and all users who log on to it, whereas user policy mode applies to specific users who log on to the Group Policy client computer. Group Policy: Registry Extension Encoding Provides the mechanism for a Group Policy administrator to control any behavior on a Group Policy client that depends on registry-based settings. This extension has both and implementations. The extension enables the Group Policy administrator to use Administrative template settings to write a registry policy file and associate it with a GPO. The client-side is extension invoked by the core Group Policy engine on the Group Policy client to read the registry policy file specified by a GPO and apply its contents to the registry of the Group Policy client computer. Group Policy: Security Protocol Extension Enables the Group Policy administrator to distribute and apply group security policies
Internal Security This section describes the internal security of the Policy client. The general guideline for Group Policy implementers is to ensure that the resources used by the core Group Policy engine and extensions are protected from unauthorized access. In addition, users who do not have the required credentials should be prevented from modifying or tampering with administrative configurations. The following diagram shows the different components that define the security boundaries of the Group Policy protocols on the Group Policy client. Elements that are external to the Group Policy protocols are described in . Figure : Group Policy security boundary components Data Store Permissions Group Policy writes policy information to various data stores, such as the Group Policy file share, Active Directory, and the registry, where policy settings are persisted. The Group Policy protocols ensure that appropriate permissions are set on each resource so that no user can tamper with the data unless that user has permissions to the resource. Group Policy protocols set user permissions on resources to read only, so they cannot change the data. Group Policy cannot protect against a user with administrative credentials, because that user can take ownership of a resource and change it. Timer and Network Events The process that applies Group Policy to Group Policy client computers runs periodically in the background and is triggered by the firing of a timer or a network event, such as a change to the user’s network state. Any implementation of Group Policy protocols should ensure that these event sources are trusted and cannot be spoofed. Computer Startup and Logon Events The computer startup, computer shutdown, user and user logoff events are used to apply policies to a user or a computer when these events occur. Any implementation of Group Policy protocols should ensure that the components that generate these events are trusted and cannot be spoofed. External Security Group Policy protocols use the encryption mechanisms provided by the LDAP and file access transports to ensure that the data is protected against tampering. Group Policy relies on the authentication mechanisms provided by the underlying protocols to establish user and computer identities. These security mechanisms include the following: LDAP and file access protocol signing, for setting and retrieving policy data. Kerberos authentication for application of computer policy, as described in section 3.3. SPNEGO authentication for application of user policy, as described in section 5. The Group Policy protocols do not define any additional external security beyond what is described in the specifications of the protocols listed in section . Additional Considerations There are no additional security considerations.
User Logon Scripts Group Policy Scripts Extension: Protocol Specification 3.2.5, Message Processing Events and Sequencing Rules Periodic Computer Core Policy Application [MS-GPOL]: Policy: Core Protocol Specification 1.3.3, Policy Application Periodic Computer CSE Policy Application [MS-GPOL]: Group Policy: Core Protocol Specification 3.2.5.1.10, Extension Protocol Sequences Periodic User Policy Core Application [MS-GPOL]: Group Policy: Core Protocol Specification 1.3.3, Policy Application Periodic User CSE Policy Application [MS-GPOL]: Group Policy: Core Protocol Specification 3.2.5.1.10, Extension Protocol Sequences User Logoff Scripts Group Policy Scripts Extension: Protocol Specification 3.2.5, Message Processing Events and Sequencing Rules Computer Shutdown Scripts Group Policy Scripts Extension: Protocol Specification 3.2.5, Message Processing Events and Sequencing Rules Example 2: Applying Policy on the Policy Client The Group Policy client's interaction with the Group Policy server in policy application uses a pull model, in which the Group Policy client polls a Group Policy server to check for new user GPOs. When the Group Policy client discovers the Group Policy server, the client performs two sets of queries to Active Directory on the Group Policy server using LDAP as a transport. The first set of queries determines which GPOs have been assigned.
Index A 64 Administering group policy — administrative tool 58 44 Applying group policy — group policy client 56 Architecture 54 49 59 25 security ( 62, 64) 44 54 54 C 59 85 Coherency requirements 62 61 61 49 6 Considerations 64 62 D 54 58 56 54 55 E 49 59 65 Extensibility Microsoft implementations ( 65, 83) 59 F Functional architecture 54 49 59 25 security ( 62, 64) 44 54 25 G 18 H 59 I Implementations - Microsoft ( 65, 83) 62 23 54 62 6 M Microsoft implementations ( 65, 83) N 61 O Overview 44 25 6 P 54 83 R 23 62 Requirements coherency 62 61 61 59 25 54 S Security considerations ( 62, 64) 49 59 44 25 System use cases 58 56