In this module, we're going to begin a series of discussions that will take place over the next few
modules that talk about specific policy scenarios and how we can implement those using group policy.
In this module, we're going to talk about desktop and server lockdown.
So let's kind of dig into it.
RU policy's main job is really to do lockdown and that's really what it does best.
It started in that area.
Remember when I talked in module one about the G at the predecessor to group policy, which was system
policy.
That was all about lockdown.
It was all about essentially controlling what the user could do on their system.
And that really is my definition for lockdown.
It's preventing a user or an application or anything really on a system from doing something to that
system.
And it could be everything is from the, you know, simple things like disabling the registry editor
to more complicated things like setting trusted site lists on Internet Explorer.
And that's really what lockdown is all about.
It is primarily implemented in two policy areas within group policy, namely administrative templates
and security.
And those are pretty broad areas, especially security.
And I will also say that there are other policy areas that can implement lockdown.
And I'm going to actually show you an example of one of those in this module.
But these are the primary areas where we see the things that control the Windows operating system and
prevent the user from doing stuff.
So let's talk a little bit about administrative templates.
We've introduced this in previous modules and shown examples of administrative templates settings.
These are found under computer configuration backslash policies and user configuration backslash policies,
so they apply to both the computer and the user.
And they really are all about pushing registry values to the computer or user.
If it's a computer policy under admin templates, then it's going into the HK UI underscore local underscore
machine portion of the registry.
If it's the if it's user policy under admin templates, then it's going into the HK UI underscore current
underscore user registry hive.
And that's, of course, the user's profile.
So there's no user policy being delivered if there's no user logged on to a system.
I mean, that's simply just the user side of group policy is strictly dependent on having a user available.
And it does presume that the thing that's being locked down knows how to read those registry settings.
So what this essentially means is, you know, Microsoft ships a bunch of templates that implement lots
of different policy, locked down everything from IEEE to Windows Media Player.
The list is long and there are literally thousands of these settings under admin templates.
The key to them is that each of those components that Microsoft delivers has been coded to look for
these registry values and to change their behaviour based on their value.
So if you enable a policy to disable the registry editor, Microsoft has coded the registry editor to
look for that registry value.
And if it finds it and sets it and sees that it's enabled, it will essentially cancel the launch of
the registry editor.
And that is really, you know, a function of the fact that these applications are aware of admin templates
settings.
And that's that's really a key.
You can't really just create an admin template setting out of the blue and hope that the application
is going to change its behavior.
The application has to be aware of that setting and has to be coded ahead of time to pay attention to
that setting.
The other thing that we talk about when we talk about admin templates is that these registry settings
don't tattoo the registry when they're applied and when the policy is removed.
So what this means, and I'm going to explain this in more detail in a second, is that if you have
a GPO and you define some admin template settings on it and you apply those to a user and the user logs
on and gets those registry settings in their HQ, I underscore current underscore user registry hive
and then you delete or unlink the GPO or for some reason that GPO no longer applies to that user.
Well then you're going to get that registry value.
Those values are going to be removed the next time the user processes policy.
And that gets done automatically.
You don't have to do anything to get that removal to happen.
And that was never the case in the old system policy day.
And it was a big improvement when Microsoft shipped admin templates.
Now, in order for this non tattooing behavior to happen, the admin templates have to write values
to one of these four policy keys.
Two of them on the computer side under HK UI underscore local underscore machine and two on the user
side.
And if you look into the template files that Microsoft ships in the box, you'll notice that 99, if
not 100% of the registry keys that get written to exist under these four policy keys.
And the applications, of course, have been coded to look in one of these four policy keys for these
registry values.
So these keys are kind of key to the non tattooing nature of policy, and they're there on purpose.
They're not accidental.
Microsoft has specifically coded the group policy engine to look in these keys when it's doing its cleanup
and essentially, you know, use these keys to write new values, too.
So let's look at tattooing them a little bit more and how this works.
So we've got our client, we've got a GP and the client process is an admin template setting and makes
a bunch of registry tape changes on its registry.
And then a new processing cycle happens and the client again looks for GPO changes.
But before it does that, it actually removes the old values that were processed in that first cycle.
So the first thing it does is it removes those registry values that were delivered by that GPO during
the first cycle.
And then it gets its list of GPOs that apply and brings down the new settings from the GPO.
So if you've gotten, you know, a change in settings, you added new settings to the previous GPO or
maybe you've even just removed all the settings from the previous GPO and set a new set of admin template
settings.
Those old settings are removed before the new ones are applied.
So essentially what you see the effect of this is this kind of non tattooing nature of group policy
admin templates.
And it's really the key to it is that those old values are swept away from those four policy keys I
showed in the previous slide.
And that's essentially how the group policy engine is able to guarantee that no registry values are
tattooed between one processing cycle and the next.