Okay.
Now I am on a Windows client machine and I'm going to walk through the process of getting the GMP PC
installed on both a client operating system like Win7 or Wind ten and a server operating system.
So the assumption is that you've gone ahead and gone to the Microsoft Download site.
And in this case, I did a search on RSA.
And you'll see here that the first entry is Remote Server Administration Tools for Windows Client.
I'm going to go ahead and I've already installed this.
But if you were to go ahead and click this and run this install, it will perform a feature upgrade
and add the remote server administration tools now once they're added.
As I mentioned in my previous clip, the pmc's not actually installed yet.
It needs to be added.
So what you do is come into the ADD, remove programs, control panel applet and go to turn Windows
features on or off.
And keep in mind, this is the same for both Windows seven or Windows ten.
So it they both work basically the same way.
And once that comes up, what we're going to do is drill into the feature administration tools and.
Okay.
So now we've got feature administration tools under remote server administration tools and in featured
administration tools.
You'll see here the group policy management tools are checked.
Normally this would be unchecked.
Right after you install the resets, you would come in here and check this and it would make the change
and add PMC to your system so you'd be good to go and you can just come to your command prompt and type
PMC Dot MSI, or you can go to administrative tools that actually aren't on the start menu.
But if you had administrative tools in the start menu, you could see group policy management.
That's one of the options.
Now, if we shift gears to a server 2012 box, if I'm in server manager, which is sort of the, you
know, the configuration dashboard for Windows Server as of 2008 or two and come in under management,
add roles and features.
Click next.
Click next, click through the server roles.
And once you get into features, you'll see group policy management as an option.
Now this is an Active Directory domain controller and PMC gets installed by default when you promote
an Active Directory domain controller.
If this were just a member server, you could come down to this feature list and just click on group
policy management and you would get that the PMC installed.
So that's really all it takes to get PMC on your systems for managing group policy.
You know, in terms of which is which platform is better to manage group policy.
I know a lot of it.
Shops that don't like administrators logging into servers.
So there's a tend tends to be a preference of installing end and doing group policy management from
a desktop SKU like Windows seven or Windows ten.
I think it really just depends on your own best practices.
I don't think one is better than the other.
Some folks like to have all of their admin tools on their server box and they'll use that as kind of
the place to go to do administration.
I think that's perfectly reasonable if your policies allow that.
So let's shift gears and talk a little bit about the cross domain stuff that I had mentioned.
So PMC, as I mentioned, has the support for cross domain management.
And what you can see here is that I've got the the forest that I am currently installed in is there
to test scuttled.
Okay.
So what I am going to do is right click on the group policy management node on the top there.
Select that forest.
And I've got the name of a forest that I'm trusted with here called Steam Test Dot Net.
And as you can see, it adds the forest.
And then I have the ability to browse its GPOs, its own use and manage it just as I would manage the
my own domain in forest.
I'll also mention that if you click on the domains node and say show domains, if you are in a multi-domain
forest, you could selectively show or hide domains in that forest using this dialogue.
So there is a lot of options here in terms of managing multiple domains.
And again, you have to have permissions to be able to edit domains on this foreign forest.
You'll note the edit option is blanked out in in this for this particular GPO.
And that's because even though I can read the GPOs and read the ad structure in steam test dot net.
I cannot actually write to or edit those GPOs unless I'm explicitly given permissions to do so in that
domain.
So that's just a something to keep in mind as you're managing, you know, remote domains through PMC.
And again, remember, the PMC requires those trusts.
It doesn't support this notion of a run as like some of the other Active Directory related tools do.
So you need to have trust to all the domains that you're managing in order to actually read, end and
potentially write to those GPOs.