Using GPOs to Configure and Tune Desktops
Upcoming SlideShare
Loading in...5
×
 

Using GPOs to Configure and Tune Desktops

on

  • 5,105 views

Ron Oglesby's presentation from Briforum Chicago 2011 on "Using GPOs to Configure and Tune Desktops"

Ron Oglesby's presentation from Briforum Chicago 2011 on "Using GPOs to Configure and Tune Desktops"

Statistics

Views

Total Views
5,105
Views on SlideShare
3,659
Embed Views
1,446

Actions

Likes
0
Downloads
47
Comments
0

6 Embeds 1,446

http://www.unidesk.com 1421
http://feeds.feedburner.com 11
http://data.unidesk.com 7
http://chris.dev.unidesk.com 4
http://blog.unidesk.com 2
http://www.google.com 1

Accessibility

Categories

Upload Details

Uploaded via as Microsoft PowerPoint

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment

Using GPOs to Configure and Tune Desktops Using GPOs to Configure and Tune Desktops Presentation Transcript

  • Using GPOs to Configure and Tune Desktops
    Living without Registry ‘Hacks’
    Ron Oglesby @RonOglesby
    NOT A UNIDESK COMMERCIAL
  • Gabe asked about golf carts
    Copyright © 2010 Unidesk Corporation. All Rights Reserved. www.unidesk.com
  • Agenda
    Why use GPOs?
    Policy Basics
    Policies Vs Preferences
    Desktop Configurations
    ADMs and ADMX/ADMLs
    Tools you can use as venture into GPOs
  • Why do we hack the registry
    Tune the OS
    Set defaults
    Hide things from users
    Others…
    But is a hack a policy?
    Policies can be used for more than just registry changes
  • Why use GPOs and Not Reg hacks???
    Documentation….
    How do to remove this spoiler?
    Without opening the trunk?
  • What do GPOs TYPICALLY get used for?
    Windows Settings like folder redirection
    Hiding icons and Windows options
    Configuring browser settings
    Setting permissions? Sometimes
    Configuring Office or other app settings…
    Adding Users.. Occasionally.
  • Login Times and the default profile????
    Copyright © 2010 Unidesk Corporation. All Rights Reserved. www.unidesk.com
  • Common tasks in tuning the VDI image?
    Add and modify local security accounts (at times)
    Disable / reconfigure Services
    Tune the local OS parameters
    File System, desktop display, TCP parameters, etc, etc
    Tune the user profile (like Menu show delay)
    Configure applications (like IE)
    Sometimes even create folders and move items like tools into the image
    Copyright © 2010 Unidesk Corporation. All Rights Reserved. www.unidesk.com
  • Policy Basics
    GPO Processing and Trigger events
    GPUPDATE /FORCE
  • Policy Basics
    Computer Configvs User Config
    Copyright © 2010 Unidesk Corporation. All Rights Reserved. www.unidesk.com
  • Policy Basics
    Policy Vs Preferences…..
    Copyright © 2010 Unidesk Corporation. All Rights Reserved. www.unidesk.com
  • Policy Basics
    Preferences added in Win 2008
    Allow for SIMPLE config of numerous settings
    No Templates needed!
    Copyright © 2010 Unidesk Corporation. All Rights Reserved. www.unidesk.com
  • Policy Templates
    Traditionally known as Policy ADMs (ADMX now)
    Set the options you see in the GPOs
    Often created by the App vendors or industrious System Engineers
  • ADM files are TXT files
    CLASS xxx - User or Machine
    CATEGORY xxx - Major heading. “Windows Update”
    KEYNAME xxx “SoftwareMicrosoftOffice12.0Oulook”
    Policy xxx - name of Policy shown in GPO editor
    VALUENAME xxx - Registry entry we are changing
    END POLICY
    END CATEGORY
  • ADM file Example
    CLASS MACHINE
    CATEGORY !!Reader
    POLICY !!Checkforupdatesatstart
    KEYNAME "SoftwareAdobeAcrobat Reader9.0AVGeneral"
    EXPLAIN !!Checkforupdatesatstart_Help
    VALUENAME "bCheckForUpdatesAtStartup"
    VALUEON NUMERIC 1
    VALUEOFF NUMERIC 0
    END POLICY
    END CATEGORY
  • ADM vs ADMX
    ADMX are the ‘new’ ADM
    XML based
    Policies/operative section of the policy are contained in ADMX
    ADML are language specific files
    Not stored in individual policies, can be stored in 1 central location in enterprise environments
    Will (by default) supersede existing ADM files (Inetres.adm, system.adm, etc) or can be created to supersede and existing ADM
    Copyright © 2010 Unidesk Corporation. All Rights Reserved. www.unidesk.com
  • ADMX file sample comparison
    <categories>
    <category name="Reader" displayName="$(string.Reader)" />
    </categories>
    <policies>
    <policy name="Checkforupdatesatstart" class="Machine" displayName="$(string.Checkforupdatesatstart)" explainText="$(string.Checkforupdatesatstart_Help)" presentation="$(presentation.Checkforupdatesatstart)" key="SoftwareAdobeAcrobat Reader9.0AVGeneral" valueName="bCheckForUpdatesAtStartup">
    <parentCategory ref="Reader" />
    <supportedOn ref="SUPPORTED_NotSpecified" />
    <enabledValue>
    <decimal value="1" />
    </enabledValue>
    <disabledValue>
    <decimal value="0" />
    </disabledValue>
    </policy>
    Group Policy Samples from Microsoft:
    http://www.microsoft.com/downloads/en/details.aspx?FamilyId=3D7975FF-1242-4C94-93D3-B3091067071A&displaylang=en
    Copyright © 2010 Unidesk Corporation. All Rights Reserved. www.unidesk.com
  • ADM file Example
    CLASS MACHINE
    CATEGORY !!Reader
    POLICY !!Checkforupdatesatstart
    KEYNAME "SoftwareAdobeAcrobat Reader9.0AVGeneral"
    EXPLAIN !!Checkforupdatesatstart_Help
    VALUENAME "bCheckForUpdatesAtStartup"
    VALUEON NUMERIC 1
    VALUEOFF NUMERIC 0
    END POLICY
    END CATEGORY
    Copyright © 2010 Unidesk Corporation. All Rights Reserved. www.unidesk.com
  • Building your own?
    Start with ADM files if you haven’t already.
    Then convert them w/ the ADM to ADMX converter
    The hardest part is not building the text file….
    Its finding the registry keys
  • Ron’s rules for Policies Vs Preferences…
    When to use a policy
    Something that the usermay have access to but I don’t want them to change
    IE security, connectivity, or application settings
    When to use a preference
    When I set a default setting that they may change
    IE default start page or default short cuts on the desktop
    When I want to change a registry setting that they do not have a GUI to change
    Default user screen saver, machine settings like NTFS last access time stamp, etc.
  • Policy Preference Options
    Create
    Create the object (reg entry, drive mapping, etc, etc)
    Will do nothing if the entry/object already exists
    Replace
    Delete existing setting (if exist) and create a new object
    Update
    Modification of an existing object
    Will create if it does not exist
    Delete
  • Preference Common Settings
    Copyright © 2010 Unidesk Corporation. All Rights Reserved. www.unidesk.com
  • Preference WARNINGS
    These are like defaults NOT Policies….
    These can tattoo the machine
    Newer policies do not tattoo.
    That was a benefit of getting away from some of the old school NT type policies
    Registry changes made via Preferences can leave a tattoo after removal of policy UNLESS you counter/remove the VM from having the policy apply.
    Other changes (Directories, User/group modifications or additions) also stick
    Preferences are basically like your image “HACK” but with management….
  • So let’s look at how you can do this in a Policy
    Copyright © 2010 Unidesk Corporation. All Rights Reserved. www.unidesk.com
  • Windows 7 Services Examples
    Desktop Window Manager Session manager
    Disk Defragmenter
    Diagnostic Policy Services
    IP helper (if no IPv6)
    Security Center
    Superfetch
    Themes Service (classic interface)
    Windows Defender
    Windows Search
    Windows Update
    http://www.vmware.com/files/pdf/VMware-View-OptimizationGuideWindows7-EN.pdf
  • Demo
    Copyright © 2010 Unidesk Corporation. All Rights Reserved. www.unidesk.com
  • Windows Settings Examples
    Recycle Bin – Do not move files to recycle bin
    Screen saver (XP disable .default screen saver, Win7 Blank)
    Disable System Restore
    UAC settings
    Windows Update disabled
    Tune the file system (last access time stamp, 8.3 file names, etc)
    Remove Tablet PC components (or disable services)
    Project VRC Phase III – www.projectvrc.nl
    Copyright © 2010 Unidesk Corporation. All Rights Reserved. www.unidesk.com
  • Demo
    Copyright © 2010 Unidesk Corporation. All Rights Reserved. www.unidesk.com
  • User Tuning?
    Focus on HKCU
    IE and other application settings
    Graphics/video settings
    Customer templates are out there and checkout PolicyPak.com
    Copyright © 2010 Unidesk Corporation. All Rights Reserved. www.unidesk.com
  • Demo
    Copyright © 2010 Unidesk Corporation. All Rights Reserved. www.unidesk.com
  • Finding the Registry Entry
    GOOGLE http://lmgtfy.com/
    RegSnap/Registry Monitoring Tools
    Good old fashion digging and guessing!
    My Favorite:SysTracerhttp://www.blueproject.ro/systracer
  • You didn’t convince me Ron!
    Windows Enabler
    http://www.bluemoonpcrepair.com/wp/?p=39
    http://www.wincert.net/tips/microsoft-windows/windows-7/2109-how-to-copy-a-user-profile-on-windows-7.html
    Pierre’s VUEM - VirtuAllUser Environment Manager
    http://www.virtualdesktops.info/Products.aspx
    Login scripts, User configs, Printer configs, registry values, Port mapping, and File and folder operations.
    Copyright © 2010 Unidesk Corporation. All Rights Reserved. www.unidesk.com
  • Where to start?
    GPAnswers.com http://www.gpanswers.com/resources/gp-tips-and-tricks.html
    PolicyPak.com http://policypak.com/
    Off 2007 Policy Templates
    http://www.microsoft.com/downloads/en/details.aspx?FamilyID=92d8519a-e143-4aee-8f7a-e4bbaeba13e7&displaylang=en
    Off 2010 Policy Templates
    http://www.microsoft.com/downloads/en/details.aspx?FamilyID=64B837B6-0AA0-4C07-BC34-BEC3990A7956&displaylang=en
    Using GPOs to Customize XenApp
    http://support.citrix.com/proddocs/index.jsp?topic=/online-plugin-110-windows/ica-import-icaclient-template-v2.html
    IE 9 Preferences not working?
    http://blogs.technet.com/b/asiasupp/archive/2011/03/30/internet-explorer-9-ie9-group-policy-preferences-gpp.aspx
    XenApp Blog’s XenApp and XenDesktop Policies
    http://www.xenappblog.com/downloads/
  • ADM/Xs and Policy references?
    Microsoft ADM to AMDX migrator?
    http://www.microsoft.com/downloads/en/details.aspx?FamilyID=0F1EEC3D-10C4-4B5F-9625-97C2F731090C
    Group Policy Settings References from MS?
    http://www.microsoft.com/downloads/en/details.aspx?FamilyID=18c90c80-8b0a-4906-a4f5-ff24cc2030fb
    Group Policy ADMX Syntax Guide:
    http://technet.microsoft.com/en-us/library/cc753471(WS.10).aspx
    Group Policy Survival Guide
    http://technet.microsoft.com/en-us/library/cc754151(WS.10).aspx
    Managing with ADMX files
    http://technet.microsoft.com/en-us/library/cc709647(WS.10).aspx
  • Q&AOpen Discussion
    Ron Oglesby
    ron.unidesk.com
    Twitter: @ronoglesby