Active Directory/Documentation/Planning

Tasks

Group Policies

Block Incompatible GPOs

Use WMI filters to block incompatible GPOs. Todo:

• Default Domain Policy - Still deciding how to handle GP differences between WinXP and Vista.
• Domain-Laptop Policy - Still deciding how to handle GP differences between WinXP and Vista.
• FW-NCSU-WolfTech-Defrag C-1.0-20050408 - Not necessary, Vista has builtin defrag scheduling.
• SW-NCSU-NCSU-Wolfcall (with autologin)-1.2.0-20040601 - Not Vista compatible.
• SW-NCSU-NCSU-Wolfcall (with autologin)-1.2.1-20050510 - Not Vista compatible.
• SW-NCSU-NCSU-Wolfcall (with autologin)-1.2.1-20060829 - Not Vista compatible.
• SW-NCSU-NCSU-Wolfcall (without autologin)-1.2.1-20050615 - Not Vista compatible.
• SW-NCSU-Symantec-AntiVirus (UNI03NT)-10.0.2.2021-20060530 - Not Vista compatible.
• SW-ECE-Symantec-AntiVirus (SERPENT)-10.0.2.2021-20060530 - Not Vista compatible.

Domain Policy

Options:

• Create separate domain policies for Vista and Windows 2000/XP/2003.
  • Creates more complexity by having completely separate group policy environments for different OS's.
  • OS's may have different security levels/inconsistent security policies.
    • Reduces predictability.
    • Complicates determining security compliance.
    • Compatibility issues could vary on different OS's
• Use common domain policy for all OS's and create a separate domain policy for Vista only policies.
  • This would prevent any unintended consequences on XP/2003 computers.
  • Reduces complexity by having common security policies for all OS's.
  • Would be a good idea to reconsider settings using both updated Windows XP Security Guide and new Windows Vista Security Guide.
• Use common domain policy for all OS's including Vista only policies.
  • Will require testing to make sure Vista only policies don't cause problems on XP/2003 computers.
  • Reduces complexity by having common security policies for all OS's.
  • Would be a good idea to reconsider settings using both updated Windows XP Security Guide and new Windows Vista Security Guide.

Observations:

• Security settings in Vista and Windows XP are very similar. The only obvious difference is that Vista has new policies to control new features such as privilege elevation.

Deployment

WDS Server

• Brought up ECE00WDS.
• Created WDS GPO template.
• Created image.
• Installed Vista from WDS.

Todo:

• Apply Member Server template.
• Setup DFS Replication between WDS Servers

Create Unattended Image

• Created Image

Todo:

• Make image actually install unattended.