UltimateWindowsSecurity.

com

Active Directory for IT Auditors:

Where Does Group Policy Fit In?
Made possible by Randys On Demand, Interactive training course:
Audit and Assessment of Active Directory
Same 3-day course as in-person training
Only $595 and includes AD audit program (available separately for $200)
www.ultimatewindowssecurity.com/training/oiportal.aspx

Become an AD audit expert

Everything in this webinar comes from my course
and audit program
AD Audit Program
$200
www.ultimatewindowssecurity.com/itaudit/programs/ad

On Demand Interactive Training: Audit and

Assessment of Active Directory
Only $595
Includes the AD audit program
www.ultimatewindowssecurity.com/training/oiPortal.aspx

2011 Monterey Technology Group Inc.

UltimateWindowsSecurity.com

Preview of Key Points

Group Policy
What it does
Where does it fit into audits?
How it works
Become an AD audit expert

2011 Monterey Technology Group Inc.

What Group Policy Does

Centralized, automated control of configuration
Especially security settings, user desktop
restrictions

2011 Monterey Technology Group Inc.

UltimateWindowsSecurity.com

The Big Question

Where does Group Policy fit into IT audits?
Group policy might reside in AD
But
Group policy controls
Workstations
Servers
Not Active Directory

The Big Question

Where does Group Policy fit into IT audits?
4 different types of audits in MS environment
Workstations

Active
Directory

Applications

2011 Monterey Technology Group Inc.

Servers

UltimateWindowsSecurity.com

The Big Question

Where does Group Policy fit into IT audits?
4 different types of audits in MS environment
Workstations

Group Policy

Active
Directory

Applications

Servers

How Does Group Policy Work

Dont get hung up on the word group
First quick look at a GPO
Assign a GPO to an OU

2011 Monterey Technology Group Inc.

UltimateWindowsSecurity.com

How Does Group Policy Work

But, much more involved
What if multiple GPOs define conflicting settings?
How can you can override normal GPO behavior to
handle special requirements?
How can you be sure GPOs be applied the way
admins think they are?

What if GPOs conflict?

On the same OU
Priority
On different OUs
GPOs on lower OUs
override GPOs on higher
OUs

organizational
units

Audit policy:
- logon/logoff enabled
- all others disabled

Acme

HR

Audit policy:
- use user rights enabled
- all others undefined

Benefits
Audit policy:
- use of user rights disabled
- object access enabled
- all others undefined

Recruiting

Audit policy:
- logon/logoff enabled
- object access enabled
- all others disabled

RecruitSvr1

2011 Monterey Technology Group Inc.

UltimateWindowsSecurity.com

Controlling Inheritance
with Enforced Policies
Two GPOs at root of domain
No Override & Enforced mean
the same thing
GPO1 blocks but Enforced/No
override GPO2 punches
through to the server

GPO2

GPO1

(no override)

Acme

HR

(block policy
inheritance)

Recruiting

Benefits

RecruitSvr1

What if GPOs conflict?

Sequence of
application (last
applied wins)

Computer
Startup Applying Computer
Configuration

Local Computers
GPO

Local Computers
GPO

GPOs
linked to computers

GPOs
linked to computers

GPOs
linked to computers

GPOs
linked to users

GPOs
linked to computers

GPOs
linked to users

Site

Domain

Organizational
Units

2011 Monterey Technology Group Inc.

User Logon Applying

User
Configuration

Site

Domain

Organizational
Units

UltimateWindowsSecurity.com

What if GPOs conflict?

GPO at
domain root
User
Configuration

Computer
Configuration

HumanResources OU

Finance OU
GPO
User
Configuration

GPO

Computer
Configuration

User
Configuration

Computer
Configuration

GPO
User
Configuration

Computer
account

Not
applied

Computer
Configuration

Bobs user
account

Bob logs on
at a computer
in HR

Computer Configuration based upon computers location in AD.

User Configuration based on users location in AD.

Controlling Inheritance
Domains are the boundary
GPOs on parent domains do not flow to child
domains
Container level option
Block

2011 Monterey Technology Group Inc.

UltimateWindowsSecurity.com

Verifying results
Group Policy Results Wizard

Become an AD audit expert

Everything in this webinar comes from my course
and audit program
AD Audit Program
$200
www.ultimatewindowssecurity.com/itaudit/programs/ad

On Demand Interactive Training: Audit and

Assessment of Active Directory
Only $595
Includes the AD audit program
www.ultimatewindowssecurity.com/training/oiPortal.aspx

2011 Monterey Technology Group Inc.

UltimateWindowsSecurity.com

Bottom Line
Group Policy
Resides in AD but is not a control for AD
Control for
Workstations
Servers

Take a free sample of my course

www.ultimatewindowssecurity.com/training/oiPortal.aspx

2011 Monterey Technology Group Inc.