Windows Group Policy Interview Questions

What is group policy in active directory ? What are Group Policy objects (GPOs)?

 
Group Policy objects, other than the local Group Policy object, are virtual objects. The policy setting information of a GPO is actually stored in two locations: the Group Policy container and the Group Policy template.

The Group Policy container is an Active Directory container that stores GPO properties, including information on version, GPO status, and a list of components that have settings in the GPO.

The Group Policy template is a folder structure within the file system that stores Administrative Template-based policies, security settings, script files, and information regarding applications that are available for Group Policy Software Installation.
The Group Policy template is located in the system volume folder (Sysvol) in the \Policies subfolder for its domain.

What is the order in which GPOs are applied ?
Group Policy settings are processed in the following order:
1.Local Group Policy object : Each computer has exactly one Group Policy object that is stored locally. This processes for both computer and user Group Policy processing.

2.Site : Any GPOs that have been linked to the site that the computer belongs to are processed next. Processing is in the order that is specified by the administrator, on the Linked Group Policy Objects tab for the site in Group Policy Management Console (GPMC). The GPO with the lowest link order is processed last, and therefore has the highest precedence.

3.Domain: Processing of multiple domain-linked GPOs is in the order specified by the administrator, on the Linked Group Policy Objects tab for the domain in GPMC. The GPO with the lowest link order is processed last, and therefore has the highest precedence.

4.Organizational units : GPOs that are linked to the organizational unit that is highest in the Active Directory hierarchy are processed first, then POs that are linked to its child organizational unit, and so on. Finally, the GPOs that are linked to the organizational unit that contains the user or computer are processed.

At the level of each organizational unit in the Active Directory hierarchy, one, many, or no GPOs can be linked. If several GPOs are linked to an organizational unit, their processing is in the order that is specified by the administrator, on the Linked Group Policy Objects tab for the organizational unit in GPMC.

The GPO with the lowest link order is processed last, and therefore has the highest precedence.
This order means that the local GPO is processed first, and GPOs that are linked to the organizational unit of which the computer or user is a direct member are processed last, which overwrites settings in the earlier GPOs if there are conflicts. (If there are no conflicts, then the earlier and later settings are merely aggregated.

How to backup/restore Group Policy objects ?
Begin the process by logging on to a Windows Server 2008 domain controller, and opening the Group Policy Management console. Now, navigate through the console tree to Group Policy Management | Forest: | Domains | | Group Policy Objects.

When you do, the details pane should display all of the group policy objects that are associated with the domain. In Figure A there are only two group policy objects, but in a production environment you may have many more. The Group Policy Objects container stores all of the group policy objects for the domain.

Now, right-click on the Group Policy Objects container, and choose the Back Up All command from the shortcut menu. When you do, Windows will open the Back Up Group Policy Object dialog box.

As you can see in Figure B, this dialog box requires you to provide the path to which you want to store the backup files. You can either store the backups in a dedicated folder on a local drive, or you can place them in a folder on a mapped network drive. The dialog box also contains a Description field that you can use to provide a description of the backup that you are creating.

You must provide the path to which you want to store your backup of the group policy objects.
To initiate the backup process, just click the Back Up button. When the backup process completes, you should see a dialog box that tells you how many group policy objects were successfully backed up. Click OK to close the dialog box, and you're all done.

When it comes to restoring a backup of any Group Policy Object, you have two options. The first option is to right-click on the Group Policy Object, and choose the Restore From Backup command from the shortcut menu. When you do this, Windows will remove all of the individual settings from the Group Policy Object, and then implement the settings found in the backup.

Your other option is to right-click on the Group Policy Object you want to restore, and choose the Import Settings option. This option works more like a merge than a restore.
Any settings that presently reside within the Group Policy Object are retained unless there is a contradictory settings within the file that is being imported.

You want to standardize the desktop environments (wallpaper, My Documents, Start menu, printers etc.) on the computers in one department. How would you do that?
go to Start->programs->Administrative tools->Active Directory Users and Computers
Right Click on Domain->click on preoperties
On New windows Click on Group Policy
Select Default Policy->click on Edit
on group Policy console
go to User Configuration->Administrative Template->Start menu and Taskbar
Select each property you want to modify and do the same

What?s the difference between software publishing and assigning?
Assign Users: The software application is advertised when the user logs on. It is installed when the user clicks on the software application icon via the start menu, or accesses a file that has been associated with the software application.

Assign Computers: The software application is advertised and installed when it is safe to do so, such as when the computer is next restarted.

Publish to users: The software application does not appear on the start menu or desktop. This means the user may not know that the software is available. The software application is made available via the Add/Remove Programs option in control panel, or by clicking on a file that has been associated with the application. Published applications do not reinstall themselves in the event of accidental deletion, and it is not possible to publish to computers.

What are administrative templates?
Administrative Templates are a feature of Group Policy, a Microsoft technology for centralised management of machines and users in an Active Directory environment. Administrative Templates facilitate the management of registry-based policy. An ADM file is used to describe both the user interface presented to the Group Policy administrator and the registry keys that should be updated on the target machines.

An ADM file is a text file with a specific syntax which describes both the interface and the registry values which will be changed if the policy is enabled or disabled.

ADM files are consumed by the Group Policy Object Editor (GPEdit). Windows XP Service Pack 2 shipped with five ADM files (system.adm, inetres.adm, wmplayer.adm, conf.adm and wuau.adm). These are merged into a unified "namespace" in GPEdit and presented to the administrator under the Administrative Templates node (for both machine and user policy).

Can I deploy non-MSI software with GPO?
create the fiile in .zap extension.

Name some GPO settings in the computer and user parts ?
Group Policy Object (GPO) computer=Computer Configuration, User=User ConfigurationName some GPO settings in the computer and user parts.

A user claims he did not receive a GPO, yet his user and computer accounts are in the right OU, and everyone else there gets the GPO. What will you look for?
make sure user not be member of loopback policy as in loopback policy it doesn't effect user settings only computer policy will applicable. if he is member of gpo filter grp or not?
You may also want to check the computers event logs. If you find event ID 1085 then you may want to download the patch to fix this and reboot the computer.

How can I override blocking of inheritance ?

What can I do to prevent inheritance from above?

Name a few benefits of using GPMC.

  

How frequently is the client policy refreshed ?
 90 minutes give or take.

 

Where is secedit ?
It’s now gpupdate.

 

What can be restricted on Windows Server 2003 that wasn’t there in previous products ?
Group Policy in Windows Server 2003 determines a users right to modify network and dial-up TCP/IP properties. Users may be selectively restricted from modifying their IP address and other network configuration parameters.

 

You want to create a new group policy but do not wish to inherit.
Make sure you check Block inheritance among the options when creating the policy.

How does the Group Policy 'No Override' and 'Block Inheritance' work ?

Group Policies can be applied at multiple levels (Sites, domains, organizational Units) and multiple GP's for each level. Obviously it may be that some policy settings conflict hence the application order of Site - Domain - Organization Unit and within each layer you set order for all defined policies but you may want to force some polices to never be overridden (No Override) and you may want some containers to not inherit settings from a parent container (Block Inheritance).
A good definition of each is as follows:
No Override - This prevents child containers from overriding policies set at higher levels
Block Inheritance - Stops containers inheriting policies from parent containers
No Override takes precedence over Block Inheritance so if a child container has Block Inheritance set but on the parent a group policy has No Override set then it will get applied.
Also the highest No Override takes precedence over lower No Override's set.
To block inheritance perform the following:

1. Start the Active Directory Users and Computer snap-in (Start - Programs - Administrative Tools - Active Directory Users and Computers)
2. Right click on the container you wish to stop inheriting settings from its parent and select 
3. Select the 'Group Policy' tab
4. Check the 'Block Policy inheritance' option
   
5. Click Apply then OK

To set a policy to never be overridden perform the following:

1. Start the Active Directory Users and Computer snap-in (Start - - Administrative Tools - Active Directory Users and Computers)
2. Right click on the container you wish to set a Group Policy to not be overridden and select Properties
3. Select the 'Group Policy' tab
4. Click Options
5. Check the 'No Override' option
   
6. Click OK
7. Click Apply then OK

 Thnaks
R.karthikeyan

Using Virtual Domains to host more than one FortiOS instance on a single FortiGate unit

Scenario

Providing Internet connectivity and security for two private networks with a single FortiGate unit.

Solution

Use Virtual domains (VDOMs) to divide the FortiGate unit into two or more virtual instances of FortiOS that function similar to two independent FortiGate units. Each VDOM has its own physical interfaces, routing configuration, and security policies.

This example simulates an ISP that provides Company A and Company B with Internet services. Each company would have its own Internet IP address and internal network. This configuration requires:

• Two VDOMs: VDOM-A and VDOM-B each operating in NAT/Route mode with two interfaces, one for a connection to the Internet and one for a connection to the internal network.

• The routing configuration of the example is simplified to only require a default static route from each VDOM to an Internet gateway router.

Create VDOM-A and VDOM-B

Enable multiple VDOM mode, create the VDOMS, configure interfaces and add them to their VDOMs.

1 Connect to the FortiGate web‑based manager and from the Dashboard System Information widget select Enable beside Virtual Domain.

2 Go to System > VDOM > VDOM and select Create New to create two VDOMs with the following configuration:

For company A:

Name	VDOM-A
Enable	Select
Operation Mode	NAT

For company B:

Name	VDOM-B
Enable	Select
Operation Mode	NAT

3 Go to System > Network > Interface and Edit port1 and add it to VDOM-A.

Name	port1
Virtual Domain	VDOM-A
Addressing Mode	Manual
IP/Netmask	172.20.120.10/255.255.255.0

Edit port2 and add it to VDOM-A:

Name	port2
Virtual Domain	VDOM-A
Addressing Mode	Manual
IP/Netmask	192.168.10.1/255.255.255.0
Administrative Access	HTTPS, PING, SSH

Edit port3 and add it to VDOM-B:

Name	port3
Virtual Domain	VDOM-B
Addressing Mode	Manual
IP/Netmask	172.20.120.20/255.255.255.0

Edit port4 and add it to VDOM-B:

Name	port4
Virtual Domain	VDOM-B
Addressing Mode	Manual
IP/Netmask	192.168.20.1/255.255.255.0
Administrative Access	HTTPS, PING, SSH

4 Go to System > Admin > Administrators and select Create New to add an administrator for VDOM-A.

Administrator	a-admin
Type	Regular
Password	passw0rda
Confirm Password	passw0rda
Admin Profile	prof_admin
Virtual Domain	VDOM-A

5 Go to System > Admin > Administrators and select Create New to add an administrator for VDOM-B.

Administrator	b-admin
Type	Regular
Password	passw0rdb
Confirm Password	passw0rdb
Admin Profile	prof_admin
Virtual Domain	VDOM-B

Create a basic configuration for VDOM-A

Add a default route, a DHCP server, and security policy to allow company-A users to get their IP configuration from the FortiGate unit, and connect to the Internet.

1 Beside Current VDOM select VDOM-A.

2 Go to Router > Static > Static Route and select Create New to add the default route for VDOM_A.

Destination IP/Mask	0.0.0.0/0.0.0.0
Device	port1
Gateway	172.20.120.2

3 Go to System > Network > DHCP Server and select Create New to add a DHCP server.

Interface Name	port2
Mode	Server
Type	Regular
IP	192.168.10.100-192.168.10.200
Network Mask	255.255.255.0
Default Gateway	192.168.10.1

4 Configure the DNS Service as required for the network.

5 Select OK to save the port2 DHCP server.

6 Connect a PC to the port2 interface and configure it to get an IP address automatically using DHCP.

7 Log in to VDOM-A by browsing to https://192.168.10.1 and entering a-admin as the Name and passw0rda as the Password.

8 Go to Policy > Policy > Policy and select Create New to create a security policy that allows users on the company A internal network to connect to the Internet.

Source Interface/Zone	port2
Source Address	all
Destination Interface/Zone	port1
Destination Address	all
Schedule	always
Service	ANY
Action	ACCEPT

9 Select Enable NAT and Use Destination Interface Address.

10 Select OK to save the security policy.

11 Test the configuration by connecting to the Internet from the PC.

You should be able to connect to the Internet, if not check the configuration or use the steps described in “Troubleshooting NAT/Route mode installations” to find the problem.

12 Configure the computers on the company A network to get their IP configuration automatically using DHCP.

Create a basic configuration for VDOM-B

Add a default route, a DHCP server, and security policy to allow company-B users to get their IP configuration from the FortiGate unit, and connect to the Internet.

1 Log in to the FortiGate unit as the admin administrator (or any administrator with the super_admin profile).

2 Beside Current VDOM select VDOM-B.

3 Go to Router > Static > Static Route and select Create New to add the default route for VDOM_A.

Destination IP/Mask	0.0.0.0/0.0.0.0
Device	port3
Gateway	172.20.120.2

4 Go to System > Network > DHCP Server and select Create New to add a DHCP server.

Interface Name	port4
Mode	Server
Type	Regular
IP	192.168.20.100-192.168.20.200
Network Mask	255.255.255.0
Default Gateway	192.168.20.1

5 Configure the DNS Service as required for the network.

6 Select OK to save the port4 DHCP server.

7 Connect a PC to the port4 interface and configure it to get an IP address automatically using DHCP.

8 Log in to VDOM-B by browsing to https://192.168.20.1 and entering b-admin as the Name and passw0rdb as the Password.

9 Go to Policy > Policy > Policy and select Create New to create a security policy that allows users on the company B internal network to connect to the Internet.

Source Interface/Zone	port4
Source Address	all
Destination Interface/Zone	port3
Destination Address	all
Schedule	always
Service	ANY
Action	ACCEPT

10 Select Enable NAT and Use Destination Interface Address.

11 Select OK to save the security policy.

12 Test the configuration by connecting to the Internet from the PC.

You should be able to connect to the Internet, if not check the configuration or use the steps described in “Troubleshooting NAT/Route mode installations” to find the problem.

13 Configure the computers on the company B network to get their IP configuration automatically using DHCP.

Results

Connect to the Internet from the company A and company B networks. From either VDOM, go to Policy > Monitor > Policy Monitor and confirm that the policies that you added are allowing traffic through the individual VDOMs.

You can use the packet sniffer to verify that traffic is staying in a VDOM. For example, enter the following command from the FortiGate CLI and then ping from one of the internal networks to an address on the Internet.

diagnose sniffer packet any 'icmp' 4 10

interfaces=[any]

filters=[icmp]

10.728968 port4 in 192.168.20.100 -> 66.171.121.34: icmp: echo request

10.729158 port3 out 172.20.120.20 -> 66.171.121.34: icmp: echo request

10.821152 port3 in 66.171.121.34 -> 172.20.120.20: icmp: echo reply

10.821288 port4 out 66.171.121.34 -> 192.168.20.100: icmp: echo reply

11.729230 port4 in 192.168.20.100 -> 66.171.121.34: icmp: echo request

11.729431 port3 out 172.20.120.20 -> 66.171.121.34: icmp: echo request

11.821349 port3 in 66.171.121.34 -> 172.20.120.20: icmp: echo reply

11.821481 port4 out 66.171.121.34 -> 192.168.20.100: icmp: echo reply

The command output shows sessions only uses the port4 and port3 interfaces, both of which are in VDOM-B.

If you log in as an administrator with the super_admin profile, you can sniff any interface. If you log in as a-admin or b-admin (an administrator for a single VDOM), you can only sniff interfaces in the administrator’s VDOM. To access the packet sniffer, you must log in to a VDOM, you cannot access the packet sniffer from the global configuration.

Thanks
R.karthikeyan

cPanel VS Plesk - Which one is right for your dedicated server?

cPanel VS Plesk. Which control panel is right for your dedicated server?
There are a number of control panel options available to choose from for your dedicated server. Two of the most popular of these options are cPanel and Plesk. Choosing the right control panel for your dedicated server can sometimes be a difficult decision as there are a number of points to consider. While both control panels offer a lot of the same options, there are some differences that should be noted before deciding which one to use. First, let's learn a bit about the history of each company.
cPanel History
Since 1997, cPanel has been providing software packages to automate server tasks for web hosts and website owners. cPanel is a Linux based control panel system that utilizes a GUI (Graphical User Interface) to simplify and automate a lot of the functions needed to host a website.
Plesk History
Plesk (Parallels Plesk Panel), originally Plesk Inc., was originally started in the US and purchased by SWSoft in 2003. SWSoft changed their name in 2008 to Parallels, where you will still find them today. The Plesk control panel is compatible with both Windows and Linux server platforms which has helped them in positioning themselves at the top of the list for reliable control panel software providers in the world.
What are the system requirements for cPanel & Plesk?
It is very important to ensure you have the appropriate resources allocated to your server before choosing the control panel software as both cPanel and Plesk have their own requirements. Speak with your service provider to find out which control panel options they offer as some do not offer both.
cPanel Requirements

• Processor: 266MHz processor
• Memory: 512MB RAM (1GB is recommended when hosting a large number of websites)
• Disk Space: 10GB hard disk

Plesk for Linux Requirements

• Memory: 512MB RAM (1 GB when hosting many accounts; 768MB minimum when also using Web Presence Builder)
• Disk Space: 10GB hard disk

Plesk for Windows Requirements

• Memory: 1 GB of RAM (2 GB when hosting many accounts)
• Disk Space: 32GB hard disk

Which Operating Systems are supported?
As previously mentioned, cPanel is a Linux based control panel while Plesk offers installation options on both Linux and Windows servers. cPanel does offer a secondary control panel called Enkompass which can be installed on Windows servers. Below is a list of the supported operating systems for both control panels.
cPanel

• CentOS versions 4.x, 5.x, 6.x
• Red Hat Enterprise Linux versions 4.x, 5.x, 6.x
• CloudLinux 5.x, 6.x

Enkompass

• Windows Server 2008
• Windows Server 2008 R2, Web, Standard Data Center
• Enterprise Edition

Plesk
Linux

• CentOS versions 5.x, 6.x
• Red Hat Enterprise Linux versions 5.x, 6.x
• CloudLinux versions 5.x, 6.x
• Debian 6.0
• openSUSE versions 11.4, 12.1
• Ubuntu versions 10.04, 12.04 Server LTS

Windows

• Windows Server 2008 R2 SP1
• Windows Server 2008 R2
• Windows Server 2008 SP2

Supported Virtual Environments
cPanel lists a number of supported virtual environments that are compatible with their control panel, which include:

• KVM
• Linux-VServer
• Microsoft Server 2008 Hyper-V
• OpenVZ
• Oracle VM VirtualBox, VirtualBox OSE
• Virtuozzo
• VMware Server, VMware ESX Server
• Xen, XenEnterprise, XenExpress, ZenSErver

Which control panel is more popular?
cPanel currently tops the market share of control panel installations around the world. We strongly recommend to customers to have CentOS 6 and cPanel installed on their servers as we find cPanel is easier for clients to manage and they provide excellent technical support. There are also a number of additional features, including:

• One-Click software installations (Softaculous)
• Easily updated software
• Fast loading times
• 3 tier user setup (root, reseller and user)
• and more

Are there licensing fees for these control panels?
There are monthly licensing fees for both cPanel and Plesk, but these vary depending on your service provider. You can typically see a cost of between $24.99 to $49.99 per month for a cPanel license and $39.99 to $59.99 for a Plesk license.
How do I install cPanel or Plesk?
If you are going to install cPanel or Plesk on your own it is important that you familiarize yourself with the full installation instructions prior to starting and contact your service provider to ask any questions you may have first. Below are links to the installation instructions for cPanel and Plesk.
cPanel Installation Instructions
Plesk Installation Instructions
Whether you choose cPanel or Plesk it is important to first do your research. Again, ensure your server has the appropriate resources available and do not be afraid to ask your service provider for assistance. Also, find out if your service provider is an authorized cPanel or Plesk partner as that may help you make the decision of which control panel to choose.

Thanks
R.karthikeyan

Single Sign-On with Windows AD in FortiOS 5.0

Hi

Now i got  task from my office that  converting  IP based access to  User profile based authentication in Fortigate . So I am currently reading the following documents and i thought to share the same things with my blog readers as well...

I am expecting feed back /Comments from you to improve my blog...

FortiOS 5.0 brings with it an enhancement to how single sign-on can be performed in a Microsoft Active Directory environment.

In prior versions of FortiOS an agent software was needed on either a Domain Controller or a Member Server. There was a lot of push back since many IT admins were not comfortable running third-party software on their critical AD servers. FortiOS 5.0 allows the firewalls to directly query the AD global catalog and event logs, the agents are now optional.

When a Windows AD user logs on at a workstation in a monitored domain, the FortiGate unit:

• detects the logon event in the domain controller’s event log and records the workstation name, domain, and user
• resolves the workstation name to an IP address
• uses the domain controller’s LDAP server to determine which groups the user belongs to
• creates one or more log entries on the FortiGate unit for this logon event as appropriate

When the user tries to access network resources, the FortiGate unit selects the appropriate security policy for the destination. The selection consists of matching the FSSO group or groups the user belongs to with the security policy or policies that match that group. If the user belongs to one of the permitted user groups associated with that policy, the connection is allowed. Otherwise the connection is denied.

Happy to hear comments from you peoples.....

You can download pdf from below mentioned Link...
 FortiOS 5.0 Authentication Guide

Thanks
R.karthikeyan