Don't you love GPOs?
I was just chatting with a good friend about them the other
day about GPOs. Seems someone modified a GPO (allegedly only one small unrelated
thing) and all of a sudden the NIC was broken and clustering was screwed and all
sorts of stuff was happening. This prompted me to say something like... GPOs are
a great technology that make it possible to easily do things you could already
fairly easily do (and were doing) if you knew how to properly automate things
like many large enterprise admins already do daily. So basically they make it so
gomers could also easily do this stuff too but the sad thing is that it wasn't
set up in a way to be safe for gomers to use (i.e. easy to hurt themselves). So
the one main group of people who have to use it are the one main group of people
you really don't want to see use it.
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ulf B. Simon-Weidner
Sent: Monday, May 15, 2006 3:05 PM
To: [email protected]
Subject: RE: [ActiveDir] Group Name (Pre-Win2k) - Is it important
GREP?
Whats GREP! ;-)
Great
idea - forgot about that one.
GPOs
are really a big point here - I've seen an enterprise going down because of
that.
GPMC
with backup / import (instead of backup / restore) might help here as
well.
Gruesse - Sincerely,
Ulf B. Simon-Weidner
Profile
& Publications: http://mvp.support.microsoft.com/profile="">
Weblog: http://msmvps.org/UlfBSimonWeidner
Website: http://www.windowsserverfaq.org
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of joe
Sent: Monday, May 15, 2006 3:56 PM
To: [email protected]
Subject: RE: [ActiveDir] Group Name (Pre-Win2k) - Is it importantWindows itself will mostly not have an issue if you don't. Some things that might are custom scripts, batch files, tools, applications, etc that you have written to use those names. The one place I can think of off the top of my head that might have an issue in Windows is if you have set up restricted groups and didn't browse for the group name and instead, simply typed it in, the restricted group may be specified by legacy name instead of SID in the policy files. You can easily find this by GREPping your sysvol with an ID that has suitable permissions to see all policies files for the string that represents the group name. If you know you have used the group that way you may also want positive affirmation that is isn't there by name by also GREPping by the SID.joe
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Teo De Las Heras
Sent: Monday, May 15, 2006 8:42 AM
To: [email protected]
Subject: [ActiveDir] Group Name (Pre-Win2k) - Is it importantWe're making changes to group names in Active Directory. Is it important to keep the Pre-Win2k names the same?Teo
