Troubleshooting Group Policy is now easier in that there’s a dedicated event log just for Group Policy events. Server 2008 introduces the concept of “preferences,” which you can use when you want to make settings that don’t need to be enforced. These are like suggestions, in that the settings take effect initially but users can change them – unlike “real” policies which are not modifiable by users.
Of course there are a bunch of new categories of Group Policy settings to think about when you plan your migration. Most of these apply only to Vista and Server 2008 systems. These include things like restricting device driver installation, managing power settings, User Account Control policies, pre-configuring wireless networking settings, and so on.
But one of the most interesting new policy categories may shake the very foundations of your Active Directory domain plan: fine-grained password policies. In Server 2003 and 2000, all Ous in the same domain shared the same password and account lockout policies. In Server 2008, you can create Password Settings Objects that you can apply to security groups, so that you can have different user sub-populations within a domain that have their own unique password policy settings. This could be a huge change for some organizations in the sense that they could potentially do some domain collapsing and simplify their AD design; unfortunately, the new system isn’t perfect, because the Password Settings Objects don’t apply directly to Organizational Units. Microsoft suggests you make “shadow groups” that mirror your OU membership. Hmm, one more thing to manage… well, it might be worth it if you can get away with fewer domains in your forest.
See recent blog posts…
The evolution of Group Policy in Windows Server 2008 – Part 1
Server Manager – One-stop shop for Server Administration
Back to the Future with Read-Only Domain Controllers
Windows Server 2008 Migration Considerations
