In today's lesson, I will talk about group policy. Group policy allows us to configure both computers and users within a Windows domain a number of different ways. And by a number, I mean almost 1,000 different ways. We can configure anything from how they log in to what computers they access to software they can install on their computers, and many, many more things. In order to access group policy management, we can either go to the Windows Administrative Tools Folder or you can just type in group policy management when you click the Windows Start Button. You'll see any forest that you have in the domain, so Williams.local is our domain. So I'll click that down. We're going to see a number of different things. Domains, I'm going to modify my domain williams.local. If I click on this, it says we've selected a link to the group policy object. Changes here are global, so they're going to affect everything. That's okay, let's just press OK. And we'll increase the size here. Here's our location. And here's how we want the users to receive, or what users we want to receive the policy. We can also put policies on domain controllers and other policies as well. So let's take the default domain policy. You're going to right click it and press Edit. This is going to bring up the Group Policy Management Editor. I'll click on Policies, and start to configure three different types of policies. We have software settings, windows settings, and administrative templates. Okay, also I can configure information for users. However, we're going to configure a policy underneath Computer Configuration at the moment. So let's click the down arrow on Windows Settings, and we're going to look up Security settings. Let's just expand this here. Notice, how we have a lot of policies that we can configure. So even with these drop down menus, we have even more. So I'm going to click through some right here and show you how large these policies actually are. So we can configure firewalls. We can configure network cards. We can configure their certificates in public key policies. Additionally, software restrictions. But let's go back up here to Account Policies. We're going to click the Password Policy here. And notice what we can configure. So the default policy enforces the last 24 passwords remembered. Maximum password age is 42 days. The minimum password age is one day. The reason why we have minimum password age is so that users cannot continually change their password those 24 times within one day. The reason for that is, if somebody likes their old password, they could keep on changing it until the 25th password and then it becomes the standard password again. Minimum password length is seven characters. Password must meet complexity requirements, enabled stored password using reversible encryption. This is always going to be disabled and always should be. Now, on passwords for a minute. Minimum password length. This should always be changed to something much, much higher. I would venture to say 12, at least 12. The reason 12, is the more characters that we add to our password, the exponentially hard it becomes for somebody to crack that. Okay, password must meet complexity requirements. Anymore, complexity requirements don't necessarily matter. It's really the password link that matters. So I'm going to turn this off in my policy. All right, now, I have a pretty weak password on this system. So I am going to exit it out here. Let's modify a user in the domain. Windows administrator tools, down to Active dDirectory users and computers. And here's my Greg Williams account that I made in the last lesson. We're going to right click on this, and we're going to press Reset Password. We're going to intentionally choose a password that does not meet any of the complexity requirements that we just modified. So 1, 2, 3, 4, 5, 6, 7, 8, 1, 2, 3, 4, 5, 6, 7, 8, and press OK, and look, it doesn't allow me to change it. So password changes or any policy changes are instantly made to anything on the domain. Now, if we have a computer on the domain, those policies aren't going to take effect until that computer checks in again to the domain controller. So we can force a computer to automatically obtain the new policy by running a command call gpupdate. So I'm in my command prompt, here, and we'll type in gpupdate, so that stands for, Group Policy Update. And we're going to just say force. But because this is a domain controller, it's probably not going to do anything. Because it's already updated. It's already pulling it's own policy. So computer policy update has completed. Now, you can do that on any Windows domain computer as long as you have rights to do it. That's going to pull down the policy and enforce that policy on the user. This is a great way to check if the policies that we have made are successful or not nearly instantly. So in this lesson, I talked too a little bit about group policy and showed you where you can configure items. There are so many configuration items, it's really up to you to go in and configure policies that makes sense.
