Group Policy Starting from Scratch

[karldenton]

Hi,

We currently have Winsuite running our policies in school - don't ask !!

I am looking to remove it - we are going to upgrade the server to 2008 and its not compatible.

 

For group policy - is it a case of going through everything one at a time or can someone send me a policy template for staff and pupils ? I know every school is different but it would be nice not having to start from scratch

 

Thanks

[rh91uk]

If I was you, I would go through it all yourself. It may take you a while, but with the proper forward planning it should be fine.

 

Then you should know how your network is designed; and any snags that could possibly occurr.

[danrhodes]

Go through the settings one by one, it does take a while but at least you can documents exatly how the network is setup.

 

D

[timzim]

Agree with the above - it'll also make it far easier to troubleshoot if something doesn't work to your exact requirements.

[danrhodes]

Agree with the above - it'll also make it far easier to troubleshoot if something doesn't work to your exact requirements.

 

Yeah, this way if you ever need to chance a fine setting it will hae been documented and you will ahve no trouble finding it easily as sometimes you can spend ages trawling through GP's!

 

D

[soveryapt]

My recommendation for this would be to (as people have said) go through yourself and make your own, however I would suggest making a standard user GPO (one which has everything locked down you want locking down etc and applies to everyone) and then create other GPOs to unlock any extras you find staff need, extras that any admin users in your own OU require etc.

 

As you can tell, this is based on having all your users in your own OU as well and not the default USERS one that comes with.

 

I find this way it's a lot easier to then lock down a security loophole instead of having to go through a number of GPOs.

[danrhodes]

Good point, create a base GPO that is really tied down and then allow as requested for staff and other pupils.

[timzim]

My recommendation for this would be to (as people have said) go through yourself and make your own, however I would suggest making a standard user GPO (one which has everything locked down you want locking down etc and applies to everyone) and then create other GPOs to unlock any extras you find staff need, extras that any admin users in your own OU require etc

 

Disadvantage of this is that your logon times will increase as your PCs have to parse a load more GPs than they need to.

[danrhodes]

I know what aptp means it just need's wording better, I think he means to create 1 policy that is really tied down, then copy it and then allow certain parts for say staff, not have one tied down and then others to unblock as that would be plain daft!

 

D

[soveryapt]

I know what aptp means it just need's wording better, I think he means to create 1 policy that is really tied down, then copy it and then allow certain parts for say staff, not have one tied down and then others to unblock as that would be plain daft!

 

D

 

Yup, pretty much. Sorry, it's been a long day today .. lol ..

[danrhodes]

I knew what you meant aptp, it's Monday that's my excuse!

 

D

[soveryapt]

I knew what you meant aptp, it's Monday that's my excuse!

 

D

 

Mine is long walk up big hill saturday, partying with friends sunday, trying to recover whilst working on a monday .. lol ..

[danrhodes]

Oh I'm recovering from 2 relaxing days sunning myself in the garden with the other half and a fair few Vodka/Tonic/Ice and Slice's. ;-)

[jsnetman]

Don't go over board and set settings on every object, start with just a view basic settings like folder/desktop redirection and build up as you go. I would guess I don't use 80% of group policy, the 20% I do use is sufficient to lock the dektops down. Microsoft provide templates for various scenarios it used to be called intellimirror.

[dtakias]

Also it may be a good idea to use mandatory profiles for the pupils otherwise the logon times can increase dramatically especially over wireless.

[danrhodes]

Yeah and keep them as small as possible, also look into redirecting your start menu and desktop through GP it also saves time and space on your profiles.

 

D