Active Directory Domain Services 2008 : Create a New Group Policy Object from a Starter GPO, Edit Group Policy Objects and Starter GPOs, Copy Group Policy Objects and Starter GPOs

Create a New Group Policy Object from a Starter GPO

Scenario/Problem: Your company has a number of starter GPOs. You need to create a new GPO that is derived from a starter GPO.

Solution: Create a new GPO from a starter GPO.

To create a new GPO from a starter GPO, perform the following steps:

1.	Log on to a domain controller or a member computer that has Windows Server 2008 RSAT installed.
2.	Click Start, click Administrative Tools, and then click Group Policy Management.
3.	In the console tree, navigate to the domain where you want to create the GPO, right-click the Group Policy Objects node, and click New.
4.	In the New GPO window, shown in Figure 1, type a name for the GPO in the Name field. Figure 1. Creating a new GPO from a starter GPO.
5.	In the Source Starter GPO field, select the Starter GPO you want to use from the drop-down list and click OK.

Edit Group Policy Objects and Starter GPOs

Scenario/Problem: You created a new GPO and need to use it to apply security settings to users.

Solution: Edit a GPO.

To edit a GPO, perform the following steps:

Tip

These steps can be applied to a GPO and a starter GPO.

1.	Log on to a domain controller or a member computer that has Windows Server 2008 RSAT installed.
2.	Click Start, click Administrative Tools, and then click Group Policy Management.
3.	In the console tree, navigate to the domain that contains the GPO or starter GPO you want to edit.
4.	If you want to edit a GPO, select the Group Policy Objects node. If you want to edit a starter GPO, select the Starter GPOs node.
5.	Right-click the GPO you want to edit, and select Edit.
6.	In the Group Policy Management Editor, shown in Figure 2, modify the settings accordingly and then close the Group Policy Management Editor. Figure 2. Editing a GPO.

Note

The majority of group policy settings are configured in one of two states: Not Defined or Defined. When a group policy setting is configured as Not Defined, the setting is not applied via the GPO. When a group policy setting is configured as Defined, it is applied via the GPO.

Furthermore, when a group policy setting is configured as defined, the way in which the setting is edited varies depending on the setting in question. For example, certain group policy settings can be set to be enabled or disabled, such as the Administrator Account Status. Certain group policy settings can be set to numerical values, such as the Password Policies. Some group policy settings can be set to security principals, such as User Rights Assignments.

Copy Group Policy Objects and Starter GPOs

Scenario/Problem: You have an existing GPO and want to create a new GPO that has the exact same settings, but that you can alter independently.

Solution: Copy a GPO.

To copy a GPO or a starter GPO, perform the following tasks:

Tip

These steps can be applied to a GPO and a starter GPO.

1.	Log on to a domain controller or a member computer that has Windows Server 2008 RSAT installed.
2.	Click Start, click Administrative Tools, and then click Group Policy Management.
3.	In the console tree, navigate to the domain that contains the GPO or starter GPO you want to copy.
4.	If you want to copy a GPO, select the Group Policy Objects node. If you want to copy a starter GPO, select the Starter GPOs node.
5.	Right-click the GPO you want to copy, and select Copy.
6.	If you are copying a GPO, right-click the Group Policy Objects node and click Paste. On the Copy GPO window, select how you want permissions for the new GPO to be handled, as shown in Figure 3, and click OK. Figure 3. Copying GPO permissions.
7.	If you are copying a starter GPO, right-click the Starter GPOs node and click Paste.
8.	Verify that the copy progress succeeded, as shown in Figure 4, and click OK. Figure 4. Verifying the progress of copying the GPO.
9.	Rename the GPO accordingly.