Okay.
Let's summarize what we've learned about Adnan templates in this module.
So group policies, main job is lockdown and this is implemented primarily in admin template policy.
Security policy certainly has a role here and I'll talk about that in the next module.
But group policies, history comes from admin templates and the capabilities of being able to push registry
values into a given computer or user.
So admin templates generally does not tattoo a system.
This is a development that Microsoft made great strides on when they introduced group policy.
When you apply a group and admin template setting to a system or a user, it gets applied in push there.
And if you remove that GPO, the next processing cycle that happens will remove that old setting from
the system and reapply the new settings so that tattooing doesn't happen.
And that's a great thing.
You can extend what can be controlled using admin templates.
So these underlying IDM, x and ADMA files that are the things that generate what you see in editor,
those can be extended.
You can write your own custom DMX and ADMA files and I gave you a link to a free Microsoft tool called
Adam X Migrate that has an authoring tool in it that lets you do these things.
They are very powerful in that you can really customize any registry entry or any registry edit that
you want using an add amex or ADMA file.
And of course, if it's not in one of those four special policy keys I talked about, it will probably
tattoo the system.
But nonetheless, you have the flexibility to really write a custom dmcs for really any registry value
you want to set.
You can deploy admin templates settings in layers.
So what I had suggested it is that you can provide kind of base level lock down for general things like
Explorer and the Start menu and the desktop.
And then if you have other more specific application, specific lockdowns you want to do, like in your
office, you can create separate GPOs that contain all the settings for IEEE or all the settings for
office for a particular business unit.
And this is a good way of kind of approaching the problem from a layering perspective, not duplicating,
but providing kind of an additive use of admin templates and taking advantage of the hierarchical processing
model that group policy has.
And then finally, in terms of discoverability, you know, there are literally thousands of admin templates
settings out there.
So how do you find them?
Well, there's the Microsoft setting spreadsheet that I talked about.
You can get from the Microsoft download site or the search app.
It's an online Web app found on the Microsoft Azure site developed by somebody at Microsoft.
And it gives you the ability to interactively search on keywords.
And essentially what it does is discover within the current admin templates that Microsoft provides,
and it is specific to the Microsoft admin template settings.
It can give you the ability to search on settings to find a particular area that you're interested in
locking down.
So that's a great resource.
And what we're going to do next is talk about how security policy lends itself to this whole notion
of lockdown.