Advanced Group Policy Management - On privileges and roles.

-

hello!

we rolling out agpm (vlatest).  seems work enough.

we have more 1 set of standard permissions.  for example, our citrix team controls gpos citrix, our desktop team controls gpos desktops, etc.

is there no way delineate in agpm?

  • my first thought use powershell rapidly set, , regularly audit , auto-correct these privileges.  true group policy form, there limited powershell support - in case, none @ all.
  • my second thought templates might include agpm roles.  so 'group x has privileges template a,' 'group y , z have privileges template b,' , forth.  when create template, include permissions.  nope.

i'm opening access, might tough sell.  am 1 has disparate security boundaries around group policies?  am overlooking solution this?

thanks!

rcm

hi all,

my apologies if common knowledge or available somewhere, can't seem find it.

looking understand how agpm works.

  • if 'import from...' production, or 'control' gpo.  which domain controller agpm select from?  does behave gpmc , use pdc emulator?  does pick site agpm server resides on?
  • same question when deploy gpo.  which domain controller deploy to?

i ask because when edit policy, see domain controller isn't pdc emulator.  this makes sense given aren't editing production gpo, curious see what's going on behind scenes.  i'm assuming there isn't way 'deploy specific domain controller'.

also, going bring in every agpm post make; powershell support agpm?  does exist?  this poor showing, , limiting...

thanks!



Windows Server  >  Group Policy



Comments

Post a Comment

Popular posts from this blog

List Styles

-
in word 2010, defined new list style called “custom1′ “new docs based on template” instead of “this doc only.” heading 1, 2, 3, etc. appear linked within document. document create list style called “custom2′ , choose make available “new docs based on template” , also link them heading styles. though both list styles show available new docs, 1 of list styles (the last 1 used) linked heading styles. in word's default list library, multiple multi-level lists appear be linked heading styles. not able link heading styles multiple custom list styles? a particular list style can have 1 set of paragraph styles associated (one style each numbering level). the list formats in so-called list library behave differently, have noticed. similar predefined formats in bullets , numbering dialog box of word 97-2003. stefan blom, microsoft word mvp ...
Read more

DA client not sending packets - no IPSec?

-
this da server / client environment built in hyper-v mix of virtual , real networks. remote da client uses teredo , iphttps. can ping directaccess (dns servers) listed in nrpt, can ping internal statically configured native ipv6 addresses of internal resources, (2001:480:664a:e::/64) can ping nat64&dns64 addresses assigned da server internal ipv4 resources. (2001:480:664a:e:b733::/96) real dmz network, when attempts ping fqdn of server ipv address proven pingable, there no packet sent out nic (wireshark, promiscuous scanning).  message 'ping request not find host bobbysox.tidir.bctest.. please check name , try again.' again, da & internal dns servers still pingable remote client. if remote da client part of virtual dmz network, boots , communicates da server slew of isakmp messages before establishing ipsec , using esp. same addressing scheme, , connecting da client , external interface of da server real dmz network, ipsec never established, thou...
Read more

DFS Replication Setup Issue

-
i have windows 2008 r2 server environment.  forest , domain set windows 2008.  2 file servers windows 2008r2.  have created name space in domain , have 2 folder targerts on 2 file servers. when try configure replication error "the folloing folder targets cannot added dfs replication members.  click details more information." details: \\ servername \ sharename domain \ servername$ : windows nt 4.0 account name cannot converted qualifies distinguisedname on server.domain.local.  the name returned error. i have tried adding different share , adding folder targets fqdn , netbios name , same error.  can't seem find anyything in searches lead me fixing issue.  there nothing in event log.  cannot replication diagnostic since option not there in dfs managment. hi, as dfs namespace new created, can test recreate dfsr database see if help. you can stop , disable dfsr service on,  go <drive letter>:\sys...
Read more