William Stanek: Getting the green light on Group Policy Preferences

  • Article

Mr. Stanek starts our day:

William here. Okay, call me a zealot. I probably am but when a technology works I’m not afraid to say it (and I’m not afraid to proclaim it from the rooftops either), so here I go with a bold statement: I just don’t understand why Group Policy Preferences (GPP) aren’t being used everywhere. I first started exploring GPP when I was doing research for my book Windows Group Policy Administrator’s Pocket Consultant. That was back in 2008. Now in 2009, I don’t find as many organizations using GPP as I thought there would be. My thought: Some people just don’t understand the technology, so I’m going to write a series of blog entries about GPP that I hope will change that and might also help administrators get management to say, “Yes, we want GPP.”

You may be wondering what GPP is all about, and that’s where I’ll start. Group Policy preferences differ from Group Policy settings in many ways. If you think of GP settings as a set of rules that you apply to computers and users, you can think of GP preferences as a set of guidelines that you apply to users and computers. Alternatively, you can think of GP settings as managed settings for computers and users, and GP preferences as unmanaged settings for computers and users.

You use settings to control configuration of the operating system and its components. Often settings you apply prevent users from making certain changes to their computers. On the other hand, you use preferences to establish baselines. Users can change settings applied through preferences (though you can have GP reapply preferences automatically as part of the policy refresh process). So it’s apply once or reapply with refresh for preferences.

Other things to keep in mind:

  • When you configure GP settings, changes typically are made in policy-based areas of the registry and original settings are not overwritten. When you configure GP preferences, changes are made in the same areas of the registry used by the operating system and applications, which overwrites the original settings.
  • When you remove a GP setting, the original settings are restored. When you remove a GP preference, the original settings are not restored.

Bottom line: GP settings are enforced, and GP preferences are not enforced. So if that’s the case, why use preferences? I’ll tell you why in my next post. Thanks for reading!

William R. Stanek

williamstanek at aol dot com

Twitter at williamstanek