Okay.
I'm going to talk about a few specific commonly used preference areas.
And the first one I'm going to dive into is managing local users in groups.
So there's this policy area or preference area within group policy preferences under both computer and
user configuration called preferences.
Backslash Control Panel Settings backslash, local users and groups.
And the per user one has just a couple more options than the pre-computer one or a couple different
options.
One that's kind of interesting is the ability to add to currently logged on user to a local group.
So when the user logs on if this preference is set, their user account is automatically added as a
member of a local group.
So I'll show you that.
But that's a nifty kind of side feature of this that may come in handy in certain scenarios.
So this particular area has functionality, at least on the group side.
That's very similar to the restricted groups policy that I talked about in an earlier module on security
policy.
And it has the ability to basically add users to groups, remove users from groups.
You can also use this area to manage the creation, the update or the deletion of local user accounts.
So this area handles both groups and users and it is strictly geared towards local accounts, not Active
Directory accounts.
So you wouldn't use this to create groups and members and add members to those groups from an Active
Directory?
This is strictly around the local user accounts on a given workstation or server.
It's really handy when you have environments that rely on those local accounts and local group memberships.
So for example, a common scenario is you add domain global groups to local administrative groups so
that, for example, the helpdesk team or the server team can manage and have administrative access
on desktops and servers.
So how this works.
This kind of gives you a little screenshot of the user part of this particular preference area and you
see some of the fields that are available.
Again.
It's got the action dropdown with the four actions available.
And you can either create a new user account or set an existing user account.
You could rename an account.
You can change the full name or the description or other properties like whether the user can change
password or not.
Password never expires, etc..
And group is a different UI but similar.
You can select the group or you can create a new group and you can even rename or change the description
on a group.
So, you know, on the user side, you can set the group name or I'm sorry, the username.
You can set those user profile properties.
And on the group side you can select the group name or you can create a group.
If you wanted to create a new local group.
You can selectively delete all members from a group or delete all users from a group.
So you could delete.
If there were individual user accounts in a local group, you might have a policy that says no individual
user accounts in a group.
So this will go in and delete all user accounts and leave all groups.
Still a member of the existing group.
You can also add or remove individual members from a group.
So you can do this on an individual basis instead of deleting all member users or all members groups.
You can add or delete individual groups or users.
So lots of options here.
And what I am going to do now is get into my test system and show you a little bit about how this works.
But before I do that, I want to make one point.
You'll see here that there's a password field on the local user account section of preferences.
And it's important to note that Microsoft has actually deprecated the ability to set passwords in all
group policy preference areas that support the use of passwords.
So local user is one of them schedule tasks.
You had the ability to, you know, set the user account and password of the user under which the scheduled
task would run.
Odyssey.
Data Sources Drive Mappings Services.
System services, you could set the service account, username and password.
And all of those areas have been deprecated.
The reason Microsoft has deprecated is that the way they were storing those passwords was in an encryption
format within sizable portion of the group policy object.
Remember that the group policy object uses both AD and Sissel to store settings related information.
In the case of preferences and passwords in particular, they were using this encryption form that had
a publicly published key.
Encryption key.
And what that mean was that anyone with the key could decrypt the passwords that had been set on local
user accounts.
It could have been the administrator account.
The people that were using this preference item for.
It could have been steadily tasks, whatever.
You could easily get that encrypted password information out of the GPO even as a regular non privileged
user.
So Microsoft has deprecated the ability to set passwords in new preferences areas.
There's a hotfix that if you apply that hotfix, that password field that you see up here is essentially
grayed out.
So that's just a warning that even though it's showing up in the UI, if you haven't installed that
hotfix, I would not recommend using GP preferences to store passwords going forward.