How do you manage Windows Group Policy for XP, Vista, and Win 7 clients?

Question

DOMAIN = w2k3 DC's only

WORKSTATIONS = xp, vista, and now a few Win 7 Enterprise

I have the RSAT tools installed on my Windows 7 computer.

I can administer Group Policy Management "for the most part" on my Win 7 computer for the domain, even with XP clients.

However, certain policies (such as Windows Firewall policies) show different settings and even a different interface depending on if I use the GPMC on Vista/Win7 versus using the GPMC on W2k3.

And if I create new settings on a Vista/Win7 GPMC and then try and look at those gpo settings in the GPMC on w2k3 then it typically gives a "page cannot be displayed" from there...although it looks fine on the Vista/Win7 GPMC.

SO....my question(s) is(are)...

What GPMC should I be using or can I use to properly manage and deploy GPO's to XP and Vista and Win7 computers? Can I use a single console? If so, which one do I use? Are there issues (pros/cons) regardless?

I like using the one in Windows 7 for the added functionality but I'm concerned about its "backwards compatibility" (such as the Windows Firewall settings in the policies) for XP.

Answer 1

I was just reading up on this. You'll find some very useful information at http://technet.microsoft.com/en-us/library/cc766208%28WS.10%29.aspx on how GPOs work in a mixed-mode environment.

Basically, the recommendation is to use the newer client to manage GPOs, as this has a number of improvements - how it stores the GPO itself on the SYSVOL share, among several.

As you noticed in the firewall settings, there are some parts of the GPOs that are just not compatible between the different versions. I've been trying to find the MS documentation on this but I just couldn't locate it in a hurry. Do some searching, though, and you'll find it.

Answer 2

To my understanding the issue has to do with the schema in the AD tree itself, and to some extent the type of DC's you have. You have a 2003 tree. If I'm remembering right, 2003r2 includes GPO improvements to support Vista clients. 2008 improves more on that, and 2008r2 adds Win7 support to the GPO environment.

Use the GPO Console for the schema-level in your domain. It sounds like you should use the gpmc for 2003, not the gpmc for 2008.

Answer 3

GPOs are unrelated to AD Schema version. AD only stores GUIDs, Links and pointers to the SYSVOL\domain\policies share where the GPO settings are actually stored.