Advanced Audit Policy
Another security-related feature that you’ll find in Server 2008 R2 and Windows 7 is a much more granular auditing infrastructure. If you look under \Computer Configuration\
Windows Settings\Security Settings\Advanced Audit Policy Configuration, you’ll see 10 different auditing categories that you can now tweak to control exactly which types of events generate security audits on Server 2008 R2 or Windows 7 systems. This new granularity, of course, is exposed only in these newest OS versions, but the fact that it’s manageable via Group Policy is a good thing.


Network List Policies
The last new security policy I’ll discuss gives you the ability to control network lists. By default, when Server 2008 R2, Windows 7, or Vista systems find new networks, whether public wireless networks or corporate LANs, a user is prompted to indicate the type of network it is (e.g., public, domain, home). But by using Network List Policies in Group Policy, you can now preconfigure how particular networks behave and which zone they should be shunted into when a user finds them. You can also control the icons and the names of the networks that appear to the user. The only downside to using this policy area for preconfiguring wireless access points is that you need to know the name of the WAP ahead of time to configure all the various options. But this policy area is still a welcome addition for controlling users who frequently roam between networks.


Name Resolution Policy
The last new policy area, although not strictly a security policy (it’s found under \Computer Configuration\ Windows Settings\Name Resolution Policy in GPE), lets you control DNS Security Extensions (DNSSEC) and Microsoft DirectAccess DNS configurations on a per-DNS domain name basis. For example, you can configure which features of DNSSEC are used for a given client talking to its DNS server, or which DNS and proxy servers a client connecting to your network via Direct-Access will use. Although not used by all shops, this feature is handy to have in
Group Policy if you’re rolling out Direct-Access to your mobile users.

Source of Information : Windows IT Pro June 2010

The biggest new addition in the area of Group Policy–based security policy is the Application Control Policies, or AppLocker. These policies are found under \Computer
Configuration\Windows Settings\ Security Settings\Application Control Policies. Essentially, this is a significant upgrade to the old Software Restriction Policies (SRPs— which are still supported in Server 2008 R2 and Windows 7) that let you control which applications can execute on your Windows systems. Specifically, AppLocker lets you create application whitelists and blacklists to explicitly allow or deny a particular application or set of applications to execute based on a set of criteria you specify.

A major difference between what’s available in AppLocker and SRPs is that you now have more flexible rules for defining applications. For example, you can create rules by software publisher, application name, and version information held within the file.

You can also create rules for controlling script execution, which wasn’t explicitly supported in earlier Windows versions. Also, for each type of rule you create, you can enforce the rule or just work in audit mode. In audit mode, whenever a rule is hit by an application, the result is logged to the client rather than blocking or allowing that application. That way, you can run a rule in test mode before making it live, to ensure it doesn’t catch any unsuspecting applications. The only downside to AppLocker is that it works only on Server 2008 R2 and Windows 7 clients, so you can’t leverage it in earlier versions of Windows.

Source of Information : Windows IT Pro June 2010

The last of the changes I’ll cover are the new policies that have been added to support management of new features available in Server 2008 R2 and Windows 7. Most of the new policies relate to security settings, but a few minor updates have been made to Group Policy preferences as well. Let’s start with the new Group Policy preferences:

• Support for managing the new Power Plans for power management that were introduced in Vista. These are now available in addition to Power Options and Power Schemes. Power Plans require that the client receiving them is running at least Vista.

• Updated Scheduled Tasks preferences now support the newer Task Scheduler that shipped with Server 2008 and beyond, as well as Vista. This new Task Scheduler supports many more options than Windows 2003’s and XP’s Task Scheduler. In addition, Microsoft added Immediate Tasks for Vista and beyond, which lets you create a one-time scheduled task that runs as soon as the policy processes.

• Addition of Internet Explorer (IE) 8 in the Internet Settings preferences, which lets you now configure options specific to IE 8.

Source of Information : Windows IT Pro June 2010

The major change in this release of Windows that I alluded to earlier is added support for PowerShell within the Group Policy universe. Microsoft added support for running PowerShell scripts within per-machine or per-user scripts policy and provided a set of 25 PowerShell cmdlets for PowerShell 2.0 that support many of the operations you can perform within Group Policy Management Console (GPMC). Let’s look first at the new scripts policy support.

When you create a new startup script or logon script in GPE, you’ll see a new tab. You can now add PowerShell scripts to your scripts policy and control whether the scripts run before or after non-PowerShell scripts. But note that only Server 2008 R2 and Windows 7 Group Policy clients will run these new PowerShellbased script policies. They won’t work on earlier versions of Windows.

Perhaps the more interesting of the PowerShell enhancements is a set of cmdlets within a new PowerShell 2.0 module for Group Policy. These cmdlets encapsulate many of the functions found within the GPMC sample scripts that used to ship with that tool. From the PowerShell cmdlets, you can perform Group Policy–related administrative tasks such as creating new GPOs or deleting existing ones, linking GPOs to OUs or domains, and repermissioning GPOs.

Note that to use the GroupPolicy module, you must be running PowerShell 2.0 on Server 2008 R2 or Windows 7. To provide this kind of GPMC PowerShell functionality on earlier versions of Windows, I’ve written a set of GPMC PowerShell 1.0 cmdlets that you can download for free at my website (www.sdmsoftware.com/freeware).

Let’s look at an example of the kind of power these new cmdlets provide. Suppose you want to create, permission, and link a GPO within a PowerShell script. The following one-line command does all that by leveraging three of the new cmdlets and the PowerShell pipeline:

new-gpo "Marketing IT GPO" |
Set-GPPermissions -TargetName
"Marketing Users" -TargetType Group
-PermissionLevel GPOEdit | new-gplink
-order 1 -Target "OU=Marketing,
DC=cpandl,DC=com"

Source of Information : Windows IT Pro June 2010

With the release of Windows Server 2008 came Group Policy preferences, a set of more than 20 Group Policy extensions that expanded the range of configurable settings within a Group Policy object (GPO). Following that game-changing release, you might expect new Group Policy features of a similar nature in Windows Server 2008 R2 and Windows 7. Unfortunately, most of what you’ll see, and what I discuss in this article, are incremental improvements rather than game changers. That being said, Microsoft did manage to incorporate one major change in Server 2008 R2 and Windows 7 by taking the first tentative steps toward automating Group Policy management using PowerShell. The rest of what you’ll find new in the latest Windows release is mostly updates to existing policy areas, some additional Windows components under Group Policy management, and some improvements to Group Policy preferences. Let’s look at the changes in depth.


Administrative Template Changes
The major news in Administrative Templates, or registry policy, occurred when Windows Vista shipped. With Vista, Microsoft introduced a new ADMX format and the Central Store. The ADMX format provided better multilanguage support; the Central Store took old ADM files out of the SYSVOL part of every GPO. With Server 2008 R2 and Windows 7, the greatest change in this area is the addition of yet more Administrative Template settings (more than 300). These settings cover a bevy of new Server 2008 R2 and Windows 7 features (e.g., policies to control new UI elements specific to each platform). You’ll find a full list of Administrative Template and Security policy settings in Excel format in Microsoft’s “Group Policy Settings Reference for Windows and Windows Server” (www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=18c90c80-8b0a-4906-a4f5-ff24cc2030fb).

One of the more subtle changes to Administrative Templates is a modified ADMX schema that now supports two new registry value types: REG_MULTI_SZ and REG_QWORD. Previously, you couldn’t use Administrative Templates to modify these two value types. Your choices were to deliver these kinds of values via registry scripts, or to use the Group Policy preferences’ registry extension to get these value types on client machines. Now these types are supported in the ADMX syntax, and you can create custom ADMX templates that support these new types.

Another subtle Administrative Templates change is a UI improvement. In Server 2008 and Vista, Microsoft introduced the concept of Comments to Administrative Template settings. If you chose to, you could add comments to each policy setting. These comments, and the improved Explain text that provided help for each setting, were displayed as three separate tabs within Group Policy Editor’s (GPE’s) UI. You had to flip between each tab to use them. In Server 2008 R2 and Windows 7, all three elements are presented on a single pane that you can easily see and edit.

Source of Information : Windows IT Pro June 2010

Clipboard enhancement
The Windows clipboard is a very useful tool for copying things (text, images, hyperlinks, files and much more) and pasting them elsewhere. The most obvious use for the clipboard is for copying and pasting text in a word processor like Word or WordPad, but the copy and paste function in almost every program makes use of the clipboard. It also works between programs, so you can copy text from a web browser and paste it into a spreadsheet. Of course, the program you are pasting into needs to be able to use the item you’re pasting – you can’t paste an image into Windows Notepad, for example.


Add a clipboard gadget
The clipboard has one irritating limitation – you can only use it to copy one item at a time. If you copy another item, it will replace anything you’ve currently got in the clipboard. Wouldn’t it be useful to be able to copy several things and then select the one you want to paste? There’s a gadget for Windows 7 and Vista that does exactly this. Go to http://bit.ly/exptips1233 and install Clipboard Manager. If it doesn’t immediately appear, right-click the Desktop and select Gadgets (in Windows 7), or start the Sidebar (in Vista), and add it. Clipboard Manager shows the most recent items that were copied to the clipboard and you can click any of them to make it current – the one that’ll be pasted into a program. The size of the gadget limits the number of clipboard items that are visible but clicking the More link at the top shows all the items – 250 by default but up to 999 if you want to configure it.


Copy multiple items in Firefox
If you are browsing the web using Firefox and you want to copy some text, you can highlight it with the mouse and then press Ctrl+C. You can then switch to another program and press Ctrl+V to paste it in. If there are several items on the web page you want to copy, you could repeat the process or, better still, copy them all in one go. Click and drag over the first block of text to select it and then hold down the Ctrl key as you click and drag over other blocks of text on the page. When you’ve selected everything, press Ctrl+C and all the selected blocks are copied to the clipboard and can be pasted elsewhere.


Automatic copy in Chrome
If you copy a lot of text from web pages, you should use Google Chrome with the AutoCopy extension. Select any text on the page and it is automatically copied to the clipboard, without you having to click a menu or press a key. It’s even better when used with the Clipboard Manager gadget because you can browse the web, selecting text as you go, and each item will automatically be copied to the clipboard and stored. You can then browse through all the items and copy and paste them afterwards. To install extensions, you need Google Chrome Beta 4 (www.google.com/landing/chrome/beta). Then download the AutoCopy extension from www.chromeextensions.org/utilities/autocopy.


Take the clipboard with you
If you use more than one computer, either at home or between home and work, you might find it useful to have a single clipboard manager to use on both. Visual Clipboard (www.visualclipboard.com/download.html) does this, and comes in a portable version. Just unzip the file and put it on a USB memory drive. When the program is run, it restores all the items you copied to the clipboard, no matter which PC you copied them on. Hold down Ctrl and click the mouse or press Ctrl+Alt+V to display the Visual Clipboard window and then select the item you want to paste from a list. A small Desktop widget shows the current clipboard text and you can click the icon to display the clipboard history.


More clipboard tools
There are many more clipboard tools and they all have a slightly different set of features and functions. Some will be more suitable for your particular needs than others, so try them out and see which you like best. Here are just some of the tools you can try: Clipdiary (http://clipdiary.com/karpolan2.php), ClipMate Clipboard Exender (www.thornsoft.com), PasteCopy.NET (www.pastecopy.net) and xNeat Clipboard Manager (www.xneat.com/clipboardmanager).


Source of Information : WebUser February 11 2010