6.1.1 管理和设置组策略的工具

 
  • 6.1.2 组策略可以执行的操作
     
  • 6.1.3 组策略对象
    GPO GPO
  • GPTGPOGUIDDC128GPCGPOGUIDGPT%systemroot%\SYSVOL\sysvol6．2   创建组策略
    GPO GPO GPO —— Builtin OU( )
    GPO GPO GPO 6.2.1 创建组策略
    OUGPO1Active Directory .GPOOU2GPO
     6.2.2 链接组策略
GPO GPO gPLink gPOptions GPO GPO1Active Directory .GPOOU2GPOGPO

 6．3   组策略如何应用于活动目录

 

 

 
GPO 6.3.1 如何处理组策略
Windows 2000 Windows 2000 DLLswinnt\system32
组策略_第1张图片
6.3.2 控制组策略处理
Windows2000 ² WindowsGPOOUGPOWindowsOUOU² Windows 20005Windows 20000DC9030DCWindows 2000secedit /refreshpolicy user_policy /forcesecedit /refreshpolicy machine_policy /forceWindows Serve 2003gpupdate Active Directory secedit /refreshpolicy gpupdate /target:user /forcegpupdate /target:computer /forcegpupdate /force² 500kbps

6.3.3 解决组策略设置的冲突

 

 

DCGPOGPO
² DCGPO => DCGPO
  • ² GPO
     
  • 6．4   组策略的继承性
    OU OU OU OU OU OU OU 6.4.1 启用阻止继承和禁止替代
    Block Inheritance GPO OU GPO GPO GPO GPO
    Accounts OU GPO Accounts OU OU Accounts OU Production OU GPO ² GPO
    GPO 1OUOU AccountsOU ProductionOUAcctuser1Acctuser22Active Directory Accounts OU3Restricted Standard Desktop GPO GPO4 => =>
     
    5 GPO Enforced User Policies Ctrl+Alt+Del
    6 7Acctuser1Acctuser2Ctrl+Alt+DelOUOUGPO² GPO GPO ProductionOU 1AccountsOU ProductionOU2Production 组策略_第2张图片
     
    3 Acctuser1 Acctuser2 Ctrl+Alt+Del OU OU GPO ² 1Active Directory Accounts OU2Enforced User Policies
    3Acctuser1Acctuser2Ctrl+Alt+DelOUOURestricted Standard Desktop Enforced User Policies6.4.2 安全组筛选
    GPO GPO GPO DACL DACL GPO GPO GPO GPO OU DACL GPO ²
    1
    1OU2OUGPO3
    2
    OU GPO :
    1 DACL 2OU3OUGPO4² GPO 1ManagementAcctuser22Active Directory Accounts OU3Enforced User Policies4ManagementManagementACE 6-8
    5 6Acctuser1Ctrl+Alt+DelOUOURestricted Standard Desktop Enforced User Policies7Acctuser2Ctrl+Alt+DelOUOURestricted Standard Desktop Enforced User Policies6．5   委派组策略的管理控制
    GPO ²
  • ² GPO
    GPO ² GPO
    GPO
  • 6．6   监控组策略
    ² 1=> Regedit2HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\Current\Version => => Diagnostics3Diagnostics => “DWDRD Value”RunDiagnosticsLoggingGlobal4RunDiagnosticsLoggingGlobal1
    ²
    “%systemroot%\Debug\UserMode” Userenv.log UserEnvDebugLevel 30002 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon 300023000130000