Group Policy Editor

Yoni · October 06, 2003, 06:18 PM

This is a very neat MMC snap-in that I didn't know about until today:

Start -> Run -> gpedit.msc

Many UI tweaks, and more.

[Edit: Thread title]

Skywing · October 06, 2003, 06:46 PM

Quote from: Yoni on October 06, 2003, 06:18 PM
This is a very neat MMC snap-in that I didn't know about until today:

Start -> Run -> gpedit.msc

Many UI tweaks, and more.

<correction>Note that it's group policy and not global policy.</correction>

Group Policy is one of the major benefits of domains and Active Directory, since you can setup a policy that is automatically distributed and applied to all member computers or member domain controllers.

You can use this to, for instance, ensure all computers on the domain don't allow anonymous enumeration of SAM accounts. Simply put, you only need to configure something in one place (e.g. the domain controller) and it will automatically be applied to all member computers. Very handy for large networks.

j0k3r · October 06, 2003, 06:56 PM

Skywing, do you spend your freetime reading a dictionary definition book? You seem to know EVERYTHING lol.

Yoni · October 06, 2003, 07:22 PM

I don't know anything about active directories or domains yet. My network consists of 2-3 computers (one of which is insecure by definition, but cannot accept network connections so I don't mind).

Maybe I'll study them and set one up sometime in the future for educational purposes...

gpedit.msc has cool things regardless of whether they're used for domain purposes or not, though.

Grok · October 06, 2003, 10:02 PM

The MSDN Subscription has a CD in it titled "Enterprise Group Policy Manager (Beta)" or something like that. I saw it today while browsing through the CDs. If someone's really interested, I'll get the help file from it and you can decide if it's something you want.

Arta · October 07, 2003, 05:15 AM

Speaking of gpedit:

I need to set up automatic updates client using my SUS server on a WinXP Home machine. It has no group policy editor (Home edition == poo), so I can't set the autoupdate server location key. Anyone know of a workaround?

Adron · October 07, 2003, 11:37 AM

Presumably it's just a registry key you have to know where it is? You could also try adding the group policy snap-in with mmc on the machine, if that works.

Arta · October 07, 2003, 06:08 PM

Tried that, it doesn't. I googled for the registry key with no success.

Yoni · October 07, 2003, 06:29 PM

[quick hack] Add a hosts file entry <your SUS IP> windowsupdate.microsoft.com ?

Better solution: XP Home sux... Use something better? 2000 is good, XP Pro is tolerable.

Skywing · October 07, 2003, 06:31 PM

Quote from: Yoni on October 07, 2003, 06:29 PM
[quick hack] Add a hosts file entry <your SUS IP> windowsupdate.microsoft.com ?

Better solution: XP Home sux... Use something better? 2000 is good, XP Pro is tolerable.

I don't think the SUS interface is the same as regular Windows Update.

Arta · October 08, 2003, 08:33 AM

Yeah, it's not. This isn't my machine to reinstalling just for SUS would probably not be welcomed - and it's overkill anyway, really. I'll use regmon or something to see which key gpedit changes.