Configuring Group Policy - MCTS Guide to Microsoft Windows Server 2008 Active Directory Configuration - page 317

exempt from these policies but shouldn't be a member of the local Administrators group.
What should you do?
a. Configure the Local Computer Policy object, and then configure a user-specific GPO for
the owner.
b. Configure the Local Computer Policy object, and use GPO filtering to exempt the owner
from this policy.
c. Install Windows Server 2008 and configure Active Directory. Add the Vista computers
to the domain, configure a GPO for the domain, and use filtering to exempt the owner.
d. Configure the Local Computer Policy object, and then configure a logon script for the
owner that changes the restrictive settings.
25. You want to have a library of GPOs that specify baseline settings for different policy cate-
gories, and you can use this library to create new GPOs with baseline settings already con-
figured. What's the best way to accomplish this?

7

Case Projects
The following case projects work with GPOs for the coolgadgets.com OU structure. When
possible, GPOs should be named CG- OUwhereLinked -C/U . For example, a GPO linked to the
coolgadgets.com OU that configures computer settings should be named CG-coolgadgets-C.

Case Project 7-1: Creating a Computer GPO for Cool Gadgets
Create a GPO that meets the following requirements:
• Create a startup script policy that applies to all computers in the domain. The
script should create a folder in the root of the C drive with the same name as the
computer name. The script should then run the Gpresult.exe program for the
Administrator user and the computer scope and send RSoP data output to a file
named Gpresult.txt in the directory that was created. ( Hint : At a command
prompt, type gpresult /? for syntax help.)
• Set computer security policies that affect all computers as follows:
• Deny guests the ability to log on to computers from the network.
• Do not display the last username that logged on to a computer.
• Do not allow a system to be shut down unless somebody is logged on.
• When logon hours expire, users should be logged off the system.
• Set the following additional policies that affect all computer accounts:
• Change the default group policy refresh interval to 45 minutes for computers, with
the random time interval set to 15 minutes.
• Configure user profiles to be deleted after 90 consecutive days of nonuse.
• Configure Windows Update so that updates are downloaded and installed automat-
ically every day at 3:00 a.m.

Case Project 7-2: Creating a Software Installation Policy
Create a software installation policy that affects all domain users and places the program
XML Notepad, a handy XML editor available on the Microsoft download site, on each
user's Start menu.

Case Project 7-3: Analyzing Security Settings
Create a security database with Security Configuration and Analysis, using a template file
created by exporting settings from the GPO created in Case Project 7-1. Use this security
database to analyze the security settings of your Vista computer. Print the log file and hand
it in to your instructor.