Lab Managing user settings with group policy scenario.
A data corporation has implemented Microsoft Office 2016, and you want to use group policy to configure
settings for some Office 2016 apps.
The IT department uses log on scripts to provide users with drive mapping to shared folders.
However, maintaining these scripts is an ongoing problem because they are large and complex.
Your manager has asked that you implement drive mapping by using group policy preferences to remove
log on scripts.
Your manager also has asked that you place a desktop shortcut to the notepad app for all users who belong
to the IT security group.
Additionally, you must add a new computer administrator security group as a local administrator on
all servers to help minimize profile sizes, you also need to configure folder redirection to redirect
several profile folders to each user's home drive.
Finally, you have to complete the GPO designed to manage user desktops and server security.
Exercise one.
Using Administrative Templates to manage user settings.
Task one.
Import Administrative Templates for Microsoft Office 2016 one on low and DC one on the taskbar.
Click the file Explorer Icon two in File Explorer.
Three.
Double click add min templates underscore x64 underscore 4390.
Dash 1000.
Underscore inexact xy.
Forward in the Microsoft Office 2016 Administrative Templates Dialog Box Select the click here to accept
the Microsoft Software License Terms CheckBox and then click Continue.
Five.
In the Browse for folder dialog box, click desktop and then click okay.
Six.
In the Microsoft Office 2016 Administrative Templates Dialog Box.
Click.
Okay.
Seven In File Explorer in the navigation pane, click desktop.
And then in the content pane, double click ends.
Eight Press Control plus.
Eight to select all files.
Right click and then click copy.
Nine in the navigation pane.
Expand local disk.
See Expand Windows, right click policy definitions and then click paste.
Ten.
Close file explorer.
Task to configure Office 2016.
Settings one on low and DC one in server manager Click Tools and then click group policy management
to switch to the group policy management window three in the navigation pane, expand forest a datacom,
expand domains, expanded data, cnn.com, and then click group policy objects.
For right click group policy objects and then click New five in the new GPO Dialog Box Type Office 2016
Settings and then click okay six in the contents pane right click office 2016 Settings and then click
edit seven in the group policy management editor in the navigation pane expand user configuration,
expand policies, expand administrative templates, and then click Microsoft Excel 2016 eight.
Expand Microsoft Excel 2016.
Expand Excel Options, Click Customize Ribbon and then Double Click Display Developer Tab in the ribbon
nine in the Display Developer Tab in the ribbon dialog box click enabled and then click okay ten in
the group policy management editor click save and then double click default file location 11 in the
default file location dialog box click enabled in the default file location text box type percent user
profile percent backslash desktop and then click okay.
12 Closed the group policy management editor.
13.
In Group Policy Management, right click the a datacom domain and then click link in existing GPO 14
in the select GPO Dialog Box Click Office 2016 Settings and then click okay.
Task three Apply and verify settings on the client computer one.
Switch to L0 and seal one to right click start and then click command prompt.
Three in the command prompt window typed the following command and then press enter update slash force.
Four Closed the command prompt window.
Five Click Start and then click Excel.
2016.
Six In the Microsoft Office Activation Wizard Dialog Box.
Click Close.
Seven In the First Things First Dialog Box, select the Ask Me Later Option and then click Accept.
Eight.
Click Blank Workbook.
Nine.
Verify that the developer tab displays on the ribbon.
Ten.
If the developer tab is not displayed on the ribbon, perform the following steps.
A right click start.
Hover over shutdown or sign out and then click restart.
B After the computer has restarted, sign in as a data backslash administrator with the password.
See perform steps 5 to 9 again 11.
Click File, Click Save and then click browse 12 in the save as dialog box in the address bar.
Verify the desktop displays and then click Cancel.
13.
Close Excel 2016.
Exercise two.
Implementing settings by using group policy preferences.
Task one Set up the current environment.
One.
Switch to low and DC one.
Two.
On Low and DC one on the taskbar.
Click the file explorer icon three in the navigation pane.
Expand the folder containing the script for in the details pane right click mod zero six, dash 1.1
and then click run with PowerShell.
Five if prompted.
Type Y and then press enter.
Six.
Right click branch script dot CND and then click copy.
Seven.
Switch to the group policy management window.
Eight In the navigation pane, right click group policy objects and then click refresh.
Nine Right click the branch one group policy object, GPO and then click edit.
Ten In the group policy management editor window under user configuration, expand policies, expand
window settings and then click scripts.
Log on.
Slash log of.
11 in the details pane double click log on.
12 In the log on.
Properties Dialog Box Click Show Files.
13 in the details pane right click a blank area and then click paste.
14.
Closed the log on window 15 in the log on properties dialog box.
Click add 16 in the Add a script dialog box.
Click Browse 17 Click Branch script that seemed and then click open 18 click okay twice to close all
dialog boxes 19 closed the group policy management editor window task to test map drive for branch office
one users one switch to allow NCL one to right click start hover over shutdown or sign out and then
click restart.
Three when the computer has restarted sign in as a date and backslash addy with the password for on
the taskbar click the file explorer icon five in file explorer click this PC six verify that in the
details pane in the network location section drive as displays seven If the drive is not available,
perform these steps a right click start and click command prompt B in the command prompt window type
the following two commands and press enter after each command update slash force shutdown slash r/t0c
perform steps 3 to 6 again task three Create a preferences GPO with the required group policy preferences
one switch to L0 and DC one two on L0 and DC one switch to server manager Click Tools and then click
Active Directory users and computers.
Three in the Active Directory users and computers window right click it hover over new and then click
group.
Four in the new object group dialog box in the group name, text box type computer administrators and
then click okay.
Five Switch to the group policy management console, right click the a datacom domain and then click
refresh.
Six Expand Branch Office one right click the branch one GPO and then click Delete.
Seven In the group policy management dialog box, click.
Okay.
Eight.
Right click the A data CNN.com domain and then click create a GPO in this domain and link it here.
Nine.
In the new GPO dialog box, in the name text box type preferences and then click.
Okay.
Ten.
In the navigation pane, right click preferences and then click edit 11.
Expand user configuration.
Expand preferences.
Expand window settings, right click shortcuts.
Hover over new and then click Shortcut.
12.
In the new Shortcut Properties Dialog Box in the action list, click create.
13 in the name text box type notepad 14 in the location box, click the arrow and then select all users
desktop 15 in the target path box type C Colon backslash windows backslash system32 backslash notepad
dot easy 16 on the common tab clear the run in logged on user security context User Policy Option CheckBox
17 Select the item level targeting checkbox and then click targeting 18 in the Targeting Editor Dialog
Box, Click New Item and then click security group.
19.
In the lower part of the dialog box, click the ellipsis button.
20.
In the select group dialog box in the Enter the object name to select examples box type it and then
click.
Okay.
21.
Click.
Okay.
Two more times.
22.
Right click drive maps hover over new and then click map drive.
23.
In the new Drive Properties dialog box in the location text box type backslash backslash yellow and
hyphen DC one, backslash branch one and then select the reconnect checkbox in the label as text box
type drive for branch office one in the used dropdown list box select s 24 on the Common Tab.
Select the run in logged on User Security Context User Policy Option CheckBox 25.
Select the item level targeting checkbox and then click targeting.
26 In the Targeting Editor Dialog Box, Click New Item and then click Organizational Unit 27 in the
lower part of the dialog box, click the ellipsis button 28 in the find custom search dialog box in
the Search Results list, select branch office one and then click okay 29 click okay.
Two more times 30 expand computer configuration, expand preferences and then expand control panel settings.
31 Right Click Local users and groups hover over new and then click local group.
32 in the new local group properties dialog box in the group name, text box type administrators and
then click add 33 in the local group member dialog box, click the ellipsis button 34 in the select
user computer or group dialog box in the Enter the object name to select examples, text box type computer
administrators and then click okay twice.
35.
In the new local group Properties Dialog Box, click the Common Tab 36.
On the Common Tab, select the item level targeting checkbox and then click targeting.
37.
In the targeting ed dialog box, click new item and then click operating system.
38.
In the product dropdown list box select Windows Server 2016 family and then click okay twice.
39.
Closed all open windows except group policy management and server manager task for test the preferences
one.
Switch to ello and seal one to right click start hover over shutdown or sign out and then click restart.
Three when the computer has restarted sign in as a date and backslash addy with the password for on
the taskbar.
Click the file explorer icon five in file explorer click this PC six verify that in the details pane
in the network location section drive as displays note the drive label now is drive for branch office
one, which verifies that the drive is mapped through group policy preferences.
Seven on the desktop verify that a shortcut exists for Notepad.
Eight If the shortcut for Notepad is not available, perform these steps a right click start and click
command prompt B in the command prompt window type the following two commands and press enter after
each command update slash force shutdown slash r/t0c perform step three again d The shortcut for notepad
should now display on the desktop nine right click start and then click Computer Management ten in computer
management, expand local users in groups and then click groups 11 in the details pane double click
administrators.
12 Verify that the Computer Administrators Group is not a member of the Administrators Group.
Note, The Computer Administrators Group is not a member of the Administrators Group because the preferences
setting only applies to servers.
14 Sign out of ELO and see L1 Exercise three.
Configuring Folder Redirection Task one.
Create a shared folder to store the redirected folders one on low and DC one on the taskbar.
Click the file explorer icon two in the navigation pane.
Click this PC three in the details pane double click local disk, see and then on the home tab click
new folder.
For name the new folder branch one redirect five right click the branch one redirect folder click share
with and then click specific people.
Six In the file sharing dialog box.
Click the dropdown list box, select everyone and then click Add seven for the Everyone group.
Click the permission level dropdown list box and then click read slash, write eight Click Share and
then click done.
Nine Close File Explorer.
Task to create a new GPO and link it to the branch office.
One organisational unit a new one on low and DC one.
Switch to group policy management two in Group Policy Management.
Expand in right click branch office one and then click Create a GPO in this domain and link it here.
Three In the new GPO dialog box in the name text box type folder redirection and then click.
Okay.
Task three Edit the folder redirection settings in the policy one Expand Branch Office one right click
folder redirection and then click edit two in the group policy management editor window under user configuration,
expand policies, expand window settings, and then expand folder redirection.
Three.
Right click documents and then click properties.
Four in the Document Properties dialog box on the Target tab in the setting dropdown list box select
basic.
Redirect everyone's folder to the same location.
Five Ensure that the target folder location box is set to create a folder for each user under the root
path.
Six In the root path textbox type backslash backslash l1 dash DC one backslash branch one redirect and
then click.
Okay.
Seven in the warning dialog box click.
Yes.
ET right click pictures and then click properties.
Nine in the Pictures Properties Dialog box on the Target tab in the setting dropdown list box select
follow the documents folder and then click okay.
Ten in the warning dialog box click.
Yes.
11 Right click music and then click properties.
12.
In the Music Properties dialog box on the Target tab in the setting dropdown list box select.
Follow the documents folder and then click.
Okay.
13.
In the warning dialog box click.
Yes.
14 closed all open windows on low and DC one.
Task four.
Test the folder redirection settings one.
Switch to elo NCL one to sign in as a data and backslash A-B with the password three right click start
and then click command prompt four in the command prompt window type the following command and then
press enter update slash force.
Five.
When prompted.
Type the following and then press enter.
Why six?
Sign out and then sign back into l0 and seal.
SEAL one is a date and backslash A-B with the password seven on the taskbar.
Click the file explorer icon eight in file explorer in the navigation pane, right click documents and
then click properties.
Nine In the Documents Properties Dialog Box.
Verify that the location is backslash.
Backslash.
L1 hyphen.
DC one backslash.
Branch one redirect backslash.
A-D and then click.
Okay.
Note if the location is C colon backslash users backslash abbi perform steps three through nine again.
If the location has not changed, restart ello and seal one and perform steps two through nine again.
Ten Click Documents and verify that two subfolders music and pictures exist.
Note This verifies that music and pictures are redirected as well.
11 Sign out of ELO and seal one.
Exercise for Planning Group Policy Optional.
Task one.
Read the supporting documentation.
Read the documentation provided.
Task to update the proposal document with your planned course of action.
Answer the questions in the proposal section of the A Date and GPO Strategy Proposal.
Document Proposals.
Which of the requirements will necessitate creating one or more GPOs?
The central IT administrators in London must be able to manage all GPOs and settings in the organization.
Administrators in each office should be able to manage only GPOs that apply to that office.
Although you can complete any of the remaining tasks manually on each computer, using GPOs requires
the least effort.
You could implement some of the other requirements such as the security warning or preventing access
to registry editing tools by using local policies only.
However, because local policies are hard to manage, GPOs are also beneficial for these settings.
Can you fulfil any of the requirements without creating GPOs?
You can fulfill all the requirements without creating GPOs.
Are there any exceptions to the default GPO application that you must consider?
Yes, there is one exception security filtering of administrator desktops so that they will not be prevented
from accessing registry editing tools.
List the GPOs that you must create to fulfill the lab scenarios.
Requirements.
Provide the following information in the table.
Provided Name of the GPO.
The requirements that the GPO fulfils.
The configuration settings, user policies, computer policies, user preferences or computer preferences.
The GPO will contain the container domain or use site to which the GPO will be linked.