Win 7 Certification Sample Papers Forest Schema to use restricted groups
One of the best tricks in the book for a seasoned administrator who has had more than a couple issues with group membership not working properly with Group Policy is to use the power of restricted groups. Restricted 70-680 groups are permissions lists that can be established within GPOs to determine who a GPO does and does not apply to.The name itself can be a little confusing. At first, when you hear restricted group, you may think it’s used as a ?lter that restricts users from doing something. And in truth, it does. But the easier way to think about restricted groups is that they are designed to choose who a policy does apply to, not who it does not.
For instance, say you have a GPO you’re creating to deploy a piece of software to 300 users who are members of the IuseSoftware group. If you wanted to make sure the GPO you’re using applies only to those users, you could create a GPO and then use a restricted group that made sure only the IuseSoftware group could use it, regardless of where that policy is applied. This adds a lot of ?exibility, because you can now deploy a GPO where you need and ensure that this GPO is accessible only by certain groups.
Of course, if you are given the option, it’s best not to use restricted groups unless your situation demands it. The best practice is to create both your Active Directory structure and your OU design in such a way that you can easily deploy GPOs to areas that will not affect one another. However, sometimes there is a ?needs-must?situation where you must use them. Don’t feel bad if you have to; sometimes life has its demands.
In Exercise 6.2, you’ll use Group Policy to create a restricted mcts certification group that you can use for policy appliance.
Type the name of a user you want to include, such as snuf?eupagus. Alternatively, you can browse for a user and select the one you like. Just make sure the domain path is listed after you select a user, and click OK. For instance, my user, snuf?eupa- gus, shows up as DOMAIN\snuf?eupagus.
With this completed, your test policy now is restricted to a user group that contains only the users you are interested in including. In this case, snuf?eupagus now has his own unique Group Policy object that applies only to him.
Processing your request, Please wait....
