Windows Server 2008 R2 - Changes in Group Policy and Removal

Transcription

1 What s New in Windows Server 2008 R2: Active Directory, Group Policy and Terminal Services Speaker: Jonathan Hassell Jonathan Hassell: Hello, and welcome to the TechTarget.com webcast, What s New in Windows Server 2008 R2: Active Directory, Group Policy and Terminal Services. I m Jonathan Hassell and I will be your host for this webcast. I run the Sun Valley Group, a technical writing company in Charlotte, North Carolina, and I have years of experience with Windows, both the client and the server, and a bunch of real world experience as well, so that s why I m happy to present to you some of the improvements that you can expect in Windows Server 2008 R2. Just by the way of a little bit of background, you know that Windows Server 2008 R2 is simply an incremental release. It s not a major release, a la Windows Server 2003 or Windows Server 2008, and therefore we can t expect the types of ground-breaking features and radical enhancements that those releases provided. Rather, Server 2008 R2 is a mid-band release. It s in between major releases and thus it s just a bunch of enhancements, and improvements, and refinements on the pieces of the software, of the user interfaces and the protocols that users and administrators use in their daily operations and interactions with Windows. So, some of those improvements are in the areas that we ll talk about today, in Active Directory, also in Group Policy and Terminal Services, which is now called Remote Desktop Services. So, there is a lot to cover here. Let s go ahead and get started. First off, let s talk about some of the benefits for Active Directory users in Windows Server 2008 R2. Active Directory has matured as the directory services of choice for large enterprises across the world. That doesn t mean there wasn t some room for improvement and in R2 Microsoft has released a new management console, so the user interface that you work with to manage your Active Directory. Directory services installation has changed. Hopefully, it s a little bit more refined, a little bit easier to use, more intuitive for you. But, more importantly is the introduction of the Active Directory Recycle Bin. Now, we ve all been in situations where we made mistakes when we re editing the Active Directory. We deleted an object by mistake. We move something that shouldn t have been moved and there wasn t any way to correct that error, lest you recreate everything and generally spend a lot of time trying to clean up after the mess that you made. The AD Recycle Bin promises to address a little bit of that pain. And, also we have the capability to join a domain offline, which is a boon for large data centers and also for remote offices with a lot of clients and slow or nonexistent connection to the domain controller, so there s a lot of juicy stuff here. So, the new Active Directory directory services Management Console is shown here on the slide. You can see it kind of takes on a Vista sort of user interface. You ve got the normal

2 three-pane taskpad interface with your navigation tree in the left pane and your action pane in the right, with the various tasks that apply to whatever you ve currently clicked. And, in the middle, you have the display of whatever it is that you ve selected. So, as you can see here in the left pane, we can browse through our directory structure with all of the different built-in organizational units and groups. In the right-hand pane, we see tasks that apply to the selection that we ve made, so in the user s organizational unit we can select a new user. We can look at the properties of the user that we ve selected, reset a password, add them to the group, disable them and so on. And, in the middle, you can see the display of the contents of the directory has been refined a little bit. We ve got a tabbed box down at the bottom. We can look at a summary of the properties of the object. We can, with one click on the member up tab, see what groups this particular object is a member of, and then we can, with just a couple of clicks, search through the directory listing that we have here at the top. So, you can see the search box under the user s label in the middle pane. You can type in whatever you d like to search for and filter based on that search term, and you can also customize some of the views that you have. And, at the top, you can see the breadcrumbs navigation, which is sort of an inherited aspect from Windows Vista and now Windows 7, and it has also permeated throughout Windows Server 2008 R2, but in particular is useful here because if you re going down into a very complex directory structure you can see how easy it would be to get lost, and so with the bread crumbs you can easily backtrack to where you d like to be and generally navigate a little bit easier than if you re having to follow the tree structure in the left pane there. You can also see it as a toolbar at the top, which allows you to connect to different domain controllers and perform other tasks that are specific to the context in which you re operating in. So, overall, I think this is a pretty good improvement over the old Active Directory computer interface that we had before. That was looking at little bit long since it really hadn t changed since the introduction of Active Directory back in the Windows 2000 Server. So, for those of you who that are still pretty manual and pretty graphically oriented, don t use a lot of PowerShell or other scripting techniques and administer your Active Directory deployment using a graphical user interface, I think you ll find the new Active Directory Administrative Center UI to be something that will make you a little bit more productive and hopefully make your day-to-day administration a little bit easier. So, along with the new user interface, we ve got the Active Directory Recycle Bin, and this has been something that has been a long time coming. The primary and only function of this Recycle Bin is to serve as an undelete function for when you accidentally delete something you didn t mean to delete. Now, you can see that, in your mind if you take yourself through deleting say a computer object from the Active directory, you can see how that might require more legwork, even if Active Directory could restore that object. But, Microsoft has really done a pretty good job of making this relatively seamless. So, if you accidentally delete a computer object, for example the security ID, or SID, isn t automatically removed. That SID that is unique to that computer isn t automatically removed rather it s restored just as if the object had never been deleted. So, if you accidentally delete a computer object and restore it, that computer, that client computer or that member server, or what have you, that object does not need to actually physically rejoin the domain after the deletion has been undone. So, that s a really helpful thing if you massively delete a whole bunch of objects that you didn t mean to. This is really helpful if you have a staff of junior administrators that get a little bit too happy with the delete copy or think they re deleting an object that doesn t exist anymore but rather it s an obscure computer in the corner that only runs simulations in lab or something and you accidentally find out that you need to restore that. So, the AD Recycle

3 Bin is certainly a big boon for those of us that are not perfect and definitely make mistakes within Active Directory administration. And, closing out the Active Directory side of this broadcast, we ll talk about Offline Domain Join. Now, this feature, before I go into it, you should know is specific to Windows 7 or Windows Server 2008 R2 machines, so anything down-level from that won t be able to take advantage of this feature. Basically, Offline Domain Join does exactly what it sounds like it does. You can join a domain, join a computer to a domain, without having to contact the domain controller. So, in the past when you join a computer to a domain, there has to be a process in which that computer introduces itself to a domain controller. The computer account is provisioned on the domain controller for that computer. Administrative credentials are provided so that computer can contact the domain controller and get its computer group memberships, obtain the necessary permissions and integrate itself within the domain. And, then after that process happens, Group Policy can be applied to that machine. It can be managed from a central administrative console, if that sort of things is set up. So, up until this point, in the past, that computer, the target computer that you wanted to join to a domain always had to be on a network with contact and the ability to talk to the domain controller, Windows Server 2008 R2. So, say if you re deploying a lot of virtual machines in a data center, you can install the operating system on those virtual machines and roll them out without actually joining them to the domain at first, and then you can set it up so that upon first boot they automatically join into a domain and that saves a lot of time and eliminates the need to restart all of these vast swaths of virtual machines that you might be deploying. It s equally helpful if you re connecting machines in a remote office and, for whatever reason, your connection to the main office, where the domain controller is located, is slow it s not existent for a certain period of time. You can still perform these domain join procedures in those conditions. And, also if you re familiar with joining machines to a domain against a read-only domain controller, that process is now simplified with this offline domain join procedure. So, this is just a better experience all around and in those specific situations where you need to be able to talk to the domain controller, this feature can now come in handy. So, the state changes on both the Active Directory side on the domain controller and the target computer. It can be done without any sort of network traffic passing between the two, and the big benefit is that each set of these changes can be completed at different times. You can prompt the domain controller at any time and then two weeks later, two months later, two years later prompt the client computers to join the domain and that traffic can be virtually nonexistent between the domain controller and the target computer. So, in these types of scenarios, this is definitely a very useful feature. The ability to join Active Directories from afar without having any contact with the domain controller is what this new feature, Offline Domain Join, offers you. Shifting gears a bit over to Group Policy, here we ll talk about some of the Group Policy enhancements in R2. First of all, there are some new cmdlets to manage Group Policy from within PowerShell. There are also enhancements to the actual Group Policy Editor interface, the interface that edits the ADMX files. It s richer and easier to navigate. And, also there are improvements to Group Policy Preferences, which was first introduced with Windows Server So, first off, there are new PowerShell cmdlets available within Windows Server 2008 to manage Group Policy. So, with these cmdlets, you can create, move, back up and import Group Policy Objects into Active Directory. You can manage the links and associations of those Group Policy Objects with containers in your Active Directory. You can set inheritance flags and permissions on Active Directory organizational units. You can

4 configure registry base policy settings and Group Policy Preferences from PowerShell and these new cmdlets. And, you can also manage the starter GPOs, which are predefined Group Policy Object templates, which are really useful if you have to create the same type of Group Policy Object over and over. That can be automated even more using the Starter GPO feature and these new PowerShell Group Policy cmdlets. So, if we take a look at a sampling of these cmdlets, you can see to get started you just have to import to Group Policy cmdlets module within PowerShell, and that s done using the first command import module Group Policy and then for a listing of all of the Group Policy Object cmdlets you can use to get help, PowerShell command using the GP log card as it s shown there, so the cmdlets to note, that you ll probably be using the most often. The new GP link creates new policy object linked. A new GPO obviously creates a new Group Policy Object. You also create a new Group Policy Starter Group Policy Object. You can back up, copy, import, rename and restore Group Policy Objects, which are all very useful in disaster recovery scenarios or to bring up a new machine, or a virtual machine that s in your test lab, all of these things are very useful and can be automated now with these new Group Policy cmdlets. There are many more. There are probably 25 to 30 of them. Again, you can get a listing of all of them using that Get Help link up there, that s shown second on the slide. So, definitely a very useful addition to Windows Server 2008 R2, the ability to manage Group Policy from the PowerShell command line using these new cmdlets. Something Microsoft has done for Windows Server 2008 R2 is also to improve the user interface that you re presented with when you re actually editing Group Policy Objects and their properties. This is a user interface that actually edits the ADMX files that hold the physical policies that are stored within your Active Directory. This new UI has integrated help content and the tabs that you might have been familiar with are definitely history, and personally I think those are good rid-its. They just crowded up the interface and made it very difficult for you to figure out where the information you needed was. So, you can see on this slide, as an example of the new user interface, you can see very clearly in the top left-hand corner you can enable, disable or leave un-configured effects of a policy. You could comment to other administrators or yourself for later reference. The options will be clearly laid out in the bottom left box, if there are any options more to enable or disable to that particular Group Policy Object, and also the integrated help is displayed there in the bottom right corner. You can navigate between settings in the Group Policy tree using the buttons at the top right, previous setting and next setting, and there is also support for these registrybased preferences, including various Multi Sz (ph) keys and Reg (ph) keyboard keys. So, definitely an improvement if you manage a lot of Group Policy Objects, you have to edit their configurations. I think you ll find the user interface to be much improved for doing activities like that. Rounding out our discussion of Group Policy, there are the enhancements that Microsoft has made to the Group Policy Preferences feature. This feature was introduced in Windows Server 2008 a couple of years ago and it lets administrators configure the default state for a lot of applications and a lot of desktop settings, like wallpapers, sound, screen resolution, etc. So, you can set up a default environment for your users, in essence suggestions for how they should configure things. The difference between Preferences and normal Group Policy Objects is that Preferences aren t necessarily enforced, so a user receives them by default but they can be changed by the user and the settings are not reset or the user is not prevented from making those changes. In Windows Server 2008 R2, Group Policy Preferences has been improved so that you have more control of the desktop. You also have control of setting preferences in applications that aren t preference aware themselves. Some manufacturers

5 have built-in figures that interact with the Group Policy Preferences feature and let the administrator configure some specialized options, but basic preferences, like default save to locations and so on are now available to applications that aren t preference aware. There is a better user interface for configuring these preferences. It s been streamlined and is more in line with the other user interfaces that you re familiar with. The Preferences feature itself was inherited within Windows when Microsoft purchased a third-party company. So, these user interfaces have been improved and streamlined so that it would look more like the tools that you re used to working with. There is better targeting of preferences to certain scenarios and there is also support for Preferences within Windows 7, including support for the new settings in Power Plan and for Scheduled Task trigger actions, and so on. So, some very minor but certainly needed enhancements, and certainly welcome enhancements to the Group Policy Preferences feature. So, now let s take a look at some of the improvements to Terminal Services in Windows Server 2008 R2. The first thing to note is that Microsoft has rebranded the venerable Terminal Services name. It s now called Remote Desktop Services, or RDS for short. That includes everything that is exposed on the client and the server. So, in Windows 7, Remote Desktop Connection is now Remote Desktop Connection, of course. Nothing has changed there but the Terminal Services pieces within Windows 7 and Windows Server 2008 R2 are now rebranded as Remote Desktop. Along with this rebranding, you have a new Remote Desktop Services Connection Broker which helps to broker traffic and send traffic to where it needs to go, also some experienced enhancements for those users that use Remote Desktop a lot and Remote Desktop Services a lot, and also some improvements to the RDP protocol itself. So, let s take a look at some of those. First off, let s take a look at the RDS Connection Broker. This Connection Broker is a piece that accepts and routes requests from clients that exist on your corporate network in all premises, from a remote location or from a user s home, or really wherever that user or that computer has an internet connection. This Connection Broker will accept these remote desktop requests and provide the connection with virtual or real desktops and applications. You ll note that a big piece of Microsoft s virtual push now is this Virtual Desktop Initiative, wherein you can have farms and libraries of virtual machines that are used for contractors and remote workers, and they can either be torn down each time someone logs off or the state of them can persist if you have a permanent user that s using this virtual desktop. It saves a lot on energy. It saves a lot on administrative costs, because you don t have physical machines that keep breaking. You basically just have a dumb terminal with graphics support that logs in and then this RDS Connection Broker could take that request and route it to any one of a number of servers running Remote Desktop Services. Along with the Connection Broker, it can be used with this virtual desktop infrastructure I was just talking about, and those virtual desktops can maintain their state in two different ways, either per user, meaning that one user is always mapped to one specific virtual desktop and any changes that user makes in that virtual desktop are persisted throughout sessions. So, any change that occurs on a Monday is automatically carried over to Tuesday, Wednesday and so on. So, a user could change his wallpaper and his theme, and all of that will persist. And, then you can also have a per session virtual desktop, which allows an administrator to configure a virtual desktop such that when a temporary worker logs in, he gets a standard bland virtual desktop with only the applications that he needs. Any changes that he makes to the environment are not persisted. So, if that person logs out and another temporary worker logs in, it s a completely bland environment again. So, you can have a very standard, very

6 vanilla, very intuitive virtual desktop for users in limited roles and also virtual desktops for those users that work from home or otherwise need more ability to customize their environment. Now, this Connection Broker can span multiple RDS services servers, so multiple machines that are running RDS can be a part of this kind of RDS farm and the Connection Broker will route requests from clients, no matter where they re located, either on your network or off your network, to this correct RDS server. The Connection Broker works with RemoteApp, with TS Web Access, which is now RD Web Access, and the RD Gateway Service. So, it s an integral plug-in piece to all of this. This is not a silo d kind of thing. This type of environment and configuring this type of brokerage in the past required that you investigate other solutions, like those from Citrix. So, this is a piece that Microsoft has brought in-house and is available to anyone who licenses Windows Server 2008 R2. So, it saves you money on the deployment and the ongoing annual licensing fees, and what not. This functionality is now in the product, it s baked in and it s very useful if you have a heavy investment into the Virtual Desktop Initiative or any sort of Terminal Services or RDS investment. There are also some enhancements to the user experience. When the user launches a Remote Desktop connection and connects to an RDS server running Windows Server 2008 R2, you ll experience a number of different things, including multiple monitor support so you can span a session of Remote Desktop connection across multiple monitors, just like you were using a console session. There is also enhanced RDS support with better sound quality and more audio channels, and what not, redirection for Windows media so that Windows media files played back on the client computer themselves rather than being rendered on the distant computer and having to be piped through automatically through the RDP connection. So, the result is a lot smoother video playback. I saw this in action one time at a Microsoft trade show and it was just unreal how smooth the Windows media playback was. There is also Aero Glass support from Windows 7 over a Remote Desktop connection and the experience is very smooth. There is not a lot of lag with the mouse between clicks or dragging things around and what not. And, of course, along with that is the enhanced bitmap acceleration, so really snappier responsiveness and just a general smoother experience while using a Remote Desktop connection. You can almost not tell over a fast enough connection that you are indeed using a Remote Desktop session rather than just interacting with a computer in a console session, so very nice improvements there. Also, just briefly, some enhancements to the RDP protocol itself and a lot of these have to do with the smoother experience I was just talking about. There is better command remoting, which is used where appropriate. If you have a video card that supports command remoting, that s where the host computer can send commands directly to the computer running the RDS session and the graphics can be drawn locally on that machine rather than all of the instructions having to be cached manually back and forth over the connection. So, it results in a much smoother experience and without a lot of lag, and the redraws are better. And, also there is an improved compressor for the Remote Desktop Protocol, so that results in bandwidth use improvement since compressed data, of course, takes less space to transmit over a connection. So, with the protocol enhancement combined with the user experience improvements, Remote Desktop Services is definitely a solution that you should investigate if you have a lot of users and you re interested in virtualizing some of your desktops. If you want to get rid of a lot of the client computers and centrally manage machines that your users can log into, RDS is now almost indistinguishable from a regular client session for most knowledge worker needs. So, these enhancements have really matured, that model, and

7 brought it forward so that it s able to be used by a number of different firms, so definitely something that you should check out. So, in summary, we covered a lot about what s new in Windows Server 2008 R2. We talked about some of the Active Directory benefits, including a new management console user interface, the Active Directory Recycle Bin and also the ability to join a domain offline. We talked about the Group Policy enhancements, including the PowerShell cmdlets that allow you to manage Group Policy directly from that command line, enhancements to the Object Editor interface that allows you to edit those ADMX files themselves, and also improvements to the Group Policy Preferences, including support for some of the Windows 7 Preferences that are now available for you, and we rounded out with a discussion about Remote Desktop Services, which was Terminal Services, that you might have been familiar with, including the new Remote Desktop Services Connection Broker, some of the user experience improvements and also the improvements to the RDP protocol itself. I hope this webcast has been helpful. Please feel free to shoot me an . My address is jon@jonathanhassell.com. I d love to hear from you, answer any questions that you have and thanks for joining us for this Tech Target webcast!