- [Instructor] Security professionals may take advantage
of account policies to apply security requirements
and other configuration settings across the domain.
Windows Active Directory provides group policy functionality
to allow this type of configuration.
Administrators may create Group Policy Objects, or GPOs,
which are groups of configuration settings
and then apply those GPOs to either an entire domain
or smaller groups of users and computers
known as organizational units.
Let's create a Group Policy Object together
on a Windows server.
We'll work together to design a policy
that requires the use of a password protected
screen saver for all users.
From Server Manager, we pull down the tools menu
and choose the Group Policy Management tool.
We drill down to our domain, corp.TestDomain.com
and expand the Group Policy Objects folder.
Notice that there are only two default policies here.
We right-click on the folder
and choose New from the pop-up menu.
Let's give our GPO a logical name,
say Screensaver Policy,
and click OK.
Now you can see that we've created the GPO.
It doesn't have any requirements yet,
but we have an empty shell that we can work with.
If we right-click on this new GPO and choose Edit,
that opens up the Group Policy Management Editor.
Let's just rearrange this screen a little bit
to make it easier to read.
The expandable folders here
contain all of the setttings
that we can enforce by GPO.
Let's try expanding the User Configuration Policies folder,
then the Administrative Templates folder,
and the Control Panel folder under that.
If you look through the names of the folders here,
you'll see that they describe the types of settings
we can configure.
We're interested in the screen saver settings,
so let's click on Personalization, where those are found.
Here, we can set the required configuration by GPO.
These settings are all currently set as not configured,
meaning that the GPO does not affect them.
Let's go ahead and edit the Enable screen saver policy
by double-clicking on it.
Then we'll choose the Enabled option
and click OK.
You'll see over here that the state
of the Enable screen saver setting in our GPO
is now set to enabled.
This GPO will require all users to have a screen saver
if this GPO applies to them.
We can similarly prevent the user
from changing these screen saver settings
by using the Prevent changing screen saver policy,
so let's go ahead and double-click on that,
select Enabled and click OK.
And we can also require
that the screen saver be password protected,
using the Password protect the screen saver policy.
Let's also set a screen saver time-out
so that the screen saver comes on automatically.
And this setting's a little bit different.
It's more than just enabling it.
We also have the ability to change an option here.
And in this option, you see it says
the number of seconds to wait
to enable the screen saver.
We're going to go ahead and use the default setting
of 900 seconds, or 15 minutes.
That's a reasonable amount of time
to wait to activate the screen saver.
We can then exit the editor
and our screen saver GPO
now applies to all users in the domain.
That's an easy way to enforce
a consistent group policy for all users.