003, if you select a domain controller that runs Windows Server 2003 when you run Group Policy Modeling, ensure that the Group Policy Preferences client-side extensions (CSEs) are installed on the domain controller. To download the Group Policy Preferences CSEs for Windows Server 2003 (x86), see http://go.microsoft.com/fwlink/?LinkId=111852. To download the CSEs for Windows Server 2003 (x64), see http://go.microsoft.com/fwlink/?LinkId=111863.

  • To customize the information displayed in a report, click Show or Hide to display only the data that you want to view or print.

  • Within the GPMC, you cannot use the keyboard to navigate inside an HTML report. To browse inside the HTML report, save the report to a file and then use Internet Explorer to view the report.

  • If you open a previously saved console and want to save a Group Policy Modeling or Group Policy Results report in XML, rerun the report by using the Rerun Query option.

  • To view a saved report in a Web browser, you must use Internet Explorer® 6 or later.

Additional references

  • Use Resultant Set of Policy to Manage Group Policy


Delegate Permissions for Group Policy

  • Delegate Permissions for a Group or User on a Group Policy Object

  • Delegate Permissions to Link Group Policy Objects

  • Delegate Permissions for Generating Group Policy Modeling Data

  • Delegate Permissions to Generate Group Policy Results

  • Delegate Permissions for a Group or User on a WMI Filter


Delegate Permissions for a Group or User on a Group Policy Object

To delegate permissions for a group or user on a Group Policy object

  1. In the Group Policy Management Console (GPMC) console tree, expand the Group Policy Objects node in the forest and domain containing the Group Policy object (GPO) for which you want to add or remove permissions.

  2. Click the GPO.

  3. In the results pane, click the Delegation tab.

  4. Click Add.

  5. In the Select User, Computer, or Group dialog box, click Object Types, select the types of objects for which you want to add GPO permissions, and then click OK.

  6. Click Locations, select either Entire Directory or the domain or organizational unit containing the object for which you want to add GPO permissions, and then click OK.

  7. In the Enter the object name to select box, type the name of the object for which you want to add GPO permissions by performing one of the following actions:

    • If you know the name, type it and then click OK.

    • To search for the name, click Advanced, type the search criteria, click Find Now, select the name in the list box, click OK, and then click OK again.

    • In the Permissions box of the Add Group or User dialog box, select the appropriate permissions from the drop-down list, and then click OK.

Additional considerations

  • To perform this procedure, you must have Edit settings, delete, and modify security permissions on the GPO.

  • Groups and users that have Custom in the Allowed Permissions column in the Groups and users list box on the Delegation tab have permissions that do not match one of the three standard levels of permissions. To view the permissions for groups with custom permissions or to set custom permissions, click Advanced.

  • You can also click the Delegation tab to change or remove permissions for a group or user on a GPO.

Additional references

  • Delegate Permissions for Group Policy


Delegate Permissions to Link Group Policy Objects

To delegate permissions to link Group Policy objects

  1. In the Group Policy Management Console (GPMC) console tree, do one of the following:

    • To delegate permission to link Group Policy objects (GPOs) to either the domain or an organizational unit (OU), click the domain or the OU.

    • To delegate permission to link GPOs to a site, click the site.

  2. In the results pane, click the Delegation tab.

  3. In the Permission drop down-list box, select Link GPOs. Click Add.

  4. In the Select User, Computer, or Group dialog box, click Object Types, select the types of objects to which you want to delegate permissions for the domain, site, or OU, and then click OK.

  5. Click Locations, select either Entire Directory or the domain or OU containing the object to which you want to delegate permissions, and then click OK.

  6. In the Enter the object name to select box, enter the name of the object to which you want to delegate permissions by doing one of the following:

    • If you know the name, type it and then click OK.

    • To search for the name, click Advanced, enter the search criteria, click Find Now, select the name in the list box, click OK, and then click OK again.

  7. In the Add Group or User dialog box, in the Permissions drop-down list, select the level to which you want permissions to apply for this group or user, and then click OK.

Additional considerations

  • To delegate permissions to link GPOs to a site, domain, or OU, you must have Modify Permissions on that site, domain, or OU. By default, only Domain Administrators and Enterprise Administrators have this permission.

  • Users and groups with permission to link GPOs to a specific site, domain, or OU can link GPOs, change link order, and set block inheritance on that site, domain, or OU.

  • You cannot remove groups and users that inherit permissions from a parent container.

  • Some entries in the Groups and users drop-down list, such as System, do not have an associated property dialog box, so Properties is unavailable for these entries.

Additional references

  • Delegate Permissions for Group Policy


Delegate Permissions for Generating Group Policy Modeling Data

To delegate permissions for generating Group Policy Modeling data

  1. In the Group Policy Management Console (GPMC) console tree, click the domain or organizational unit (OU) for which you want to delegate Group Policy Modeling permissions.

  2. In the results pane, click the Delegation tab.

  3. In the Permission box, select Perform Group Policy Modeling analyses to add a new group or user to the permissions list.

  4. On the Delegation tab, click Add.

  5. In the Select User, Computer, or Group dialog box, click Object Types, select the types of objects to which you want to delegate permissions for the domain, site, or OU, and then click OK.

  6. Click Locations, select either Entire Directory or the domain or OU containing the object to which you want to delegate permissions, and then click OK.

  7. In the Enter the object name to select box, find the name of the object to which you want to delegate permissions by doing one of the following:

    • If you know the name, type it, and then click OK again.

    • To search for the name, click Advanced, enter the search criteria, click Find Now, select the name in the drop-down list, click OK, and then click OK.

  8. In the Add Group or User dialog box, in the Permissions drop-down list, select the level to which you want permissions to apply for this group or user, and then click OK.

Additional considerations

  • To delegate permissions to perform Group Policy Modeling analyses for objects in a domain or organizational unit, you must have Modify Permissions on that domain or organizational unit. By default, only domain administrators and enterprise administrators have this permission.

  • You cannot delegate permission to perform Group Policy Modeling analyses for sites.

  • You can also use the Delegation tab to change or remove permissions for a group or user for Group Policy Modeling data.

Additional references

  • Delegate Permissions for Group Policy


Delegate Permissions to Generate Group Policy Results

To delegate permissions to generate Group Policy Results

  1. In the Group Policy Management Console (GPMC) console tree, click the domain or organizational unit (OU) for which you want to delegate permission to generate Group Policy Results.

  2. In the results pane, click the Delegation tab.

  3. In the Permissions drop-down list, select Read Group Policy Results data to add a new group or user to the permissions list.

  4. On the Delegation tab, click Add.

  5. In the Select User, Computer, or Group dialog box, click Object Types, select the types of objects to which you want to delegate permissions for the domain, site, or OU, and then click OK.

  6. Select the user or group to which permission should be delegated.

  7. In the Add Group or User dialog box, in the Permissions drop-down list, select the level to which you want permissions to apply for this group or user, and then click OK.

Additional considerations

  • To delegate permissions to generate Group Policy Results for objects in a domain or OU, you must have Modify Permissions on that domain or OU. By default, only domain administrators and enterprise administrators have this permission.

  • You cannot delegate permission to generate Group Policy Results for sites.

  • You can also use the Delegation tab to change or remove permissions for a group or user for Group Policy Results data.

Additional references

  • Delegate Permissions for Group Policy


Delegate Permissions for a Group or User on a WMI Filter

To delegate permissions for a group or user on a WMI filter

  1. In the Group Policy Management Console (GPMC) console tree, click the WMI filter for which you want to delegate permissions.

  2. In the results pane, click the Delegation tab.

  3. Click Add.

  4. In the Select User, Computer, or Group dialog box, click Object Types, select the types of objects to which you want to delegate permissions on the WMI filter, and then click OK.

  5. Click Locations, select either Entire Directory or the domain or organizational unit containing the object to which you want to delegate permissions, and then click OK.

  6. In the Enter the object name to select box, type the name of the object to which you want to delegate permissions by doing one of the following:

    • If you know the name, type it and then click OK.

    • To search for the name, click Advanced, type the search criteria, click Find Now, select the name in the list box, click OK, and then click OK again.

  7. In the Add Group or User dialog box, in the Permissions box, select the permissions level you want to assign to the group or user, and then click OK.

Additional considerations

  • You must have Full Control permissions on a WMI filter to change its permissions.

  • You cannot remove or change inherited permissions for WMI filters.

  • All users must have Read access to all WMI filters. Otherwise, Group Policy stops processing when it encounters a WMI filter that cannot be read.

  • You cannot use the GPMC to remove Read permissions from WMI filters.

  • WMI Filters are available if at least one domain controller in the domain is running Microsoft Windows Server 2003 or later.

  • You can also use the delegation tab to change or remove permissions for a group or user for WMI filters.

Additional references

  • Delegate Permissions for Group Policy


Delegate Permissions for a Group or User on a Starter GPO

Delegating permissions for a Group or User on a Starter GPO

  1. Open the Group Policy Management Console. Expand the Starter GPOs node.

  2. Click the Starter GPO you want to delegate.

  3. In the results pane, click the Delegation tab.

  4. Click Add.

  5. In the Select User, Computer, or Group dialog box, click Object Types, select the types of objects for which you want to add Starter GPO permissions, and then click OK.

  6. Click Locations, select either Entire Directory or the domain or organizational unit containing the object for which you want to add Starter GPO permissions, and then click OK.

  7. In the Enter the object name to select box, type the name of the object for which you want to add Starter GPO permissions by performing one of the following actions:

    • If you know the name, type it and then click OK.

    • To search for the name, click Advanced, type the search criteria, click Find Now, select the name in the list box, click OK, and then click OK again.

  8. In the Permissions box of the Add Group or User dialog box, select the appropriate permissions from the drop-down list, and then click OK.


Use Windows PowerShell to Manage Group Policy

Group Policy in Windows Server® 2008 R2 provides support for Windows PowerShell, a Windows command-line shell and scripting language. You can use the Windows PowerShell Group Policy cmdlets to automate many of the same tasks for domain-based Group Policy objects (GPOs) that you perform in the user interface by using the Group Policy Management Console (GPMC).

Tasks that you can perform

  • Maintaining GPOs: GPO creation, removal, backup, and import

  • Associating Group Policy objects (GPOs) with Active Directory® directory service containers: Group Policy link creation, update, and removal

  • Setting permissions on GPOs

  • Modifying inheritance flags on Active Directory organizational units (OUs) and domains

  • Configuring registry-based policy settings and Group Policy Preferences Registry settings: Update, retrieval, and removal

  • Creating Starter GPOs

To help you complete these tasks, more than 20 Group Policy cmdlets are provided in Windows Server 2008 R2. Each cmdlet is a simple, single-function command-line tool. By using combinations of cmdlets, you can automate more complex tasks. You can also combine actions with scheduled tasks to ensure that specific Group Policy management tasks occur when you want them to. For example, you can back up a GPO, output the result to a file, and then append the file every time that you perform a backup. This creates a report for every scheduled backup.

Using the cmdlets for Group Policy

Important
  • To use the Windows PowerShell Group Policy cmdlets, you must be running either Windows Server 2008 R2 on a domain controller or on a member server that has the GPMC installed, or Windows® 7 with Remote Server Administration Tools (RSAT) installed. RSAT includes the GPMC.
  • You must also import the Group Policy module before you use the cmdlets, at the beginning of every script that uses them and at the beginning of every Windows PowerShell session.
To import the Group Policy Module

  1. Open Windows PowerShell. To open Windows PowerShell, point to All Programs, point to Accessories, point to Windows PowerShell, and then click Windows PowerShell V2.

  2. At the Windows PowerShell prompt, type Import-Module GroupPolicy –verbose

    Important

    You must perform these steps when you open a Windows PowerShell session and you want to use the Group Policy cmdlets.
To view a list of Group Policy cmdlets

  • At the Windows PowerShell prompt, type Get-Command *GP* -commandtype cmdlet
To view Help for the Group Policy cmdlets

  • At the Windows PowerShell prompt, do the following:

    • To display basic Help, type Get-Help <cmdlet_name>

    • To display detailed Help, type Get-Help <cmdlet_name> -detailed

    • To display technical Help, type Get-Help <cmdlet_name> -full

Additional considerations

You can use the GPRegistryValue cmdlets to change registry-based policy settings and the GPPrefRegistryValue cmdlets to change Registry preference items. For information about the registry keys that are associated with registry-based policy settings, see the Group Policy Settings Reference http://go.microsoft.com/fwlink/?LinkId=131389. This reference is a downloadable spreadsheet.

Additional references

  • Group Policy Management Console

  • For the Windows PowerShell Technology Center see http://go.microsoft.com/fwlink/?LinkID=102372, This Web site is an entry point for PowerShell documentation, such as information about deployment, operations, training, support, and communities.

  • For the Windows PowerShell blog see http://go.microsoft.com/fwlink/?LinkID=128557: This Web site is an entry point for Windows PowerShell blogs that includes information about current Windows PowerShell developments, best practices, training, and other resources.

  • For the Group Policy Technology Center see http://go.microsoft.com/fwlink/?LinkID=116313. This Web site is an entry point for Group Policy documentation, such as information about deployment, operations, training, support, and communities.

  • For the Group Policy Settings Reference see http://go.microsoft.com/fwlink/?LinkId=131389. This document lists Group Policy settings described in administrative template (ADMX) files and security settings. This spreadsheet includes all administrative template policy settings for Windows Server 2008 R2 and Windows 7.


Resources for the GPMC

This topic contains links to more information about Group Policy and related technologies.

  • For the Group Policy Tech Center see http://go.microsoft.com/fwlink/?linkid=66015. This Web site is an entry point for Group Policy documentation, including information about deployment, operations, training, support, and communities.

  • For the Group Policy Settings Reference see http://go.microsoft.com/fwlink/?LinkId=131389. This document lists Group Policy settings described in administrative template (ADMX) files and security settings. This spreadsheet includes all administrative template policy settings for Windows® 7.

  • For the GPMC COM Interfaces see http://go.microsoft.com/fwlink/?LinkId=139089. This Microsoft Developer Network (MSDN) topic lists the COM interfaces that support scripting for many of the tasks that you can perform by using the Group Policy Management Console.

  • For the GPMC Sample Scripts see http://go.microsoft.com/fwlink/?LinkId=65841. This set of sample scripts provides examples of how to use these interfaces for real-world administrative problems; scenarios are available as a downloadable package.