Other Group Policy Uses

The settings showed in this chapter are only the tip of the iceberg in terms of the number of settings available to configure using group policy. In fact, there are many more settings than the ones shown in the Group Policy Editor by default. The capabilities of group policy can be expanded by using additional administrative templates (ADM), which normally contain settings specific to a program.

One of the most used sets of administrative templates comes with the Office 2003 Policy Template Files and Deployment Planning Tools. You can download them here: http://office.microsoft.com/en-us/assistance/HA011513711033.aspx.

This kit includes 11 administrative templates that control everything from the behavior opening unsafe macros to showing full menus when you click on them. Similarly, numerous templates are available for other applications. In some cases, if you can't find what you are looking for creating your own ADM templates is a possibility (KB article #323639 gives you an overview of the process).

Another use of group policy includes deploying software automatically to workstations. Although SBS has its own system of distributing software (select Server Management, Client Computers, Assign Applications to Client Computers), using group policy is much more versatile and doesn't require user interaction.

More information on deploying software using group policy can be found at http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/DepKit/3ddda5bf-cf67-4408-b68c-7e1fcb5e47ee.mspx.

If all your workstations are running Windows XP (or Windows 2003 Terminal Servers), you can even enable Software Restriction Policies. This feature allows you to identify and block certain programs from running in your domain. (You could use this to block those pesky P2P programs from running at all!)

More information of software restriction policies can be found at http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/TechRef/ad3b6293-4a22-46a5-a95b-7c50ca1fd1fb.mspx.