Configuring Group Policy - MCTS Guide to Microsoft Windows Server 2008 Active Directory Configuration - page 312

Administrative Templates can control hundreds of settings on computers and for users.
Administrative Templates in Windows Server 2008 and Vista use ADMX files to define the
policies that affect settings in the HKLM and HKCU sections of the Registry.

■

Security templates are used to transfer security settings easily from one GPO or computer
to another and can be used to analyze a computer's current settings against a security
database created from one or more security templates.

■

Group policy management involves managing GPO delegation and GPO status as well as
GPO backup and migration. Group policy monitoring involves group policy results and
group policy modeling. The ADMX central store can be created to ensure that ADMX
files are synchronized among all computers where group policies are managed.

■

Group policy preferences, new in Windows Server 2008, enable administrators to set up
user and computer environments with preferred settings, but these settings can be changed,
unlike policy settings.

■

Key Terms
administrative template files XML format text files that define policies in the Administrative
Templates folder in a GPO. You can create custom ADMX files to create your own policies.
ADMX central store A centralized location for maintaining ADMX files so that when an
ADMX file is modified from one domain controller, all DCs receive the updated file.
domain GPOs Group Policy Objects stored in Active Directory on domain controllers. They
can be linked to a site, a domain, or an OU and affect users and computers whose accounts
are stored in these containers.
fine-grained password policies A new feature in Server 2008, used to set different password
and account lockout policies for targeted users and groups. These policies are created by
defining a Password Settings Object (PSO) in the Password Settings Container (PSC).
folder redirection A feature that enables administrators to set policies that redirect folders in
a user's profile directory, usually to a location on a server.
GPO filtering A method to alter the normal scope of a GPO and exclude certain objects from
being affected by its settings. GPO filtering methods include security filtering, which uses GPO
permissions, and WMI filtering, which uses Windows Management Instrumentation queries to
select objects.
Group Policy Container (GPC) A GPO component that's an Active Directory object stored in
the System\Policies folder. The GPC stores GPO properties and status information but no
actual policy settings.
Group Policy Template (GPT) A GPO component that's stored as a set of files in the Sysvol
share. It contains all the policy settings that make up a GPO as well as related files, such as
scripts.
item-level targeting A feature of group policy preferences that enables administrators to
target users or computers for each preference based on a set of criteria.
local GPOs A Group Policy Object that's stored on local computers and can be edited by the
Group Policy Object Editor snap-in.
Resultant Set of Policy (RSoP) A report showing which policy settings apply to a user,
computer, or both and where these policy settings originated. RSoP reports can be created
using the RSoP snap-in, the Group Policy Results Wizard in GMPC, and the Gpresult.exe
command-line program.
security templates Text files with an .inf extension that contain information to define policy
settings in the Computer Configuration\Policies\Windows Settings\Security Settings node of a
local or domain GPO.
Starter GPO A GPO template that can be used as a baseline for creating new GPOs, much
like user account templates.