Group Policy Windows. Windows 8 - Group Policy

Windows is one of the most common in the world. The operating systems of this family work both on home computers and at the most powerful research stations. However, in the latter case they are much inferior to NIX-systems. Although this does not prevent Windows from being almost the most recognizable brand in the global IT infrastructure.

However, this circumstance does not prevent at all home users from virtually nothing to know about the principles of the system, nor about its basic settings. Today, we learn what Windows Group Policy is, what it is used for and how to use it correctly.

What it is?

This is the name of the set of rules and settings by which the system administrator can change Windows settings using special settings for user groups. Important! They can only be created within the domain! Simply put, if the user's machine is listed in a different workspace, the Windows Group Policy for it can not be created.

The policy object itself has two separate components: a container and a template. They contain all the information necessary to form a specific area of settings for individual user groups. This thoughtful and logical solution allows you to quickly and with minimal effort create the necessary group administrator policy group, limiting or expanding the rights of users.

Needless to say, how profitable is this practice from the economic and practical point of view, when it comes to large companies in which there are thousands of working machines. Since most often they are part of a single domain, there are no problems with assigning rights.

Run the editing tool

By the way, how can I run Windows 7 Group Policy Editor ? Very simple. To do this, click on "Start", go to "Control Panel", and then find there the option "Administration". There is a point called "Local politicians". Clicking on it, you will get to the desired Editor.

Create a new policy

So, we understood the basic concepts. It's time to learn how to create a new Windows group policy. It is quite easy to do this.

You should be aware that by default, not one, but two sets of rules are created: the basic (default) rights for machines entering the domain, and a special set of settings for the domain controller. It is the second policy designed for the container (we spoke about it above).

If you want to create a new object, then your account in the system must have the necessary powers to perform such actions. By default, Windows allows you to create policies for enterprise administrators and the domain itself. To perform this operation, you should do the following:

• First, make sure that your account belongs to either of the two types mentioned above.
• It is very important that the system in principle have tools for its extensive administration. So, you need the Active Directory Users and Computers snap-in. You should know that the system file dsa.msc is responsible for its operation.
• Open the console with the name "Users and Computers", then go to the item with the name of the organizational unit against which the Group Policy will be created.
• Click the title with the right mouse button, and then in the drop-down menu you should select "Properties". A new working window opens, in which you should be interested in the "Group Policy Object" tab.
• To make the new container belong to this particular item, click the "New" button with the left mouse button.
• After this, a new Group Policy string appears, whose name is open in edit mode. Assign her any sane name, in order to be able to quickly find the necessary.

How to use the elements

All this is good, but for better use of group policies, it is necessary to understand the algorithm for their use by the operating system itself. This is the question we will now consider. So, right after the computer starts, the following sequence of actions is performed:

• First, the registry is read, after which the computer determines which resource it belongs to. After that, the request is sent to the DNS server to obtain the necessary IP-addresses of the domain.
• After they are received, the computer automatically connects to the domain in which it is registered.
• A prompt is immediately sent for existing group policies. The domain forwards their list, and in the order in which they should be used.
• Accordingly, when a user logs on to the system, all the settings that were saved in the container will be applied to his account.

Update frequency

Simply put, they are used at every boot of the OS and with any change of user account. In addition, policy checks occur every 1.5 hours, and in some cases (Group Policy Windows 2008, the server system) - every half hour. Domain controllers are updated every five minutes.

Group Policy in Windows 8

In many ways, the new OS from Microsoft, Windows 8, is a completely redesigned and improved version of the "seven". The group policy of Windows 7 was not bypassed. It was also significantly optimized and accelerated, which explains in many respects the increased speed of the new system. The most important innovation is the completely redesigned "Group Policy Client" service, which is responsible for the group policy of the system.

Unlike the previous version, which was used for the first time in Vista, now the service is not started permanently, but is loaded exclusively if necessary. This option is called "Always On Always Connected". In the literature there is its abbreviation, AOAC. How does this service work in Windows 8? Group policies that are not used for a long time are "frozen". In some cases, this allows you to achieve a truly excellent increase in performance. The developers report that the maximum interval during which the service is waiting for the resumption of policy work is five minutes.

Other nuances

Important! If you need to update their list immediately, then the GPUPDATE command can be used for this. In addition, a request for immediate updating of group policies can be sent by the domain itself.

Many users are perplexed: "In the Windows 8 task manager there is no such service, so how is its background service performed?" The answer is simple - an improved task scheduler. From now on, group policies can create system buildings themselves, indicating the time when the service will need to be started. Once again, we emphasize that such tasks are created on behalf of the user "SYSTEM", so you can not see them.

Differences between new server versions of Windows OS

Note that this approach only exists in Windows 8. In Windows Server 2012, for example, this function is constantly active and not unloaded from memory (as in all previous versions of Windows). If the system administrator wishes that these policies are always running in the G8, you should activate the "Turn off Group Policy Client Service AOAC optimization" service.

As practice shows, the constantly running local group policy of Windows 7 does not have too much impact on the speed of the operating system. Given the capabilities of modern computer hardware, its shutdown is quite capable of causing just the same increase in the time required to perform some operations in the system.

In short, in this issue the point has not yet been set, and system administrators can choose the options for this service.