Join Ed Liberman for an in-depth discussion in this video Configure administrative template settings, part of Windows Server 2012 R2: Manage Group Policy.
- View Offline
- [Voiceover] While there's a wide variety of things that can be done with Group Policy, it should be noted that the mass majority of the settings can be found within the administrative template, so it's very important that you have a good understanding of how exactly the administrative templates settings work, and then also how to locate the setting that you might be looking for. So in order to demonstrate this, we need to go into one of our Group Policy Objects.
So here we are already on DC1 and I'm in Group Policy Management. I'm just gonna go ahead and select the default domain policy and right-click and Edit, which will take us into our Group Policy Management Editor. Inside the Editor, under both Computer Configuration and User Configuration, if we expand Policies, you'll notice that there is a selection for administrative templates, and actually, I will expand this out so we can see. We have Administrative Templates on both sides and inside those administrative templates is a wide variety of settings on both sides.
You'll notice there's a number of subfolders and if I expand those subfolders, it expands even deeper. We could just keep going and going and going, and inside each one of these folders is a list of setting. Every time I click on something, you'll see here that we have one or more settings to choose from. And in fact, I'm gonna go ahead and let's bring this back down, you'll notice at the bottom here, there is a selection for All Settings where there's a list that I can scroll through and don't even bother trying to read this. I'm just gonna kind of show you as I slowly scroll through here is a very, very long list.
I mean, I'm only up to the Ds. You can imagine how long this list is and this is only on the computer side. There's an equally long list on the user side if I come over here. So the first thing that I would like to show you, what a setting actually looks like and how it would be configured. So, to do this, I'm going to go on the user side and under Administrative Templates, I'll select Control Panel. And again, I'm just somewhat randomly picking one item here so that you can see what it looks like because for the most part, they almost all are functional in the same way.
So, I'm gonna take the first one here that says, "Prohibit access to the Control Panel and PC setting." And if I go into that setting, you will see here that the option is Not Configured, Enabled, or Disabled. That is the number one thing to know about administrative templates is that, for the most part, they're either not configured which means in this particular Group Policy Object, we are not going to mess with this setting. We're either gonna leave it at the default or however some other Group Policy Object may have set it or we can explicitly turn on the setting or we can turn off the setting.
Now, something I want you to keep in mind is you gotta watch out for the double negative and what I mean by that is the setting here says, "Prohibit access." If I disable the prohibiting of access, I'm actually granting access. So you wanna be careful. There's a lot of items that say that you're gonna disable something or you're going to deactivate something or you're going to not allow something or prohibit something and disabling that is kind of like a double negative. You are granting access.
Now in pretty much every single administrative template setting, you will see what operating system is needed for this setting to be supported because some settings are newer than others and may require newer operating systems, whereas this one is just saying at least Windows 2000, which was actually the original operating system when Group Policy was first created along with Active Directory in Microsoft Networking. There is an Options window which I will talk about in just a moment because I'm gonna show you a different item which actually has options to choose from, but then there's always a Help box, which is a really wonderful thing because it's just a plain text description of what this particular setting is going to do.
And that's the basic gist of how you set up and configure an administrative template setting. So let me cancel out of here and let's jump into another one. Instead of prohibiting total access to Control Panel, let's say that we want to hide specific Control Panel items. And the reason I'm gonna select this one is because everything looks pretty much the same, in the sense that we have not configured, enabled or disabled. We still see the operating system that is needed to support this setting. We still have our Help dialog, but notice that over here in the Options box, there is something, and the reason why is because if we're gonna say that this particular setting is to hide specified Control Panel items, well then we need to have a place to specify those items.
Now this is grayed out because it's not currently configured but if I were to enable this setting, this now becomes available and then we could go ahead and create a list of the Control Panel items that we wanted to hide. So I'm gonna go ahead and Cancel because again, we're not actually looking to set anything up here. Just wanna make sure that you understand how to actually configure these administrative template settings. Now one other thing I do wanna show you is how to locate a particular setting. Now this could be because you know of a setting and you just don't know where it is or maybe you're not even sure if a particular setting exists.
Now there's another lesson in this course where I go through and I explain loopback processing and if you happen to watch that lesson, you'll notice that I conveniently jumped to the Computer Configuration, I go down to my Administrative Templates, I expand System, I don't expand, but I click on Group Policy and then once I'm in here, I go ahead and I scroll down and I fairly quickly find the setting for loopback processing. Now you know why I was able to do that? The reason is because I've done this numerous times, but what if I hadn't? What if you're trying to remember, this is your first time, and I had to dig quite deep to find this.
Well there is a way to help you through that process and that would be, if you come down here to All Settings and then you right-click and you go to Filter Options, you have the ability to do a number of different filtering options, but the main one I want you to focus on would be the keyword filter. And then I'm gonna type in the word loopback and click OK and watch what happens. First of all, right here in All Settings, you'll notice there are only two settings that are listed. One of them is Allow Cross-Forest User Policy and Roaming User Profiles, which I'm sure that if I go into it, probably in the description or something like that, the word loopback exists.
But look what the second one is. The second one is the exact setting that we were just looking at a moment ago. Additionally, if I wanted to know where it was located, I can see the path over on the right, but I also can get used to navigating to it by seeing inside Administrative Templates, the only option I now see is System, expand that, Group Policy, if I expand that, there's nothing to expand. If I click on it, there's my two settings. So that kind of tells me where I need to go to find a particular setting. Now in order to undo this so that we can get back to seeing everything and I should point out, by the way, that even on the user side, that filter was still in effect.
So once you turn on the filter, it's for the entire Group Policy Object. But if I right-click on All Settings, and you'll see there's a checkbox for Filter On, if I click on it, that turns the Filter off and everything goes back to normal. So basically, I want you to keep in mind that administrative templates, there are literally tens of thousands of them and so there's a lot of settings and a lot of functionality that you can do here and it gives you a lot of control over creating the perfect environment for your users, so you wanna be familiar with how the administrative template settings work and then also how to either search or locate one if you have something specific you're trying to do.
In this course, author Ed Liberman uses Windows Server 2012 R2 to demonstrate what Group Policy is and how to use it effectively. He shows how to configure Group Policy processing, adjust settings and preferences, and troubleshoot Group Policy problems and conflicts as they arise.
Note: This course maps to the Configure and Manage Group Policy domain for MCSA Exam 70-411, Administering Windows Server 2012.
- Configuring Group Policy processing
- Configuring inheritance blocking and enforced passwords
- Configuring security filtering
- Configuring loopback processing and slow-link processing
- Forcing Group Policy updates
- Adjusting settings and preferences
- Backing up Group Policy objects (GPOs)
- Managing software with Group Policy