Okay.
In this module, we're going to talk about the tools of the trade of group policy management.
And what that really gets down to is the M.C. that I've shown you examples of already.
The GMC is your friend when it comes to managing group policy.
It's really the main tool for doing group policy management and you can do a lot of stuff and group
in PMC.
So we're going to dive into that a little bit in this module.
In order to get the PMC on your desktop machine or server machine, you need to install the Remote Server
Administration Tools package.
It can be installed on Windows Server or desktop as queues.
And it's available depending on which version of Windows you're running.
It's available using different mechanisms.
So on the desktop SKUs like Windows seven and Windows eight or ten.
The rest tools are downloaded from the Microsoft Download site, and there are specific versions for
Windows seven and for Windows eight, and even Windows ten has a different version.
So you need to make sure you get the right version of the SAT it installs as a kind of of a feature
module on that MCU package, an update to the operating system.
And that gives you the ability to get at those features and install or select the PMC.
So I'll show this in a demo.
But once you download and install the feed that doesn't automatically get you PMC on Windows seven or
Windows ten, you actually have to go in and select that feature.
On Server 2008 or two or server 2016 zero or 2022.
RSA is actually a feature that you can add in server manager.
So if you go in under the ad roles and feature section of server manager, you'll be able to add the
RS SAT feature and then explicitly select group policy management as the feature you want to install
in RSA and that essentially installs PMC.
The other thing you can do in PMC is you can manage other domains in forests other than the one that
you've got installed on your Windows desktop or server.
So AMC has this capability to manage multiple domains and even multiple forests.
There is some requirement around this, however.
You need to be trusting of the domain where you're running DMC.
So what this means is you need at least a one way trust from your foreign domain, so to speak.
Or foreign forced to the domain in which you're running.
M.S..
GP M.S. unfortunately doesn't support run.
As for those non trusted domains, like some of the other server administration tools do, and this
can be kind of a pain if you're trying to manage GPOs across untrusted forests, essentially you have
to go to a server or workstation in that untrusted domain and manage it from there.
And if you're going to manage other domains, GPOs from BMC, you need at least read access from those
domains.
And of course, if you're going to edit those domains, other domains, GPOs, you're going to need
right.
Access to those GPOs.
I'm going to talk more about delegation in a subsequent module.
But essentially you need to be able to perform those operations on the foreign domains just like you
would on your current domain.
The other thing you can do in kind of a cross domain fashion is you can link GPOs across domains.
So if you have Domain A and you've defined a GPO in domain A and you've got a domain B that's trusting
by a trusting of domain and has an O you, let's call it the marketing o you.
You can link a GPO from domain A to the o u in domain B and that's absolutely possible.
As a general rule, I tend to avoid it because there are performance implications of doing that.
If when a user logs in or a computer starts up and has to process a group policy, if they have to cross
a trust to read the GPO that's in domain, then it's going to perform a little bit more poorly.
And it depends on network connections and those sorts of things, but it's not generally recommended
unless you absolutely have to do it.
You can also run into more permission issues.
If you're crossing domain boundaries, it becomes.
You have to be a little bit more explicit about how you grant permissions.
That's just something to keep in mind.
I'm going to talk about in module 12, I'm going to talk about other ways of handling cross domain challenges.
We're getting GPOs between domains and specifically around importing domains.
So now let's take a look at some of the stuff on our test system and see how it all works.