Okay.
So in this module, I'm going to talk about group policy preferences in a little bit more detail.
So you'll remember from module two that I discussed preferences and talked about how they were different
from policies.
So let's kind of review that and see how preferences add to the mix in terms of group policy capabilities.
So generally speaking, preferences don't prevent the user from changing them.
And that's where the term preference comes from.
Instead of a hard policy that prevents the user from doing something, a preference really suggests
or configures a setting, but does not prevent the user from going in and changing that afterward.
Now, that's not universally the case.
And I'll talk about a scenario where preferences is actually enforceable by you, the administrator
on the user or on their computer more specifically.
But in general preferences are not locking out the UI in order to make those configuration changes.
Preferences provide this really kind of nifty feature around filtering called item level targeting.
And this is a preceding filtering capability.
So you remember from earlier modules, I talked about a couple different kinds of group policy filtering.
One is security group filtering and the other is WMD filtering.
And both of those are at the whole GPO level, whereas item level targeting is on the per preference
item level.
So we'll talk a little bit more about that and I'll show you that in a bit.
Now group policy preferences is actually it was actually originally a third party product that Microsoft
acquired from a company called Desktop Standard.
It used to be called policy maker.
And its job in life was to extend the group policy.
Of course, I mentioned early on in the course that group policy is perfectly extensible if you're a
developer and have the capability of doing so.
And that's exactly what this third party ad on did.
It still looks and feels different than core group policy, though.
And so when you're in the UI and you're managing group policy preferences, you know you're managing
it because it really is several years newer than sort of the core capabilities that were built into
group policy.
So let's look at the areas the group policy preferences support.
They're pretty substantial.
We've got environment variables.
So the ability to set per computer and per user environment variables.
Users and groups managing local users and local group memberships.
GPP devices.
This is where you can restrict, for example, USB devices from being used by a computer or user.
Network options.
This is where you can set some network parameters such as VPN.
Similar options related to network configuration.
Files and folders.
This is where you can distribute files and create folders on target systems.
Network shares.
Principally this is targeted at servers and it allows you to use group policy to create network shares.
Data sources.
This is the ability to configure ODC data sources not commonly used as much today, but still out there
in group policy preferences provides a way to manage that.
Annie files another kind of blast from the past here.
Most applications no longer use any files, but some still do.
And with preferences you can manage their the contents of those iron files.
Services.
Again, you can configure start up type of the service account that's being used by the service.
All of that's fully configurable in preferences.
Folder options.
So if you go into Explorer and you save you folder options, there's a number of features that you can
set.
And this this particular area of group policy preferences lets you push that down through policy.
Schedule tasks lets you create a variety of different scheduled task types on your Windows system.
So you can actually push scheduled tasks jobs to systems using group policy preferences.
Registry.
This is something I'll talk about in demo in this module.
This is the ability to kind of have a freelance capability around modifying the registry.
So instead of being tied to admin templates in the Adam X file, this really lets you kind of do really
whatever you want in the registry.
Printers.
The ability to create printer mappings for users of various types.
Short cuts.
The ability to distribute shortcuts to the user's desktop.
Shortcuts could be favorites in IEEE, or they could be just your typical old shortcut that shows up
on the desktop or on the start menu.
Power options.
The ability to set power plans and power schemes.
So in other words, being able to push out the configuration of the preferred power scheme for all of
your desktops.
So if you want to save power and ensure that all systems have a consistent power plan, this is the
place you can do that.
Drive mappings, a really common one, probably the most common use of GP preferences and it lets you
do drive mappings for your users.
Start menu the ability to customize the start menu and what appears on it.
Regional options.
This is the those options under control panel.
But let you control the culture and the display format of various representations like dollars and dates
and things like that.
Internet options.
This is where you can configure IEEE.
We talked about this in a previous module.
In addition, preferences has this notion of actions.
So every preference item or most preference items have the ability to set the action type when you set
the preference.
In this case, I'm showing you a screenshot of the drive mapping preference item and you'll notice the
dropdown that lets you select the preference or I'm sorry, the action type.
So create is create the setting if it doesn't exist, but only do that once.
Replaces, remove the existing setting and then set the new value every time the policy processes.
So this is very similar in behavior to what Adnan templates does in order to not tattoo the registry.
It first removes the setting and then it replies whatever settings now exist.
Update a little different from replace.
This lets set the value only if it's different from the policy.
So you're only going to do that.
You're only going to do work if there's a change that has to be made either to the existing value on
the system, or maybe it's just never been delivered to the system.
So update will make that change and then leave it alone until it changes again.
And then delete will delete the setting if it exists.
Now again, not all GP preferences areas have actions.
So you'll notice if you go back to the module on Internet Explorer configuration, that the GP preferences
internet options did not have actions.
And then finally, another kind of part of preferences that I discussed, item level targeting.
So what you're seeing here is a screenshot of all the different item level targeting types.
This is accessible from the common tab.
And I'm going to show you that in a second.
And it's available on a percentage basis, and it provides these 27 different criteria for filtering.
You can also do some logical operations like ends indoors.
You can combine filters into a fairly complex set of logic.
Now, I'll tell you again, is separate from security group or WMI filtering.
So now let's dive in and look at an example of how group policy preferences operates.