Index. Special Characters

Transcription

1 Index Special Characters 32-bit applications bit applications 367 A Access Control Entry (ACE) 141 Access Control List (ACL) 254 account lockout policies account security policies Active Directory See also Group Policy; IntelliMirror described 8 desktop management tools 15 IPSec policies 164 local infrastructure deployment non-active Directory computers 340 Active Directory Migration Tool (ADMT) 256 Add the Administrator security group to the roaming user profile share policy 302.adm files administration configuration management requirements 28 Group Policy objects 64, 93 Group Policy 56, software restriction policies and 188 Software Update Services 204, 219 administrative install 378 Administrative Templates extension 9 Administrative Tools Pack 459, 469 ADMT (Active Directory Migration Tool) 256 advertisement scripts 383 all user policies 80 81, Allow processing across a slow network connection policy 98, 99 Always use local ADM files for Group Policy Object Editor policy 102 Always wait for the network at computer startup and logon policy 297 application compabitility for updates 201 Application Data for user profiles 270 application deployment See software deployment application migrations 249 application server shares 455 Application Server 440 application-specific settings 249 Apply Group Policy permissions 72, 75, 89 approving SUS updates See also SUS synchronization list of 222 logs 223 overview revised content 215 assigning software audit policy settings 185 authentication IPSec setting up 463 wireless networks 178, 189, auto-install by file activation option 389 automatic policy refreshes 67 automatic synchronizations 209 automatic system updates See SUS (Software Update Services) automatic update approvals 215 Automatic Updates Active Directory environments 230 configuring , 463 deploying described 200 Group Policy 230 non-active Directory environments 231 overview 202 version upgrades 228 auto-populating migration tables 142

2 494 Index B backups Group Policy objects 73, Group Policy staging 122 servers bandwidth requirements software deployment and 372 basic services See SLAs (service level agreements) block filtering 163 C cache encryption 315 local workstation storage 275 Offline Files 321 roaming user profiles 335 categorizing applications 392 centralized automation certificates 254, 414 Change Domain Controller function 95 changed Group Policy settings 66 67, child servers 209 classifying applications 392 client components See SUS client components client operating systems client support for updates 202 client-side extensions collecting user state centralized automation manual migrations overview scripts user-driven migration 247 command prompt Group Policy Modeling 107 policy refreshes 104 restricting access 80 compabitility for updates 201 comparing registry images 255 Compatws.inf template 170 complete application installations 389 compression, roaming user profiles 296 computer migration See user state migration computer multiple user configuration 20 computer patch updates See SUS (Software Update Services) computer replacements configurations 43 examples 14 managed desktops for 288 Remote Installation Services 272 computer roles evaluating mapping configurations to computer security policies See security policy computer service evaluations 274 computer settings management 34 computer software restrictions computer-assigned applications 351, 388 configuration management additional resources 48 administrative requirements corporate policies 24 deployment plans 16 deployment process 4 6 designing desktop environment 19 examples need assessments 18 network requirements overview 1 4 roles 20 22, scope 17, 44 security requirements 23 software staging deployment 48 storage requirements technologies listed 7 11 testing configuring users and computers See Group Policy connectivity See also configuration management; slow links roaming user profiles 291 Software Update Services 204, 206

3 Index 495 container Group Policy object tasks 90 converting Group Policy object values CopyGPO.wsf 153 copying GPOs 111, 123, corporate policies 24, 63 corporate standard GPOs 80 cost calculations for migration 250 CreateEnvironmentFromXML.wsf CreateMigrationTable.wsf 147 CreateXMLFromEnvironment.wsf critical security rating 200 cross-forest GPO importing 122 cryptography Folder Redirection 312, 315 IPSec Offline Files 322 security policy 167 user state migration 254 Custom permissions 89 custom security templates 169 custom services See SLAs (service level agreements) customized home page URLs 14 customizing.inf files 240, 253 customizing User State Migration Tool 240 customizing Windows Installer packages 359 D DACL (Discretionary Access Control List) 111 data backups data management options 31 data migration See user state migration data-entry users 21, 42 DC security.inf template 170 DC See domain controllers (DC) decryption 254 default disk quota limits 337 Folder Redirection settings 308 Group Policy update intervals 100 migration files and settings 239 Offline Files state 331 policy restoration 73 default (continued) roaming user profiles 306 security settings 175 slow link settings 96 slow-link thresholds 61, 277 SUS settings 212 Default Domain Controller GPO 73, 167, 185 Default Domain GPO 73, 167, delegating administrative authority 59, Delete cached copies of roaming profiles policy 285, 296 desktop environment assessments 19 desktop configurations See managed desktop configurations detecting slow links 97 DFS (Distributed File System) configuring 372 described 371 root shares software distribution point servers 377 dictionary objects See metadata directory-based configuration management See IntelliMirror Diruse.exe 275 disabling GPO configuration settings 85 policy settings 70 roaming user profiles 304 script mappings 217 Disallowed security level disapproving SUS updates 223 disconnected file access See Offline Files Discretionary Access Control List (DACL) 111 disk partitions 437, 443 disk quotas administrative requirements 336 configuring described 10, 272 Group Policy options 339 overview 334, recommendations 336 roaming user profiles 296

4 496 Index disk quotas (continued) setting up 466 user preparation 292 disk space See also Folder Redirection allocations over-allocating roaming user profiles 296 storage requirements displaying SUS synchronization logs 221 displaying SUS update information 222 Distributed File System See DFS (Distributed File System) distribution point servers configuring overview 377 distribution points 218, 227 DLL checking 188 DNS (Directory Name Service) 129 DNS (Domain Name System) 213, 437 Do not apply during periodic background processing policy 99 domain controllers (DC) configuring deploying 437 desktop management 20 drive partition formatting 443 GPO editing 94 GPO links 73 recommendations 433, 435 security policies 185 slow links 61 specifying 95 time synchronization 442 domains GPO backups 122 GPO copying 123 GPO links 73, 85 GPO tasks 90 Group Policy synchronization migration 256 names 116 remote access 291 domains (continued) security policy 167, software targeting 384 drive partition formatting 443 E Edit permissions 89 Edit/Delete/Modify Security permissions 89 editing GPOs 84, 94 EFS (Encrypting File System) Folder Redirection 312 Offline Files 322 roaming user profiles 296 user state migration 254 , user state migration and 249 encapsulating packages 360 Encrypt the offline files cache policy 316 encryption Folder Redirection 312, 315 IPSec Offline Files 322 security policy 167 user state migration 254 Enforced option evaluating current environment desktop management 19 overview 18 roles events security policy 168 Software Update Services 223 exception management 76 Exclude directories in roaming profile policy 276, 297 excluding folders from user profiles 276 excluding local administrators 188 external domain users 92 external time sources 442 F fast logon enhancement 297 File Replication System (FRS) 371

5 Index 497 files See also Offline Files; Synchronization Manager; user state migration name collisions 253 relocations 253 user profiles 269 Files and Settings Transfer Wizard ACLs 254 encryption 254 overview 238 user-driven migrations 247 filters Group Policy objects IPSec firewalls shared resources 330 Software Update Services 206 first time log ons 12 folder migration See user state migration Folder Redirection default settings 308 described 10, 270 encryption 312, 315 Group Policy guidelines 312 home directories 310, 318 log files 319 logging on after 278 My Documents 309, 318 non-active Directory computers 340 Offline Files 309, 311 Outlook 311 overview 307 quotas 335 recommendations roaming user profiles 295 security setting up 463 special folders 317 Start Menu 311 user preparation 291 folders for user profiles 269 forced application removals 412 forcing synchronization 323 formats drive partitions 443 migration tables 146 Free Text or SID 142 FRS (File Replication System) 371 full synchronization 320 G GPMC (Group Policy Management Console) described 8 domain controllers 94 GPO backups , 122 GPO copying 111, 123, GPO creation 84 GPO importing 122, GPO links 472 GPO migration Group Policy Modeling 105 installing 57, 448 migration tables 124, overview scripts 117 software deployment troubleshooting staging tools synchronization GPOs (Group Policy objects) administration 64, 93 backups 73, , 122, 477 copying 111, 123, creating 83 87, 91 92, 463 delegating authority disabling settings 85 editing 84, 94 filtering importing settings 112 importing 122, 133, linking 73 75, 84, 472 migrating migration tables 124, number needed 72 79

6 498 Index GPOs (Group Policy objects) (continued) OU structure overview 52 permissions 89 production deployment replication 149 restoring 110 security policy 167 service level agreements 62 software deployment troubleshooting software restriction policies 416 software targeting synchronization troubleshooting 115 Gpresult.exe 107 Gptool.exe 61 gpupdate command 67, 474 granting profile share permissions 301 Group Policy See also GPMC (Group Policy Management Console); Group Policy planning; Group Policy staging; managed desktop configurations; security policy additional resources 117 administration 56, application scope 45 Automatic Updates 227, 230 changed settings interval 66 67, configuration management and 4 described 8 disk quotas examples 53 Folder Redirection 312 implementation process 54 inheritance 68 loopback processing 87 maintaining Offline Files overview processing order 70 roaming user profiles Group Policy (continued) slow link modifications 277 software deployment , , software upgrades 411 testing tools Group Policy containers 100 Group Policy Creator Owners security group 91 Group Policy deployment administration backing up client-side extensions domain controllers 94 GPO creation 83 87, operational guidelines 93 overview refresh intervals settings evaluation slow links stored information Group Policy design all users GPO quantity overview 68 preparation 55 process 54 scope 70 Group Policy Management Console See GPMC (Group Policy Management Console) Group Policy MMC snap-in See Group Policy Object Editor Group Policy Modeling Group Policy testing linked GPOs 472 settings evaluation troubleshooting deployments Group Policy Modeling Wizard , 138 Group Policy Object Editor 94 Group Policy objects See GPOs (Group Policy objects)

7 Index 499 Group Policy planning interoperability objectives operational guidelines 64 OU structure overview 58 refresh intervals service level agreements 62 software installations 68 Group Policy Refresh Interval for Computers policy 67, 103 Group Policy Refresh Interval for Domain Controllers policy 67, 103 Group Policy Refresh Interval for Users policy 67, 103 Group Policy Results Group Policy testing settings evaluation software deployment 423 testing deployment 474 Group Policy Results Wizard 115, 138, 180 Group Policy Slow Link Detection policy 61, 97, 99, 277, 283 Group Policy staging additional resources 156 creating GPO importing 133 hardware requirements 128 migration tables options overview populating domain 134 preparing 129 process 121 production deployment production examples production precautions 149 production preparation synchronization technology background testing verification checklist 150 XML format files Group Policy template 100 group security policies See security policy H hardware Automatic Updates 203 Group Policy staging 128 SUS server component 202 hash rules 414 hierarchies, Group Policy settings 59 high performance users 21 highly managed configurations 37 highly managed desktops 285 Hisec*.inf templates HKEY_CURRENT_USER 255 home directory redirection 310, 318 home page URLs 14 HTTPS 219 I-K identifying computers, user state migration 246 identifying migration content applications 249 cost calculations 250 data 248 overview 248 user settings IEEE 802.1X authentication Ignore Language parameter 386 IIS Lockdown tool 204, 216 IIS 201, 216 immediate SUS synchronizations 221 immediate updating, linked GPOs 474 ImportGPO.wsf 155 importing GPOs 122, 133, importing GPO settings 112 importing security templates 182 Inf Commands.doc file 239.inf files 239, 253 inheritance, Group Policy 68, 70, 80 in-place application upgrades 419 Install this application at logon option 374

8 500 Index installing operating systems remotely 36, 272 installing software updates 222 IntelliMirror See also managed desktop configurations additional resources 48 administrative requirements corporate policies 24 deployment plans 16 deployment process 4 6 design considerations desktop environment 19 examples features 7 need assessments 18 network requirements overview 1 4 roles 20 22, scope 17, 44 security requirements 23 software staging deployment 48 storage requirements technologies listed 7 11 testing user state management 266 internally synchronized servers 209 international considerations 201, 215, 386 Internet Explorer configuration management 9 policy settings 4 Internet zone rules 415 interoperability, Group Policy 65 intranet 206, 214 IP addresses 435, 445 IP filters IPSec (IP Security Protocol) applying changes 165 described 302 designing policies ISAPI handlers 217 job-based desktop configurations 20 Kerberos account policies described 302 kiosk workstations 41 knowledge users 21 L lab testing 259 language support 201, 215, 386 LAN-router connections 436 large-size organizations, software deployment LGPOs (local Group Policy objects) 16 lightly managed configurations 38 lightly managed desktops 286 Limit profile size policy 291, 297 link speed domain controller locations 61 measuring 95 specifying Group Policy for linking GPOs 73 75, 84, 472 load balancing 210, 220 Loadstate.exe 239 local Group Policy objects (LGPOs) 16 local infrastructure local security policies 185 local user profiles 10, 270, 304 local workstation storage 275 locales, SUS synchronization 215 locally hosted updates 214 lockout policies log wrapping 168 logging on examples fast logon enhancement 297 Folder Redirection and 278 GPO quantity and 72 roaming user profiles 290, 296

9 Index 501 logs Folder Redirection 319 roaming user profiles 307 security policy 168 SUS synchronization 221, 224 SUS update approvals 223 loopback processing applying user settings 20, 87 Group Policy staging 139 roaming user profiles 297 low-level GPO permissions 89 low security rating 200 M MAC (media access control) 246 major application upgrades 410 managed desktop configurations See also user state management highly managed desktops 285 lightly managed desktops 286 mobile users multi-user desktops new users 280 overview 278 replacing computers 288 managed environments See also simple managed environment additional resources 48 administrative requirements corporate policies 24 deployment plans 16 deployment process 4 6 designing desktop environment 19 examples need assessments 18 network requirements overview 1 4 roles 20 22, scope 17, 44 security requirements 23 software staging deployment 48 managed environments (continued) storage requirements technologies listed 7 11 testing mandatory user profiles 10, 270 manual migration table data entry 146 manual migrations manual policy refreshes 67 manual synchronizations 209 manually created upgrade relationships 411 mapping ACEs 141 security principals 141 source and destination values UNC paths 124, 141 maximum profile quotas 335 maximum profile size 276 MaxNoGPOListChangesInterval 100 measuring link speed 95 media access control (MAC) 246 medium-size organizations, software deployment member servers 20 merge loopback mode 87, 139 Merge mode 298 message digests 414 metadata 214 Microsoft Office 455, 459, 463 Migapp.inf 239 migrating applications to managed environment migrating Group Policy objects migrating user state additional resources 260 centralized automation collection methods data 248, 253 domains 256 file relocations 253 identifying content 248 manual overview planning 251

10 502 Index migrating user state (continued) registry 255 scheduling 257 scripts security storage system deployment methods and 241 testing tools user preparation 257 user settings user-driven 247 migration tables auto-populating 142 formats 146 GPOs manual data entry 146 mapping types 141 object types 142 overview 124, 141 scripts 147 Migsys.inf 239 Miguser.inf 239 minor application upgrades 408 mixed environments, Group Policy 65 mobile users configuring 284 managed configurations for 39, management features 283 need assessment 22 policies for 470 software installations 282 synchronization 282 moderate security rating 200 MOF (Microsoft Operations Framework) 2 monitoring SUS servers 223 MSF (Microsoft Solutions Framework) described 2 team model 17.msi files 64-bit applications 367 customizing 359 described 354 examples 360 overview 359 reauthoring applications repackaging applications 355, vs..zap files 364.msp files 407 MTE (Migration Table Editor) 111, 125, multilingual considerations 201, 215, 386 multiple domain controllers 433 multiple servers, Software Update Services 201, , 220 multiple user migration See user state migration multiple users accessing distributed software 376 multi-user configurations 20, 40 multi-user desktops My Documents redirecting 309, 318 user profiles 270 My Pictures 270 N names file relocations 253 name services integration 129 UNC 377 NAT (Network Address Translation) 435 native Windows Installer packages 64-bit applications 367 customizing 359 described 354 examples 360 overview 359 reauthoring applications repackaging applications 355, vs..zap files 364

11 Index 503 net start policyagent command 165 net stop policyagent command 165 Netsh IPSec context 164 network adapters, user state migration 246 network bandwidth requirements 24 28, software deployment and 372 network capacity 372 network file synchronization See synchronization network infrastructure client operating systems domain controllers evaluating physical network 436 setup steps 435 Windows XP Professional network keys 190 network load balancing 210, 220 network migration considerations 257 network requirements network testing network traffic assessments new user desktop configurations 280 new user log ons 12 NLB (network load balancing) 210, 220 No Override option See Enforced option non-active Directory computers 340 non-active Directory environments 15 notifications, Software Update Services 229 notifying file conflicts See Synchronization Manager Notssid.inf template 174 NTFS described 303 Folder Redirection roaming user profiles 296, 301 security policy 167 shared resources 330 O Offline Files available files and folders 320 caching 321 configuring , 463 described 10, 271 encryption 322 examples 13 Folder Redirection 309, 311 Group Policy guidelines overview 320 policy settings recommendations roaming user profiles 296 security shared resources synchronization 323, 333 Terminal Services 322 user preparation 291 on-demand application installations 390 Only allow local user profiles policy 304 open system authentication 189 operating systems See also user state migration remote configurations 4, 11 remote installations 36, 272 roaming user profiles 295 Software Update Services 202 Operations Master token 95 optional application removals 412 organization management requirements 17 OU (organizational units) administrator isolation 75 corporate standards 81 creating 448 described 54 designing GPO links 74, 85 GPO tasks 90 hierarchy 44

12 504 Index Outlook, folder redirection 311 over-allocating disk space overriding Group Policy objects 70 P packages 214, 222 packaging software 64-bit applications 367 native Windows Installer packages overview 357 repackaging applications zap files parallel deployments 241, 245 parent servers 209 passwords account password policies shared resources 330 patches See also SUS (Software Update Services) comparing deployment options examples 418 overview 407 path rules 414 PDC emulators 94, 442 per-container Group Policy object tasks 90 performance, software deployment 375, permissions Folder Redirection Group Policy delegations Group Policy objects 75, 89 IPSec roaming user profiles 301 Security Filtering 72 shared resources software distribution point servers 379 permit filtering 163 persisting security settings 168 physical network setup 436 pilot testing 47, 194, 259, 290, policy refresh intervals 66 67, policy settings See Group Policy polling IPSec changes 165 polling SUS servers 229 populating Group Policy staging domain 134 portable computer log ons 13 precedence Group Policy 70, 75 security policy 167 software restriction rules 418 software restrictions 186 wireless network policies predefined security templates recommendations 175 types preferred wireless networks Prevent access to the command prompt policy 80 Prevent access to the registry editing tools policy 80 Prevent Roaming Profile changes from propagating to the server policy 304 primary domain controller (PDC) emulator 442 priority processing, Group Policy 70, 74 Process event if the Group Policy objects have not changed policy 100 process users 21 processing order, Group Policy 70, 74 processor serial numbers 246 production environment staging See Group Policy staging profile quotas assigning 335 described 271 overview 334 user preparation 292 profiles See roaming user profiles; user profiles proof of concept testing 46 proxy servers 212 public updates Web site See Windows Updates publishing software

13 Index 505 Q quick synchronization 320 quotas described 271 disk quotas overview 334 setting up 466 user preparation 292 user profiles 335 R Read (from Security Filtering) permissions 89 Read permissions 72, 75, 89 reauthoring applications Recycle Bin 310 Redircomp.exe 44, 450 Redirect to home folder policy 309 redirecting Automatic Updates 231 redirecting folders default settings 308 described 10, 270 encryption 312, 315 Group Policy guidelines 312 home directories 310, 318 log files 319 logging on after 278 My Documents 309, 318 non-active Directory computers 340 Offline Files 309, 311 Outlook 311 overview 307 quotas 335 recommendations roaming user profiles 295 security server shares 457 setting up 463 special folders 317 Start Menu 311 user preparation 291 redirecting Users and Computers containers 44 Redirusr.exe 44, 450 refresh intervals 66 67, refreshing security settings 176 registered file types 249 registry Automatic Updates 231 Group Policy 80 hive 269 path rules 414 policy settings 9 user state migration 250, 255 relocating files 253 relocating registry entries 255 remote access, user preparation 291 remote administration configuration management 4, 11 network requirements Software Update Services 219 remote connection slow links 95, 98 Remote Installation Services See RIS (Remote Installation Services) remote log ons 13 remote operating system installations 36 remote user need assessments 22 remote user software deployment Remotely access Group Policy Results data permission 106 removing cached roaming profiles 336 Group Policy for Folder Redirection 312 installed applications 412, 419 Windows Updates access 230 renaming domains 116 repackaging applications 355, , 411 replace loopback mode 87, 139 Replace mode 297 replacing computers configurations 43 examples 14 managed desktops for 288 Remote Installation Services 272

14 506 Index replication Group Policy 66 67, 87, 94, 101 status information 149 requirements See also configuration management network software distribution point servers 377 Software Update Services 202 storage user 274 resolving file conflicts See Synchronization Manager resource management requirements 18 restarting IPSec service 165 restoring configuration on replacement computers 14, 43 default policies 73 GPOs 110, 122 Restricted Groups policy 168 Restricted/Permitted Snap-ins\Extension snap-ins policy 93 revised patch content 215 RIS (Remote Installation Services) See also managed desktop configurations described 11, 272 migrating applications roaming user need assessments 22 Roaming User Profiles See also Folder Redirection configuring deleting cached profiles 336 described 10, 270 disabling 304 Group Policy guidelines local profiles 304 log files 307 operating system versions 295 overview 295 policies for 467 policy settings 300 quotas 335 Roaming User Profiles (continued) recommendations security server shares shared computers 14 size reductions 276 user preparation 290 roles evaluating mapping configurations to rolling back deployments 156 root shares 308 Rootsec.inf template 174 router configuration 436 RSoP data 106 RSoP logging mode See Group Policy Results RSoP planning mode See Group Policy Modeling rules software restriction policies software restriction precedence 186 S scaling out SUS deployments scanning tool comparisons Scanstate.exe 239 scheduling Automatic Updates 229 scheduling migrations 257 scheduling synchronizations 221, 333 scripts advertisement 383 centralized automation configuration management 4, 9 copy deployments 153 disabling mappings 217 GPMC 56 57, 117 import deployments 155 manual migrations migration tables 147 non-active Directory computers 340 roaming user profiles 305 software upgrades 411 synchronization 131

15 Index 507 secedit/refreshpolicy command 67, 104 Secure Sockets Layer 219 Secure*.inf templates security See also security policy; SUS security configuration management 3, 9, 23 deploying 451 Folder Redirection registry 256 roaming user profiles shared resources software distribution point servers 379 software restriction policies user state migration Security Configuration Manager 161 Security Filtering 72, 75 security identifiers (SIDs) 256 security policy account policies additional resources 194 changing settings 169, configuration options 181 custom templates 169 default settings 175 deployment process 159 designing 162 encryption 167 Group Policy importing templates 182 IPSec local policies 185 overview predefined templates refreshing settings 176 Security Configuration Manager 161 settings guidelines software restrictions 176, testing 194 tools wireless networks , security principals 122, 141 serial numbers 246 server components (SUS) 201 server disk storage 275 Server Message Block (SMB) signing 303 server roles 441 server shares service level agreements (SLAs) described 28 Group Policy 62 settings migration See user state migration Setup security.inf template 170, 175 severity ratings 200 share level permissions Folder Redirection roaming user profiles 301 shared computer environments 13 shared files See Offline Files shared folders shared key authentication 189 shared resource security SIDs (security identifiers) 256 simple managed environment additional resources 478 Administrative Tools Pack 459, 469 all user policies assumptions backing up deployment process 431 deployment steps hardware requirements 434 local infrastructure mobile users 470 network infrastructure overview roaming user profiles 467 sample configuration shared folders software installation software requirements 434 testing user state management

16 508 Index simulating Group Policy deployment simultaneous migration See centralized automation simultaneous software deployment access 376 single-purpose workstations 41 site Group Policy object links 73, 85, 86 site Group Policy object tasks 90 site locations, Group Policy 61 size, profiles 276, 296, 335 SLAs (service level agreements) described 28 Group Policy 62 slow links domain controller locations 61 Group Policy staging 139 measuring 95 software deployment and 373, 375 specifying Group Policy for thresholds 277 Slow network connection timeout for user profiles policy 97 small application upgrades 408 SMB (Server Message Block) signing 303 SMS (Systems Management Server) See also SMS with SUS Feature Pack configuration management 15 software deployment 347, 374 user state migration 246 SMS with SUS Feature Pack described 200 vs. SUS software deployment additional resources 426 assigning software available to users 376, categorizing applications 392 computer-assigned applications 351, 388 distribution point servers Group Policy , maintaining after 405 software deployment (continued) migrating to managed environment network infrastructure options overview , packaging patches 407, 418 performance issues 375 preparing publishing software reauthoring applications remote users removing applications 412, 419 repackaging applications restiction policies targeting testing troubleshooting upgrading applications , user requirements 372, 380 user-assigned applications 351, software distribution point servers configuring overview 377 Software Installation Settings files See.zap files software installations 68, 282, software life cycles 405 software management options software restriction policies 176, , Software Update Services See SUS (Software Update Services) special folder redirection 317 SSL (Secure Sockets Layer) 219 staged configuration management deployments 48 staged SUS deployments described 201 scaling out testing 225

17 Index 509 staged user state migrations 259 staging Group Policy deployments additional resources 156 creating described 83 GPO importing 133 hardware requirements 128 migration tables options overview populating domain 134 preparing 129 process 121 production deployment production examples production precautions 149 production preparation synchronization technology background testing verification checklist 150 XML format files stand-alone Migration Table Editor 142 Standard User Policy GPOs 80 Start Menu redirection 311 stationary users 21 statistics, Automatic Updates 231 status information network performance 97 SUS approvals 222 stopping IPSec service 165 storage requirements determining 24 28, user state migration storing Group Policy information storing user data in managed environment 268 storing user settings in managed environment 269 SUS (Software Update Services) See also Automatic Updates; SUS deployments; SUS server components additional resources 233 SUS (Software Update Services) (continued) administering 219 application compabitility 201 approving updates connectivity 206 described 11, 200 IIS 216 installing 460 language support 201, 215 network load balancing 210, 220 overview 198 patches 347, 408 related information 197 vs. SMS with SUS Feature Pack Windows updates supported 201 SUS client components Active Directory environments 230 configuring deploying described 200 Group Policy 230 non-active Directory environments 231 overview 202 version upgrades 228 SUS deployments Automatic Updates comparing options described 198 designing scaling out server configuration server installations 211 staging content 225 SUS security administration 219 IIS 216 overview 204 severity ratings 200

18 510 Index SUS server components administering 219 configuring default settings 212 deployment design deployment process 211 distribution points 218 installing 212 monitoring functionality 223 overview scaling out SUS synchronization data types 214 distribution points 218 list of approved items 222 logs 221, 224 multiple servers 209 options 221 synchronization See also SUS synchronization DC time synchronization 442 Folder Redirection 312 Group Policy staging mobile user settings 282 Offline Files 10, 13 types 320 user preparation 291 Synchronization Manager configuring 333 described 271 Offline Files 323 roaming user profiles 296 user options 291 Synchronize all offline files before logging off policy 324 Sysdiff.exe 250, 255 Sysfiles.inf 239 system backups system migration See user state migration system updates See SUS (Software Update Services) Systems Management Server See SMS (Systems Management Server) Sysvol folder 100 T targeting software deployment assigning software GPOs multinational users 386 need assessments 380 options 372 publishing software scaling 384 task stations 42 tattooing 169 templates custom security templates 169 importing 182 predefined security templates roaming user profiles 306 security 23 Terminal Services 322, 347, 374 test user accounts 138 testing See also Group Policy staging configuration management designs Group Policy design 82 Group Policy migration processes patches 225 security policies 194 simple managed environment software deployment 375, user state management plans 290 Timeout for dialog boxes policy 291 tools Group Policy patch deployment options security policy user state migration

19 Index 511 traffic assessments transferring files and settings See user state migration transforms transitioning applications to managed environment translating Group Policy object values 114 translating registry entries 255 troubleshooting See logs trust relationships , Turn off automatic update of ADM files policy 102 Turn off background refresh of Group Policy policy 103 U UNC mapping 122, 141 UNC names 377 unicast mode 221 unlinking Group Policy objects 84, 85 Unrestricted security level untrusted relationships 154 update severity ratings 200 updating software 222 updating versions See synchronization Upgrade option 241 upgrade relationships 411 upgrading Automatic Updates 228 upgrading installed applications , URLs, customized home pages 14 Urlscan security tool 204, 216 user account testing 138 user configurations See managed desktop configurations user data defined 268 user data management 31 user data server shares User Group Policy loopback processing mode policy 87, 297 user management See IntelliMirror user preparation user profiles See also profile quotas excluding folders from 276 folders 269 management options 32 user profiles (continued) overview 269 quotas 271 scripts 305 size 296 types 9 user requirements determining 274 storage 275 user rights assignment settings 185 user roles evaluating mapping configurations to user security policies See security policy user settings management 32, 269 user software requirements 372, 380 user state management See also Folder Redirection; managed desktop configurations; Offline Files; roaming user profiles additional resources 341 assessing requirements deployment preparation 289 feature configuration implementation process 265 non-active Directory computers 340 overview planning policies for quotas technology background user preparation user state migration additional resources 260 centralized automation collection methods data 248, 253 domains 256 file relocations 253 identifying content 248 manual overview

20 512 Index user state migration (continued) planning 251 registry 255 scheduling 257 scripts security storage system deployment methods and 241 testing tools user preparation 257 user settings user-driven 247 user training and support 47 user-assigned applications 351, user-driven migrations 247 USMT (User State Migration Tool) ACLs 254 data management 253 described 11 domain migrations 256 encryption 254 overview registry 255 V version control See Synchronization Manager versions, Group Policy interoperability 65 Vertias WinInstall LE 369 viewing registered file types 249 viewing security templates 169 viewing wireless network settings 180 virus protection 389, 413, 416, 419, 425 W-Z WebDAV 375 WEP (Wired Equivalent Privacy) key 179 Windows Installer packages See also managed desktop configurations 64-bit applications 367 customizing 359 examples 360 Windows Installer packages (continued) options overview reauthoring applications repackaging applications 355, upgrades vs..zap files 364 Windows Update Synchronization Service 201 Windows Updates See also SUS (Software Update Services) described 199 removing access 230 SUS synchronization from Web site 214 Windows XP Professional WINS (Windows Internet Name Service) 129 wipe-and-load deployments 241, 244 wireless network policies , WMI filters delegating 92 Group Policy objects WMI Query Language queries (WQL) queries 77 WSH (Windows Script Host) scripts 131 XML zap files creating 364 described 354 examples 366 zone rules 415