70-680 Configuring Windows 7 Lab Manual

LAB 10
CONFIGURING APPLICATIONS
Exercise 10.1
Overview

Installing e!ote "er#er $d!inistration %ools

Before you can configure AD DS Group Policy settings from your Windows 7 workstation, you must install and ena le t!e "emote Server Administration #ools, w!ic! includes t!e Group Policy $anagement console% '( minutes

&ompletion time

')% #ake a screen s!ot of t!e Group Policy $anagement console, s!owing t!e GPO you created, y pressing Alt*Prt Scr, and t!en paste t!e resulting image into t!e

70-680 Configuring Windows 7 Lab Manual

la '(+works!eet file in t!e page provided y pressing &trl*,%

70-680 Configuring Windows 7 Lab Manual

Question 1

Will the Group Policy settings you configure in your new GPO have an immediate effect on your network? Why? No because it is not linked to any object or to the domain.

Exercise 10.&
Overview

Configuring IE8
#!e director of -# at &ontoso, .td% wants to prevent t!e company/s Windows 7 users from modifying t!e default -nternet 01plorer configuration y installing additional software, suc! as add2ons and accelerators% S!e also wants to ensure t!at t!e company intranet pages, designed several years ago for a previous -0 version, display properly in -03% 4inally, t!e director wants to ensure t!at all -nternet rowsing activity on t!e network is logged for later e1amination% 5our 6o is to configure t!e appropriate Group Policy settings to implement t!ese re7uirements in your GPO% '( minutes

&ompletion time

Question 2 Question 3

Why would you want to enable the 'se (olic) accelerators policy in this case rather than the %urn off accelerators policy? !t will prevent users from installing other accelerators Why is it necessary to disable the "urn on !nternet #$plorer %tandards &ode for 'ocal !ntranet policy?!t will prevent users from modifying !# Why in this case is it necessary to enable both the Prevent (eleting Web sites that the )ser has *isited policy and the "urn off !nPrivate +rowsing policy?+ecause you need user to browse the internet but also having their sites track. Why isn,t it necessary to enable the "urn off !nPrivate -iltering as well?"he policy has no effect on the workstation that is maintaining browse history

Question 4

Question 5

70-680 Configuring Windows 7 Lab Manual

'8% #ake a screen s!ot of t!e Group Policy $anagement console displaying all of t!e policy settings you configured in t!is e1ercise y pressing Alt*Prt Scr, and t!en paste t!e resulting image into t!e la '(+works!eet file in t!e page provided y pressing &trl*,%

70-680 Configuring Windows 7 Lab Manual

Exercise 10.*
Overview

'sing $((Loc+er
5our -# director wants to egin using t!e new App.ocker feature in Windows 7 to restrict t!e applications t!at users are a le to run on t!eir workstations% S!e wants standard users to a le to run all of t!e e1ecuta les included wit! Windows e1cept for t!e "egistry 0ditor% $em ers of t!e -# support staff, !owever, w!o are all mem ers of t!e Group Policy &reator Owners group, must e a le to run t!e "egistry 0ditor to service ot!er users/ computers% '( minutes

&ompletion time

Question 6

+ased on the default rules that appear in the #$ecutable .ules folder what programs can a typical user run on a Windows / workstation? What programs can members of the 0dministrators group run?0ll files in the Windows -older e$cept .ageedit.e$e and 0dmin group can run all files. +ased on the default rules that appear in the Windows !nstaller .ules folder what Windows !nstaller files can a typical user run on a Windows / workstation? What Windows !nstaller files can members of the 0dministrators group run? 0ll installer files that are digitally signed and in the specific installer folder for windows. 0dmins can run all files. Why is it necessary to create the additional rule for the Group Policy 1reator Owners group? +ecause the default rule won,t let you access .ageedit.e$e.

Question 7

Question 8

70-680 Configuring Windows 7 Lab Manual

70-680 Configuring Windows 7 Lab Manual

'3% #ake a screen s!ot of t!e Group Policy $anagement 0ditor console displaying t!e contents of t!e 01ecuta le "ules container y pressing Alt*Prt Scr, and t!en paste t!e resulting image into t!e la '(+works!eet file in t!e page provided y pressing &trl*,%

70-680 Configuring Windows 7 Lab Manual

LAB CHALLENGE: SUPPRESS NG C!"PA# B L #$ %ARN NGS

&ompletion time ') minutes

#!e Windows 7 users at &ontoso, .td% are restricted to a predefined set of applications, all of w!ic! !ave een recently updated and carefully tested for compati ility% #o prevent users from attempting to run downlevel applications, you !ave een instructed to disa le t!e Windows 7 compati ility mode controls using Group Policy% #o complete t!is c!allenge, you must locate and configure t!e appropriate Group Policy settings to accomplis! t!ese goals in t!e GPO you created in 01ercise '(%'% Write out t!e procedure you used to configure t!e settings, and t!en take a screen s!ot of t!e container w!ere t!e settings are located y pressing Alt*Prt Scr, and paste t!e resulting image into t!e la '(+works!eet file in t!e page provided y pressing &trl*,%

70-680 Configuring Windows 7 Lab Manual

LAB CHALLENGE: &EPL!$ NG GR!UP P!L C$ !B'EC#S

Completion time 15 minutes

#o deploy a GPO like t!e one you !ave created in t!is la , you must link it to a Active Directory Domain Services domain, site, or organi9ational unit o 6ect% :owever, for t!e purposes of t!is la , it is necessary for t!e settings in your GPO to e applied to your workstation only, and not any of t!e ot!er computers on t!e network% #o complete t!is c!allenge, you must configure your GPO so t!at its settings apply only to t!e ;5&2&.a computer and t!en link it to t!e contoso%com domain o 6ect in t!e AD DS tree% Write out t!e procedure you used to complete t!e c!allenge, and t!en take a screen s!ot s!owing t!e configuration t!at limits t!e scope of t!e GPO y pressing Alt*Prt Scr, and paste t!e resulting image into t!e la '(+works!eet file in t!e page provided y pressing &trl*,%