Group PolicyResources for Group Policy- The two best sites out there are Darren Mar-Elia's and Jeremy Moskowitz'. They both are best-of-class in GP and have excellent books on the subject. Their sites have FAQs, forums and tools.
'No brainer' policy settings & templates- MAKE WINDOWS XP BEHAVE WELL IN A GP MANAGED ENTERPRISE. You really must (from a practical standpoint) enable this setting, otherwise many changes to policy settings may take up to three logons and/or restarts to take effect. By default, Windows XP allows you to log on and instantiate the shell before it is able to contact domain controllers--therefore before it can apply any new or changed GPs.
- Computer/Administrative Templates/System/Logon/Always wait for the network at computer startup and logon.
- MAKE WINDOWS XP ALLOW REMOTE ADMINISTRATION. If you're enabling Windows Firewall, by default it will block all remote administration tools, since those, by definition, are incoming requests. Luckily, WF's domain profile and standalone profile allow you to open ports while the machine is connected to the domain and close ports when it is not connected to the domain.
- Computer Configuration/Administrative Templates/Network/Network Connections/Windows Firewall/Domain Profile/Windows Firewall: Allow remote administration exception
- Computer Configuration/Administrative Templates/Network/Network Connections/Windows Firewall/Domain Profile/Windows Firewall: Allow Remote Desktop exception
Guidance- You're crazy not to install the free Registry Extension from Desktop Standard. It allows you to completely manage the registry on systems in your enterprise through group policy's tools and technologies. No more need to regedit or hack .adm files! Must be seen to be believed! And did I say free? The reason is that Desktop Standard's other GP extensions are even more cool, and they want you to experience (free and fully functional) just how powerful registry extenstions can be, so that when you're ready to take the next big step, they'll be the first on your list. Get it! (No I'm not on their payroll ... I'm just a huge fan.)
| |
|  | | |