Why group policy management works

Timing is everything

Thanks to GPOs, this is not a problem. I apply a timezone policy only to his user. Since the policy that results is based on hierarchical inheritance, this overrides the GPOs assigned to any computer he logs on to. When this user is logged onto the machine, the computer behaves as though it were in his native timezone. When he logs off there is no longer an overriding GPO changing the timezone, and so the system reverts to the timezone settings of the site where it is located.

Configuring this entire setup, from placing the systems into groups, creating OUs and then policies took me perhaps two minutes. As systems are now in groups for this purpose, future changes would probably take less than a minute. As I said earlier, GPOs can be narrowed to modify the configuration of a single user or computer. They can also affect the configuration of thousands with only a few clicks.

Policies are designed to be simple to create and administer. Not only does grouping and hierarchical inheritance make distributing these configurations easier, but virtually no knowledge of scripting languages or programming is required. In fact, very little knowledge of the target operating system is required.

For example; I know how to change the time settings on a Windows 7 computer from the command line. I couldn’t write a VB script to do it, and the powershell syntax is similarly unknown. I’ve been managing time settings on Windows 7 systems for about a year now via GPOs, and I have never needed to know any other method, let alone use one.

The entire idea of GPOs is to add a few layers of abstraction between the systems administrator and the fleets of systems he or she has to administer, to make manageability easier. As the head of an IT department, I find this an incredibly useful business tool. I can offload mundane configuration tasks onto the least skilled people in my staff because they don’t have to be fully versed in the systems they are configuring.

These junior systems administrators can be fresh out of school, green as grass and wet behind the ears. Most importantly, they are cheap. GPO management of a network is the entry level position in systems administration. Along with tasks like patch management, user object maintenance and end-user support it is a way of keeping these junior admins gainfully employed while they are shown the ropes of the more difficult parts of systems administration. It is also one way to vet the capable from those who will never rise beyond their entry level.

Don’t get me wrong; AD admins need to know what they are doing. To properly create a GPO for time settings you have to understand what clock synchronization is, how timezones affect the system. GPOs are about managing the fundamental concepts underlying IT without having to know how to manually configure or script on every different flavour of system on the network.

This is the controversy. Vocal evangelical IT purists believe that no administrator should be allowed near a network where they don’t know how to manually configure, script and recompile every single module of every application on every operating system. Similarly, no users would ever be allowed in the same room as a computer unless they could compile their entire OS from source. How they expect these individuals to gain this knowledge if they can’t touch a computer until they know it is beyond me. You might have some ideas.

For this type of administrator, services halfway between raw scripting and policy administration - like Puppet - have arisen. To use Puppet you still to know pretty much everything about the systems you are administering, and being deft with scripts is important. If you aren’t deft with scripts, then at the very least your script-seeking Google-fu must be strong. There just isn’t the level of abstraction or ease of use that you would find in a policy-based environment.

Puppet and similar services exist entirely to help automate the grunt work for admins who already know everything there is to know about their systems. I would go so far as to say that if you are one of those types of administrators, your time is so valuable that something like Puppet is mandatory. You may be the wizard who writes the scripts, but disseminating them to the systems in your care is properly beneath you.

The truth is: we are not all uber-administrators. We were not born in the fires of a semiconductor fab and trained to etch our commands directly upon hard disk platters with an atomic microscope built from needles, old tyres and sheer willpower. The rest of us are mortals; we start off knowing nothing, and with luck learn continuously until we die.

This, then, is why systems management abstraction services like group policy matter. ®