Using Group Policy Editor To Set Policies

That's enough of the background material about Group Policy. It's time to actually -do- something with GP and see how it works. Since Windows Messenger is a constant topic of e-mail I receive, lets use it as the subject of this section.

I'm going to use the standard Group Policy Editor (Fig. 03) that opens with the gpedit.msc command rather than the enhanced MMC snap-in (Fig. 02) I mentioned in the last section simply to avoid any confusion. Items to note are the left pane which gives you access to the Local Computer Policy for both Computer Configuration and User Configuration. The right panel follows normal explorer protocols, displaying the folder views. At the bottom of the right pane there are two tabs; Extended and Standard. When the Extended tab is selected the right pane contains a description of the policy that has been highlighted. The Standard tab selection removes the description and makes for more compact viewing. For the rest of this section I'm going to use the Standard tab selection.

Fig. 03

I've opened Group Policy (Fig. 04) and expanded the trees for Computer Configuration\Administrative Templates\Windows Components. Windows Messenger has been highlighted in the Computer Configuration section. In the right pane I've highlighted the entry for Do Not Allow Windows Messenger To Be Run. The State column in the right pane shows that this policy is currently Not Configured. To set, or implement this policy either double click the entry in the right pane or right click and select Properties. Either method will open the window shown in Fig. 05.

Fig. 04

Each one of the policies listed under Administrative Templates has a setting dialog similar to the one in Fig. 05 below. There are three choices for setting a policy; Not Configured, Enabled, and Disabled.

By default, all policies start out as Not Configured. Enabled and Disabled are self-explanatory, but only to a point. The language used for policy descriptions can be vague and sometimes downright counterintuitive. In the Do Not Allow Windows Messenger To Be Run example I'm using here, Enable means it will not be run. Had the designers called this policy Allow Windows Messenger To Be Run, Disabled would provide the same end result. A number of policies begin with the word "Disable" and require careful scrutiny to get the desired result.

The large gray area in the middle of the window will hold other controls when they are appropriate to the policy. Examples of this would be a drop down list of applications the policy might control, or a Browse button so other files could be selected that are affected by the policy.

The Previous Setting and Next Setting buttons provide an easy way to move through a section of policies without returning to the main GP Editor window after each selection.

Fig. 05

The Explain tab (Fig. 06) provides the same information as the Extended tab in the main Group Policy Editor window. If additional clarification of the policy is needed because of an ambiguous policy name this section may be able to help sort out the confusion.

Fig. 06

That's all there is to setting a Group Policy in Windows XP Professional.

Next: I Lied - That's Not All You Need To Know About Group Policy