Group Policy and Organizational Unit Re-Structuring Template

Transcription

1 Document Information Document Title: Document Purpose: Group Policy and Organizational Unit Re-Structuring Template This document captures the data required to perform OU and GPO restructuring This document will walk through about the due diligence, risks involved, Operations support and testing. Document Owner Author Sainath K.E.V, Microsoft Most Valuable Professional 1. Introduction Most of System Engineers, Consultants and Architects are aware of Active Directory and Group Policies in length. Group policies are one of the most critical components in any Infrastructure design which acts as security boundary and reduces the need to create additional Active Directory Domains. Most of the Microsoft articles discuss about setting up Group Policies to the internals of them. But I thought of bringing insight about the Organization Unit restructuring due-diligence which is vital part in GPO design. 2. Organization Unit Re-Structuring Due Diligence Collect the scripts, WMI Queries, custom ADM templates configured for the OU. List down all the Group Policies currently configured for the OU and child OU s. List the current scope of management comprising group membership to manage OU and child OU s respectively.

2 List down the policies configured under Synchronous / Asynchronous List all Block policy inheritance applied at the domain level and on the OU level List all the Enforced policies configured at the OU and child OU s List down the security filtering configured on the OU and child OU s List down the Group Policy preferences configured for the clients List down the disabled Group policies configured under OU and child OU s List down the inaccessible Group Policies configured under the OU s and child OU s List down the group policy precedence order List down the SCCM or SMS collection query pointing to the OU and child OU respectively. List down all the LDAP queries ( DN s ) used in applications pointing to the OU and child OU List down the windows services configured to use the OU and child OU DN Plan for the computer objects and user objects which needs to be moved to new OU structure. Plan the group policy delegation for the OU s and child OU s respectively. Make sure the Domain controllers replication is healthy Create the new OU structure on the healthy domain controller Wait for the OU structure to get replicated across the active directory forest Communicate the new OU structure to support team The above points will ensure the due-diligence is done appropriately. 3. Risks

3 Risk that scripts ( ADM and WMI ) might fail due to new OU DN structure. Risk that Failure of windows services Risk that SCCM or SMS collection membership might failure Risk that precedence order would change Risk that OU structure is not replicated properly Risk that group membership is assigned inappropriately on OU and child OU level Risk that GPO s are not synchronized properly 4. Operations Checklist Delete the unwanted computer objects and user objects and wait for the domain controllers to get replicate the changes across forest. Delete the redundant group policies configured under the OU and child OU s Delete any blank group policies configured under OU and child OU s Add the new active directory users under security group memberships Move the computer objects and User objects into appropriate OU and child OU s Assign the Group membership to OU and child OU s Link the group policies to OU and child OU s with proper precedence level Enforce the required Group policies at the OU and the Child OU s level

4 Change the DN / OU path configured under Scripts ( WMI / ADM ) mapping to new OU structure Change the DN / OU path for any application used to retrieve data from the OU and child OU s respectively 5. Post GPO Implementation Checklist Confirm the OU structure in place Ensure that Users and Computer objects are moved appropriately to the OU and child OU s respectively. Ensure the Security membership is configured appropriately Ensure that all the Group policies are configured as per the precedence level Ensure the Support team is provided administrator access to manage the desktops Ensure the OU structure and GPO structure is replicated across the AD forest Ensure the SCCM / SMS collection query are updated to the new OU path Ensure the scripts and services are updated with the new OU path. Ensure all the applications retrieving information from the OU are changed with the new DN path / OU path. 6. Testing

5 Ensure that users are able to logon to their desktops / laptops Ensure that Group policies are applied successfully on all the desktops / laptops \ Use Group policy utilities to troubleshoot or analyze the data collected Check the applications / scripts for any errors Test for SCCM / SMS collections Conclusion The above document would assist GPO / OU Architects / Engineers in performing valid evaluation of existing environment and migrating to new OU structure.