Using GPOs to Configure and Tune Desktops

Using GPOs to Configure and Tune DesktopsLiving without Registry ‘Hacks’Ron Oglesby @RonOglesbyNOT A UNIDESK COMMERCIAL

AgendaWhy use GPOs?Policy BasicsPolicies Vs PreferencesDesktop Configurations ADMs and ADMX/ADMLsTools you can use as venture into GPOs

Why do we hack the registryTune the OSSet defaultsHide things from usersOthers…But is a hack a policy?Policies can be used for more than just registry changes

Why use GPOs and Not Reg hacks???Documentation….How do to remove this spoiler?Without opening the trunk?

What do GPOs TYPICALLY get used for?Windows Settings like folder redirectionHiding icons and Windows optionsConfiguring browser settingsSetting permissions? SometimesConfiguring Office or other app settings…Adding Users.. Occasionally.

Common tasks in tuning the VDI image?Add and modify local security accounts (at times)Disable / reconfigure ServicesTune the local OS parameters File System, desktop display, TCP parameters, etc, etcTune the user profile (like Menu show delay)Configure applications (like IE)Sometimes even create folders and move items like tools into the imageCopyright © 2010 Unidesk Corporation. All Rights Reserved. www.unidesk.com

Policy BasicsGPO Processing and Trigger eventsGPUPDATE /FORCE

Policy TemplatesTraditionally known as Policy ADMs (ADMX now)Set the options you see in the GPOsOften created by the App vendors or industrious System Engineers

ADM files are TXT filesCLASS xxx - User or MachineCATEGORY xxx - Major heading. “Windows Update”KEYNAME xxx “Software\Microsoft\Office\12.0\Oulook” Policy xxx - name of Policy shown in GPO editorVALUENAME xxx - Registry entry we are changingEND POLICYEND CATEGORY

Using GPOs to Configure and Tune Desktops

ADM file ExampleCLASS MACHINECATEGORY !!ReaderPOLICY !!Checkforupdatesatstart KEYNAME "Software\Adobe\Acrobat Reader\9.0\AVGeneral" EXPLAIN !!Checkforupdatesatstart_Help VALUENAME "bCheckForUpdatesAtStartup"VALUEON NUMERIC 1VALUEOFF NUMERIC 0 END POLICYEND CATEGORY

ADM vs ADMXADMX are the ‘new’ ADMXML basedPolicies/operative section of the policy are contained in ADMXADML are language specific filesNot stored in individual policies, can be stored in 1 central location in enterprise environmentsWill (by default) supersede existing ADM files (Inetres.adm, system.adm, etc) or can be created to supersede and existing ADMCopyright © 2010 Unidesk Corporation. All Rights Reserved. www.unidesk.com

ADMX file sample comparison<categories> <category name="Reader" displayName="$(string.Reader)" /></categories> <policies> <policy name="Checkforupdatesatstart" class="Machine" displayName="$(string.Checkforupdatesatstart)" explainText="$(string.Checkforupdatesatstart_Help)" presentation="$(presentation.Checkforupdatesatstart)" key="Software\Adobe\Acrobat Reader\9.0\AVGeneral" valueName="bCheckForUpdatesAtStartup"> <parentCategory ref="Reader" /> <supportedOn ref="SUPPORTED_NotSpecified" /><enabledValue> <decimal value="1" /> </enabledValue> <disabledValue> <decimal value="0" /> </disabledValue> </policy>Group Policy Samples from Microsoft:http://www.microsoft.com/downloads/en/details.aspx?FamilyId=3D7975FF-1242-4C94-93D3-B3091067071A&displaylang=enCopyright © 2010 Unidesk Corporation. All Rights Reserved. www.unidesk.com

ADM file ExampleCLASS MACHINECATEGORY !!ReaderPOLICY !!CheckforupdatesatstartKEYNAME "Software\Adobe\Acrobat Reader\9.0\AVGeneral" EXPLAIN !!Checkforupdatesatstart_Help VALUENAME "bCheckForUpdatesAtStartup"VALUEON NUMERIC 1VALUEOFF NUMERIC 0 END POLICYEND CATEGORYCopyright © 2010 Unidesk Corporation. All Rights Reserved. www.unidesk.com

Building your own? Start with ADM files if you haven’t already.Then convert them w/ the ADM to ADMX converterThe hardest part is not building the text file….Its finding the registry keys

Ron’s rules for Policies Vs Preferences…When to use a policySomething that the usermay have access to but I don’t want them to change IE security, connectivity, or application settingsWhen to use a preferenceWhen I set a default setting that they may changeIE default start page or default short cuts on the desktopWhen I want to change a registry setting that they do not have a GUI to changeDefault user screen saver, machine settings like NTFS last access time stamp, etc.

Policy Preference Options CreateCreate the object (reg entry, drive mapping, etc, etc)Will do nothing if the entry/object already existsReplaceDelete existing setting (if exist) and create a new objectUpdate Modification of an existing objectWill create if it does not existDelete

Preference WARNINGSThese are like defaults NOT Policies….These can tattoo the machineNewer policies do not tattoo. That was a benefit of getting away from some of the old school NT type policiesRegistry changes made via Preferences can leave a tattoo after removal of policy UNLESS you counter/remove the VM from having the policy apply.Other changes (Directories, User/group modifications or additions) also stickPreferences are basically like your image “HACK” but with management….

Windows 7 Services ExamplesDesktop Window Manager Session managerDisk DefragmenterDiagnostic Policy ServicesIP helper (if no IPv6)Security CenterSuperfetchThemes Service (classic interface)Windows DefenderWindows SearchWindows Updatehttp://www.vmware.com/files/pdf/VMware-View-OptimizationGuideWindows7-EN.pdf

Windows Settings ExamplesRecycle Bin – Do not move files to recycle bin Screen saver (XP disable .default screen saver, Win7 Blank)Disable System RestoreUAC settingsWindows Update disabledTune the file system (last access time stamp, 8.3 file names, etc)Remove Tablet PC components (or disable services)Project VRC Phase III – www.projectvrc.nlCopyright © 2010 Unidesk Corporation. All Rights Reserved. www.unidesk.com

User Tuning?Focus on HKCUIE and other application settingsGraphics/video settingsCustomer templates are out there and checkout PolicyPak.com Copyright © 2010 Unidesk Corporation. All Rights Reserved. www.unidesk.com

Finding the Registry EntryGOOGLE http://lmgtfy.com/RegSnap/Registry Monitoring ToolsGood old fashion digging and guessing!My Favorite:SysTracerhttp://www.blueproject.ro/systracer

You didn’t convince me Ron!Windows Enablerhttp://www.bluemoonpcrepair.com/wp/?p=39http://www.wincert.net/tips/microsoft-windows/windows-7/2109-how-to-copy-a-user-profile-on-windows-7.htmlPierre’s VUEM - VirtuAllUser Environment Managerhttp://www.virtualdesktops.info/Products.aspxLogin scripts, User configs, Printer configs, registry values, Port mapping, and File and folder operations.Copyright © 2010 Unidesk Corporation. All Rights Reserved. www.unidesk.com

Where to start?GPAnswers.com http://www.gpanswers.com/resources/gp-tips-and-tricks.htmlPolicyPak.com http://policypak.com/Off 2007 Policy Templateshttp://www.microsoft.com/downloads/en/details.aspx?FamilyID=92d8519a-e143-4aee-8f7a-e4bbaeba13e7&displaylang=enOff 2010 Policy Templateshttp://www.microsoft.com/downloads/en/details.aspx?FamilyID=64B837B6-0AA0-4C07-BC34-BEC3990A7956&displaylang=enUsing GPOs to Customize XenApphttp://support.citrix.com/proddocs/index.jsp?topic=/online-plugin-110-windows/ica-import-icaclient-template-v2.htmlIE 9 Preferences not working?http://blogs.technet.com/b/asiasupp/archive/2011/03/30/internet-explorer-9-ie9-group-policy-preferences-gpp.aspxXenApp Blog’s XenApp and XenDesktop Policieshttp://www.xenappblog.com/downloads/

ADM/Xs and Policy references? Microsoft ADM to AMDX migrator?http://www.microsoft.com/downloads/en/details.aspx?FamilyID=0F1EEC3D-10C4-4B5F-9625-97C2F731090CGroup Policy Settings References from MS?http://www.microsoft.com/downloads/en/details.aspx?FamilyID=18c90c80-8b0a-4906-a4f5-ff24cc2030fbGroup Policy ADMX Syntax Guide:http://technet.microsoft.com/en-us/library/cc753471(WS.10).aspxGroup Policy Survival Guidehttp://technet.microsoft.com/en-us/library/cc754151(WS.10).aspxManaging with ADMX fileshttp://technet.microsoft.com/en-us/library/cc709647(WS.10).aspx

Q&AOpen DiscussionRon Oglesbyron.unidesk.comTwitter: @ronoglesby

Using GPOs to Configure and Tune Desktops

More Related Content

Similar to Using GPOs to Configure and Tune Desktops (20)

More from Unidesk Corporation (14)

Recently uploaded (20)

Using GPOs to Configure and Tune Desktops