Overview of Group Policy Staging
Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2
Group Policy is a powerful tool for configuring Microsoft® Windows® 2000, Windows® XP Professional, and Windows Server 2003 operating systems across the enterprise. This ability to affect configurations across hundreds or even thousands of computers necessitates good change management practices to ensure that the changes made to a Group Policy object (GPO) produce the expected results for the intended targets — users and computers — in infrastructures that use the Active Directory® directory service.
Most enterprises have change management processes in place to ensure that any new configurations or deployments of production systems go through rigorous testing in a non-production environment prior to moving them into the production environment.
In many change management processes, enterprises differentiate between a test environment, which is used to test changes, and a staging environment, which is a pristine environment that resembles production and is the last stop for a change before it is deployed to production. In this chapter, the terms test and staging are used interchangeably, without differentiating between them as physical environments. You can, however, use the techniques described in this chapter to create separate test and staging environments if your change management processes require them.
This kind of change management process is equally important for Group Policy changes because Group Policy is capable of affecting everything from registry settings to security settings to deployed software on a workstation or server. In addition to the many configuration settings that Group Policy accommodates, GPOs can be linked to a number of different scopes, and their effect can be filtered by users, computers or security groups. The ability to stage GPOs in a pre-production test environment and then test the various ways that they can be deployed prior to committing them to live users and computers is critical to ensure reliable, robust operation of your Windows-based infrastructure.
The creation of a staging environment is critical to any successful deployment of Group Policy within your Active Directory–based infrastructure. There are several options that you can choose from to create such an environment. These options are enabled by using features within the Group Policy Management Console (GPMC). GPMC runs on 32-bit computers running a member of the Windows Server 2003 family operating system or Windows XP Professional with Service Pack 1 (SP1). GPMC consists of a set of scriptable interfaces for managing Group Policy and an MMC-based user interface (UI). The UI integrates all previous Group Policy tools into a unified Group Policy-management console. GPMC can manage both Windows Server 2003 and Windows 2000 Active Directory–based domains, although some features are available only in Active Directory environments running Windows Server 2003.
GPMC console-based features and accompanying Windows Script Host (WSH) scripts give you the ability to create a staging environment that mimics your production environment. You can then use the staging environment to test new or changed GPOs. Once those GPOs are validated, you can use GPMC to migrate them to your production domains.