1 00:00:03,070 --> 00:00:05,770 So now I'm going to review what we just talked about. 2 00:00:05,980 --> 00:00:07,420 Just so it's crystal clear. 3 00:00:08,320 --> 00:00:12,340 Let's see the GPO that we're focused on right now. 4 00:00:12,370 --> 00:00:14,410 Default domain controllers policy. 5 00:00:14,440 --> 00:00:19,990 Oh, by the way, if I click into this, I can change the name of this GPO just as soon as I type in 6 00:00:19,990 --> 00:00:20,710 a new value. 7 00:00:21,590 --> 00:00:23,450 So just be aware of that. 8 00:00:24,350 --> 00:00:27,980 It's easy to change the name of a GPO in the PMC. 9 00:00:28,870 --> 00:00:34,000 There's really no downside to doing it because everything that clients care about in terms of processing 10 00:00:34,000 --> 00:00:38,830 GPO is tied to that quid, which is a good segway into talking about the Details tab. 11 00:00:39,640 --> 00:00:43,570 The Details Tab provides a bunch of information about this GPO. 12 00:00:43,780 --> 00:00:46,390 What I called in my previous section, the metadata. 13 00:00:47,320 --> 00:00:49,720 So here's the guide of the GPO. 14 00:00:49,840 --> 00:00:54,970 This is the unique identifier that never changes, regardless of what the name of the GPO might be. 15 00:00:55,900 --> 00:00:59,650 So this value is always constant through the life of the GPO. 16 00:01:00,490 --> 00:01:06,820 And in fact, the two GPOs that Windows creates when you first promote an Active Directory domain controller 17 00:01:06,820 --> 00:01:11,910 into a new domain are the default domain controllers policy and the default domain policy. 18 00:01:12,760 --> 00:01:14,470 And they always have the same quid. 19 00:01:14,590 --> 00:01:19,720 So the quid that you see will be the same for the default domain controllers policy in this domain or 20 00:01:19,720 --> 00:01:22,090 any other domain running Active Directory. 21 00:01:22,990 --> 00:01:27,970 Now the version information I mentioned briefly in my previous discussion and what this relates to is 22 00:01:27,970 --> 00:01:31,600 it tells you how many changes have been applied to each side of the GPO. 23 00:01:32,410 --> 00:01:35,890 And the number that you're interested in is really the, the numeric value. 24 00:01:35,920 --> 00:01:40,870 The fact that it shows the ad side and the system side is something that will get into a little on in 25 00:01:40,870 --> 00:01:41,500 this course. 26 00:01:42,370 --> 00:01:46,630 But essentially Active Directory GPOs are really in two parts. 27 00:01:47,530 --> 00:01:51,130 One part is in the ad and the other part is in system all. 28 00:01:52,020 --> 00:01:55,650 And the system all replicates those around just as aid does. 29 00:01:56,520 --> 00:02:01,410 And so this is telling you that there's a version number kept on the system, all part of the GPO and 30 00:02:01,410 --> 00:02:03,540 a version number kept on the aid part. 31 00:02:04,430 --> 00:02:07,370 And those are in sync, which is what you want to see. 32 00:02:08,270 --> 00:02:10,820 You want to see these both being the same number. 33 00:02:11,750 --> 00:02:12,560 In this case. 34 00:02:12,560 --> 00:02:17,870 On the computer side, you can see that one change was made to the computer side of this GPO and that 35 00:02:17,870 --> 00:02:21,650 it exists as number one or version number one in ad and sizzle. 36 00:02:22,490 --> 00:02:25,090 And then of course, we've got last modified date. 37 00:02:26,000 --> 00:02:31,220 This tells you when the last time a change was made to the GPO and the date the GPL was created. 38 00:02:32,120 --> 00:02:33,290 The owner information. 39 00:02:33,290 --> 00:02:38,300 This gets populated automatically by whichever user or group has created this GPO. 40 00:02:38,300 --> 00:02:39,890 So it's pretty straightforward. 41 00:02:40,730 --> 00:02:42,730 And typically you don't change that. 42 00:02:42,830 --> 00:02:44,810 You don't go in and change the owner. 43 00:02:45,760 --> 00:02:50,080 There's there's no real reason to under the scope tab. 44 00:02:50,140 --> 00:02:53,560 Remember that I said that we list the links that this GPO has. 45 00:02:54,520 --> 00:02:57,590 So in this case, it's linked to the domain controllers. 46 00:02:57,610 --> 00:02:58,240 Oh, you. 47 00:02:59,080 --> 00:03:02,500 The link is enforced or not enforced, and the link is enabled. 48 00:03:03,380 --> 00:03:06,000 And this is the path, the full path to that. 49 00:03:06,030 --> 00:03:09,350 Oh, you remember when I talked about Enforced? 50 00:03:09,530 --> 00:03:14,600 That means that this link is not forcing down these settings on this O.U. 51 00:03:14,600 --> 00:03:16,700 And anything underneath this O.U. 52 00:03:17,570 --> 00:03:21,590 So if I right click this, I could very easily set this to enforce. 53 00:03:22,500 --> 00:03:24,390 I can also disable a link. 54 00:03:25,290 --> 00:03:28,020 This is not quite the same as deleting a link. 55 00:03:28,930 --> 00:03:32,990 So if I disable a link effectively the GPO is ignored. 56 00:03:33,100 --> 00:03:34,660 That's linked to this container. 57 00:03:35,550 --> 00:03:39,510 But it's not completely gone as if I were deleting it so I can come back in. 58 00:03:40,410 --> 00:03:46,950 Let's say I want to test something and I don't want this GPIO to take effect on the domain controllers. 59 00:03:46,960 --> 00:03:47,580 Oh, you. 60 00:03:48,480 --> 00:03:53,880 I can temporarily check this box to disable that link and then come back in later and enable it again. 61 00:03:54,780 --> 00:03:59,850 So it's a simple matter of sort of temporarily turning off the GPO on this container. 62 00:04:00,730 --> 00:04:02,980 Again, the security filtering. 63 00:04:03,860 --> 00:04:06,440 I talked about this in a previous module. 64 00:04:07,320 --> 00:04:13,920 But this is showing what security filters are on this GPO and what WMI filters are. 65 00:04:13,920 --> 00:04:21,690 Link to this GPO remembering again that only one WMI filter can be linked to a GPO at a time. 66 00:04:22,530 --> 00:04:24,810 And then finally, the Settings report. 67 00:04:25,720 --> 00:04:30,880 Again, this is the report that shows you all of the settings that are applied or that are defined within 68 00:04:30,880 --> 00:04:36,770 this GPO and it shows them in sort of that hierarchical format that you would see in GP. 69 00:04:36,920 --> 00:04:42,400 ED So you can drill in and look at whichever policy area you're interested in. 70 00:04:43,300 --> 00:04:48,610 This one only has computer side settings, but if this were another GPL with the user side settings, 71 00:04:48,820 --> 00:04:50,980 they would be listed here just like they are here. 72 00:04:51,860 --> 00:04:54,530 And as I mentioned, you can right click on this. 73 00:04:55,460 --> 00:05:01,940 You can edit the GPO, you can print this HTML report or you can save the report. 74 00:05:02,810 --> 00:05:09,200 And it gives you an option of saving it to either HTML or XML, depending on what you're trying to accomplish. 75 00:05:10,100 --> 00:05:16,760 In most cases, if you save it as HTML, then you can publish it as a HTML file on a Web site if you 76 00:05:16,760 --> 00:05:17,420 wanted to. 77 00:05:18,230 --> 00:05:26,360 Now you'll remember that I also mentioned this View Options menu in the PMC, and let's just go through 78 00:05:26,360 --> 00:05:27,140 that quickly. 79 00:05:28,040 --> 00:05:33,560 So I've got I can do some control of what is displayed in each of the different views within the group 80 00:05:33,560 --> 00:05:35,180 policy management console. 81 00:05:36,070 --> 00:05:39,100 I can also make some changes to how reporting is done. 82 00:05:40,000 --> 00:05:43,030 This first option relates to the old dot Adam files. 83 00:05:43,210 --> 00:05:46,450 These are the admin template files that preceded Adam X. 84 00:05:47,350 --> 00:05:52,660 Normally they're going to look in the default local folder, then insist, well, for these Adam files, 85 00:05:53,560 --> 00:06:00,280 the Adam files are used during reporting to resolve registry values to their friendly names as they 86 00:06:00,280 --> 00:06:01,780 appear in editor. 87 00:06:02,660 --> 00:06:04,210 You can also have the option. 88 00:06:04,220 --> 00:06:09,230 I haven't talked about having administrative template comments, but there is the facility to actually 89 00:06:09,230 --> 00:06:13,940 put comments within only within administrative template settings. 90 00:06:14,870 --> 00:06:20,510 So you can go ahead and view those in the PMC settings reports if you wanted to using this checkbox 91 00:06:20,510 --> 00:06:20,870 here. 92 00:06:21,730 --> 00:06:28,120 And then again, going back to the general tab, this is where I showed you some of these options for 93 00:06:28,120 --> 00:06:34,600 showing domain controllers, showing confirmation of the distinction between links and GPOs. 94 00:06:35,510 --> 00:06:39,530 I'm just going to go ahead and check this one here so you can kind of see what happens. 95 00:06:40,460 --> 00:06:45,680 So you'll notice here that the display changed and now it's showing me which DC I'm focused on within 96 00:06:45,890 --> 00:06:46,640 PMC. 97 00:06:47,540 --> 00:06:52,670 This is useful if you have a large number of DCS and you want to change DCS that you're focused on, 98 00:06:52,670 --> 00:06:55,280 or at least see what you're focused on at any given time. 99 00:06:56,150 --> 00:06:59,810 I can actually change it by going here and saying, change domain controller. 100 00:06:59,810 --> 00:07:01,550 And in this domain I only have one. 101 00:07:01,550 --> 00:07:07,400 DC but if there are other DC in this domain, I could pick one, choose this and pick that. 102 00:07:07,400 --> 00:07:10,400 DC And I would be focused on that other DC. 103 00:07:11,250 --> 00:07:16,230 And that would mean that any edits that I did to GPOs or any reporting I did were done against that 104 00:07:16,230 --> 00:07:17,100 other DC.