1 00:00:03,060 --> 00:00:09,230 The final group policy management concept I want to talk about in this module is the starter GPO. 2 00:00:10,170 --> 00:00:12,270 So what is the starter GPO? 3 00:00:13,150 --> 00:00:19,540 Well, it's a sort of a reusable model or gold image, if you will, of admin template settings. 4 00:00:20,560 --> 00:00:27,040 So it does only support admin templates and it provides this ability to create commonly used admin templates 5 00:00:27,040 --> 00:00:31,030 that can be used over and over again in new GPOs that you create. 6 00:00:31,990 --> 00:00:38,500 So you start with a starter GPO and Microsoft even provides some kind of default ones out of the box 7 00:00:38,500 --> 00:00:41,440 that might be sort of commonly used configurations. 8 00:00:42,400 --> 00:00:48,340 And then you can edit it just like you would edit a regular GPO using the group policy editor. 9 00:00:49,280 --> 00:00:55,430 But it's only exposing you to admin templates so you can create starter GPOs of security settings or 10 00:00:55,430 --> 00:01:00,260 folder redirection software installation any of the group policy preferences. 11 00:01:01,230 --> 00:01:04,950 It's really just limited to that admin templates policy path. 12 00:01:05,930 --> 00:01:12,290 And again, you can once you've created these sort of templates where golden images of GPOs, you can 13 00:01:12,290 --> 00:01:15,860 then go in and create a new GPO from a starter GPO. 14 00:01:16,750 --> 00:01:22,390 And what essentially happens there is it takes the settings that you've defined in that starter GPO. 15 00:01:23,260 --> 00:01:29,800 And it's very simply just copy them into the new GPO so that when you open up editor on the new GPO, 16 00:01:29,980 --> 00:01:35,170 all of those admin templates, settings that you defined in the starter GPO are already there. 17 00:01:36,080 --> 00:01:39,590 And then you can go and build more settings into that GPO. 18 00:01:40,520 --> 00:01:46,160 But it essentially lets you sort of define a beginning point for a standard, maybe corporate standard 19 00:01:46,160 --> 00:01:47,480 for admin templates. 20 00:01:48,460 --> 00:01:54,130 You know, to be honest, I don't see a lot of people ending up using these, but there have been scenarios 21 00:01:54,130 --> 00:01:56,560 where I've seen them to provide some value. 22 00:01:57,500 --> 00:02:01,250 So I think it's worthwhile to know that they're there and know that they're available. 23 00:02:02,230 --> 00:02:08,080 But just based on the fact that they only include Adnan template settings makes their value really limited. 24 00:02:09,070 --> 00:02:12,250 So let's just kind of dig in and see what this looks like. 25 00:02:13,220 --> 00:02:18,470 I'll just run through a quick scenario so you can see how to create a starter GPO and how to create 26 00:02:18,470 --> 00:02:19,670 a GPO from that. 27 00:02:20,700 --> 00:02:26,880 So you may not have noticed, but if you go down to the bottom of the tree within a domain in PMC, 28 00:02:26,970 --> 00:02:29,130 you have the starter GPOs folder. 29 00:02:30,110 --> 00:02:35,540 And the very first time that you click on it, you'll note this button here that says that you can create 30 00:02:35,540 --> 00:02:37,310 the starter GPOs folder. 31 00:02:38,240 --> 00:02:43,880 And this actually gets created insensible as a special folder in the system malaria that is used to 32 00:02:43,880 --> 00:02:45,800 store your starter GPOs. 33 00:02:46,760 --> 00:02:52,790 And what you'll notice is as soon as I click that, it's created a bunch of templates for Windows XP, 34 00:02:52,790 --> 00:02:58,490 Windows Vista Group Policy Remote Update Firewall Ports and Reporting Firewall Ports. 35 00:02:59,420 --> 00:03:05,270 And you'll see if you go into settings, you can do a settings report just like any other basic admin 36 00:03:05,270 --> 00:03:08,000 template or any GPO that has settings in it. 37 00:03:08,970 --> 00:03:11,190 And it's got a bunch of settings in it. 38 00:03:12,150 --> 00:03:17,790 And what you know, you'll notice that I mentioned previously that it only shows or only supports admin 39 00:03:17,790 --> 00:03:18,360 templates. 40 00:03:18,570 --> 00:03:22,320 And you're probably asking, well, why are there firewall settings here? 41 00:03:23,280 --> 00:03:29,160 Well, what's happening is the Windows firewall with advanced security policy area actually uses the 42 00:03:29,160 --> 00:03:34,110 same registry keys as the old admin templates network connections Windows firewall. 43 00:03:35,100 --> 00:03:41,130 So when it sees admin templates for Windows Firewall defined, it translates those into Windows Firewall 44 00:03:41,130 --> 00:03:41,700 settings. 45 00:03:42,710 --> 00:03:48,200 So that's why you're seeing these here, even though, frankly, these are all just admin template settings. 46 00:03:49,180 --> 00:03:52,090 And I'll show you this in a little bit more detail. 47 00:03:53,010 --> 00:03:57,690 If I go ahead and right click starter GPOs and say new starter GPO. 48 00:03:58,640 --> 00:04:00,770 I'm going to say test starter. 49 00:04:01,750 --> 00:04:06,430 And I'm going to just say this starter is for corporate standard admin templates. 50 00:04:07,400 --> 00:04:11,780 And what I'll do is go ahead and define a couple of admin template settings. 51 00:04:12,790 --> 00:04:18,670 So if I right click on this and open up edit it brings up editor, but it's sort of a stripped down 52 00:04:18,670 --> 00:04:19,210 version. 53 00:04:20,150 --> 00:04:25,640 I only see administrative template options for under user and computer configuration. 54 00:04:26,600 --> 00:04:29,900 So I'm going to go ahead and go into Windows Components. 55 00:04:30,890 --> 00:04:37,130 Under Computer configuration Windows update and I'm going to use this to configure automatic updates. 56 00:04:38,140 --> 00:04:41,950 So I'm going to say this is my corporate standard for Windows Update. 57 00:04:42,070 --> 00:04:48,460 And, you know, I say every day at or every Friday at 3 a.m. scheduled to install and then I can use 58 00:04:48,460 --> 00:04:50,860 this going forward to create a new GPO. 59 00:04:51,780 --> 00:04:57,660 So if I come in under group policy objects and say, new GPO, you'll notice that I have a source starter 60 00:04:57,660 --> 00:04:59,250 GPO that I can use. 61 00:05:00,200 --> 00:05:05,570 And I'm going to pick my test starter and I'm going to say marketing Windows Update policy. 62 00:05:06,490 --> 00:05:08,290 And create from my starter. 63 00:05:09,270 --> 00:05:14,790 Now if I go to marketing Windows Update policy and go in under settings, what you'll notice is it's 64 00:05:14,790 --> 00:05:20,580 picked up the settings from the starter GPO and translated them into this new GPO that I just created. 65 00:05:21,520 --> 00:05:28,510 So essentially I've created this sort of Windows Update standard using starter GPOs and now I can propagate 66 00:05:28,510 --> 00:05:31,990 that forward into any variations on that that I want to distribute. 67 00:05:32,960 --> 00:05:39,080 So that's kind of a simple example of how starter GPOs can work and hopefully you'll see some value 68 00:05:39,080 --> 00:05:39,590 in that. 69 00:05:40,570 --> 00:05:46,660 Like I said, it's not a super commonly used feature, but it can be useful in certain scenarios.