Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

Group Policy in Forest and Multiforest Scenarios

Group Policy is primarily a domain-centric process. That is, Group Policy Objects (GPOs) are created to control users and computers that have accounts in specific domains. The GPOs are linked to the domain or the domain's OUs. The exception to this is the Site GPO, a rare beast that can impact users in multiple domains depending on the location of domain users and computer accounts and where they log on. However, site policies only affect computers and users whose accounts reside in that site. The site GPO is limited to a single forest. There is no Group Policy mechanism for managing users forest-wide, and there is no mechanism for implementing a single GPO that can impact multiple forests.

However, it is still necessary to manage Group Policy across multiple domains in a forest to ensure consistency of policy. It may also be useful to be able to manage Group Policy across forest boundaries. The tedious practice of inspection, reviewing, querying, using, and understanding Group Policies in the forest can be alleviated by using the Group Policy Management Console (GPMC).

Using GPMC in a Multidomain Forest and with Multiple Forests

GPMC was introduced in Chapter 8, and its functionality was described for use by a single domain. In a multidomain forest, you can use these same functions to view GPOs for a domain, and you can use GPO planning and logging mode for each domain in the forest. Remember: There is no such thing as a GPO that is created at the forest level. If you understand and have practiced with GPMC in a single domain, you have most of the knowledge needed to use it in a multiple-domain forest or with multiple forests. However, there is one major issue with using GPMC in this environment. When GPMC is used to copy a GPO from one domain to another, you must be aware of domain-specific information and make adjustments accordingly.

Most of the information in a GPO is not domain-specific, and copying this part of the GPO to another domain does not cause a problem. Other information, such as user and Group SIDs, is domain-specific, and URLs may be, too. Leaving these items as they are in the original GPO may interfere with proper functioning of the new GPO at its new location. For example, if a group of user rights is assigned to domain A's groups, and the GPO is copied for use in domain B, what will it mean? Users from domain A will have access to domain B rightsis this what you wanted? Users from domain B will not have the rights they expected. Even the SIDs of built-in domain groups will vary from one domain to another.

Because this domain-specific information cannot be changed automatically, GPMC provides a tool called migration tables to assist you in using a copy of a GPO in another domain. Before making the copy, you prepare a migration table. The table is used during the copy to translate or replace one domain's domain-specific information with the appropriate information from the other domain.

Working with multiple forests in GPMC is similar to working with one forest. Each forest has its own root. Adding a forest to GPMC is a simple process:

Using Migration Tables

User- and group-related information varies among domains in a forest and between forests. When a GPO is copied between two forests, the GPO may not function, or may not function as designed. To ensure that the GPO does its job, use migration tables to map users and groups from one domain to another.

To create the migration table, follow these steps:

To copy a GPO from a domain in one forest to a domain in another trusted forest follow these steps:

After the GPO has been copied to its new domain, it must be linked to the domain or OU before it will have any effect on users or computers. To link the GPO to a domain or OU:

Finally, check the GPO to ensure that names were migrated. For comparison, Figure 8-45 shows the details of the copied GPO, while Figure 8-46 shows the GPO implementation in the new domain. As you can see, the appropriate domain and group names were changed.

TIP: Selective Authentication and GPMC

If selective authentication is required, GPMC cannot add another forest until the Administrator using GPMC has been given access in the other domain.