UPDATE on GPO Preferences.

So I manually kicked off a Windows Update session on one of my servers today and noticed that KB943729 was available as an optional download...I checked on our WSUS servers and sure enough, there it was! KB943729 is the Group Policy Preference Client Side Extensions which can now be automatically deployed to your enterprise via WSUS. Nice and simple!!!

GPO Preferences (Part 2)

OK...I thought I'd provide an update to my earlier post about implementing "Group Policy Preferences". I've created a virtual machine running Windows Vista as my GPO Management Console - since neither Windows XP or 2003 can manage the preferences policies. There were a few "Aha!" moments with the console configuration.

• GPMC is not available as a download for Windows Vista
• Here's a bit of a Catch 22:
• In order to manage the new GPO Preferences on Vista, you have to be running SP1
• The installation of SP1 removes GPMC from the OS!
• A little googling reveals that the Remote Server Administration Tools (RSAT) for Vista SP1 installs an updated GPMC.
• Microsoft instructs you to unistall all previous versions of administation tools before installing RSAT. After the RSAT installation, you have to do the following the view the toolset:
• Open Control Panel, click Programs, and then click Turn Windows features on or off under Programs and Features. If you are prompted to provide permission by User Account Control, click Continue.
  
• In the Windows Features dialog box, select the remote administration snap-ins and tools that you want to install, and then click OK.
• Configure the Start menu to display the Administration Tools shortcut.
• Right click Start, and then click Properties.
• On the Start Menu tab, click Customize.
• In the Customize Start Menu dialog box, scroll down to System Administrative Tools, and then select Display on the All Programs menu and the Start menu.
• Click OK. Shortcuts for snap-ins installed by RSAT are added to the Administrative Tools list on the Start menu.
  

Once you've taken those steps you can launch and see the familiar Group Policy Management Console. The only difference is the addition of a Preferences folder under the User and Computer configuration folders...

Auto-configure Outlook via GPO

I was sitting in our weekly change management meeting last week and our help desk manager was expressing a desire to have an automated way of setting up user profiles in Outlook. He wanted to know if Altiris could do the trick. I chimed in that an easier solution would be to use group policy.

This is one of those needs that just about every enterprise has, and the solution is surprisingly simple. This guide should have you auto-configuring Outlook in your enterprise in about 20 minutes.

Step 1 - Build/Configure an Outlook "prf" file. The "prf" file contains all of the settings needed for Outlook to connect your mail environment. The prf file is generated using the Office Custom Installation Wizard built for the version of office that you are using (we use 2003). The wizard is pretty handy, but unnecessary. You can download (and modify) a sample prf from Outlook-Tips.net. If you want to get into the nitty gritty of the contents/functions of the prf file, see this article: Understanding An Outlook Profile (PRF)

Now, for an Exchange environment, copy and paste the following into the sample prf (NOTE: section 5 is blank so delete everything in the sample up to section 6 and replace it with the following). Customize everything in bold/red for your environment.

;Automatically generated PRF file from the Microsoft Office Customization and Installation Wizard

; **************************************************************
; Section 1 - Profile Defaults
; **************************************************************

[General]
Custom=1
ProfileName=Exchange User
DefaultProfile=Yes
OverwriteProfile=No
ModifyDefaultProfileIfPresent=False
BackupProfile=No
DefaultStore=Service1


; **************************************************************
; Section 2 - Services in Profile
; **************************************************************

[Service List]
ServiceX=Microsoft Outlook Client
ServiceEGS=Exchange Global Section
Service1=Microsoft Exchange Server
ServiceEGS=Exchange Global Section
Service2=Outlook Address Book

;***************************************************************
; Section 3 - List of internet accounts
;***************************************************************

[Internet Account List]

;***************************************************************
; Section 4 - Default values for each service.
;***************************************************************

[ServiceX]
CachedExchangeMode=0x00000002
CachedExchangeSlowDetect=TRUE

[ServiceEGS]
CachedExchangeConfigFlags=0x00000100
MailboxName=%UserName%
HomeServer=YourExchangeServer

[Service1]
OverwriteExistingService=No
UniqueService=Yes
MailboxName=%UserName%
HomeServer=YourExchangeServer
OfflineAddressBookPath=%USERPROFILE%\local settings\application data\microsoft\outlook\
OfflineFolderPath=%USERPROFILE%\local settings\application data\microsoft\outlook\outlook.ost
AccountName=Microsoft Exchange Server

[Service2]

;[ServiceX]
;FormDirectoryPage=
;-- The URL of Exchange Web Services Form Directory page used to create Web forms.
;WebServicesLocation=
;-- The URL of Exchange Web Services page used to display unknown forms.
;ComposeWithWebServices=
;-- Set to TRUE to use Exchange Web Services to compose forms.
;PromptWhenUsingWebServices=
;-- Set to TRUE to use Exchange Web Services to display unknown forms.
;OpenWithWebServices=
;-- Set to TRUE to prompt user before opening unknown forms when using Exchange Web Services.


;***************************************************************
; Section 5 - Values for each internet account.
;***************************************************************

Step 2 - Save this prf file to your DFS root (i.e. \\YourDomain\netlogon)

Step 3 - Create a custom adm template. In a previous blog entry I mentioned Yizhar Hurwitz's invaluable Reg2Adm. I used it to create a custom adm template for customizing Outlook. To save you some time, just copy the following into a text file and save it with a .adm extension (again, modify the red text):

CLASS USER

CATEGORY "Software\Microsoft\Office\11.0\Outlook\Setup"
KEYNAME "Software\Microsoft\Office\11.0\Outlook\Setup"

POLICY "ImportPRF"
PART "ImportPRF"
EDITTEXT
DEFAULT "\\YourDomain\netlogon\YourPRF.prf"
VALUENAME "ImportPRF"
END PART
END POLICY

END CATEGORY




Step 4 - Create your GPO. Kick of gpmc.msc, expand your domain and then scroll down to Group Policy Objects.

• Right click on Group Policy Objects and select New
  
• Name your GPO
• Now, right click on your newly created GPO and select edit
• Since this is a "user" setting, we'll need to add our custom adm to the User Configuration\Administrative templates
• right click on Administrative Templates under User Configuration and select "Add/Remove Templates..."
• Browse to and select the template you created in step two, click OK and then close the "Add/Remove Templates" window
• IMPORTANT - by default, the GPMC only shows settings that can be fully managed. Custom .adms are "preferences" that can be set via GPO, but can be overwritten by the end user. You need to modify the view in order to view the settings of your custom adm.
• Right click on your Administrative Templates folder under User Configuration and select View\Filtering.
• In the next window, uncheck the last option entitled "Only show policy settings that can be fully managed"

Then click OK

• Now expand the Administrative Templates folder and find the folder called "Software\Microsoft\Office\11.0\Outlook\Setup" (Note that this is for Outlook 2003 - you'll need to make some changes in the .adm file for 2007 so that it points to 12.0)
• In the right panel you should now see a red icon with a setting called "ImportPRF"
• Double click on the setting and enable the policy. It should now look like this:

Now, click ok.

That's it! Now all you have to do is link the GPO to appropriate OU(s) in your Active Directory tree and the setting will go into effect.








So, what's the magic behind this working? The first time Outlook runs, it looks for the existence of the following two registry keys:

HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Setup\First-Run

HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Setup\FirstRun

If Outlook doesn't find them it will look for the ImportPRF key. If it exists, Outlook will use the file defined in the ImportPRF key's path to configure Outlook.

Time yourself and see if you can get it done in 20 minutes or less!

Active Directory Schema Version

My co-workers and I were discussing deploying a test Exchange 2007 server this morning in an effort to demonstrate the benefits of upgrading from our existing 2003 implementation. The topic of extending our AD schema to support Exchange 2007 came up. We'll need to submit a change request to proceed so I suggested bundling that change with the schema updates brought by Server 2003 R2. One of the engineers thought that the schema was already at R2 so I thought I'd check. Checking the schema version is not something I do every day, and the only thing I remember is that I can check it via adsiedit. The rest is up to Google. The problem is that it's hard to find articles explaining how to find the schema version. It usually takes me multiple google queries to find the info. So...here it is - nice and simple:

Open ADSiEdit

At the top of the tree, right click on ADSI Edit and select "Connect To..."

In the "Connection Point" section hit the drop down menu and select "Schema".

Right click on cn=schema,cn=configuration,dc= yourdomain and select properties.

Scroll down to the attribute "objectVersion" and look at its value.

Here’s the breakdown:

13=Microsoft Windows 2000

30=Original release version of Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 (SP1)

31=Microsoft Windows Server 2003 R2

As you can see from this screenshot, we're still at Server 2003 (Not R2)

GPO Preferences

GPO Preferences (Part 1)

For a couple of years now I've being using a tool created by Yizhar Hurwitz called "Reg2Adm" to create custom adm templates from registry keys for Group Policy Objects. The custom templates are deployed as preferences which are set once, but can be overwritten by the end user. Yizhar's tool automatically converts the .reg file to the appropriate syntax and format for .adm files, thereby making virtually any registry setting configurable via GPO.

Well, Microsoft has now built a lot of this functionality (and much more) into the next generation of group policy. MS acquired a company called Desktop Standard, makers of a product called PolicyMaker. PolicyMaker's GPO tools have been integrated into the Group Policy fabric of Windows Vista and Server 2008. The new functionality is being called "Group Policy Preferences"

So...how does that help Windows 2003/XP systems engineers? Well, Microsoft has made client side extensions available for Windows XP and Server 2003 systems, enabling us to take full advantage of a broad suite of configurable settings. Everything from registry keys, to drive mappings, to power settings can now be easily and natively controlled via Group Policy. The only caveat is that the settings can only be configured via a gpmc running on a Windows Vista or Server 2008 platform (we'll be using a Windows Vista VM to create/manage the GPOs).

Over the next few weeks I'll be documenting my experiences with Group Policy preferences as I begin to deploy the extensions throughout our enterprise. We'll be using Altiris for the rollout. One of the big selling points to my management team was the GPO Preferences' ability to CENTRALLY MANAGE LOCAL ADMNISTRATOR PASSWORDS!!!

I'll keep you posted on the developments.