Group Policy may be the greatest contributor to Microsoft's new and improved ROI model. However, its complexity has limited its adoption by Windows 2000 customers. Microsoft has addressed this by releasing a new tool called the Group Policy Management Console.
Group Policy, designed to automate management of users' desktop systems, lets an administrator lock down desktop systems to prevent users from damaging their systems inadvertently or by loading unapproved software. There are hundreds of canned policy settings included in the base OS installation; additionally, administrators create their own on the fly. Policies can be applied at several levels--local machine, site, domain and organization--and in various combinations. With the tools provided in Windows 2000, however, it was difficult to determine the combined effect of policies applied at different levels, such as policies for both a local machine and the domain. Not being able to predict the outcomes of combined policies at different levels means Group Policy configuration errors could have harmed the network in ways that would be difficult to troubleshoot and repair.
GPMC addresses this problem by consolidating several tools to provide a comprehensive view of policies applied at all levels (see screenshot). It lets administrators model policy changes before implementing them on a production network. And like ADMT, Group Policy has a scripting interface so administrators can automate network configuration. GPMC's major shortcoming is the lack of a rollback feature that would let an admin back out of changes that don't work as planned. This capability still requires a third-party product.
Script Management
Windows systems programming has had a checkered past. The Windows CLI (command-line interface) has always been a poor cousin to Unix shell programming tools and scripting languages. Even though newer tools--such as VBScript, PERL for Win32 and Windows Scripting Host--allowed some automation, many system-level functions were not accessible to an administrator from the command line. Until now, system functions could only be accessed using C or C++ programming, a skill that many administrators don't have. The result was that managing a Windows network required too much manual configuration through the Windows GUI.