Feeds

Why group policy management works

Easier than scripts for tiny tots

  • alert
  • submit to reddit

Next gen security for virtualised datacentres

Timing is everything

Thanks to GPOs, this is not a problem. I apply a timezone policy only to his user. Since the policy that results is based on hierarchical inheritance, this overrides the GPOs assigned to any computer he logs on to. When this user is logged onto the machine, the computer behaves as though it were in his native timezone. When he logs off there is no longer an overriding GPO changing the timezone, and so the system reverts to the timezone settings of the site where it is located.

Configuring this entire setup, from placing the systems into groups, creating OUs and then policies took me perhaps two minutes. As systems are now in groups for this purpose, future changes would probably take less than a minute. As I said earlier, GPOs can be narrowed to modify the configuration of a single user or computer. They can also affect the configuration of thousands with only a few clicks.

Policies are designed to be simple to create and administer. Not only does grouping and hierarchical inheritance make distributing these configurations easier, but virtually no knowledge of scripting languages or programming is required. In fact, very little knowledge of the target operating system is required.

For example; I know how to change the time settings on a Windows 7 computer from the command line. I couldn’t write a VB script to do it, and the powershell syntax is similarly unknown. I’ve been managing time settings on Windows 7 systems for about a year now via GPOs, and I have never needed to know any other method, let alone use one.

The entire idea of GPOs is to add a few layers of abstraction between the systems administrator and the fleets of systems he or she has to administer, to make manageability easier. As the head of an IT department, I find this an incredibly useful business tool. I can offload mundane configuration tasks onto the least skilled people in my staff because they don’t have to be fully versed in the systems they are configuring.

These junior systems administrators can be fresh out of school, green as grass and wet behind the ears. Most importantly, they are cheap. GPO management of a network is the entry level position in systems administration. Along with tasks like patch management, user object maintenance and end-user support it is a way of keeping these junior admins gainfully employed while they are shown the ropes of the more difficult parts of systems administration. It is also one way to vet the capable from those who will never rise beyond their entry level.

Don’t get me wrong; AD admins need to know what they are doing. To properly create a GPO for time settings you have to understand what clock synchronization is, how timezones affect the system. GPOs are about managing the fundamental concepts underlying IT without having to know how to manually configure or script on every different flavour of system on the network.

This is the controversy. Vocal evangelical IT purists believe that no administrator should be allowed near a network where they don’t know how to manually configure, script and recompile every single module of every application on every operating system. Similarly, no users would ever be allowed in the same room as a computer unless they could compile their entire OS from source. How they expect these individuals to gain this knowledge if they can’t touch a computer until they know it is beyond me. You might have some ideas.

For this type of administrator, services halfway between raw scripting and policy administration - like Puppet - have arisen. To use Puppet you still to know pretty much everything about the systems you are administering, and being deft with scripts is important. If you aren’t deft with scripts, then at the very least your script-seeking Google-fu must be strong. There just isn’t the level of abstraction or ease of use that you would find in a policy-based environment.

Puppet and similar services exist entirely to help automate the grunt work for admins who already know everything there is to know about their systems. I would go so far as to say that if you are one of those types of administrators, your time is so valuable that something like Puppet is mandatory. You may be the wizard who writes the scripts, but disseminating them to the systems in your care is properly beneath you.

The truth is: we are not all uber-administrators. We were not born in the fires of a semiconductor fab and trained to etch our commands directly upon hard disk platters with an atomic microscope built from needles, old tyres and sheer willpower. The rest of us are mortals; we start off knowing nothing, and with luck learn continuously until we die.

This, then, is why systems management abstraction services like group policy matter. ®

5 things you didn’t know about cloud backup

More from The Register

next story
The Return of BSOD: Does ANYONE trust Microsoft patches?
Sysadmins, you're either fighting fires or seen as incompetents now
Oracle reveals 32-core, 10 BEEELLION-transistor SPARC M7
New chip scales to 1024 cores, 8192 threads 64 TB RAM, at speeds over 3.6GHz
Microsoft: Azure isn't ready for biz-critical apps … yet
Microsoft will move its own IT to the cloud to avoid $200m server bill
Docker kicks KVM's butt in IBM tests
Big Blue finds containers are speedy, but may not have much room to improve
US regulators OK sale of IBM's x86 server biz to Lenovo
Now all that remains is for gov't offices to ban the boxes
Gartner's Special Report: Should you believe the hype?
Enough hot air to carry a balloon to the Moon
Flash could be CHEAPER than SAS DISK? Come off it, NetApp
Stats analysis reckons we'll hit that point in just three years
Dell The Man shrieks: 'We've got a Bitcoin order, we've got a Bitcoin order'
$50k of PowerEdge servers? That'll be 85 coins in digi-dosh
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.