5. Searching Group Policy
One of the strengths of
Group Policy also becomes one of its weaknesses. Just about anything you
want to manage or restrict for users and computers in a domain can be
done with Group Policy. However, locating the setting that you need can
be a challenge.
Thankfully, the GPMC that
comes with Windows Server 2008 and newer versions includes a search
feature. You can use this to search through the Administrative Templates
node. As a reminder, the Administrative Templates node includes
settings that will modify the Registry. This node is frequently used to
control the user desktop and environment.
You can filter Administrative Template Group Policy settings based on properties, keywords, or requirements. Figure 6
shows the search screen. You can access this screen by right-clicking
Administrative Templates in the Group Policy Object Editor and selecting
Filter Options.
You can remove the filter by
right-clicking Administrative Templates and selecting Filter On. The
Filter On selection can be toggled on or off and will have a checkmark
when enabled.
5.1. Searching Group Policy on Properties
You can filter the
viewable Group Policy settings based on one of three properties. Each of
these settings allows you to choose Yes, No, or Any:
Managed
When you select
Yes, only managed settings are shown. Most Group Policy settings are
managed, so this doesn't have much effect. An unmanaged Group Policy
setting is typically used to set preferences for an operating system
component.
Configured
Selecting Yes for
this setting allows you to filter the view based on Group Policy
settings that are set to Enabled or Disabled. If the Group Policy
setting is set to Not Configured, it is not shown when the setting is
set to Yes.
Commented
Administrators can add
comments to any GPOs. These comments can be useful in the future if
you're trying to remember why you configured a specific setting six
months earlier. Selecting Yes for Commented shows only the GPOs that
have comments.
These filters can be used
together. For example, if you want to see only the configured settings
that include comments, you can select Yes for Configured and Yes for
Commented. Only the settings that include both selections will be
included when the settings are combined.
5.2. Searching Group Policy on Keywords
The Keyword Filter allows
you to enter any text to search for a relevant Group Policy. This is
very useful if you have an idea of what you want to do but just can't
find the setting.
As an example, you may want to manipulate user profiles but can't find the settings. You can enter User Profiles as the words to search. By default, the filter will search for any occurrence of your search word or phrase in the following:
Policy Setting Title
Help Text
Comments
You can deselect any of these choices to limit the search.
5.3. Searching Group Policy on Requirements
The explanation of each
Group Policy setting in the Administrative Templates node includes a
Supported On section. Some are supported on Windows 2000 and above, some
only on Windows 7, and others on a mixture of operating systems. Some
settings apply only to applications such as Internet Explorer, and these
settings identify the version of the application where the setting is
supported.
You can use the
Requirements Filters to search based on the different operating systems
or applications. Filters are provided for the following:
Windows 2000 family
You can choose Windows 2000 without a service pack or with SP1, SP2, SP3, or SP4.
Windows XP
You can choose Windows XP without a service pack or with SP1 or SP2.
Windows Vista
You can choose Windows Vista without a service pack or with SP1.
Windows 7 family
Currently, only Windows 7 is
available, but as service packs are released, these will likely be
included if the Administrative Templates are updated.
Windows Server 2003
You can choose Windows Server 2003 without a service pack or with SP1 or SP2. You can also choose Windows Server 2003 R2.
Windows Server 2008
This includes the options of Windows Server 2008 and Windows Server 2008 R2.
BITS
Background Intelligent Transfer Service (BITS) versions 1.5, 2.0, and 3.5 can be selected.
Internet Explorer
Versions 3.0, 4.0, 5.0, 6.0, 7.0, and 8.0 can be selected.
Net Meeting
Version 3.0 is included.
Windows Installer
Versions 2.0, 3.0, and 4.0 can be selected.
Windows Media Player
Windows Media Player 8, 9, 10, and 11 can all be selected.
Figure 7
shows the Group Policy Management Editor with a filter enabled for
Internet Explorer 8.0 settings. Many of the nodes that normally appear
under Administrative Templates are not showing because they don't match
the filter. You can also see an icon of a filter on the Administrative
Templates nodes, which indicates that the filter is on.
When searching with the Requirements Filters, you can choose to include settings that match any
of the selected platforms or those that match all of the selected
platforms. For example, if you want to view only the settings that apply
to Windows Vista or Windows 7, you can select these two families as the
requirement and select Include Settings That Match Any Of The Selected
Platforms.
Launch the Local Group Policy Editor by clicking Start, typing in Group, and selecting Edit Group Policy.
Browse to the Computer Configuration =>
Administrative Templates node. When you select the Administrative
Templates node, an icon that looks like a funnel will appear on the
editor's toolbar. This is the Filter icon. Also notice that there are
five nodes within Administrative Templates (six if you count the All
Settings node).
Right-click Administrative Templates, and select Filter Options.
Select Enable Keyword Filters. Ensure that Policy Setting Title, Help Text, and Comment are all checked. Type in Profiles and click OK.
The filter will be enabled, and only the System node and the Windows Components nodes will be showing.
Select each of the nodes to see the available settings. Only settings with the word Profiles in the settings title, help text, or comment sections are included.
Right-click
Administrative Templates and select Filter On. This will toggle the
filter so that it is off. All of the Group Policy settings will
reappear.
Right-click Administrative Templates, and select Filter Options.
Deselect the check box for Enable Keyword Filters.
Select
Enable Requirements Filters. Select Internet Explorer 8.0 and click OK.
Only the settings that apply to Internet Explorer version 8.0 will
appear.
Click the filter icon on the toolbar. The filter will be removed.
