Vista Security Guide

[Dan Metzler]

Has anyone looked at the GPOs created by the Vista Security Guide and found
that some settings appear not to have admx template files associated with
them?

When I view the VSG EC Desktop, Laptop, and Users policies in GPMC on a
Vista computer, I see an "Extra Registry Settings" category under
Administrative templates. If I expand this category, I see a number of
registry settings in the policy which, I assume, there is no way for me to
modify since there is no Administrative Template associated with it.

Should the Vista Security Guide have come with some Administrative Templates
for Vista? Or am I missing something?

Thanks,

- Dan Metzler

 

[Dan Metzler]

Any thoughts on whether or how we might be able to get access to those?

Thanks,

- Dan Metzler

 

[Guest]

I did a little more looking into this. It turns out that it is fully to be
expected that the Extra Registry Settings show up in the GPO. If you look
carefully at them you will find out that they all have to do with the Vista
Firewall. The Vista Firewall is configured in the Windows Settings section,
but it writes its settings into the registry.pol file that is primarily used
for settings configured in the Administrative Templates section. When gpmc
goes to parse the registry.pol file it can't find a corresponding ADMX
template, because there is none, so it lists all the new firewall settings as
"Extra Registry Settings."

 

[Guest]

You would need to update the GP management tools to GPMC 2.0 for Server 2003
to manage Vista policies on a Server 2003 system. As far as I know there is
no such update yet. Therefore, currently, you need to create and manage the
policies on a Vista system, although they can be distributed by a Server 2003
DC. This doc gives a good overview:
http://www.microsoft.com/technet/windowsvista/library/02633470-396c-4e34-971a-0c5b090dc4fd.mspx

There are extensions for wireless policies that you need to deploy those
from a Server 2003 domain:
http://www.microsoft.com/technet/network/wifi/vista_ad_ext.mspx

There is also lots of good info on how to deploy GP with Vista at:
http://technet2.microsoft.com/Windo...878e-48db-a3c1-4be6ac7cf7631033.mspx?mfr=true

 

[Guest]

I have still not ever seen this option "Extra Registry Settings"
I am running Windows Vista, I have both the gpedit and gpmc running, and I
don't see it in either place.
I can enable policies using gpedit and they take effect on my machine, but
cannot utilize these tools on my win2k3 domain controller. I think I need to
install the gpmc from Vista on this server? But where do I download it?
I am really anxious to start working with GP and my Vista workstations, but
am getting flummoxed!!!
Thanks,
Greg