Module 12: Using Group Policy to Manage the Desktop Environment

Contents Overview 1 Introduction to Managing User Environments 3 Using Administrative Templates in Group Policy 5 ssigning Scripts by Using Group Policy 15 Using Group Policy to Redirect Folders 20 Lab 12A: Using Group Policy to Manage the User Environment 25 Troubleshooting User Environment Management 40 ntroduction to Managing Software Deployment 42 eploying Software 47 anaging Software 53 Identifying Solutions to Software Deployment Problems 60 Lab 12B: Using Group Policy to Deploy Software 61 Review 74 Module 12: Using Group Policy to Manage the Desktop Environment Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, e-mail address, logo, person, places or events is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.  2001 Microsoft Corporation. All rights reserved. Microsoft, MS-DOS, Windows, Windows NT, <plus other appropriate product names or titles. The publications specialist replaces this example list with the list of trademarks provided by the copy editor. Microsoft, MS-DOS, Windows, and Windows NT are listed first, followed by all other Microsoft trademarks listed in alphabetical order. > are either registered trademarks or trademarks of Microsoft Corporation in the U.S.A. and/or other countries. <The publications specialist inserts mention of specific, contractually obligated to, third-party trademarks, provided by the copy editor> The names of actual companies and products mentioned herein may be the trademarks of their respective owners. Module 12: Using Group Policy to Manage the Desktop Environment iii Instructor Notes This module provides students with the knowledge and skills to use Group Policy to manage user environments, and install, modify, repair and remove software more efficiently. Students will learn to manage user environments by configuring the Administrative Template settings, using Group Policy to run scripts at designated times, and redirecting folders to a central location. They will also learn how software installation policies take advantage of the Microsoft ® Windows ® Installer to deliver software to computers. After completing this module, students will be able to: ! Describe key tasks in configuring and managing user environments. ! Use Administrative Templates in Group Policy to assign registry-based policies to control and configure user and computer environments. ! Control user environments by using Group Policy to assign scripts, such as startup, shutdown, logon, and logoff. ! Use Group Policy to redirect user folders to a central network location. ! Troubleshoot the management of user environments by using Group Policy. ! Explain how software installation and maintenance technology uses Group Policy and Windows Installer to manage software. ! Deploy software by using Group Policy. ! Manage software by configuring deployment options, managing file extension associations, and assigning software categories. ! Identify solutions to common problems that are associated with software deployment. Presentation: 90 Minutes Lab: 105 Minutes iv Module 12: Using Group Policy to Manage the Desktop Environment Materials and Preparation This section provides the materials and preparation tasks that you need to teach this module. Required Materials To teach this module, you need Microsoft PowerPoint ® file 2126A_12.ppt. Preparation Tasks To prepare for this module, you should: ! Read all of the materials for this module. ! Complete the labs. ! Study the review questions and prepare alternative answers to discuss. ! Read the following white papers under Additional Reading on the Web page on the Student Materials compact disc: • Windows 2000 Desktop Management • Introduction to IntelliMirror ® Management Technologies • Windows Script Host: A Universal Scripting Host for Scripting Languages • Using Group Policy Scenarios ! Review the Windows Script Host information at: http://msdn.microsoft.com/scripting/. Module 12: Using Group Policy to Manage the Desktop Environment v Module Strategy Use the following strategy to present this module: ! Introduction to Managing User Environments Introduce managing user environments by configuring the Administrative Templates and Scripts Group Policy extensions, and by redirecting folders. Emphasize that configuring user environments by using Group Policy enables you to immediately apply the environments to users or computers by adding the user or computer to the organizational unit that is affected by the settings. Finally, describe the tasks for centrally configuring and managing user environments. ! Using Administrative Templates in Group Policy Introduce the different types of settings in Administrative Templates. Explain the type of settings to use if an administrator wants to lock down users’ access to the desktop, network resources, or administrative tools and applications. Emphasize that the settings that this module presents are only examples and not recommendations. Finally, demonstrate how to implement Administrative Template settings. ! Assigning Scripts by Using Group Policy Introduce how to use Group Policy to run scripts. Emphasize that script settings enable an administrator to automate the running of scripts at specific times, such as startup, shutdown, and when a user logs on or logs off. Then present the order in which the next version of the Microsoft Windows 2000 operating system processes scripts. Emphasize that startup scripts run synchronously, and define the term if needed. Finally, demonstrate how to implement scripts. ! Using Group Policy to Redirect Folders Introduce how to redirect default user folders to a network server by using Group Policy. Explain that although a redirected folder appears to be stored locally, it is actually stored on a server. Mention that the information in a redirected folder is always available to the user, regardless of the computer from which the user logs on. Present information on the four types of folders that an administrator can redirect and why an administrator would choose to redirect these folders. Finally, demonstrate how to redirect folders by using Group Policy. ! Troubleshooting User Environment Management Introduce troubleshooting options for configuring and managing user environments through Group Policy. Explain some of the more common problems that students may encounter when they manage user environments and provide suggested strategies for resolving these problems. vi Module 12: Using Group Policy to Manage the Desktop Environment ! Introduction to Managing Software Deployment Describe the technologies that participate in software deployment: Windows Installer and software installation and maintenance. Students should understand that Windows Installer resides on the client computer and executes the installation. Software installation and maintenance is the delivery mechanism that the server uses. Explain the operation of software installation and maintenance through the four phases of the software life cycle. Make sure that students understand how packages are acquired and the concept of advertising an application. Briefly mention the difference between assigning and publishing applications, and the difference between forced and optional removal. These concepts will be discussed in detail later in the module. ! Deploying Software Explain how to use software installation and maintenance to deploy a new application. Then, explain the difference between assigning an application to a user and assigning an application to a computer. Finally, explain the concept of publishing applications. ! Managing Software Focus on methods of deploying packages that upgrade previously deployed applications. Give special attention to describing the differences between mandatory and optional upgrades and the effect of redeploying software in the scenarios described in the text. Discuss how to remove deployed software. Highlight the differences between forced and optional removal. ! Identifying Solutions to Software Deployment Problems Discuss three important strategies for investigating problems with software deployments. The most complex area to troubleshoot is Group Policy conflicts. Discuss at least one scenario in which conflicting Group Policy settings would cause an application to deploy in an unexpected way. Module 12: Using Group Policy to Manage the Desktop Environment 1 Overview ! Introduction to Managing User Environments ! Using Administrative Templates in Group Policy ! Assigning Scripts by Using Group Policy ! Using Group Policy to Redirect Folders ! Troubleshooting User Environment Management ! Introduction to Managing Software Deployment ! Deploying Software ! Managing Software ! Identifying Solutions to Software Deployment Problems Group Policy in Microsoft ® Windows ® 2000 enables an organization to reduce the cost of administering computer networks by allowing administrators to control users’ desktops and deploy computer configurations from a central location. As an administrator, you can create a managed desktop environment that you tailor to each user’s job responsibilities and experience level. Windows 2000 Server includes many Group Policy settings that provide administrators with greater control over computer configurations. Group Policy enables administrators to specify Group Policy settings to manage desktop configurations for groups of computers and users. Group Policy includes settings for registry-based policy, security, software installation, scripts, computer startup and shutdown, user logon and logoff, and folder redirection. In addition, Windows 2000 includes a technology called software installation and maintenance that uses Microsoft Windows Installer and Group Policy to deploy and manage software with a minimal amount of administrative effort. In this module, you will learn how to deploy and manage software by using the software installation and maintenance technology. After completing this module, you will be able to: ! Describe key tasks in configuring and managing user environments. ! Use Administrative Templates in Group Policy to assign registry-based policies to control and configure user and computer environments. ! Control user environments by using Group Policy to assign scripts, such as startup, shutdown, logon, and logoff. ! Use Group Policy to redirect user folders to a central network location. Topic Objective To provide an overview of the module topics and objectives. Lead-in In this module, you will learn how to configure and manage the user desktop environment by using Group Policy, and how to deploy and manage software by using the software installation and maintenance technology. 2 Module 12: Using Group Policy to Manage the Desktop Environment ! Troubleshoot managing user environments by using Group Policy. ! Explain how software installation and maintenance technology uses Group Policy and Windows Installer to manage software. ! Deploy software by using Group Policy. ! Manage software by configuring deployment options, managing file extension associations, and assigning software categories. ! Identify solutions to common problems that are associated with software deployment. Module 12: Using Group Policy to Manage the Desktop Environment 3 Introduction to Managing User Environments ! Control user desktops, user interfaces, and network access ! Use group policy settings ! Apply group policy to a site, domain, or organizational unit " User environment settings automatically apply to a new user or computer Manage User Environments Administrative Templates Settings Script Settings Redirecting User Folders Security Settings HKEY_LOCAL_MACHINE HKEY_CURRENT_USER Registry Registry My Documents Managing user environments means controlling what users can do when they are logged on to the network. You control user environments by controlling users’ desktops, network connections, and user interfaces. You control user environments to ensure that users have what they need to perform their jobs, but do not have the ability to incorrectly configure their environments. The types of Group Policy settings that you typically use to manage user environments are Administrative Template settings, script settings, folder redirection, and security settings. You configure these settings in Group Policy. If you use Group Policy to set up user environments for a site, a domain, or an organizational unit, Group Policy settings are applied automatically to any computer or user that you add to the site, domain, or organizational unit. To centrally configure and manage user environments, you can perform the following tasks: ! Enforce standard configurations. Group Policy settings provide an efficient way to enforce standards, such as logon scripts or password settings. For example, you can prevent users from making changes to their desktops that could make their user environments more complex than necessary. ! Limit user access to selected components of the operating system. You can prevent users from opening Control Panel and shutting down their computers. By preventing users from accessing critical operating system components and configuration options, you reduce the possibility of users corrupting their systems, and therefore, the number of technical support calls that users must make. Topic Objective To identify the benefits of using Group Policy to centrally configure and manage the user desktop environment. Lead-in Managing user environments means controlling what users can do when they are logged on to the network, which includes controlling what appears on their desktops. 4 Module 12: Using Group Policy to Manage the Desktop Environment ! Ensure that users always have their desktops and personal data. By managing user desktop settings with registry-based policies, you ensure that users have the same computing environments even if they log on from different computers. You can control how Windows manages user profiles, which includes how users’ personal data is made available. By redirecting user folders from users’ local hard disks to a central location on a server, you can ensure that users’ data is available to them regardless of the computers to which they log on. ! Secure the user environment. Through the use of Group Policy in the Active Directory ™ directory service, administrators can centrally apply the security settings that are required to protect the user environment. In Windows, you can use the Security Settings extension in Group Policy to define the security settings for local and domain security policies. For more information about managing Group Policy security settings for user environments, see Module 13, “Managing Network Security” in Course 2126A, Managing a Microsoft Windows 2000 Network Environment. Note [...]... the Properties dialog box for the GPO Module 12: Using Group Policy to Manage the Desktop Environment 15 #Assigning Scripts by Using Group Policy Topic Objective To introduce the topics that relate to assigning scripts in Group Policy ! Introduction to Group Policy Script Settings Lead-in ! Applying Script Settings in Group Policy ! Assigning Group Policy Script Settings You can use Group Policy to. .. in a Windows 2000 domain, the Windows 2000 default adm files are automatically updated with the new adm files on the client 8 Module 12: Using Group Policy to Manage the Desktop Environment Settings for Securing the Desktop Topic Objective To explain how to use the Administrative Template settings to lock down users’ desktops Common Group Policy Settings for Securing the Desktop Emphasize that this... removed Module 12: Using Group Policy to Manage the Desktop Environment Lab 12A: Using Group Policy to Manage the User Environment Topic Objective To introduce the lab Lead-in In this lab, you will create a GPO linked to an organizational unit, configure the GPO with Group Policy, verify Group Policy settings are in effect, verify that proper scripts are executed, and direct the My Documents folder to a... scripts Module 12: Using Group Policy to Manage the Desktop Environment 19 Assigning Group Policy Script Settings Topic Objective To illustrate the procedure that is to assign Group Policy script settings to users and computers Lead-in To implement scripts by using Group Policy, you add the script to the appropriate script setting Logon Properties Scripts Logon Scripts for Log On Script [AUCKLAND.contoso.msft]... Module 12: Using Group Policy to Manage the Desktop Environment # Using Group Policy to Redirect Folders Topic Objective To introduce the topics that relate to using Group Policy to redirect user folders ! Folder Redirection Overview Lead-in ! Selecting the Folders to Redirect ! Redirecting Folders to a Server Location By redirecting folders, you can ensure that users’ data is available to them regardless... Add the script to Add the script to the appropriate GPO the appropriate GPO Add Edit Remove To view the script files stores in this Group Policy Object, press the button below Show Files Copy the script to the Copy the script to the appropriate GPT appropriate GPT OK Delivery Tip Demonstrate how to add a startup script by using Group Policy Then show students where the script resides in the GPT The. .. Folders to a Server Location Topic Objective To illustrate how to redirect folders to a server location by using Group Policy Lead-in You use the Folder Redirection extension in Group Policy to redirect folders Desktop Properties Target Settings Desktop Properties Desktop Properties Target Settings You can specify the location of the Desktop folder Target Settings You can specify the location of the Desktop. .. you can manage these scripts centrally, along with startup, shutdown, and logoff scripts Module 12: Using Group Policy to Manage the Desktop Environment 17 Applying Script Settings in Group Policy Topic Objective To explain the process of applying script settings in Group Policy Lead-in Windows processes Group Policy scripts in a particular order, which is from top to bottom Delivery Tip On the Script.. .Module 12: Using Group Policy to Manage the Desktop Environment # Using Administrative Templates in Group Policy Topic Objective To introduce the topics that relate to using Administrative Templates in Group Policy Lead-in Administrative Template settings are available for both computers and user accounts ! Types of Administrative Template Settings ! Settings for Securing the Desktop ! Settings... throughout your network 16 Module 12: Using Group Policy to Manage the Desktop Environment Introduction to Group Policy Script Settings Topic Objective Computer Startup/Shutdown Startup/Shutdown To identify the purpose of Group Policy script settings Computer Configuration Startup/Shutdown Startup/Shutdown Lead-in Using Group Policy script settings, you can set up scripts to run automatically when specific . files on the client. Note 8 Module 12: Using Group Policy to Manage the Desktop Environment Settings for Securing the Desktop ! Hide all icons on desktop !. settings to configure secure user desktop environments. Module 12: Using Group Policy to Manage the Desktop Environment 9 (continued) Group Policy setting