Active Directory and Group Policy Management

Overview

In this project, I managed users, computers, security groups, and organizational units (OUs) in an Active Directory domain. I also created and applied Group Policy Objects (GPOs) to manage security settings, software deployment, network resources, printers, files, and user and computer configurations across domain-joined clients.

Objectives

• Manage domain users, security groups, computers, and organizational units.

• Create and apply GPOs to users and domain-joined computers.

• Configure Windows Firewall rules through Group Policy.

• Deploy software to users through Group Policy.

• Configure user rights and restrict remote access.

• Distribute files, folders, network drives, and shared printers to clients.

• Automate file management and report collection using scripts.

• Restrict USB storage devices and access to the Command Prompt.

• Centralize common Windows client configurations through Active Directory and Group Policy.

Technologies Used

• Windows Server

• Active Directory Domain Services (AD DS)

• Active Directory Users and Computers (ADUC)

• Group Policy Management

• Group Policy Objects (GPOs)

• Organizational Units (OUs)

• Security Groups

• Windows Firewall

• Windows Software Installation

• Windows PowerShell

• Batch Scripts

• SMB File Sharing

• Network Printers

• Windows Client Computers

Configurations

Users and Computers Management

Create Users

Since Group Policies can be applied to Organizational Units (OUs), I first created a new OU called XCo Users. I then created the required domain user accounts and placed them in this OU so that user-based policies could be applied to them.

Create Groups

To manage users through security groups and apply Group Policies selectively, I created security groups and added the required users to them. These groups were also used for Security Filtering when necessary.

Create Computers OU

To manage domain-joined computers separately from users, I created a dedicated OU for computer accounts and placed the required computer accounts in it. This allowed computer-based GPOs to be linked specifically to these computers.

Create and Apply GPOs

After creating the user accounts, groups, and computer OUs, and joining the client computers to the domain, I created and linked GPOs to the appropriate users and computers. The following are some of the GPO configurations I used in my projects.

Firewall GPO

Firewall rules are computer-based Group Policy settings rather than user-based settings. Therefore, after creating a GPO for the required firewall rules, I linked it to the OU containing the target computer accounts.

For example, I needed firewall rules for a group of client computers to:

• Block traffic from a specific IP address.

• Prevent a specific application from accessing the network or receiving updates through the Internet.

• Allow ICMP Echo Requests so the clients could respond to ping requests.

I created a new GPO in Group Policy Objects and configured the required Windows Firewall rules under Computer Configuration > Policies > Windows Settings > Security Settings > Windows Defender Firewall with Advanced Security.

I then linked the GPO to the OU containing the target computers. On the clients, I ran gpupdate /force to immediately request the updated Group Policy.

Finally, I tested the configuration from the Domain Controller by pinging the client computers. The computers that received the appropriate ICMP firewall rule successfully responded to the ping requests.

I also compared the results before and after running gpupdate /force to verify that the policy was being applied.

Install Software

To deploy software to client computers, I first created a shared folder on the Domain Controller with read access for Authenticated Users. I then placed the .msi installation package in the shared folder. For software where an MSI package was not provided by the developer, I converted the installer to an MSI package using a third-party tool such as Advanced Installer.

Since the software was optional rather than mandatory, I decided to publish it to users instead of automatically installing it. This allowed users to install the software when needed and avoided unnecessary software installation and network traffic on clients that did not require it.

I created a new GPO and configured the software package under User Configuration > Policies > Software Settings > Software Installation, then selected the MSI package from the shared folder and, under the deployment options, selected Published. This allowed users to install the application themselves through Windows' available software installation interface.

I also enabled the Advanced option in the deployment properties. This provides access to additional deployment options and allows more detailed configuration of the software package before it is published.

After configuring the software package, I applied the GPO to the required users. Since there were many users, I created a security group, added the target users to it, and used the group in Security Filtering.

I then linked the GPO to the OU containing the users.

On the client computers, I ran gpupdate /force, and then used gpresult /r to verify that the GPO had been received and applied to the client.

Finally, users could install the published software through the Windows software installation interface when required.

User Right Management

To restrict remote access to specific client computers, I configured user-rights policies through Group Policy.

I used Deny access to this computer from the network to prevent remote network access to the computers and Deny log on through Remote Desktop Services to prevent users from signing in through Remote Desktop.

I then linked the GPO to the OU containing the target computers.

Copy a File on Client Computers

In an organization where users did not need direct access to a shared folder but needed an updated file to be available locally, I used Group Policy Preferences to distribute the file to selected users.

For example, an Excel file containing an updated list of products and their prices was provided to the administrator at the end of the working day. I configured Group Policy to copy the updated file to the users' computers.

I created a GPO for the file and configured User Configuration > Preferences > Windows Settings > Files, and then created a new File item and specified the source and destination paths.

I pressed F3 and chose the related %USERPROFILE% environment variable when defining the destination path so that the file could be placed in the appropriate location for each user's Windows profile.

Add a Network Drive

Some users needed regular access to a shared folder, so instead of creating a simple shortcut, I mapped the shared folder as a network drive.

First, I created a GPO and configured Drive Maps under: User Configuration > Preferences > Windows Settings > Drive Maps.

Then entered the shared folder's UNC path as the location and enabled Reconnect so that the mapping would be restored when users signed in again.

I also assigned a fixed drive letter so that users could consistently identify the shared folder.

Adjust Date and Time

To configure regional settings on client computers, I used Group Policy Preferences under: User Configuration > Preferences > Control Panel Settings > Regional Options.

The individual settings are not enforced until they are enabled. I configured the required values and used the F5 key to enable the corresponding settings.

Add a Shared Printer

To add a shared printer to client computers, I used the Printers option under Group Policy Preferences rather than Drive Maps. So, I created a printer preference under User Configuration > Preferences > Control Panel Settings > Printers.

Since the printer was being added for the first time, I selected Create as the action and specified the UNC path of the shared printer.

I also configured the printer as the default printer for the target users.

Copy a Folder Automatically

In another task, a manager needed to review daily reports created by a department. Employees used a predefined template to create their reports and were expected to archive them at the end of each working day.

I configured Group Policy Preferences to create a folder on each user's desktop with a name ending in -Reports, such as John-Reports. The folder contained the report template that employees used during the day.

To make sure reports were not forgotten, I created a command line script that searched the user's desktop for a folder ending in -Reports and copied it to a shared folder on the Domain Controller when the user logged off.

I then created a GPO and configured the script under User Configuration > Policies > Windows Settings > Scripts (Logon/Logoff). Then added the script to the Logoff section so that it would run when the user clicked on sign out.

The script commands were:

$Desktop = [Environment]::GetFolderPath("Desktop")

$SourceFolder = Get-ChildItem -Path $Desktop -Directory -Filter "*-Repots" | Select-Object -First 1

$Destination = "\\WS22\SharedFolder\Reports"

if ($SourceFolder) {

Copy-Item -Path $SourceFolder.FullName -Destination $Destination -Recurse -Force

}

Block USB Devices

To prevent users from copying files to removable storage on selected computers, I disabled access to USB storage devices through Group Policy.

These computers were intended to have restricted network access and did not require removable storage. I configured the relevant settings under Computer Configuration > Policies > Administrative Templates > System > Removable Storage Access.

Then I enabled the required removable-storage restrictions for the target computers, and linked the GPO to the appropriate computer OU so that the restrictions were applied to those computers.

Disable CMD

Since the Command Prompt provides users with access to many administrative and system functions, I restricted its use for selected domain users.

To do this, I configured the following policy: User Configuration > Policies > Administrative Templates > System > Prevent access to the command prompt.

Then I opened the policy, selected Enabled, and applied the GPO to the required users.

Results

The Active Directory environment was configured to centrally manage domain users, groups, computers, and client configurations through Group Policy. The implemented GPOs successfully provided centralized control over firewall rules, software deployment, user rights, file and folder distribution, network drives, printers, regional settings, removable storage, and command-line access.

The configurations also reduced the need to manually configure individual client computers and provided a consistent way to apply security and management policies across the domain.