Group Policy

Windows Vista contains over 800 new group policy settings. Improved management and configuration settings include:

• Blocking portable media device installation

• More Internet Explorer security settings

• Improved IPsec and Windows Firewall settings

• Improved administrative templates

• Improved printer control (location-based, can allow users to install)

• Improved power management

There are also several new user rights, such as the ability to grant users the right to change time zones. In addition, there are dozens of new security settings.

The Group Policy Management Console (GPMC) is installed by default, no longer requiring a separate download. On the client-side, one of the biggest changes is that group policy application is no longer under the mandate of the Winlogon.exe process, as it is in prior Windows operating systems. It is now its own separate Group Policy Client, with increased reliability, increased functionality, and more intelligence about what to apply when. And, even more important, it has significantly better logging (see the Improved Event Logs section above).

There is a new Administrative Templates format, known as ADMX files (matching their new file extension). ADMX files are "easily" editable XML files, with increased functionality and capable of multi-language support. They will be stored more efficiently in Longhorn server, with ADMX templates being stored in a central Sysvol location, instead of individually being attached to one or more group policy objects. Legacy ADM files are still supported, however.

Another important client-side change is the ability to have multiple Local Computer security policies, instead of the computer having only one. Actually, there is still only one Local Computer policy, but it can have different settings for different users or groups. Chapter 14 will cover group policy in more detail.