Group Policy Central

This post is part of a series of posts about Advanced Group Policy Management. If you want to see the other post in this series you can use the links below:

1. Introduction to Advanced Group Policy Management (a.k.a AGPM) v4
2. How to install the Advanced Group Policy Management Client v4
3. How to install the Advanced Group Policy Management (AGPM) Server v4
4. How to configure the AGPM client via Group Policy to automatically connect to the AGPM server
5. Delegating permission to Review/Edit GPO’s in AGPM
6. How to create make changes to Group Policy Objects in AGPM
7. How to makes changes to existing uncontrolled GPO’s in AGPM

Editing existing uncontrolled GPO’s in AGPM

If you are deploying AGPM into an existing environment (and you probably are) then you will probably want to editing you existing GPO’s. Any GPO that is not managed by AGPM is called an “Uncontrolled” GPO and as such will not be touched until it is specifically made into a “Controlled” policy.

Step 1. Logon as Alan to a computer that has GPMC and the AGPM client

Step 2. Open GPMC and click on Change Control and then then Uncontrolled tab then right click on the GPO you want to “Control” and then click on Control…

 Step 3. Add a comment to the GPO as its initial comment then click OK

This Group Policy is now “controlled”

Hopefully this has series given you enough of an introduction to AGPM to get it installed and start to perform basic changes and approvals to GPO setting …

If you want more information on Advanced Group Policy Management then here is a list of link to pages I have found useful:

Microsoft MDOP Blog
TechNet: Overview of Advanced Group Policy Management
TechNet: A Video tour of Advanced Group Policy Management
TechNet: Technical Overview of AGPM
TechNet: What’s New in AGPM

TechNet: Choosing Which Version of AGPM to Install
TechNet: Step-by-Step Guide for Microsoft Advanced Group Policy Management 4.0
TechNet: Operation Guide for Microsoft Advanced Group Policy Management 4.0
Group Policy Blog: Importing and Exporting with AGPM

This post is part of a series of posts about Advanced Group Policy Management. If you want to see the other post in this series you can use the links below:

1. Introduction to Advanced Group Policy Management (a.k.a AGPM) v4
2. How to install the Advanced Group Policy Management Client v4
3. How to install the Advanced Group Policy Management (AGPM) Server v4
4. How to configure the AGPM client via Group Policy to automatically connect to the AGPM server
5. Delegating permission to Review/Edit GPO’s in AGPM
6. How to create make changes to Group Policy Objects in AGPM
7. How to makes changes to existing uncontrolled GPO’s in AGPM

Creating and Editing GPO’s in AGPM

Now you are going to logon as John and create a fresh new Controlled GPO to have it then approved by Alan.

Step 1. Logon as John to a computer that has GPMC and the AGPM client

Step 2. Open GPMC and right click on Change Control and then click on New Controlled GPO…

Step 3. Fill in the submission field so that an email will be sent to the AGPM administrator to review the New Controlled GPO Request then click Submit

Step 4. Click Close

Note: In this example I don’t have a mail serve configured so the sending the of the email failed.

Step 5. Click on the Pending Tab. You can now see the Pending request waiting for approval.

Now we will approve the New Controlled GPO request.

Step 6. Logon as Alan to a computer that has GPMC and the AGPM client

Step 7. Open GPMC and right click on Change Control then click on the Pending tab and the right click on the pending request and click on Approve…

Step 8. Add a comment before you confirm the Approval action then click Yes

Step 9. Wait for it to Approve and then click Close

Note: It is this stage that Alan can link the GPO manually to the Organisational Unit (OU).

NEXT > How to makes changes to existing uncontrolled GPO’s in AGPM

This post is part of a series of posts about Advanced Group Policy Management. If you want to see the other post in this series you can use the links below:

1. Introduction to Advanced Group Policy Management (a.k.a AGPM) v4
2. How to install the Advanced Group Policy Management Client v4
3. How to install the Advanced Group Policy Management (AGPM) Server v4
4. How to configure the AGPM client via Group Policy to automatically connect to the AGPM server
5. Delegating permission to Review/Edit GPO’s in AGPM
6. How to create make changes to Group Policy Objects in AGPM
7. How to makes changes to existing uncontrolled GPO’s in AGPM

Delegating permission in AGPM

This section show you how to delegate permission to a user to either review or edit group policy object via AGPM.

Step 1. Open GPMC on a computer that you have installed the AGPM client on.

Step 2. Navigate and click on Change Control option and then the Domain Delegation tab then click Add

Step 3. Select the user John and then select the Editor from the role field then click OK

John now has Reviewer/Edit access to AGPM (that was easy!).

NEXT > How to create make changes to Group Policy Objects in AGPM

This post is part of a series of posts about Advanced Group Policy Management. If you want to see the other post in this series you can use the links below:

1. Introduction to Advanced Group Policy Management (a.k.a AGPM) v4
2. How to install the Advanced Group Policy Management Client v4
3. How to install the Advanced Group Policy Management (AGPM) Server v4
4. How to configure the AGPM client via Group Policy to automatically connect to the AGPM server
5. Delegating permission to Review/Edit GPO’s in AGPM
6. How to create make changes to Group Policy Objects in AGPM
7. How to makes changes to existing uncontrolled GPO’s in AGPM

Configuring the AGPM Client

This section describes the process of how to automatically connect AGPM client to the AGPM server you have in your forest. If you do not perform this option step then each person that uses the AGPM will need to manually configure the Client to the correct AGPM server.

Step 1. Edit the Default Domain Policy using the Group Policy Management Editor (GPME) and navigate to Users Configuration > Policies > Administrative Templates > Windows Components > AGPM then edit the AGPM: Specify default AGPM Server (all domains)

Step 2. Tick Enable and then type the name/IP address then :Port number of the AGPM Server in the text field then click OK

(Hopefully this is the last non-managed GPO change you ever make again)

NEXT > Delegating permission to Review/Edit GPO’s in AGPM

This post is part of a series of posts about Advanced Group Policy Management. If you want to see the other post in this series you can use the links below:

1. Introduction to Advanced Group Policy Management (a.k.a AGPM) v4
2. How to install the Advanced Group Policy Management Client v4
3. How to install the Advanced Group Policy Management (AGPM) Server v4
4. How to configure the AGPM client via Group Policy to automatically connect to the AGPM server
5. Delegating permission to Review/Edit GPO’s in AGPM
6. How to create make changes to Group Policy Objects in AGPM
7. How to makes changes to existing uncontrolled GPO’s in AGPM

Installing the AGPM Server

The Advanced Group Policy Management Server is the central server that keeps track and makes changes to all the Group Policy Objects in the forest. 

Step 1. Start the Advanced Group Policy Management and select the “– Server install.” option.

Step 2. Click Next

Step 3. Tick I accept license terms and then click Next

Step 4. Confirm the Application path and click Next

Step 6. Confirm the Archive Path and click Next

Step 7. Enter the AGPM Service Account details. This account needs to have full access to all GPO that you want to manage using AGPM then click Next

Step 8. Enter the Archive Owner account (e.g. Contoso\Alan ) this account is the first Full Control administrator in AGPM that is used to delegate permission to other users then click Next

Step 9. Confirm the Port (this needs to be the same as step 5 in the Install Client stage) and click Next

Step 10. Leave all the languages selected and click Next

Step 11. Click Install

Step 11a. Optional – Click on the Details button to see the components that will be installed.

Wait

 Step 12. Click Finish

NEXT > How to configure the AGPM client via Group Policy to automatically connect to the AGPM server