Hey everybody I'm going to the next video.
So in this video we're gonna be going over group policies now group you can think of group policies
as the configuration component for the Active Directory Domain.
Now I'm not talking about the domain controllers specifically I'm talking about all of the workstations
the users the groups.
What happens when they log in.
What restrictions they have whether it's something like we're restricting down what applications can
be ran as an example or we want to make sure users on certain workstations have certain printers installed
they have they run certain startup scripts based on current based on the actual user or maybe the user
and the computer.
Maybe you want the computer to do something the or the account has a certain restriction on how long
it can keep its password for.
So all this type of stuff is built into group policies.
Now to view this we're on the currently around the domain controller here.
So we're going to come over to the start menu and then Windows administrative
then we're gonna see right here in the middle we're gonna see group policy management.
So go ahead and open that perfect.
Now what you'll see here when you first land is you'll see it looks like this.
Now we only have one forest or one domain.
So red team nation dot local.
So we're gonna go out and open this up under go under domains and we see red team nation not local.
So underneath here we have something called default domain policy.
You could just go ahead and click.
Do not show this mess again.
We don't care.
So this is the base version of a group policy.
It affects all authenticated users.
So this is everybody who's a domain user that has been logged in to a workstation of some kind or some
server.
So right now it's not enforced.
Don't worry about the link or the path in this particular case but just look at enforce that means are
these rules being applied.
Correct.
Currently they're not however to enforce a policy.
You right click click enforce that's it.
And we're going to enforce that for now.
But you can see it says authenticated users.
Now again everybody who's logged in will have these settings so if we go to details gives us a quick
look about the policy itself.
So when it was modified the owner of it the GPO settings which it's currently enabled not enforced but
enabled.
Now if we want to actually see what was changed or what the policy is we go to settings.
So this takes a quick second generate the report so to show all just to be things a little easier.
Now this structure is important.
So you'll see a computer configuration than Windows settings security settings then under that you see
account policies and password.
These are folder structures or branches in the pop group policy edit menu.
So we'll go over that in a second when we create a brand new one.
But I just want to give you an idea.
So by default if we enforce this we would have a password history of 24 passwords remembered.
They can keep it for 42 days minimum time they have to keep it as one so you'll get the user resetting
the password over and over and over again to get back to the one that they want minimum password like
the seven.
That's not ideal we're gonna want twelve in most enterprise environments pass and must meet.
Complexity is enabled which will offset this as well.
That should set at least eight I believe.
And then store as a reversible encryption.
This has been disabled account lockout threshold.
So we can't have any lockout threshold at all in some cases with group policy zero means unlimited.
So just keep that in mind.
We'll go over like a few instances of that a little bit later.
So this is about Kirby that we have the network policies and then we've got certificates so you can
see that there's there's quite a bit here but there's thousands of possible options that you could have
enabled.
So what we'll do.
We're going to want to create a brand new one.
So if we right click read to nation and we'll do create a GPL or a group policy object in this domain
and link it here so we're gonna name this testing.
Right.
We're going to leave everything else default for now.
OK now we see our testing one right here and we can see that there's nothing built.
And right now it's on authenticated users.
So what I want to take a second and do is remove that yes.
So the way you can do this is you can do this on a per user per group basis or computer basis.
So in this case we want this want to be you know domain admins.
Right.
So actually we'll do domain users so if they're part of the domain users group then they will be affected
by this policy.
Now if we look over here there's settings nothing there so to edit this and actually start getting some
policies in there.
You're going to right click on your policy and click Edit Now this is gonna bring up a whole separate
window that we're going to use.
So if we kind of go in here there's two sections computer configuration and user configuration.
Remember that hierarchy for account preferences.
We had computer configuration policies this over and we had windows settings
and then we had security settings and then we had our local account policy.
So now we can see underneath here we have those same restrictions that we had that we saw in the previous
one so.
But what I want to go over real quick is forgetting the computer we're going to look at the user configuration.
So if we go into policies and Windows settings we have a few options here.
So per user we can set a log on or log off script.
So when somebody logs in we can tell it whatever script we want in the parameters to go with it.
Now this works for power shell as well or you can have it run something completely on its own.
This is important.
Maybe on a Windows environment if you have a user that wants to let's say they need you have a script
or a bash script or batch script that needs to set up all the printers.
You don't want to do it manually.
You do have a script that automatically does everything for you.
You'll just throw all that into the log on scripts that way.
It runs when the user logs and folder redirection is another important one.
So if you want their desktop and documents and everything else to be stored in a different location
maybe you have a network share that is hosting all the user's home directories.
So what you can do is you can have all their documents and their desktop their downloads everything
being stored on a server.
So that way they have all of their data on their desktop looks the same their documents looks the same.
Everything is exactly the same no matter which machine they log into.
So that's an important one to notice as well.
Now we've got deployed printers so if you need to deploy a printer per particular user you can do that
here or for these sets of users.
Anyway so we're going to go back up to computer management now.
So in here under security settings we have quite a lot of options to work with.
So again the first one we're going to look at is account as a password policy so enforcement password
history.
So if we double click on it it comes up with our properties back where you could right click properties.
Now if we define this policy how many passes do you want to keep.
There should be always an explain option for ones that need a little bit of information around them
so you can see here the default is twenty four on domain controllers and zero on standalone.
It gives you an idea of what the value should be.
So for example between 0 and 24 we're going to go ahead just apply that as zero when we can see that
right here at 0 percent remember.
So we want a minimum password age again we'll go and explain between.
It says oh between zero and nine hundred ninety eight so we'll go ahead and set this to say they can't
change their password every 20 days and since this one requires a minimum password is now 20 days the
maximum must be changed as well.
So we go ahead and do that.
It sets it to 10 days more than what your current one is.
So in this particular case this requires to be set.
And if we looked at a minimum password again I should say it should it need some maximum needs to be
set as well
now the lockout policy so we want the lockout duration.
So if somebody uses the password wrong so we can do from zero to almost ten thousand minutes.
So if you set the account lockout duration to zero the account will be locked out until an administrator
explicitly unlocks it.
So this is one of those instances we're setting this to zero has a different effect than what you would
think it's going to be.
So just always double check on uncertain things like this.
So what I want you guys to do now is to go through and play around with some of the settings.
Now when you save this I'm sorry.
When you when you close this it saves it so right now.
That's the policy.
So we're just going to go ahead and refresh here and we can see everything that we selected has been
set.
So there's no need to save it.
What I want you to do is play around with a few settings when you're done.
Close it out right click and enforce it and make sure the scope is set to something that you were using
so domain users should be any of the users you've created while testing this.
And then log in from the workstation and make sure things are doing what you expect them to such as
redirecting the desktop to a folder on the the domain controller or let's say we set the minimum password
history to our minimum password.
Yeah minimum password age to five days.
Right.
And then you go and change the password on the workstation and give that a try.
There's also options which I didn't show you yet here that you can restrict what you view when it comes
to different types of things.
So if we look in here and we say control panel and we go to display we can hide disable the control
panel.
So they can't see it.
We can disable certain things and Adam move programs from inside the control panel.
So play around with different stuff like this.
Test it out.
Now there is a command called GP update space slash force which will be below the video.
Now if you see that you've made a change and you go to the computer log out and log back in and you
see that it hasn't taken effect.
Go ahead and run that command.
That'll force the update to happen.
Normally this update occurs every five 10 minutes or so.
But in case you need it to happen right now because you're playing around with it live.
Go ahead and run that that GP update that again that'll be below the video.