Lab 5.0: ADDS Group Policy

Summary

This lab was very straight forward except I hit a roadblock when it came to the disablelastlogin. Overall it was a very fun lab and I hope I do well when everything is deleted.

Assessment Prep

Remember to enable ICMP on windows and follow my documentation.

Commands / Steps

1. To add an Organization Unit or OU

   • Go to tools then select Active Directory Users and Computers

   • Right-click on name.local new then Organizational Unit

   • Now create Accounts, Computers, Groups

2. To add users to the OU

   • Right-click on the Accounts New then User

3. To add a computer to an OU

   • Do the same as before except select Computer instead of User

4. Creating Group Policy for OU

   • Select your Groups then right-click on the Accounts New then Group

   • Here you want to add the users to that policy

5. Group Policy Management

   • Go to tools then select Group Policy Management

   • Select the OU created before and Create a GPO in this domain, and Link it here...

   • Now remove Authenticated Users and add the name of the Group Policy created before

   • Next add the Domain Computers so this affects all computers in the Domain

   • Next got to Delegations tab and to Domain Computers and change the Permissions so Deny is checked for Apply Group Policy

To Clear Login After Every Logout * Create DisableLastLogin under the Computers OU * Now remove Authenticated Users and add the name of the Group Policy created before * Next add the Domain Computers so this affects all computers in the Domain * Make sure Apply Group Policy is checked under the Delegation tab for Domain Computers * Now right click on DisableLastLogin and select edit Computer Config/Policies/Windows Settings/Security Settings/Local Policies/Security Options right click on Security Options then find Don't display last signed-in and enable

PLEASE HIT APPLY WHEN YOU WANT TO CHANGE POLICY

1. To edit this new GPO

   • Right-click and select Edit

   • Now if you want to remove the recyling bin navigate to User Configuration/Administrative Temp/Desktop and under desktop will be everything that can be changed

2. To check if GPO is applied

   • On a domain computer and login then pull up a power shell and type gpresult /r

     • under Applied Group Policy Objects will show what rules are applied

     • gpudate /force = will update the group policy by force

   • gpresult /scope computer /r = shows what is applied to current computer