Windows Server 2008 and Windows Vista : Advanced Group Policy Management - Workflow (part 2) - Deploying GPOs, Rolling Back and Rolling Forward

4. Deploying GPOs

Deploying GPOs from AGPM can be done in many different ways and for many different reasons. For the purposes of this discussion, the term deploy is defined as taking a GPO from AGPM and putting it into production on a domain controller.

Deploying a GPO That Was Created Offline (with Deploy Permissions)

GPOs created offline, meaning in AGPM only, must be deployed before they can affect a computer or user with their settings. Follow these steps to deploy a GPO that was created in AGPM:

1.	In the GPMC, click the Controlled tab in the details pane.
2.	Right-click the GPO that you want to deploy, and then click Deploy.
3.	In the Deploy GPO dialog box, click Yes, as shown in Figure 3. Figure 3. The Deploy GPO dialog box asks you to confirm deployment of your GPO.

Deploying a GPO That Was Created Offline (without Deploy Permissions)

GPOs created by administrators who do not have the deploy permission will follow a similar deployment process, with a different final step. In this scenario, the GPO deployment will move to a pending state. Follow these steps to deploy a GPO without deploy permissions:

1.	In the GPMC, click the Controlled tab in the details pane.
2.	Right-click the GPO you want to deploy, and then click Deploy.
3.	In the Submit Deploy Request dialog box, click Submit, as shown in Figure 4.

Figure 4. If an administrator without deploy permissions wants to deploy a GPO, a request for this action must be sent to an administrator with the appropriate permissions.

After the GPO request is sent, the GPO will appear on the Pending tab, as shown in Figure 5.

Figure 5. After a request for deployment is sent to an administrator, the GPO is placed on the Pending tab for approval.

Note

A GPO that is pending deployment has the same control options as a GPO that is pending creation. This includes the option for the requestor to withdraw and the option for the approver to approve or reject.

Deploying a GPO from the Archive (with Deploy Permissions)

A GPO that already exists in production and AGPM will include archived versions of the GPO. In the event that an older or newer GPO must be deployed from AGPM to production, an administrator can perform the task by following these steps:

1.	In the GPMC, click the Controlled tab in the details pane.
2.	Double-click the GPO that you want to deploy.
3.	Right-click an archived version of the GPO, and then click Deploy.
4.	In the Deploy GPO dialog box, click Yes.

Deploying a GPO from the Archive (without Deploy Permissions)

An administrator who has limited control over GPOs in AGPM but does not have deploy permissions can still trigger a deploy request from the archived list of GPOs. The steps are similar to those for an administrator who does have deploy permissions, with the inclusion of a request for deployment:

1.	In the GPMC, click the Controlled tab in the details pane.
2.	Double-click the GPO that you want to deploy.
3.	Right-click an archived version of the GPO, and then click Deploy.
4.	In the Submit Deploy Request dialog box, click Submit.

5. Rolling Back and Rolling Forward

When a GPO within AGPM is edited, a copy is placed in the archive. This feature allows for an excellent backup and restore process—all GPOs are backed up automatically and can be easily accessed at any time for restoration.

Whenever you edit a GPO, a copy is automatically saved; this process cannot be altered. To see how the automatic backup process works, follow these steps:

1.	In the GPMC, click the Controlled tab in the details pane.
2.	Right-click the GPO in the list that you want to edit, and then click Check Out.
3.	(Optional) Type a comment in the Comment box, and then click OK.
4.	After the GPO is checked out, click Close.
5.	On the Controlled tab, right-click the GPO in the list again, and then click Edit.
6.	Make any modifications to the GPO that you want, and then exit the GPME.
7.	On the Controlled tab, double-click the GPO.
8.	View the new archived copy of the GPO, listed in the History for <GPO name> dialog box, as shown in Figure 6. Figure 6. Every time a GPO within AGPM is edited, a copy is placed in the archive, providing an automated mechanism for restoration of any GPO.

This historical archive gives you control over every GPO that is included in AGPM. You can choose to keep the current version or “roll back” to an older version. If you deploy a GPO that causes a problem, breaks an application, or behaves badly in some other way, you can easily roll back to an older version. To roll a GPO back to an older version (or even roll it forward to a newer version in time), follow these steps:

1.	In the GPMC, click the Controlled tab in the details pane.
2.	Double-click the GPO that you want to deploy.
3.	Right-click the archived version of the GPO, and then click Deploy.
4.	In the Deploy GPO dialog box, click Yes.