Windows Server 2012 Active Directory Basic Configuration and application (Novice Tutorial) 9---Understanding Group Policy

introduced : Recognize Group Policy

1. on the DC1 and client, enter the following two commands in the Run dialog box

(1) gpmc.msc (2 ) Gpedit.msc

Compare two open windows, what's different.

2. You can set Group Policy for sites, domains, and organizational units in ADDS. The local computer policy affects only the local computer and all users who are logged on to the local computer.

Action: Set the password for all ordinary users in the domain to a blank password

( 1 Check to see if you can set the password for a normal user to null (by default it is not allowed to set to a blank password)

650) this.width=650; "Src=" Http://s1.51cto.com/wyfs02/M01/8A/54/wKioL1gtpgaBfi2XAAA-69bSd-8515.jpg-wh_500x0-wm_3 -wmp_4-s_1938814067.jpg "title=" 9-1.jpg "alt=" Wkiol1gtpgabfi2xaaa-69bsd-8515.jpg-wh_50 "/>

( 2 ) Modify the Default Domain Policy

650) this.width=650; "Src=" Http://s3.51cto.com/wyfs02/M01/8A/54/wKioL1gtpjqQiS2MAACAhpg16Sg523.jpg-wh_500x0-wm_3 -wmp_4-s_2427824001.jpg "style=" Float:none; "title=" 9-2.jpg "alt=" Wkiol1gtpjqqis2maacahpg16sg523.jpg-wh_50 "/>

650) this.width=650; "Src=" Http://s1.51cto.com/wyfs02/M02/8A/58/wKiom1gtpjuwdbiYAACZZ_Sl4dg042.jpg-wh_500x0-wm_3 -wmp_4-s_2645509186.jpg "style=" Float:none; "title=" 9-3.jpg "alt=" Wkiom1gtpjuwdbiyaaczz_sl4dg042.jpg-wh_50 "/>

( 3 ) Refreshes the policy that was modified

650) this.width=650; "Src=" Http://s3.51cto.com/wyfs02/M00/8A/58/wKiom1gtpnHCyN2SAAAiEyO1k4I821.jpg-wh_500x0-wm_3 -wmp_4-s_3702794732.jpg "title=" 9-4.jpg "alt=" Wkiom1gtpnhcyn2saaaieyo1k4i821.jpg-wh_50 "/>

( 4 again, try to set the user password to empty

650) this.width=650; "Src=" Http://s3.51cto.com/wyfs02/M02/8A/54/wKioL1gtpn_QFDa9AAAgL3POkw8001.jpg-wh_500x0-wm_3 -wmp_4-s_287581869.jpg "title=" 9-5.jpg "alt=" Wkiol1gtpn_qfda9aaagl3pokw8001.jpg-wh_50 "/>

After the password policy has been modified, all users in the domain are affected by this policy, and the password can be set to NULL, including the administrator.

The following is an experiment to understand the configuration of Group Policy ideas and procedures------ take the Start menu as an example:

after a user in the domain logs on to the client, The default can be accessed from the Start menu to the shutdown and restart commands. As shown below:

650) this.width=650; "Src=" http://s4.51cto.com/wyfs02/M00/8A/54/wKioL1gtpwPwBYRVAAA5D4Q3mJA854.jp G-wh_500x0-wm_3-wmp_4-s_992155496.jpg "title=" 9-6.jpg "alt=" Wkiol1gtpwpwbyrvaaa5d4q3mja854.jpg-wh_50 "/>

a domain administrator can target a OU set the policy so that the above interface can be blocked for some users. For example, when a user of a network class logs on, it is not possible to open the "close" or "Restart computer" instructions from the Start menu.

0. organizational units and users.

650) this.width=650; "Src=" Http://s4.51cto.com/wyfs02/M00/8A/58/wKiom1gtpzGzEsHTAACiOQR4PaQ515.jpg-wh_500x0-wm_3 -wmp_4-s_1194668336.jpg "title=" 9-7.jpg "alt=" Wkiom1gtpzgzeshtaacioqr4paq515.jpg-wh_50 "/>

1. Log on to the DC as a domain administrator and open the Group Policy Management Console .

2. Create a new GPO and link in the class OU .

650) this.width=650; "Src=" Http://s1.51cto.com/wyfs02/M02/8A/58/wKiom1gtp1LQJPA4AACW4IOfQOI574.jpg-wh_500x0-wm_3 -wmp_4-s_2328761976.jpg "title=" 9-8.jpg "alt=" Wkiom1gtp1lqjpa4aacw4iofqoi574.jpg-wh_50 "/>

650) this.width=650; "Src=" Http://s4.51cto.com/wyfs02/M01/8A/58/wKiom1gtp3LjA11NAAA0lBk_IeI207.jpg-wh_500x0-wm_3 -wmp_4-s_3941000037.jpg "title=" 9-9.jpg "alt=" Wkiom1gtp3lja11naaa0lbk_iei207.jpg-wh_50 "/>

3. Edit the policy . Modify the User Configuration --- policies - Administrative Templates - Start menu and taskbar to modify the following policy.

650) this.width=650; "Src=" Http://s2.51cto.com/wyfs02/M01/8A/54/wKioL1gtp5KjUbKcAAAj1UXLFaQ239.jpg-wh_500x0-wm_3 -wmp_4-s_1803464296.jpg "title=" 9-10.jpg "alt=" Wkiol1gtp5kjubkcaaaj1uxlfaq239.jpg-wh_50 "/>

4. When the above policy edits are complete, on the client win7 , use An account that is not in the OU, and OU Login to an account within .

( 1 ) used in the OU (more than two) accounts in the Win 7 , test results.

(You can log off OU users can also refresh the policy directly on the client, the policy is effective immediately, only need to refresh to see the effect)

650) this.width=650; "Src=" Http://s1.51cto.com/wyfs02/M02/8A/58/wKiom1gtp7ihMxL7AABq_hAPcvs480.jpg-wh_500x0-wm_3 -wmp_4-s_4230358370.jpg "title=" 9-11.jpg "alt=" Wkiom1gtp7ihmxl7aabq_hapcvs480.jpg-wh_50 "/>

continue to use this account to detect whether the computer can be shut down by command Win 7 .

650) this.width=650; "Src=" Http://s2.51cto.com/wyfs02/M02/8A/54/wKioL1gtp8vDy2twAABLrA5Ighg220.jpg-wh_500x0-wm_3 -wmp_4-s_581541008.jpg "title=" 9-12.jpg "alt=" Wkiol1gtp8vdy2twaablra5ighg220.jpg-wh_50 "/>

  

( 2 ) use not in the OU Login to an account within Win 7

650) this.width=650; "Src=" Http://s3.51cto.com/wyfs02/M00/8A/58/wKiom1gtp-yjDPYoAABtIHSB2oY184.jpg-wh_500x0-wm_3 -wmp_4-s_952233353.jpg "title=" 9-13.jpg "alt=" Wkiom1gtp-yjdpyoaabtihsb2oy184.jpg-wh_50 "/>

As you can see from the above operation:

1. You can set Group Policy for the entire domain, or you can set the policy for the organizational unit in the domain;

2. If you set a policy for an OU, only the users and computers that are contained within that ou are subject to policy restrictions.

This article from "Network Snail" blog, declined reprint!

Windows Server 2012 Active Directory Basic Configuration and application (Novice Tutorial) 9---Understanding Group Policy