Okay.
Now I want to talk since we've kind of laid the groundwork on what administrative templates can do.
I want to talk about how you can deploy them or strategies for deploying them to get the best out of
them.
So, you know, if you're faced with kind of a blank slate, you've got thousands of these admin templates
settings in the box it's shipped by Microsoft via admin X files.
Where do you start?
Well, you know, there's a couple places that I typically recommend to folks.
I mean, typically, you know, what you want to lock down in your organization and at least at a high
level, you understand, you know, that you care about things like i.e. you might want to prevent the
user from doing certain things on their desktop.
Like running registry ed or running the command shell.
You have a high level idea about what you want.
The Microsoft provides a settings spreadsheet you can download from the Microsoft site.
That is a kind of handy way of listing all of the available admin templates settings that ship in the
box for each version of Windows as it's released.
And there's also a neat application online at this u r l search dot azure websites, dot net where you
can do a keyword search on admin templates, settings and find.
Let's say you wanted to find a setting for media player.
You can just type in media player and it will return all of the admin template settings that have that
in their explain text or in the description.
And so it's a great way of finding settings.
I think discoverability in those thousands of settings is a big challenge.
So that provides kind of a starting point for you.
And then when it comes time to deploying those settings, what I like to do is.
I mentioned earlier around not having one setting per show or at least not going to town on that idea
and having hundreds of GPOs each with one setting.
So one of the ways that I think you can get around this, especially with admin templates, is to group
settings based on their function.
So for example, you might have a GPO that defines all of the IEEE settings for the domain or for the
business unit or a setting that controls the kind of the user experience.
The Start Menu, Explorer Options, Desktop, etc..
And then you might have a separate setting or separate GPO that has only Microsoft Office settings.
And that way you can more granularly target these GPOs at the right audiences.
And that can be, you know, kind of a really helpful thing as you're deploying into finding these GPOs.
So think about grouping based on function or based on need or the use of the policies, rather than
just sort of randomly picking a new GPO and creating a setting in it and applying it to all users or
some of your users in the environment.
Now, what this looks like is really illustrated in this kind of a graphic on a typical ad domain.
So you've got your domain, you've got two people over you.
And then underneath the people or you, you have a marketing and a sales you.
And at the people level we've got a couple GPOs, the all users locked down and all users i.e. and each
of those go to all of the users underneath the.
So you.
So these are settings that apply to every user regardless of whether they're in marketing or sales.
And then what we do is more granularly and closer to the ultimate target.
You might have some separate lockdown for marketing.
Maybe you don't want marketing to be able to view a certain drive letter, or you don't want them to
be able to open the command prompt.
Well, this is a place you can do that.
You can link a GPO with more specific, not conflicting, but more specific lockdown, specific to for
the marketing folks.
And similarly, sales, you could have their own lockdown GPO, that is settings that are specific to
sales.
So what happens is, if I'm a user in sales, I essentially get the sales locked down, GPO, the all
user locked down, GPO and the all users, i.e. GPO and all of those apply to me at processing time
to result in what the salesperson would get.
Similarly for the marketing person.
So in this way, you sort of build a layered approach and this approach actually works beyond just admin
templates settings.
It works for security policy.
It works for a lot of different policy where you're linking the settings as close to their intended
target as possible, which is a guideline that I mentioned early on.
And you're really, you know, trying to get very specific about a particular audience.
So the general stuff is linked higher up so that you only have to define it once.
And then the more specific stuff is linked lower down on this specific target audience.