Okay.
So now what I want to do is create a scenario to illustrate some of the admin template settings for
EII and how they can work with group policy preferences internet settings.
So I've created this GPO called i.e. Lockdown Policy.
We're going to go ahead and bring up the editor on it.
And first, let's go into admin templates.
I want to show you the site to zone assignment list that I mentioned admin templates was good at setting
earlier.
If I go in under Internet Explorer.
This is per user now that I'm setting this under user configuration.
Ongoing in under Internet Explorer Internet Control Panel Security page.
If I come over here to the right, you'll see this policy called site to zone assignment list.
Now, this is very frequently used, and I'm going to go ahead and bring it up.
If you look at the Help text, it explains that you can assign websites or web domains to particular
zones using numeric values.
So one for Internet zone, two for trusted sites, three for Internet zone, and four for restricted
sites.
So if I enable this policy, I can go ahead and type in some domain names that I'm interested in assigning
to particular zones.
And so I'll assign Microsoft.com and Google.com to the trusted sites zone.
And now those are in there and the policy has been set in this GPO.
Now, what I want to do is, by contrast go into GP preferences and set a couple of Internet Explorer
settings for IE10 and above.
So I'm going to go ahead and double click this existing one.
The first thing I want to do is set the homepage to Google.
So I'm going to go ahead and set the homepage to Google.com.
Then what I'm going to do is go in and define a proxy setting, and I've already got a proxy setting
defined here.
It's a proxy PAC file.
This is a central file that can be used to set proxy settings on a browser.
So let's go ahead and accept that.
And so now I've got these two things set.
I've got the homepage set in preferences and I've got the proxy set.
I'm going to go ahead and say, okay to this to accept those changes.
And now what I want to do is take this GPO and link it to an O u that contains a user that I have in
my test environment.
So I've got the IEEE locked down policy.
I'm linking it to this users o you underneath the sales.
Oh you and I've got a user called Joe Sales on this machine here, this Windows seven machine.
So this is me as Joe Sales logged into this Windows seven machine.
Now, if I bring up.
Internet options on the browser.
You'll see here that currently the home page is set to Microsoft.com, that I don't have any trusted
sites to find and I don't have any proxy settings defined.
Okay, great.
So now let's go ahead and run update on this machine.
And I'm going to use the force parameter because it always helps me make sure that I'm getting the most
frequent or the most recent group policy settings that have been delivered.
So as soon as that finish is running, we'll say no to logging off and let's go back in the browser
and see what's changed.
If I go in under internet options, you'll see now that my homepage has changed to Google.com.
If I go under security trusted sites sites now you'll see Google and Microsoft have been added to the
trusted sites own and I can no longer change anything.
So this is one of the side effects or one of the capabilities of admin templates is that when it makes
changes, it prevents me from making any subsequent changes to those.
So I can't edit these trusted sites that have been added by the administrator.
And you'll see here this message.
It says Some settings are managed by your system administrator.
Now, if I come in under connections, let's look and see if we've gotten my proxy setting.
We haven't gotten my proxy setting, at least not visibly.
But what I'll do here is close the browser.
Bring it back up.
Let it go to Google.
And go back in and see what I get.
And there it is.
And the reason that happened is because there are some settings that will require the application that's
being configured to be restarted.
And in this case, a proxy configuration is one of those.
Now, what you notice here also is that I can change this.
I can disable using this automatic configuration script.
And if I come back into it, it's still disabled.
So because this was delivered as a preference, it's perfectly reasonable for me to go ahead and change
it back.
Now, that's probably not a great behavior.
If I'm an administrator, I want to be able to enforce something like proxy.
So what I'm going to do is go into my i.e. lock down policy again.
Go ahead and edit it.
I'm going to come down to admin templates, Windows Components, Internet Explorer.
Let's go ahead and expand that out a little bit and then I'm going to go ahead and sort these settings.
And if I go down here, you'll see an option that says Disable changing connection settings.
That sounds about what I want, so I'm going to go ahead and enable that.
So now that's enabled on this GPO that is being processed by sales.
So now what I want to do is come back to my Windows client.
And go ahead and do my pup date.
And once that finishes running, I'm going to go back into IEEE and see how, if anything, has been
affected by that policy I just set.
So let's go into Internet options, connections and look, the launch settings button that used to be
available to me to change is now disabled.
So now that proxy is set by preferences, but the launch settings button is disabled by admin templates.
So I'm taking advantage of the power of both of these different settings to be able to essentially configure
proxy in one case using preferences and disable the ability for the user to change it.
What they would normally be able to change using admin templates in another.
So this is kind of a great example of a common way of deploying, i.e. configuration using both of these
different policy areas to their best benefit.