new DC 2008 R2 with 2003 GPO

Question

I've been having some issues with firewall and the likes concerning GPO being applied on my new 2008 DC. Is there anything that would make 2008 act differently than a 2003 server when it comes to GPO policies?

Answer 1

Your best bet is to create a new group policy object and edit it from the Server 2008 machine (or a Windows 7 machine, if you have one of those). I don't like the idea of installing unrequired software on a production server, but you'll have to find a happy medium between provisioning a new Server 2008 or Windows 7 machine or utilising an existing Server 2008 resource. In any case, here's the basic steps you can utilise:

1. Install the Group Policy Management Console. On Server 2008, it's part of Server Manager by default. For Windows 7, you will need to install the RSAT update before the Group Policy Management option shows up in the Windows Features section (under the RSAT node).
2. Edit the new group policy - don't edit an existing policy.
3. Add the firewall settings you require under the Computer Config > Windows Settings > Security Settings > Windows Firewall with Advanced Security.
4. Close the group policy editor.
5. Review the settings of the policy via the Settings tab.
6. Link the policy object to the OU that contains the Server 2008 machine(s).
7. Either wait, or run a gpupdate /force on the Server 2008 machine you want the settings to apply to.

The 2008 policies are just files, and they could happily live on a Windows 2000 domain controller. The important part is that they're created by a Server 2008 or Windows 7 machine. That's the key.