Application of Group Policy settings relies heavily on the availability of a network connection and the connection speed. In previous versions of Windows, the Group Policy engine determines the state and speed of a network connection by sending Internet Control Message Protocol (ICMP) ping packets to domain controllers. However, this approach is unreliable over high-latency networks and complicated by host-based firewalls that block ping messages.

In Windows Vista, Group Policy no longer relies on ICMP to determine the connection speed, but instead uses the new Network Location Awareness service. This service alerts the Group Policy engine to whether a Network Interface Card (NIC) is enabled or disabled, alerts the engine when a network connection is available, and improves the ability of the client to detect a domain controller when a network becomes available after a period of being offline. As a result, Windows Vista provides faster boot times, more reliable application of policy, and better support for roaming.

With Network Location Awareness, Group Policy also has access to resource detection and event notification capabilities in the operating system, such as recovery from hibernation or standby, establishment of VPN sessions, and moving in or out of a wireless network.

For more information, see Network Location Awareness.

In previous versions of Windows, when a GPO is created, all the default Administrative Template files are added to the GPO. The storage cost is approximately 4 MB per GPO for the default templates, but can be larger if there are custom templates. In Windows Vista, each GPO does not contain its own Administrative Template files, resulting in a savings of about 4 MB per GPO in Sysvol (a shared folder on a domain controller) size and less replication traffic.

Windows XP® implements client-side Group Policy processing within the system boot/logon process. In some cases, this enables users to log on to their computers before the application of Group Policy is complete. In Windows Vista, Group Policy processing occurs through the new Group Policy Client service and is isolated from the logon process, eliminating this problem.

For increased security, users cannot start or stop the Group Policy Client service. In the Services snap-in, the options to start, stop, pause, and resume the Group Policy client are unavailable.

The Group Policy Client service includes the following additional benefits:

• Group Policy files can be updated without requiring a restart of the operating system.

• The application of policy is more efficient because of the reduction of resources used for background processing.

In Windows XP and Windows Server® 2003, the Group Policy infrastructure writes function trace statements and supporting data to the user environment log file (userenv.log); however, the log is shared with user profile functions, which sometimes make the file difficult to use.

In Windows Vista, Group Policy logging is made to the new Group Policy Operational log, which provides improved messages specific to Group Policy processing.

Another change is the location of Group Policy event messages, which previously appeared in the Application log and now appear in the System log with an event source of "GroupPolicy."

For more information, see Troubleshooting Group Policy Using Event Logs.

Windows XP supports only one local Group Policy object, so changes made to its settings affect all users and administrators who use that computer. This behavior can be a nuisance for local administrators who have to explicitly disable or remove Group Policy settings that interfere with their ability to manage the workstation before performing administrative tasks.

Windows Vista addresses this problem by allowing the use of multiple local GPOs. For example, one GPO can be assigned to the Administrators group, and another GPO, with different settings can be assigned to a specific local user. This feature works with domain-based Group Policy and can be disabled through a Group Policy setting.

For more information, see Step-by-Step Guide to Managing Multiple Local Group Policy Objects.

The Group Policy Management Console (gpmc.msc) and Group Policy Object Editor (gpedit.msc) are the standard tools for managing Group Policy. GPMC is a scriptable Microsoft Management Console snap-in and is integrated into the Windows Vista operating system. GPMC provides a single administrative tool for managing Group Policy across the enterprise, including the creation and viewing of GPOs. GPMC also provides direct access to the GPOE, which is used to edit the individual policy settings contained within each GPO.

The enhanced GPMC available with Windows Vista provides the following benefits over the downloadable component that is available for Windows XP and Windows Server 2003:

• Support for Windows Vista.

• Multi-language support.

• Use of the central store.

For more information, see Microsoft Management Console (MMC) and Deploying Group Policy Using Windows Vista.

Windows Vista introduces two new file types for displaying Administrative Template settings in the GPOE. The new file types, ADMX language-neutral (.admx) and ADMX language-specific (.adml), replace the ADM (.adm) files used in Windows XP and Windows Server 2003. The new ADMX files are defined using a standards-based, XML file format and are installed locally in the %systemroot%\PolicyDefinitions folder as opposed to the %systemroot%\System32\GroupPolicy\Adm folder for ADM files. The ADMX files are recognized only by the Group Policy tools in Windows Vista.

A language-neutral ADMX file determines the number and types of policy settings, and their location by category in the GPOE display. ADML files provide the language-specific information needed by the language-neutral ADMX file. The ADMX file references a specific ADML file in order to display a policy setting in the correct language. Adding a new language is achieved by adding a new ADML file in the specified language.

The following example demonstrates the benefit of this new multi-language functionality. A Group Policy administrator creates a Group Policy object from a Windows Vista administrative workstation configured for English, saves the GPO, and links it to a domain deployed across geographic boundaries. A colleague in Paris on a Windows Vista workstation configured for French can browse the same domain using the GPMC, select the GPO created in English, and view and edit the policy settings in French. All the while the Group Policy administrator who created the GPO can still see the settings in English, including those changes from the French administrator.

For more information, see Managing Group Policy ADMX Files Step-by-Step Guide.

The central store is an administrator-created folder on the Sysvol of an Active Directory domain controller that provides a single centralized storage location for all Administrative Template files (ADMX and ADML) for the domain. Using the central store, all administrators who edit domain-based Group Policy objects have access to the same set of files. Once the central store is created, the Group Policy tools use only the ADMX files in the central store and ignore ADMX versions stored locally. The central store is optional; if it is not created, the Group Policy tools use the local ADMX files. The root folder for the central store must be named "PolicyDefinitions" and must be located at %systemroot%\sysvol\domain\policies\PolicyDefinitions.

Note Reading ADMX files from the central store might have an impact on the response speed of the Group Policy tools if the domain controllers are located in a site separated from the administration machine by Wide Area Network (WAN) links.

For more information, see Managing Group Policy ADMX Files Step-by-Step Guide.

Windows Vista provides many new security settings in the following areas:

• Windows Defender (anti-malware)—used for enabling or disabling real-time protection and scanning. Also used for managing signature download configuration. Located under Computer Configuration\Administrative Templates\Windows Components\Windows Defender in the GPOE.

• Network Access Protection—provides policy to establish and enforce configuration requirements for computers accessing the corporate network. Located under Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options in the GPOE.

• Public Key Policies—provides policy settings for digital certificates. Located under Computer Configuration\Windows Settings\Security Settings\Public Key Policies in the GPOE.

• Windows Firewall with Advanced Security—includes support for Internet Protocol security (IPsec) rules. Located under Computer Configuration\Windows Settings\Security Settings\Firewall with Advanced Security in the GPOE.

A key area of configuration that customers have requested is the ability to control electrical power consumption. Microsoft has added this capability to Group Policy in Windows Vista. Application developers and administrators can use Group Policy to control how computers, peripheral devices, and portable devices use power.

Controlling power can provide an immediate financial benefit to companies by establishing power-management settings on desktops. For example, reducing the occurrence of having computers in a full power state when users are away for hours or days can save a significant amount of money in energy and other resource consumption.

Battery life is a limitation of many portable devices. Although hardware manufacturers continually improve the effective battery life of portable devices, application developers have to take proactive steps to improve the power usage of their applications on these devices. Applications that run on portable devices need to recognize whether the power source is battery or AC, and use computer resources appropriately. For example, if the power source is a battery, nonessential features such as animations and polling loops can be minimized, screens can be made less bright, hard drives can be spun down, and CPUs can be put into a power-savings mode until needed.

It is important for applications developed for portable devices to be aware when the state of the power changes and notify users to take appropriate action—for instance, to save data before a loss of power occurs. Applications should not use a device that is powered down; instead, they should wait until the device is powered up for general use. Also, applications should minimize system restarts, which are very power-consuming operations.

Windows Vista includes extensive power-management capabilities. All power policy settings are based on per-user and per-machine settings. These power-management features include:

• Group Policy enforcement of manufacturer or corporate custom (in-box) power settings.

• Separate power plan configurations for users logged into the system.

• Default settings that enable energy-saving features on all computers.

• Sleep mode that turns the system off by default.

• Display idle timeouts enabled.

• System sleep idle timeouts enabled.

Administrators can modify specific power policy settings through individual Group Policy settings, or they can construct, deploy, and enforce a custom power plan.

Power-management policy settings are located under Computer Configuration\Administrative Templates\System\Power Management in the GPOE. There also is a single setting under the User Configuration node.

Many IT professionals who work in the area of security are concerned about removable media devices such as USB, CD-RW, and DVD-RW drives. The installation and use of these devices can pose a threat to desktops and networks through the introduction of viruses, worms, and other malicious applications. They also can expose data to theft. Windows Vista provides policy settings that control device installation and use.

Windows uses a device identification string and device setup classes to control device installation and configuration. Windows communicates with a device through a device driver. When installing a device, Windows detects the device, recognizes its type, and then locates the device driver that matches that type. Group Policy settings can specify which of these device installations to allow or block.

The ability to restrict the devices that users can install provides the following benefits:

• Reduces the risk of malware, such as viruses, worms, and other malicious applications.

• Reduces support cost. For example, a system administrator can ensure that users install only those devices that an organization's help desk is trained and equipped to support.

• Reduces the risk of data theft. For example, if users cannot install a CD-R device, they cannot burn copies of company data onto a recordable CD.

Examples of device-installation policy settings include:

• Prevent users but not administrators from installing any device.

• Allow installation only of authorized devices.

• Prevent installation of prohibited devices.

• Deny write access to removable media devices, but allow read access.

Device installation policy settings are located under Computer Configuration\Administrative Templates\System\Device Installation in the GPOE. For more information, see Step-By-Step Guide to Controlling Device Installation Using Group Policy.

Windows Vista has combined two security-related technologies: host firewall and Internet Protocol security (IPsec). The configuration settings of these technologies are integrated into a single Microsoft Management Console named Windows Firewall with Advanced Security (WFAC).

WFAC is a host-based firewall that blocks incoming and outgoing connections based on its configuration. While basic end-user configuration still takes place through the Windows Firewall tool in Control Panel, advanced configuration now takes place in WFAC. The combination of host firewall and IPsec Group Policy settings leverages the advantages of both technologies while eliminating the need to create and maintain duplicate functionality.

WFAC adds a number of new and enhanced features to the previous versions of Windows Firewall. The important new features include:

• Windows service hardening.

• Granular rules.

• Outbound filtering.

• Location-aware profiles.

• Authenticated bypass.

• Active Directory user, computer, and groups support.

• IPv6 support.

Windows Vista provides the ability to configure Windows Firewall for three domains (profiles): Domain, Private, and Public. In addition, it adds outbound blocking and more granular rule setting.

WFAC policy settings are located under Computer Configuration\Windows Settings\Security Settings\Windows Firewall with Advanced Security in the GPOE.

Windows service hardening

Granular rules

Outbound filtering

Location-aware profiles

Authenticated bypass

Active Directory user, computer, and groups support

IPv6 support

Printer management can be a difficult task for almost every company and network administrator. For companies that use a brigade of laptop computers, printer management can be more complex as users move from building to building or campus to campus. Windows Vista addresses this issue by providing the ability to configure printers based on the current Active Directory site where the computer belongs. The ability to assign printers based on geography or location in an organization is a new feature. Because Active Directory sites typically map out the geographical or physical network topology, this ability creates a perfect solution for delivering printers to laptop users.

Administrators can assign printers based on location. When mobile users move to a different location, Group Policy can update their printers for the new location. Mobile users returning to their primary locations see their usual default printers.

Note:
Group Policy will not automatically refresh the printer policy settings when a computer moves to a new location. New printer assignments will be available after a Group Policy refresh following the location change.

The Printer Assignment Based on Location policy settings are located under Computer Configuration\Windows Settings\Deployed Printers and User Configuration\Windows Settings\Deployed Printers in the GPOE.

In Windows Vista, Internet Explorer can be managed in one place using Group Policy, eliminating the need for the Internet Explorer Administration Kit (IEAK). The majority of the policy settings are under Administrative Templates in the GPOE, including most of those previously under the Internet Explorer Maintenance (IEM) extension.

The Internet Explorer policy settings are located in Computer Configuration\Administrative Templates\Windows Components\Internet Explorer and in User Configuration\Administrative Templates\Windows Components\Internet Explorer in the GPOE.