Well, we covered a lot of ground in this section, in this module, talking about security policy.
So let's recap what we talked about.
So security policy supports a variety of security settings, from password policy to firewall configuration
to group membership control.
We talked about all of those and lots more beyond that public key and audit.
And the list is pretty long.
But security policy can tattoo a system and in most cases will tattoo a system.
The example I gave earlier was around security on a file system or registry.
And once that's put in place, you know, there's no easy way to just remove the policy and have the
permissions on those resources get reverted back.
In fact, you must explicitly undo those permissions or set them back to the way you want them explicitly
in a new group policy object in order to make that happen.
Group membership is another area that we talked about and we talked about how you can either use restricted
groups or group policy preferences, local users in groups.
And that's not the only example where preferences GP preferences has a sort of analogous function to
something in security policy.
Another example is in the system services area where you can configure Windows services, either the
security settings policy or group policy preferences services area.
So there are some capabilities that kind of overlap between the two areas.
And I think it's just important to be aware of what each of the different features are for those two
policy areas.
And then Windows firewall policy is pretty flexible.
It allows you to define both inbound and outbound rules, and you can define where those rules apply.
You've got those three profiles, the domain, private or public.
And you can set which of those are turned on for firewall versus not.
And you can also define IPsec policy within this area.
So again, a lot of flexibility when you create those inbound or outbound rules.
You can use predefined rules.
You can create your own custom rules.
You can do it based on TCP port or protocol.
So lots of options.
And then finally, we talked about App Locker, which is this application blacklisting and whitelisting
capability that's built into the box and provides you the ability to either audit what applications
are being executed or actually block what applications are being executed.
And I talked about how blacklisting is a lot easier to implement because basically you allow everything
and then just explicitly deny those things that you know about that are bad.
But of course, it's not as easy or as secure to do that because you don't know the universe of bad
stuff.
The alternative to that, which is whitelisting takes a lot more work because you implicitly deny execution
of everything and then specifically whitelist or allow those applications and processes to run.
And that does imply that you know exactly what those things are.
So that's kind of the summary of what we talked about in this module.
We're going to kind of continue on in this theme of different deployment scenarios for different policy
areas in the next module where we talk about using group policy to configure Internet Explorer.