Configuring Group Policy - MCTS Guide to Microsoft Windows Server 2008 Active Directory Configuration - page 269

11. Configure the following policies as shown:
• Lock the Taskbar: Enabled
• Remove Games link from Start Menu: Enabled
• Remove Network icon from Start Menu: Enabled
12. Close all open windows, and stay logged on for the next activity.
Starter GPOs can be useful for making sure your policies are consistent throughout the
domain by defining baseline settings for group policy setting categories. You can change the base-
line settings as needed in the GPO created from the Starter GPO. However, after a new GPO is
created from a Starter GPO, any changes to the Starter GPO aren't propagated to the new GPO.
Starter GPOs can also be shared with other administrators by placing them in cabinet files
(CAB files). If you click the Starter GPOs folder in GPMC (see Figure 7-11), all Starter GPOs are
listed in the right pane. You can use the Save as Cabinet and Load Cabinet buttons to save a
Starter GPO as a CAB file and load a Starter GPO from a CAB file.

7

Figure 7-11 Starter GPOs can be shared as CAB files

Group Policy Scope and Inheritance
The scope of a group policy defines which objects in Active Directory are affected by settings in
the policy. As stated, GPOs can be linked to sites, domains, and OUs and are applied to objects
(users or computers) in this order. When conflicts exist, the last policy setting applied takes
precedence. When OUs are nested, the GPO applied to the OU nested the deepest takes prece-
dence over all other GPOs. When a policy setting isn't configured, its status is Not defined or
Not configured. When a GPO is applied to an object, only the configured settings have any effect
on that object. If two GPOs are applied to an object, and a certain setting is configured on one
GPO but not the other, the configured setting is applied. For example, Table 7-1 shows an Active
Directory structure similar to what you have been using in this topic's activities (shown later in
Figure 7-12). In particular, note that Marketing is a parent OU of the Advertising OU.

Table 7-1 GPO inheritance and precedence: Example 1

GPO Linked to Policy Setting

Default Domain Policy Domain Lock the Taskbar Disabled

StMenuMktGPO Marketing OU Lock the Taskbar Enabled

StMenuAdvGPO Advertising OU Lock the Taskbar Not configured