Feeds

Why group policy management works

Easier than scripts for tiny tots

  • alert
  • submit to reddit

Internet Security Threat Report 2014

Timing is everything

Thanks to GPOs, this is not a problem. I apply a timezone policy only to his user. Since the policy that results is based on hierarchical inheritance, this overrides the GPOs assigned to any computer he logs on to. When this user is logged onto the machine, the computer behaves as though it were in his native timezone. When he logs off there is no longer an overriding GPO changing the timezone, and so the system reverts to the timezone settings of the site where it is located.

Configuring this entire setup, from placing the systems into groups, creating OUs and then policies took me perhaps two minutes. As systems are now in groups for this purpose, future changes would probably take less than a minute. As I said earlier, GPOs can be narrowed to modify the configuration of a single user or computer. They can also affect the configuration of thousands with only a few clicks.

Policies are designed to be simple to create and administer. Not only does grouping and hierarchical inheritance make distributing these configurations easier, but virtually no knowledge of scripting languages or programming is required. In fact, very little knowledge of the target operating system is required.

For example; I know how to change the time settings on a Windows 7 computer from the command line. I couldn’t write a VB script to do it, and the powershell syntax is similarly unknown. I’ve been managing time settings on Windows 7 systems for about a year now via GPOs, and I have never needed to know any other method, let alone use one.

The entire idea of GPOs is to add a few layers of abstraction between the systems administrator and the fleets of systems he or she has to administer, to make manageability easier. As the head of an IT department, I find this an incredibly useful business tool. I can offload mundane configuration tasks onto the least skilled people in my staff because they don’t have to be fully versed in the systems they are configuring.

These junior systems administrators can be fresh out of school, green as grass and wet behind the ears. Most importantly, they are cheap. GPO management of a network is the entry level position in systems administration. Along with tasks like patch management, user object maintenance and end-user support it is a way of keeping these junior admins gainfully employed while they are shown the ropes of the more difficult parts of systems administration. It is also one way to vet the capable from those who will never rise beyond their entry level.

Don’t get me wrong; AD admins need to know what they are doing. To properly create a GPO for time settings you have to understand what clock synchronization is, how timezones affect the system. GPOs are about managing the fundamental concepts underlying IT without having to know how to manually configure or script on every different flavour of system on the network.

This is the controversy. Vocal evangelical IT purists believe that no administrator should be allowed near a network where they don’t know how to manually configure, script and recompile every single module of every application on every operating system. Similarly, no users would ever be allowed in the same room as a computer unless they could compile their entire OS from source. How they expect these individuals to gain this knowledge if they can’t touch a computer until they know it is beyond me. You might have some ideas.

For this type of administrator, services halfway between raw scripting and policy administration - like Puppet - have arisen. To use Puppet you still to know pretty much everything about the systems you are administering, and being deft with scripts is important. If you aren’t deft with scripts, then at the very least your script-seeking Google-fu must be strong. There just isn’t the level of abstraction or ease of use that you would find in a policy-based environment.

Puppet and similar services exist entirely to help automate the grunt work for admins who already know everything there is to know about their systems. I would go so far as to say that if you are one of those types of administrators, your time is so valuable that something like Puppet is mandatory. You may be the wizard who writes the scripts, but disseminating them to the systems in your care is properly beneath you.

The truth is: we are not all uber-administrators. We were not born in the fires of a semiconductor fab and trained to etch our commands directly upon hard disk platters with an atomic microscope built from needles, old tyres and sheer willpower. The rest of us are mortals; we start off knowing nothing, and with luck learn continuously until we die.

This, then, is why systems management abstraction services like group policy matter. ®

Beginner's guide to SSL certificates

More from The Register

next story
Just don't blame Bono! Apple iTunes music sales PLUMMET
Cupertino revenue hit by cheapo downloads, says report
The DRUGSTORES DON'T WORK, CVS makes IT WORSE ... for Apple Pay
Goog Wallet apparently also spurned in NFC lockdown
IBM, backing away from hardware? NEVER!
Don't be so sure, so-surers
Hey - who wants 4.8 TERABYTES almost AS FAST AS MEMORY?
China's Memblaze says they've got it in PCIe. Yow
Microsoft brings the CLOUD that GOES ON FOREVER
Sky's the limit with unrestricted space in the cloud
This time it's SO REAL: Overcoming the open-source orgasm myth with TODO
If the web giants need it to work, hey, maybe it'll work
'ANYTHING BUT STABLE' Netflix suffers BIG Europe-wide outage
Friday night LIVE? Nope. The only thing streaming are tears down my face
Google roolz! Nest buys Revolv, KILLS new sales of home hub
Take my temperature, I'm feeling a little bit dizzy
Storage array giants can use Azure to evacuate their back ends
Site Recovery can help to move snapshots around
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Website security in corporate America
Find out how you rank among other IT managers testing your website's vulnerabilities.