Now let's shift gears a little bit and talk about creating and editing GPOs.
So as I sort of alluded to, AMC is again your main tool for creating and deleting GPOs.
Now, when it comes to editing GPOs, what happens is you launch this management editor out of AMC.
And I'll show you that in a bit.
It's a simple process.
But that's really the only way to launch.
The editor against a domain based GPO is to do it out of the PMC management console or PMC.
Now, when it comes to creating a GPO in PMC, there's a couple of ways to do it.
You can either select the group policy objects container and then select new after right clicking it,
or you can right click any container object in the domain.
So a site domain or an O.U.
And then select the option that I've shown you before to create a GPO in this domain and link it here.
So in both of those scenarios, you're creating a new GPO.
In the second scenario, you're creating it and linking it in one operation.
So it'll still be empty because it's a newly created GPO, but it'll also be linked to that whatever
container you're focused on.
So editing GPOs are really a simple matter of right clicking the GPO, and you can do this from either
the link as it appears under a container object or under the group policy objects folder.
So you right click it.
Select the very first option which is edit and it does presume that you have edit permissions on that
GPO.
I'm going to go into the delegation parts of group policy management in a little bit later in a future
module.
But essentially.
Assuming that you actually have edit writes on a GPO which usually are granted to the domain admins
group members of the domain admins group members of group policy container owner I'm sorry, group policy
creator owners and enterprise admins.
So those three groups, if you're in one of those, you'll have better defaults on the domain GPOs by
default.
So right.
Clicking and editing.
Pretty straightforward.
Now adding a comment to a GPO I showed you in the previous section how you can display comments from
the details tab of a GPO, you actually can add the comment.
And the only way to add the comment?
Well, there's two ways.
One is from the editor and the other is from PowerShell, which is the Microsoft scripting language.
And much later in this course, I'll be going over how you can use PowerShell to perform various group
policy management tasks.
But in any case, the way you typically do this is if you're an editor, you right click on the GPO
name in the left hand pane where the GPO name applies or where it shows up.
Choose properties and then select the comment tab as you see in the screenshot and then you can type
freeform text into this.
Now I tend to like to put a little structure behind it.
I'll use the comment field to put in dates and times of when I made a change and what the change was
for, and usually sign the change with my name so that people know who come along to this GPO.
What's been going on on this GPO?
It's kind of a poor man's change control system, but it works just fine for a lot of situations.