[explaining 17] Group Policy

Group Policy--local policy

There is a local policy in every Windows system, and starting with Windows Server 2008, local Group Policy supports setting different policies for different users.

mmc-Group Policy Object Editor-users-Choose a different user

650) this.width=650; "height=" 351 "title=" clip_image002 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image002 "src=" http://s3.51cto.com/wyfs02/ M01/6c/73/wkiom1vjlb-cc3fsaaeldm__qca833.jpg "border=" 0 "/>

650) this.width=650; "height=" 371 "title=" clip_image004 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image004 "src=" http://s3.51cto.com/wyfs02/ M02/6c/6f/wkiol1vjlzlqsn6iaac4rfb_hb0998.jpg "border=" 0 "/>

2-gpmc

GPMC is the primary Group Policy Management tool in Windows, where administrators can easily manage Group Policy by using the GPMC, and administrators can also install GPMC on Windows 7 systems.

If you want to install the GPMC on the Win7 client, you need to download the patch KB958830, after installing the patch, you need to enable the "Group Policy Management Tool" in the function

650) this.width=650; "height=" 345 "title=" clip_image006 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image006 "src=" http://s3.51cto.com/wyfs02/ M00/6c/6f/wkiol1vjlzsshd4baac9qcdq0hk083.jpg "border=" 0 "/>

3-Default of two policies

In the Active Directory, there are two default policies, one is the default domain policy and one is the default domain controller policy, which defines the security baselines for domain and domain controllers.

Recommendation: Do not make any changes to the two default policies

Default Domain Policy: password policy and Kerberos policy are defined

Default Domain Control Policy: Defines the security settings---This policy---user rights Assignment

650) this.width=650; "height=" 376 "title=" clip_image008 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image008 "src=" http://s3.51cto.com/wyfs02/ M01/6c/6f/wkiol1vjlzbt8k2naafjq_zpyn8497.jpg "border=" 0 "/>

4-Client Policy application

The Group Policy object is stored in the SYSVOL shared file of the Active Directory server, and after the client's computer or user account is authenticated, the shared Group Policy setting is read and the policy settings are eventually applied.

5-Client Tools

Generally speaking, client uses policy-related commands

Gpupdate/force/target:computer or user

GPRESULT/R/h

Rsop.msc display policy result set based on management interface

6-Group Policy precedence

After an administrator has created a Group Policy object, you can link them to different containers, and the precedence of the application is not the same in different levels of the container, and administrators can use the GPMC to visually view the priority of the policy application

650) this.width=650; "height=" 347 "title=" clip_image010 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image010 "src=" http://s3.51cto.com/wyfs02/ M02/6c/6f/wkiol1vjlzjgmuwdaacqadwu7x0039.jpg "border=" 0 "/>

Group Policy application Order: Local---Site policy---domain Policy---ou policy

Priority values : getting lower from left to right

650) this.width=650; "height=" "title=" clip_image012 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image012 "src=" http://s3.51cto.com/wyfs02/ M00/6c/6f/wkiol1vjlzmicsa-aac8o2u18lg721.jpg "border=" 0 "/>

Click the Sales container to see the priority of the policy

7-Block Inheritance and coercion

In the Active Directory, a hierarchy is formed between multiple rooms, by default, the Group Policy object that is linked to the previous layer container is applied to the next layer of container because of the inheritance mechanism, and administrators can use either block inheritance or coercion to change this default application rule.

650) this.width=650; "height=" 349 "title=" clip_image014 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image014 "src=" http://s3.51cto.com/wyfs02/ M01/6c/6f/wkiol1vjlzualmlqaaesged2gvg612.jpg "border=" 0 "/>

Also see blue * * * * on the OU

650) this.width=650; "height=" "title=" clip_image016 "style=" margin:0px;border:0px;padding-top:0px;padding-right : 0px;padding-left:0px;background-image:none; "alt=" clip_image016 "src=" http://s3.51cto.com/wyfs02/M02/6C/6F/ Wkiol1vjlzuyfrn6aaaze8ike2e139.jpg "border=" 0 "/>

Forced:

650) this.width=650; "height=" 294 "title=" clip_image018 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image018 "src=" http://s3.51cto.com/wyfs02/ M01/6c/6f/wkiol1vjlz3x7gaoaaeh0xdvljk693.jpg "border=" 0 "/>

8-Security Screening

By default, the administrator can use the mechanism of security filtering to specify specific accounts to apply Group Policy, regardless of whether the computer or the user can apply Group Policy as long as they are authenticated.

650) this.width=650; "height=" 314 "title=" clip_image020 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image020 "src=" http://s3.51cto.com/wyfs02/ M00/6c/73/wkiom1vjlczr1rxvaaeugkwkyv0591.jpg "border=" 0 "/>

650) this.width=650; "height=" 363 "title=" clip_image022 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image022 "src=" http://s3.51cto.com/wyfs02/ M01/6c/6f/wkiol1vjlz-xrnfgaaejzg-nzxi921.jpg "border=" 0 "/>

9-WMI filtering

In the GPMC, administrators can use the WMI filter feature to filter users that meet the criteria or to apply Group Policy to computers, depending on whether WMI matches a user or a specific attribute of the computer.

STEP1: You can download WMI tools on the Microsoft website

STEP2: New WMI Filter:

650) this.width=650; "height=" 274 "title=" clip_image024 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image024 "src=" http://s3.51cto.com/wyfs02/ M02/6c/6f/wkiol1vjlahhl4alaac7ebo1lnq325.jpg "border=" 0 "/>

650) this.width=650; "height=" "title=" clip_image026 "style=" margin:0px;border:0px;padding-top:0px;padding-right : 0px;padding-left:0px;background-image:none; "alt=" clip_image026 "src=" http://s3.51cto.com/wyfs02/M02/6C/73/ Wkiom1vjldcshvrsaaawj4qzkva867.jpg "border=" 0 "/>

STEP3: The WMI filter is raised in the GPO

650) this.width=650; "height=" 355 "title=" clip_image028 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image028 "src=" http://s3.51cto.com/wyfs02/ M00/6c/73/wkiom1vjldhijb8eaaebsqtqdsi696.jpg "border=" 0 "/>

10-starter GPO

Starting with Windows Server 2008, the Starter GPO feature has been added to the Group Policy, where administrators can create starter GPOs and edit common settings to which most GPOs are to be used.

One sentence explanation: This way you can simplify the creation of new GPOs

650) this.width=650; "height=" 417 "title=" clip_image030 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image030 "src=" http://s3.51cto.com/wyfs02/ M01/6c/73/wkiom1vjldlx7tvkaad8zi33y64697.jpg "border=" 0 "/>

11-Group Policy Modeling

The Group Policy Modeling feature enables administrators to simulate Group Policy settings that are applied by a specific user when they log on to a specific computer, based on the modeling Wizard.

650) this.width=650; "height=" 148 "title=" clip_image032 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image032 "src=" http://s3.51cto.com/wyfs02/ M02/6c/73/wkiom1vjldtgo9a8aabaaf43o3q451.jpg "border=" 0 "/>

650) this.width=650; "height=" 359 "title=" clip_image034 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image034 "src=" http://s3.51cto.com/wyfs02/ M00/6c/6f/wkiol1vjlafbxrgoaace3b5a0ly108.jpg "border=" 0 "/>

Group Policy Modeling is not required for computer online

12-Group Policy result set

Using the Group Policy result set tool, administrators can determine which policies are applied to specific users who log on to a specific computer.

Using the Group Policy Results Wizard: You can view the remote computer (but the remote computer must be online)

650) this.width=650; "height=" 126 "title=" clip_image036 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image036 "src=" http://s3.51cto.com/wyfs02/ M01/6c/6f/wkiol1vjlafd1ksaaaa6xrxk1mq533.jpg "border=" 0 "/>

13-Delegation of authority

With permission delegation, administrators can specify specific users and groups to be able to create and edit GPOs, as well as to specify that specific users and groups have the right to link GPOs on top of the container.

650) this.width=650; "height=" 176 "title=" clip_image038 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image038 "src=" http://s3.51cto.com/wyfs02/ M00/6c/6f/wkiol1vjlajwlzheaac76j2jst8495.jpg "border=" 0 "/>

650) this.width=650; "height=" 175 "title=" clip_image040 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image040 "src=" http://s3.51cto.com/wyfs02/ M02/6c/73/wkiom1vjldid2_5daac-_izywlk414.jpg "border=" 0 "/>

14-Backing up and restoring Group Policy objects

Using the GPMC administration tool, backing up and restoring GPOs will be straightforward, and administrators can use the Dcgpofix tool to perform a reset operation for the default Domain policy and domain controller policies.

650) this.width=650; "height=" 339 "title=" clip_image042 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image042 "src=" http://s3.51cto.com/wyfs02/ M00/6c/73/wkiom1vjldnaxmefaaextirv0am236.jpg "border=" 0 "/>

650) this.width=650; "height=" 432 "title=" clip_image044 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image044 "src=" http://s3.51cto.com/wyfs02/ M01/6c/6f/wkiol1vjlaysg17vaaewpekd1wq774.jpg "border=" 0 "/>

650) this.width=650; "height=" 297 "title=" clip_image046 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image046 "src=" http://s3.51cto.com/wyfs02/ M01/6c/73/wkiom1vjldzsdgqzaaespuqnn5s128.jpg "border=" 0 "/>

Input Dcgopfix/target:both will have a hint, enter Y is good

15-Software Distribution Policy

With the software installation features provided by Group Policy, administrators can deploy software in batches to all computers that apply the policy, improving the efficiency of software deployment.

Prepare the software and share it first

650) this.width=650; "height=" 418 "title=" clip_image048 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image048 "src=" http://s3.51cto.com/wyfs02/ M02/6c/6f/wkiol1vjla_g11p1aae1ml69_m4014.jpg "border=" 0 "/>

650) this.width=650; "height=" "title=" clip_image050 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image050 "src=" http://s3.51cto.com/wyfs02/ M02/6c/6f/wkiol1vjlbds7x_yaacpgxl3aug503.jpg "border=" 0 "/>

16-Startup/shutdown scripts

Group Policy includes thousands of settings to meet most of the application management scenarios, and administrators can set scripts in Group Policy to meet special management needs if the scenarios that the administrator encounters cannot be completed with the existing options.

650) this.width=650; "height=" 431 "title=" clip_image052 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image052 "src=" http://s3.51cto.com/wyfs02/ M00/6c/73/wkiom1vjld_wlnfwaafgq9xoof0560.jpg "border=" 0 "/>

650) this.width=650; "height=" 359 "title=" clip_image054 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image054 "src=" http://s3.51cto.com/wyfs02/ M00/6c/6f/wkiol1vjlbkt08pbaadgh09xs_0097.jpg "border=" 0 "/>

17-Audit Policy

Using audit policies, the system can track the operation of object access and changes, and record operational users for security audits within the enterprise.

650) this.width=650; "height=" 159 "title=" clip_image056 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image056 "src=" http://s3.51cto.com/wyfs02/ M00/6c/73/wkiom1vjlehb959kaacqw8j7-cc015.jpg "border=" 0 "/>

650) this.width=650; "height=" 446 "title=" clip_image058 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image058 "src=" http://s3.51cto.com/wyfs02/ M02/6c/6f/wkiol1vjlbsr0xjqaagqnobxg8a628.jpg "border=" 0 "/>

650) this.width=650; "height=" 437 "title=" clip_image060 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image060 "src=" http://s3.51cto.com/wyfs02/ M01/6c/73/wkiom1vjletjzausaafuigmidaw384.jpg "border=" 0 "/>

18-User Rights Assignment

By using the user Rights Assignment policy in Group Policy, administrators can assign specific permissions to specific users or security groups in a granular manner.

650) this.width=650; "height=" 277 "title=" clip_image062 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image062 "src=" http://s3.51cto.com/wyfs02/ M02/6c/73/wkiom1vjlefbjbt0aaenjbp9dnw985.jpg "border=" 0 "/>

There are default groups in the entries, which can be viewed in detail.

19-Security Options

With the security options provided by Group Policy, administrators can establish a unified security specification, such as renaming the Administrator account for all users in the domain, reducing security risks.

650) this.width=650; "height=" 521 "title=" clip_image064 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image064 "src=" http://s3.51cto.com/wyfs02/ M00/6c/73/wkiom1vjlejsqou0aahgvycyh4i966.jpg "border=" 0 "/>

20-Event Log

Windows security log, which records important security events, administrators can use the security log to diagnose the security status of the system, the administrator can take advantage of Group Policy for the security log unified settings, standardize the management of the security log.

Use Eventvwr.exe to view local event logs

650) this.width=650; "height=" 227 "title=" clip_image066 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image066 "src=" http://s3.51cto.com/wyfs02/ M01/6c/73/wkiom1vjleqdthftaaez4tmo0ck199.jpg "border=" 0 "/>

21-Restricted Groups

Windows built-in security groups, which have different operational permissions to the system, set restricted groups through Group Policy, and are able to restrict the members of a security group so that only authorized users can become members of the security group.

For example, you can define the user group name in the Administrtors group

650) this.width=650; "height=" 428 "title=" clip_image068 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image068 "src=" http://s3.51cto.com/wyfs02/ M02/6c/73/wkiom1vjlevctotoaagjhqfndee235.jpg "border=" 0 "/>

22-System Services

Through the system services in Group Policy, administrators can set the running state of some services in the computer, automatically start or disable

650) this.width=650; "height=" 249 "title=" clip_image070 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image070 "src=" http://s3.51cto.com/wyfs02/ M00/6c/6f/wkiol1vjlb7y5fazaafb_yub2mm376.jpg "border=" 0 "/>

23-Registration Form

By using registry settings in Group Policy, administrators can uniformly set security options for specific registry keys in the system, enforcing the security of registry keys

650) this.width=650; "height=" 326 "title=" clip_image072 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image072 "src=" http://s3.51cto.com/wyfs02/ M00/6c/6f/wkiol1vjlb-qmfe_aaf8ihbpesq072.jpg "border=" 0 "/>

650) this.width=650; "height=" "title=" clip_image074 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image074 "src=" http://s3.51cto.com/wyfs02/ M01/6c/6f/wkiol1vjlcddsi2qaab6ubwfihs351.jpg "border=" 0 "/>

24-File system

With the file system settings in Group Policy, administrators can uniformly set security options for specific files or folders on the system, forcing the security of files or folders (in fact, NTFS permissions for a folder)

25-Advanced firewall

With advanced firewall settings in Group Policy, administrators can set the rules for firewalls in the system uniformly to ensure that specific applications or ports can pass through the firewall

650) this.width=650; "height=" 317 "title=" clip_image076 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image076 "src=" http://s3.51cto.com/wyfs02/ M02/6c/6f/wkiol1vjlchiovnzaaehqfqs7zq216.jpg "border=" 0 "/>

650) this.width=650; "height=" 279 "title=" clip_image078 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image078 "src=" http://s3.51cto.com/wyfs02/ M00/6c/6f/wkiol1vjlcky25g-aadcpp5a-yk176.jpg "border=" 0 "/>

26- Network list management policy

With Group Policy's network list management policy, administrators can specify the type of network connection in the computer so that the network opens different types of services.

650) this.width=650; "height=" 366 "title=" clip_image080 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image080 "src=" http://s3.51cto.com/wyfs02/ M01/6c/6f/wkiol1vjlcodgfuaaafa8k6ojuq821.jpg "border=" 0 "/>

27-Public key policy

Through the public key policy settings of Group Policy, administrators can manage certificates uniformly, such as adding trusted Root Certification Authorities, simplifying management

28-Software Restriction Policies

With software restriction policies in Group Policy, administrators can restrict specific software operations in different ways, allowing users to focus on business software

650) this.width=650; "height=" 471 "title=" clip_image082 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image082 "src=" http://s3.51cto.com/wyfs02/ M01/6c/6f/wkiol1vjlcodqie7aaefox0fzy4489.jpg "border=" 0 "/>

650) this.width=650; "height=" "title=" clip_image084 "style=" margin:0px;border:0px;padding-top:0px;padding-right : 0px;padding-left:0px;background-image:none; "alt=" clip_image084 "src=" http://s3.51cto.com/wyfs02/M02/6C/74/ Wkiom1vjlfpxuv_iaaakbp5huoi115.jpg "border=" 0 "/>

Use a path to restrict an application from being used.

29-app Locker

AppLocker is a newly added feature in Windows Server R2, and with AppLocker, administrators can very flexibly restrict applications, Windows Installer, script runs

But the client must start the service application identity

650) this.width=650; "height=" 185 "title=" clip_image086 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image086 "src=" http://s3.51cto.com/wyfs02/ M02/6c/6f/wkiol1vjlcwb2u6faadf5sqrga8814.jpg "border=" 0 "/>

650) this.width=650; "height=" 451 "title=" clip_image088 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image088 "src=" http://s3.51cto.com/wyfs02/ M00/6c/74/wkiom1vjlftr-l8yaaeahkkjmoq082.jpg "border=" 0 "/>

650) this.width=650; "height=" 444 "title=" clip_image090 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image090 "src=" http://s3.51cto.com/wyfs02/ M00/6c/6f/wkiol1vjlcfqe8okaagm-8vngeq488.jpg "border=" 0 "/>

30-IPSEC strategy

Using IPSec technology, administrators can better secure network communications, encrypt network traffic, verify communication host identity

31-Centralized Storage policy template ADMX

Starting with Windows Server 2008, the Administrative Templates in Group Policy Add a template file for the ADMX type, while administrators can set up a centralized storage of ADMX files without having to replicate to each GPT folder

Read all ADMX files under C:\windows\PolicyDefinitions

ADMX is actually the operation that corresponds to the registry.

32-Import the application ADMX file

In order to take full advantage of the unified management of Group Policy, third-party programs can develop corresponding ADMX administrative template files, and administrators can easily implement unified settings and improve management efficiency by importing these template files.

You can go to Microsoft to download to Admintemplates, can extract to

650) this.width=650; "height=" 191 "title=" clip_image092 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image092 "src=" http://s3.51cto.com/wyfs02/ M01/6c/6f/wkiol1vjlcedpxwsaadpe65hj_e785.jpg "border=" 0 "/>

You can also add ADMX files manually

650) this.width=650; "height=" 289 "title=" clip_image094 "style=" margin:0px;border:0px;padding-top:0px; Padding-right:0px;padding-left:0px;background-image:none, "alt=" clip_image094 "src=" http://s3.51cto.com/wyfs02/ M01/6c/74/wkiom1vjlfedqdiqaadva54qsas578.jpg "border=" 0 "/>

33-Group Policy preferences

Group Policy Preferences are a new addition to Windows Server 2008, which simplifies the implementation of Group Policy by administrators, and the settings for applying preferences are not mandatory relative to policy

Group policy Preferences to set up a user or computer's working environment

As you can see, Group Policy has built-in policies and two sections of preferences .

The difference is as follows:

1-only the group path within the domain has the preferences feature, and the local machine policy does not have this feature

2-preferences are not mandatory, the client can change itself, the preference is appropriate for the default value, and then the policy setting is mandatory, after the client application, cannot change

3-policy settings take precedence over preference settings

PS: If the client is Win XP, you need to install the client-side extension CSE

The preference is also divided into : Windows Settings : (instead of script), such as drive mapping, environment variables, etc.

Control Panel Settings : used to set items within the client Control Panel, such as Regional options, power options, printers, etc.

650) this.width=650; "height=" 359 "title=" clip_image096 "style=" border:0px;padding-top:0px;padding-right:0px; Padding-left:0px;background-image:none, "alt=" clip_image096 "src=" http://s3.51cto.com/wyfs02/M02/6C/74/ Wkiom1vjlfitik6qaaf01kfydae032.jpg "border=" 0 "/>

This article from the "Erick" blog, declined to reprint!

[explaining 17] Group Policy