Information Technology Reference
In-Depth Information
7
Figure 7-1
The Group Policy Object Editor
Windows XP and 2000 computers have a single GPO that affects all users of the computer.
It's the GPO you see when you run Gpedit.msc and is referred to as the Local Computer Policy
object. Windows Vista and Server 2008 include the Local Computer Policy object containing
Computer Configuration and User Configuration nodes. The policies defined in this GPO,
when configured on non-domain computers, apply to all users who log on to the computer.
For example, a computer used in a public environment, such as a kiosk, might have policies
that severely restrict what users can do on the computer. If the administrator needs to per-
form these restricted activities, the policies need to be changed first. In addition to the
Local Computer Policy, Windows Vista and Server 2008 include more GPOs, discussed in
the next section.
New Local GPOs in Windows Vista and Server 2008 The new GPOs in
Windows Vista and Server 2008, described in the following list, allow setting different policies
depending on who logs on to the computer:
Local Administrators GPO —Members of the local Administrators group are affected by
settings in this GPO. The default membership includes the local Administrator account
and the Domain Admins global group when the computer is a domain member. This
GPO doesn't contain a Computer Configuration node, so policies are limited to user-
related settings.
Local Non-Administrators GPO —All users of the computer who aren't members of the
local Administrators group are affected by settings in this GPO, including domain users
when the computer is a domain member. Like the Local Administrators GPO, this GPO
consists of only a User Configuration node.
User-specific GPO —You can configure a GPO that applies to a local user account. This
GPO also contains only a User Configuration node and affects only users who log on to
the local computer with an account defined in the local SAM database.
 
Search WWH ::




Custom Search