Skip to main content

Group Policy Security Filtering

An administrator can add both computers and users to security groups. Then the administrator can specify which security groups are affected by the GPO by using the Access Control List (ACL) editor. To start the ACL editor, select the Security tab of the property page for the GPO. Then set access permissions using discretionary access control lists (DACLs) to allow or deny access to the GPO by specified groups. By changing the Access Control Entries (ACEs) within the DACL, the effect of any GPO can be modified to exclude or include the members of any security group. For more information about security groups, see How Security Groups are Used in Access Control.

To apply a GPO to a specific group, both the Read and Apply Group Policy ACEs are required. By default, all Authenticated Users have both these permissions set to Allow. Because everyone in an organizational unit is automatically an Authenticated User, the default behavior is for every GPO to apply to every Authenticated User. However, domain administrators, enterprise administrators, and the LocalSystem account already have full control permissions, by default, without the Apply Group Policy ACE. Therefore, because administrators are also …

Read More

Group Policy WMI Filtering

Group Policy WMI Filtering was introduced with Windows XP, and is a great way to add a decision on when to apply a given group policy. WMI Filters, written in WMI Query Language (WQL), allow an administrator to specify a WMI-based query to filter the application of a GPO. WMI Filtering can be very useful when users or computers are located in a relatively flat OU structure in Active Directory, for example. WMI Filters can also allow you to apply specific policies based on server roles, operating system version, network configuration, and other criteria. Windows evaluates these filters in the following order of overall Group Policy Processing:

  1. Policies are located in hierarchy.
  2. The WMI Filters are checked.
  3. The security settings are checked.
  4. A policy is either filtered or applied depending on the results of the previous checks.

Breakdown: We locate all of the policies that exist in the user or computer’s Local, Site, Domain, and OU hierarchy. We then determine if the WMI Filter (if any are defined) returns TRUE. We then verify that the user or computer has both Read and Apply group policy permissions for the GPO. Once all of that is validated, the group policy is …

Read More

Group Policy Best Practices

I thought it might be useful to outline the approach that I take to designing group policy infrastructure in environments that I manage. Architecting group policy can be a daunting and time consuming task, so it’s good to know how it works before you start. All of what you’re about to read was gathered from Microsoft documentation, and should be accurate to the date of this writing. Everything you’re about to read has been compiled over the last 10 years from a combination of Microsoft best practices and real world experiences tweaking GPOs in production environments.

I use the terms functional and monolithic to describe the two possible approaches:

  • Functional GPOs Contain one or more settings from a single policy area and often target a single function (e.g., Browser Security, Workstation Lock)
  • Monolithic GPOs Contain a variety of settings from multiple policy areas (e.g., Administrative Templates, security, Group Policy preferences)

The majority of the corporate environments I’ve managed contain Functional GPOs when I start. Most environments should have a mix of both Monolithic and Functional GPOs. This is driven by factors such as the need for delegating certain GPOs to a particular business unit administrator, the desire to manage …

Read More

Simplifying Veeam Backups Using VMware Tags

If you’re lazy like me, you hate having to open 26 different applications when you provision a new virtual machine. Lets eliminate the need to open one of those applications, Veeam.

Traditionally, when you provision a new virtual machine, you would open Veeam Backup & Replication Console and add that specific VM to one of the Backup Jobs you have configured. You’d have to make sure that you’ve correctly configured things like encryption, application-aware backups, exceptions and credentials for the VM you’ve provisioned.

Now, I don’t know about you, but I hate extra work. Here’s how you can solve this problem with a little bit of automation using VMware Tags and Veeam Backup & Replication.

Note: VMware Tags require vCenter version 5.1 and above. Reference

Step 1: Create Backup Tags in VMware vCenter
For my needs, I created quite a few VMware Tags. One for each of the Veeam Backup Jobs I needed, and a few to dynamically change the settings of the backup job for specific virtual machines. Here’s how they’re laid out:

  1. Create a new category for your backup tags called Backup. For this category, you should set Cardinality to Many tags per object, and you

Read More

VMware Tagging and Why You Should Care

VMware Tags were introduced with vSphere 5.1, and replace the legacy Custom Attributes feature from earlier versions. Tags allow you to add valuable metadata to every object in your inventory, which makes them searchable and sortable by those tags. How can this be used, you ask? Well I’ll tell you how I use tags.

I use tags to control which backup a virtual machine is a part of, to control the settings that should be applied during the backup, to identify the priority of virtual machines for business continuity and disaster recovery purposes, to define the patch group the virtual machine is in, to identify server roles and installed applications, to create dynamic groups of machines in Turbonomic Operations Manager. One of the guys on my team even built a dynamic list of servers on our SharePoint site that allows us to see at a glance every server in our environment and filter it to find the information we need quickly.

What is a Category?
Categories allow you to group related tags together. When you define a category, you can also specify which object types its tags can be applied to and whether more than one tag in the category …

Read More