Th2 3 lab5 gpo han che desktop

4/23/2018

Xây dựng hạn chế windows

4. Xây dựng chính sách nhóm cho OU
Hạn chế một số chức năng của người dùng
Để tạo ra các hạn chế của một số thành phần trong
windows ta tạo GPO để thiết lập các thành phần
này:

components cho GPO

Ð

Group Policy Management

Editor

File Action View Help

@ ®| 2|r2|i2|H
mđ| Ÿ
|S} GPO_Gioihanchucnang [SERVER.khoacntt.edu.vn] Policy
© g& Computer Configuration
& © Poles

B1. Tạo GPO

Scripts (Startup/Shutdown)

®

B2. Xây dựng GPO (Edit)

ccty setiros

Policy-based
Qos
ative Templates: Policy definitions (ADI

Ei a

Để hạn chế cho IE

Để hạn chế cho IE

° Tại màn hình bên sẽ chỉnh sửa tương ứng
— Hạn chế Security
@

Internet Control Panel

page
Display Properties

Hị
:
i
i
i

equirements:
Atleast Internet Explorer 5.0
Description:
Removes the Security
tab from the

interface in the Internet
Options dialog
box.

IF you enable this pokey, itprevents
and changingse

E, Tum off managing Pop-up fitter level

E) Prevent "Fax settings" functionality

E) Tum off Managing
Phishing fiter
=| Tum off the Seasrty Settings Check feature

If you disable this policy or do not

configure it, users can see and

| Tum on Compatbiity Loggng

TƠI Teebe4 C®ee Tane

these settings.

When you set this policy, you do not

need to set the foloning internet
Explorer policies, because this policy
removes the Security tab from the
interface:

ee

- Han ché Connection

Deplay Properties
Requrements:

Atleast Internet Exolorer 5.0

.

terface n the internet Optorsdaog — ¿_
potcy, users are

&

Stas
Not confi
Not conf

2

Še#ng | Explain | Comment|

=O

Net Conk

If you disable this pokky or do not
configure it, users can see and change

“©

Enabled
Daabksg

EE Disable the Securty page
© Not Configured

© Enabled

© Disabled
ce

Disable
the Advanced page
Display Properties

(i) Disable the Advanced page

Requirements:
Atleast Internet Explorer 5.0

isable the Advanced

Notc
page Properties

Removes the Advanced
tab from the
box.

[= Disable the Advanced
page

Tf you enable this polcy, users
us
are
prevented from
Samed Nenetaiaegs such as
security, multimedia, and printing.

© Not Configured
@ Enabled
© Disabled

Tf you disable this policy or do not

configure
it, users can see and
these settings.

“Disable changing connection settings”

When you set this policy,you

“Disable changing proxy settings”

do not

need to set the "Disable
none dao ne ena kn. A
‘Supported
on: At least Intemet Explorer 5.0
[

Setting | Explain
| Comment |

interface in the Internet Options dialog

When you set Cas poicy, you do not
the following poles

“Disable changing Automatic
Configureton settings”

Disable the Security page Properties

Internet Control Panel

Description:

ẾẾ Dieable the Connections page

Prevented
from seeing and changing
proxy settings.

these settings.

|_

© eee

Removes the Connectons
tab fromthe = '—box.
Ifyou

|Ju
=)p1

- Han ché Advanced
=

Setting
— Ađvanced Page
Diseasity Page
Disable the Advanced page
E Desable the Connections page

EIS

OK

|

Carcet_|

Aanip

2.

J


4/23/2018

- Hạn chế Content

- Han ché Trong Menu Start
) g& User Configuration
= © Policies

f] (5) Software Settings
EI ©) Windows Settings

i, Remote Installation Services

)

=} Scripts (Logon/Logoff)

§& Security Settings
(@ Folder Redirection

4) gly Policy-based Qos

m

Internet Explorer Maintenance

& 1 Administrative Templates: Policy definitions (ADMX files) re
(1 Control Panel

- Hạn chế Help and Support
Remove Help menu from Start Menu Properties

- Han ché Search

ri

ete

eke dace

| Exton
| Commer |

_Bmexsep
| MeeSep |

- Han ché Desktop

- Hạn chế Add or Remove Program
* Trong Control Panel

] g& User Configuration
LE] Specify default category for Add New Programs
[E) Hide the "Add a program from CD-ROM or floppy disk” option

Microsoft
Wind
,
Windows XP, and Windows 2000

= (5) Policies
(5) Software Settings
© (5) Windows Settings

i Remote Installation Services

[E] Hide the "Add programs from Microsoft” option

[E) Hide the "Add programs from your network” option
[E] Hide Add New Programs
page

Ce

@, Security Settings

(@ Folder Redirection
Policy-based QoS
Internet Explorer Maintenance

=) (S Administrative
Templates: Policy definitions (ADMX files) re

& ( ControlP:
2

G

Desktop


4/23/2018

- Hạn chế Recycle Bin

Han ché Mycomputer
Tota

- Hạn chế My network

Kết quả của triển khai các hạn chế trong GPO
Policy

on desktop Properties

‘low users to walect new roct ceticahon authorbes (CAs) to trust

Geert computers can trust the folowing certhicate stores
To ped
crters

HH

HH

Policy defiribons (ADMX files) retneved from the local machine.

- Add chính sách vừa tạo với một OU
nào đó

* Chon OU can Add rồi

2

Baaaw

89 ElBiEi

em
eg229

Baa

fap SPU ramen

sary

Ensbed
Tred Paty Roce
Ray