Group Policy and domain resources¶

Practical 6.6 group-policy-and-domain-resources-annex.pdf · PDF

The school PCs all show the same wallpaper, block the same settings and map the same network drive. Nobody walks round every morning to set them. So who does?

You already changed a setting in the local security policy of win11: a warning text on the sign-in screen. Now Aina, the boss, wants that warning on every PC of Tramuntana Apps. Twelve PCs, twelve times by hand. Next month she changes one word: twelve times again. A domain is not only one list of users. It is also one place to write the rules: you write the rule once, on the server, and every PC comes to read it.

A rule sheet on a door¶

Think of the office building again. A GPO is a rule sheet pinned on a door: whoever walks through that door follows it. A sheet on the main entrance is for everybody; a sheet on the Design room door is only for Design.

A Group Policy Object (GPO) is a named set of settings stored in the domain. You link it to a place in the directory, and every computer and user below that place applies it.

Two halves of every sheet¶

When do PCs read the sheets?¶

Clients ask the DC again in the background every 90 minutes, plus a random 0–30 minutes, so that all PCs do not ask at the same moment. When you do not want to wait:

gpupdate /force
gpresult /r

gpupdate /force applies the GPOs now. gpresult /r shows which GPOs were applied to this computer and this user. User settings and group membership are read at login, so after changing them, sign out and in.

Your first GPOs¶

The tool is Group Policy Management (gpmc.msc), installed on win11 with RSAT. Sign in as TRAMUNTANA\Administrator, open it, and go to Forest → Domains → tramuntana.internal. Your OUs Dev, Design and Admin are in the tree.

A rule for every PC: the sign-in banner¶

Right-click the domain → Create a GPO in this domain, and Link it here → name TA-Login-Banner → Edit:

Computer Configuration > Policies > Windows Settings > Security Settings
  > Local Policies > Security Options
  Interactive logon: Message title for users attempting to log on  ->  Tramuntana Apps
  Interactive logon: Message text for users attempting to log on   ->  Company computer.

Run gpupdate /force and sign out: the message appears before the login box, for any user.

Why link it to the domain and not to an OU? The banner is a computer setting, so it follows the computer account. WIN11 sits in the default container Computers, and a container cannot take a GPO link. The domain is above everything, so its sheet reaches every PC.

A rule for one department¶

Right-click the OU Design → Create a GPO in this domain, and Link it here → name TA-Design-NoControlPanel → Edit:

User Configuration > Policies > Administrative Templates > Control Panel
  Prohibit access to Control Panel and PC settings  ->  Enabled

Sign in as TRAMUNTANA\joan and try to open Settings: blocked. gpresult /r lists the GPO under USER SETTINGS → Applied Group Policy Objects. Sign in as TRAMUNTANA\marta: Settings opens and the GPO is not in her list.

Who wins?¶

The domain GPO says "wallpaper: blue"; the GPO on Design says "wallpaper: yellow". What does joan see?

A client applies the sheets in a fixed order, and a later sheet overwrites an earlier one where both set the same thing. Memory hook: LSDOU.

flowchart LR
    L["<b>1. Local</b><br>the note on your desk"] --> S["<b>2. Site</b><br>the street gate"]
    S --> D["<b>3. Domain</b><br>the main entrance"]
    D --> O["<b>4. OU</b><br>parent, then child:<br>your room's door"]
    O --> W(["<b>Last one wins</b>"])

The last door wins, so joan sees yellow. Settings that do not collide add up: joan gets the banner from the domain and the blocked Settings from Design.

A folder for a domain group¶

Who can check a domain account? Only a machine of the domain. ubu-srv is not joined, so this folder lives on one that is: dc1. The group is now TRAMUNTANA\dev.

Two locks, as always¶

As in Share permissions and groups, a share has a share permission and a file-system permission, and the most restrictive wins. The standard way: leave the share lock wide and do the real work on the file-system lock, always with groups. Never write a person's name on a folder: write the department. When Pau finishes his internship, you take him out of one group and every door closes at once.

On dc1:

sudo mkdir -p /srv/samba/dev
sudo nano /etc/samba/smb.conf
sudo smbcontrol all reload-config

At the end of smb.conf add:

[dev]
    path = /srv/samba/dev
    read only = no

smbcontrol all reload-config makes Samba read the file again without stopping.

On win11 as TRAMUNTANA\Administrator, open \\dc1\dev → right-click inside → Properties → Security → Advanced → Disable inheritance (convert) → remove Everyone and Users → add TRAMUNTANA\dev with Modify. Keep Domain Admins with Full control. On a Samba DC the domain Administrator is mapped to root, which is why he can set these permissions from Windows.

Test with someone who must not get in¶

A share is not finished until somebody who must not get in has tried and failed. whoami /groups as marta lists TRAMUNTANA\dev: that is the key that opened the folder.

A drive letter for the department¶

In gpmc.msc: OU Dev → new GPO TA-Dev-Drive → Edit:

User Configuration > Preferences > Windows Settings > Drive Maps > New > Mapped Drive
  Action: Update     Location: \\dc1\dev     Reconnect: yes     Drive Letter: S

Sign in as marta and run net use: she has S:. joan has none. Preferences exist only in domain GPOs, not in the local gpedit.msc.

When it does not work¶

Key takeaways¶

• A GPO is a named set of settings, linked to a site, a domain or an OU, never to a group.
• Computer Configuration follows the computer account and applies at start-up; User Configuration follows the user account and applies at login.
• Order LSDOU: local, site, domain, OU (parent then child). The last one applied wins; settings that do not collide add up.
• gpupdate /force applies now; gpresult /r shows what was applied.
• Permissions on a shared folder go to groups; leave the share lock wide and set the file-system lock. Always test with someone who must be denied.
• Groups open resources; OUs receive rules.

Quick check¶

Today you decided who may open a folder. Next: what happens when somebody opens it who should not — Why protect systems.