Feeds

Why group policy management works

Easier than scripts for tiny tots

  • alert
  • submit to reddit

Maximizing your infrastructure through virtualization

Timing is everything

Thanks to GPOs, this is not a problem. I apply a timezone policy only to his user. Since the policy that results is based on hierarchical inheritance, this overrides the GPOs assigned to any computer he logs on to. When this user is logged onto the machine, the computer behaves as though it were in his native timezone. When he logs off there is no longer an overriding GPO changing the timezone, and so the system reverts to the timezone settings of the site where it is located.

Configuring this entire setup, from placing the systems into groups, creating OUs and then policies took me perhaps two minutes. As systems are now in groups for this purpose, future changes would probably take less than a minute. As I said earlier, GPOs can be narrowed to modify the configuration of a single user or computer. They can also affect the configuration of thousands with only a few clicks.

Policies are designed to be simple to create and administer. Not only does grouping and hierarchical inheritance make distributing these configurations easier, but virtually no knowledge of scripting languages or programming is required. In fact, very little knowledge of the target operating system is required.

For example; I know how to change the time settings on a Windows 7 computer from the command line. I couldn’t write a VB script to do it, and the powershell syntax is similarly unknown. I’ve been managing time settings on Windows 7 systems for about a year now via GPOs, and I have never needed to know any other method, let alone use one.

The entire idea of GPOs is to add a few layers of abstraction between the systems administrator and the fleets of systems he or she has to administer, to make manageability easier. As the head of an IT department, I find this an incredibly useful business tool. I can offload mundane configuration tasks onto the least skilled people in my staff because they don’t have to be fully versed in the systems they are configuring.

These junior systems administrators can be fresh out of school, green as grass and wet behind the ears. Most importantly, they are cheap. GPO management of a network is the entry level position in systems administration. Along with tasks like patch management, user object maintenance and end-user support it is a way of keeping these junior admins gainfully employed while they are shown the ropes of the more difficult parts of systems administration. It is also one way to vet the capable from those who will never rise beyond their entry level.

Don’t get me wrong; AD admins need to know what they are doing. To properly create a GPO for time settings you have to understand what clock synchronization is, how timezones affect the system. GPOs are about managing the fundamental concepts underlying IT without having to know how to manually configure or script on every different flavour of system on the network.

This is the controversy. Vocal evangelical IT purists believe that no administrator should be allowed near a network where they don’t know how to manually configure, script and recompile every single module of every application on every operating system. Similarly, no users would ever be allowed in the same room as a computer unless they could compile their entire OS from source. How they expect these individuals to gain this knowledge if they can’t touch a computer until they know it is beyond me. You might have some ideas.

For this type of administrator, services halfway between raw scripting and policy administration - like Puppet - have arisen. To use Puppet you still to know pretty much everything about the systems you are administering, and being deft with scripts is important. If you aren’t deft with scripts, then at the very least your script-seeking Google-fu must be strong. There just isn’t the level of abstraction or ease of use that you would find in a policy-based environment.

Puppet and similar services exist entirely to help automate the grunt work for admins who already know everything there is to know about their systems. I would go so far as to say that if you are one of those types of administrators, your time is so valuable that something like Puppet is mandatory. You may be the wizard who writes the scripts, but disseminating them to the systems in your care is properly beneath you.

The truth is: we are not all uber-administrators. We were not born in the fires of a semiconductor fab and trained to etch our commands directly upon hard disk platters with an atomic microscope built from needles, old tyres and sheer willpower. The rest of us are mortals; we start off knowing nothing, and with luck learn continuously until we die.

This, then, is why systems management abstraction services like group policy matter. ®

The Power of One eBook: Top reasons to choose HP BladeSystem

More from The Register

next story
Sysadmin Day 2014: Quick, there's still time to get the beers in
He walked over the broken glass, killed the thugs... and er... reconnected the cables*
Auntie remains MYSTIFIED by that weekend BBC iPlayer and website outage
Still doing 'forensics' on the caching layer – Beeb digi wonk
SHOCK and AWS: The fall of Amazon's deflationary cloud
Just as Jeff Bezos did to books and CDs, Amazon's rivals are now doing to it
BlackBerry: Toss the server, mate... BES is in the CLOUD now
BlackBerry Enterprise Services takes aim at SMEs - but there's a catch
The triumph of VVOL: Everyone's jumping into bed with VMware
'Bandwagon'? Yes, we're on it and so what, say big dogs
Carbon tax repeal won't see data centre operators cut prices
Rackspace says electricity isn't a major cost, Equinix promises 'no levy'
Disaster Recovery upstart joins DR 'as a service' gang
Quorum joins the aaS crowd with DRaaS offering
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Securing Web Applications Made Simple and Scalable
Learn how automated security testing can provide a simple and scalable way to protect your web applications.