1
00:00:03,070 --> 00:00:07,390
Now let's shift gears a little bit and talk about creating and editing GPOs.

2
00:00:08,320 --> 00:00:14,200
So as I sort of alluded to, AMC is again your main tool for creating and deleting GPOs.

3
00:00:15,130 --> 00:00:22,360
Now, when it comes to editing GPOs, what happens is you launch this management editor out of AMC.

4
00:00:23,210 --> 00:00:24,800
And I'll show you that in a bit.

5
00:00:25,700 --> 00:00:27,260
It's a simple process.

6
00:00:28,190 --> 00:00:29,990
But that's really the only way to launch.

7
00:00:29,990 --> 00:00:37,070
The editor against a domain based GPO is to do it out of the PMC management console or PMC.

8
00:00:37,940 --> 00:00:44,030
Now, when it comes to creating a GPO in PMC, there's a couple of ways to do it.

9
00:00:44,960 --> 00:00:50,360
You can either select the group policy objects container and then select new after right clicking it,

10
00:00:51,230 --> 00:00:54,320
or you can right click any container object in the domain.

11
00:00:54,440 --> 00:00:56,720
So a site domain or an O.U.

12
00:00:57,530 --> 00:01:03,020
And then select the option that I've shown you before to create a GPO in this domain and link it here.

13
00:01:03,920 --> 00:01:07,760
So in both of those scenarios, you're creating a new GPO.

14
00:01:08,600 --> 00:01:12,980
In the second scenario, you're creating it and linking it in one operation.

15
00:01:13,880 --> 00:01:19,580
So it'll still be empty because it's a newly created GPO, but it'll also be linked to that whatever

16
00:01:19,580 --> 00:01:21,080
container you're focused on.

17
00:01:21,980 --> 00:01:28,670
So editing GPOs are really a simple matter of right clicking the GPO, and you can do this from either

18
00:01:28,670 --> 00:01:35,060
the link as it appears under a container object or under the group policy objects folder.

19
00:01:36,010 --> 00:01:37,320
So you right click it.

20
00:01:38,260 --> 00:01:44,560
Select the very first option which is edit and it does presume that you have edit permissions on that

21
00:01:44,560 --> 00:01:45,370
GPO.

22
00:01:46,210 --> 00:01:51,490
I'm going to go into the delegation parts of group policy management in a little bit later in a future

23
00:01:51,490 --> 00:01:52,090
module.

24
00:01:52,990 --> 00:01:54,220
But essentially.

25
00:01:55,130 --> 00:02:00,530
Assuming that you actually have edit writes on a GPO which usually are granted to the domain admins

26
00:02:00,530 --> 00:02:06,650
group members of the domain admins group members of group policy container owner I'm sorry, group policy

27
00:02:06,650 --> 00:02:08,930
creator owners and enterprise admins.

28
00:02:09,860 --> 00:02:15,140
So those three groups, if you're in one of those, you'll have better defaults on the domain GPOs by

29
00:02:15,140 --> 00:02:15,710
default.

30
00:02:16,660 --> 00:02:17,230
So right.

31
00:02:17,230 --> 00:02:18,400
Clicking and editing.

32
00:02:18,400 --> 00:02:19,750
Pretty straightforward.

33
00:02:20,620 --> 00:02:27,430
Now adding a comment to a GPO I showed you in the previous section how you can display comments from

34
00:02:27,430 --> 00:02:31,990
the details tab of a GPO, you actually can add the comment.

35
00:02:31,990 --> 00:02:33,750
And the only way to add the comment?

36
00:02:33,760 --> 00:02:35,320
Well, there's two ways.

37
00:02:36,190 --> 00:02:43,120
One is from the editor and the other is from PowerShell, which is the Microsoft scripting language.

38
00:02:44,020 --> 00:02:49,030
And much later in this course, I'll be going over how you can use PowerShell to perform various group

39
00:02:49,030 --> 00:02:50,590
policy management tasks.

40
00:02:51,460 --> 00:02:57,070
But in any case, the way you typically do this is if you're an editor, you right click on the GPO

41
00:02:57,070 --> 00:03:01,180
name in the left hand pane where the GPO name applies or where it shows up.

42
00:03:02,050 --> 00:03:06,970
Choose properties and then select the comment tab as you see in the screenshot and then you can type

43
00:03:06,970 --> 00:03:08,530
freeform text into this.

44
00:03:09,460 --> 00:03:12,340
Now I tend to like to put a little structure behind it.

45
00:03:13,240 --> 00:03:17,890
I'll use the comment field to put in dates and times of when I made a change and what the change was

46
00:03:17,890 --> 00:03:23,890
for, and usually sign the change with my name so that people know who come along to this GPO.

47
00:03:24,100 --> 00:03:26,020
What's been going on on this GPO?

48
00:03:26,860 --> 00:03:32,200
It's kind of a poor man's change control system, but it works just fine for a lot of situations.