Okay.
Now I want to talk about some deployment scenarios using security policy.
And the first one I'm going to go through is group membership control, which is a pretty common scenario
in a lot of situations, whether you're talking about controlling membership on desktops or servers,
there are two ways to enforce the local group membership.
And again, I'm going to reiterate that group policy does local group membership control.
It does not do anything with respect to groups that are defined in Active Directory and that's a key
distinction.
You'll need other mechanisms besides group policy to control membership on Active Directory groups.
But let's look at the ways that we can do this in group policy for local groups.
So the first way is restricted groups policy.
So you have the ability through restricted groups to do a couple of different kinds of control, which
I'll talk about in a second.
And that gives you the ability to essentially pretty much lock down the membership of the group and
also which groups are in other groups.
So adding groups to groups or adding users to groups the other way is actually through preferences,
through group policy preferences.
And I mentioned or alluded to this that even though group policy preferences has this preferences name
in it, it is capable of doing lock down if the thing that you're controlling is generally not accessible
to the normal user.
So for example, group membership.
If the user is not a local administrator on their workstation, they cannot adjust group membership
no matter how it's delivered to them, whether it's through restrictive groups or through this control
panel settings, local users and groups policy.
So these two mechanisms provide similar features.
I'll talk about where they're different, what the differences are.
And in terms of, you know, controlling group membership on workstations and servers.
So restricted groups allows you to create list of users or domain groups that you wish to be added as
a member of a local group.
So here's a scenario for this.
The Workstation, Windows Workstation and Number Servers have a local group that's built in called remote
desktop users.
And members of this group can remote desktop to a server workstation.
Now you might decide that you want your help desk users in Active Directory to be able to remote desktop
to any desktop in your organization.
So you can imagine creating a restricted groups policy that adds the Help Desk Group if there is such
a thing in your domain to the local remote desktop users group.
And that is perfectly, perfectly something you can do with restricted groups.
The other thing you can do with restricted groups is have absolute control over the membership of a
given group.
And in that scenario, it will actually dynamically remove users in groups that are not in your so-called
approved list east each time processes.
So this is kind of cool and actually somewhat dangerous in that you can really shoot yourself in the
foot if you don't build your group memberships correctly.
But the point here is that the this particular mode of restricted groups has the ability to very tightly
define group membership.
Now the members of this group side of restricted groups.
There's two boxes that you saw in that previous screen.
The members of this group side are about absolute control that I was just talking about.
The group is a member of side is where you would add users and groups to other groups.
So you have to be careful when you're defining this and I'm going to go through this in a demo.
Which side you're defining membership on?
Because one side is absolute control and the other side is sort of discretionary control.
Now with GP preferences, local users and groups, it's a little bit different.
So with this you have a way to essentially add users and groups to another group, and that's really
the main capability that this feature provides.
But it also lets you rename the local group or add a description to it.
You can delete all member users or all member groups from a group.
So this is kind of almost similar to the absolute control power, except that it's just going in through
and sweeping through all member users and all member groups to clear out the group.
And then you can add or remove specific members to or from a group.
So I can say, for example, that my helpdesk admins group will be added to the Remote Desktop Users
Group.
But Joe Smith, who was an admin that I have that's no longer with the company and has his credentials
spread all over, these local groups will be removed from that group.
And that's an easy scenario to handle with the preferences local users and groups feature.
Now, even though it's a preference, users cannot override these, as I mentioned, unless they're
a member of local administrators on their workstations or their server.
This is just as good as any other policy because the operating system security protects against tampering
of this kind of group membership stuff.
So really cool capabilities around group membership control, local group membership control and group
policy.
And what I'm going to do next is give you a little bit of demo as to how this works.