Active Directory for Administrators Training — Session 2

Overview

This course session provides a hands-on, step-by-step walkthrough of Group Policy Object (GPO) management in a Windows Active Directory environment. The instructor demonstrates core GPO workflows including creation, configuration, conflict resolution via link order, result verification using Resultant Set of Policy (RSoP), troubleshooting connectivity issues (DNS/firewall), and applying policies for security, logon restrictions, and drive visibility. The session emphasizes practical validation techniques, audit-ready reporting, and environment replication via scripting, with a focus on real-world enterprise scenarios such as compliance (CMMC), access control, and policy inheritance.

Topic (Timeline)

1. GPO Creation and Basic Configuration [00:00:10 - 00:09:27]

• Introduced gpedit.msc and Group Policy Management Console (GPMC) for navigating Local Computer Configuration → Windows Settings → Security Settings → Administrative Templates → System → Storage Access.
• Demonstrated enabling policies (e.g., removing storage access), noting that settings may be pre-configured to reduce errors.
• Used gpupdate /force to refresh policies on client machines (Server1).
• Showed verification via rsop.msc (Resultant Set of Policy) to confirm applied settings, emphasizing it as definitive proof of policy enforcement.
• Highlighted workflow pattern: Set → Update → Verify.

2. GPO Conflict Resolution and Link Order [00:09:31 - 00:23:24]

• Introduced policy conflicts using two GPOs: “Banner A Exercise” and “Banner B Exercise,” both configuring Interactive Logon Message Title/Text under Local Policies → Security Options.
• Demonstrated resolving conflicts via GPMC link order: policies higher in the list (topmost) take precedence.
• Confirmed precedence by toggling link order and verifying results with rsop.msc on Server1.
• Emphasized that link order determines winner in conflicts, not creation order.

3. GPO Management: Copying, Permissions, and Scope [00:23:26 - 00:54:59]

• Discussed resources for GPO research: Microsoft Docs as primary authoritative source over YouTube.
• Demonstrated hiding network drives via GPO: Computer Configuration → Administrative Templates → Windows Components → File Explorer → “Hide these specified drives in My Computer.”
• Explored user-specific access control: using OU-based GPOs to restrict visibility of shared drives to specific groups (e.g., administrators only, hiding from students).
• Showed copying GPOs via right-click → Copy/Paste in GPMC, preserving permissions and linking to target OUs.
• Addressed confusion around missing “Copy” option, attributing it to UI mode or permissions.
• Applied logon hour restrictions via Active Directory Users and Computers → User Properties → Account → Logon Hours, enabling bulk assignment to groups.

4. Troubleshooting GPO Connectivity and Services [00:55:00 - 01:06:49]

• Diagnosed RPC/DNS connectivity failures during remote management: error “fail to connect to class server one due to RPC server unavailable.”
• Resolved by enabling Windows Firewall rules: netsh advfirewall firewall set rule group="remote service management" new enable=yes.
• Required restarting Windows Management Instrumentation (WMI) and related services.
• Reinforced that DNS functionality alone is insufficient; firewall rules must permit remote management traffic.

5. GPO Modeling, Auditing, and Reporting [01:06:51 - 01:12:06]

• Introduced Group Policy Modeling (via GPMC → “Group Policy Modeling Wizard”) to simulate policy application without executing gpupdate.
• Explained use case: validating compliance (e.g., CMMC Level 1/2) before deployment by comparing modeled results against required controls.
• Demonstrated exporting GPO reports as HTML for audit trails: right-click GPO → “Generate Report.”
• Emphasized modeling as a safe, proactive audit tool to prevent misconfigurations.

6. Environment Setup, Scripting, and Learning Practice [01:12:06 - 01:15:23]

• Shared that the lab environment was built using PowerShell scripts (Script1, Script2, Script3) to automate domain creation and GPO deployment.
• Encouraged learners to replicate the environment in Hyper-V using checkpoints for safe experimentation (“break it, restore it”).
• Noted that the lab mirrors real-world enterprise setups (DC, OU structure, GPO hierarchy).
• Concluded with encouragement to use scripting for repetitive tasks (e.g., gpupdate) while acknowledging GUI tools remain essential for visibility and troubleshooting.

Appendix

Key Principles

• Policy Precedence: Link order in GPMC determines priority in conflicts (top = highest).
• Verification: Always use rsop.msc or Group Policy Modeling to confirm policy application before relying on it.
• Troubleshooting: GPO failures often stem from firewall rules blocking WMI/RPC, not DNS or AD connectivity.
• Scope: Computer Configuration applies to machines; User Configuration applies to users — use OUs to target appropriately.

Tools Used

• gpedit.msc — Local Group Policy Editor
• gpmc.msc — Group Policy Management Console
• rsop.msc — Resultant Set of Policy (real-time enforcement)
• Group Policy Modeling Wizard — Simulated policy application
• gpupdate /force — Force policy refresh
• netsh advfirewall — Configure Windows Firewall rules
• PowerShell — Automated lab setup

Common Pitfalls

• Assuming pre-enabled policies are correctly applied without verification.
• Misunderstanding link order (higher = stronger, not lower).
• Ignoring firewall rules for remote management (WMI/RPC).
• Confusing GPO copying (copies the object) with GPO linking (applies to OU).
• Attempting to hide drives via share name ($) alone — use GPO for true visibility control.

Practice Suggestions

• Recreate the lab environment using provided scripts in Hyper-V.
• Create two conflicting GPOs and test link order changes.
• Use Group Policy Modeling to simulate CMMC compliance before deployment.
• Practice exporting HTML reports for audit documentation.
• Experiment with logon hour restrictions and drive hiding policies on test OUs.