Configuring Preference Items

To configure a preference item in a GPO, follow these steps:

1. Right-click the GPO or its associated GPO link in GPMC and select Edit to open the GPO in the Group Policy Management Editor.
2. Expand the Preferences node under either Computer Configuration or User Configuration as desired.
3. Right-click a preference setting node and select the appropriate menu option to create, replace, update, or remove a preference setting.

You can also use the Get-GPPrefRegistrySetting cmdlet to configure preference items using Windows PowerShell. For more examples on how to use the Group Policy cmdlets, see the Windows PowerShell section of the Group Policy Team Blog on Microsoft TechNet at http://blogs.technet.com/grouppolicy/archive/tags/PowerShell/default.aspx.

Group Policy Settings vs. Group Policy Preferences

One way to think of Group Policy is as a set of rules that you can apply throughout the enterprise. Although you can use Group Policy to manage servers and workstations running Windows 2000 or later, Group Policy has changed since it was first implemented with Windows 2000. For Windows Vista with SP1 or later and Windows Server 2008, Group Policy includes both managed settings, referred to as policy settings, and unmanaged settings, referred to as policy preferences. When you deploy the Group Policy CSEs to Windows XP with SP2 or later, Windows Vista, or Windows Server 2003 with SP1 or later, these older operating systems can use Group Policy preferences as well.

• Group Policy settings enable you to control the configuration of the operating system and its features. You can also use policy settings to configure computer and user scripts, folder redirection, computer security, software installation, and more.
• Group Policy preferences enable you to configure, deploy, and manage operating system and application settings that you were not able to manage using earlier implementations of Group Policy, including data sources, mapped drives, environment variables, network shares, folder options, shortcuts, and more. In many cases, you'll find that using Group Policy preferences is a better approach than configuring these settings in Windows images or using logon scripts.
• The key difference between preferences and policy settings is enforcement. Group Policy strictly enforces policy settings. You use policy settings to control the configuration of the operating system and its features. You also use policy settings to disable the user interface for settings that Group Policy is managing, which prevents users from changing those settings. Most policy settings are stored in policy-related branches of the registry. The operating system and compliant applications check the policy-related branches of the registry to determine whether and how various aspects of the operating system are controlled. Group Policy refreshes policy settings at a regular interval, which is every 90 to 120 minutes by default.
• In contrast, Group Policy does not strictly enforce policy preferences. Group Policy does not store preferences in the policy-related branches of the registry. Instead, it writes preferences to the same locations in the registry that an application or operating system feature uses to store the setting. This allows Group Policy preferences to support applications and operating system features that aren't Group Policy-aware and also does not disable application or operating system features in the user interface to prevent their use. Because of this behavior, users can change settings that were configured using policy preferences. Finally, although Group Policy by default refreshes preferences using the same interval as Group Policy settings, you can prevent Group Policy from refreshing individual preferences by choosing to apply them only once.

When working with policy settings, keep the following in mind:

• Most policy settings are stored in policy-based areas of the registry.
• Settings are enforced.
• User interface options might be disabled.
• Settings are refreshed automatically.
• Settings require Group Policy-aware applications.
• Original settings are not changed.
• Removing the policy setting restores the original settings.

When working with policy preferences, keep the following in mind:

• Preferences are stored in the same registry locations as those used by the operating system and applications.
• Preferences are not enforced.
• User interface options are not disabled.
• Settings can be refreshed automatically or applied once.
• Preferences support non-Group Policy-aware applications.
• Original settings are overwritten.
• Removing the preference item does not restore the original setting.

In the real world, the way you use policy settings or policy preferences depends on whether you want to enforce the item. To configure an item without enforcing it, use policy preferences and then disable automatic refresh. To configure an item and enforce the specified configuration, use policy settings or configure preferences and then enable automatic refresh.