Home

General GP Concepts
.. GPMC
.. Create/Edit GPOs
.. Targeting GPOs
.. Applying GPOs
.. Developer Issues

Extensions
.. Admin Templates
.... Windows Firewall
.... Internet Explorer
.. Security Policy
.. Software Installation
.. IE Maintenance
.. Scripts

Policy Exceptions
.. Loopback
.. Enforce/Block
.. Slow Links
.. WMI Filters

Reference
.. Third Party Products
.. KB Articles
.. Community

Terms of Use
Trademarks
Privacy Statement

This page provides pointers to vendors and products relavent to Group Policy.  A similiar page is also located at http://www.microsoft.com/windowsserver2003/technologies/management/grouppolicy/gptools.mspx  and will be kept up-to-date by Microsoft:                          

• RES Software:
  • RES PowerFuse 2008 Enterprise Edition:  User Workspace Management software
    Provides Microsoft Windows users with a consitent workspace across multiple devices and application delivery mechanisms. RES PowerFuse eliminates the need for complex scripting and provides an alternative to Microsoft roaming user profiles.
  • RES PowerFuse 2008 Express Edition
    RES PowerFuse 2008 Express Edition has been designed to provide a free starter package for managing operating systems and application settings for Microsoft Windows users. With the Express Edition IT staff can offer the individual a workspace with access to only the applications that are meant for the specific user. RES PowerFuse 2008 Express Edition is available to download today at: www.respowerfuse.com.
    
• Centrify Corporation:
  • DirectControl GP for Non-Windows Systems: Use Active Directory Group Policy to centrally enforce security and configuration policies across your UNIX, Linux and Mac systems.
  • DirectControl GP for Mac OS X: Centrally secure and configure Mac systems through Active Directory Group Policy.
  • February 21, 2008 Webinar: “Five Top Benefits of Using Windows Group Policy to Secure and Manage UNIX, Linux and Mac Systems.” Concise overview of how Group Policy works from Jeremy Moskowitz, author of authoritative works on both Windows Group Policy and Windows/Linux integration.
• JiJiTechnologies:
  • Active Directory Reporter: Active Directory Reporter(ADR) enables IT organization to extract vital information from AD in seconds.It supports GPO Reports,User Reports,Group Reports,Computer Reports,Exchange Reports,OU Reports and Other Reports.It supports Powershell scripting for reporting automation.
• Group Policy Task Force: A list of ISVs involved in Group Policy
• Special Operations Software:
  • Specops Gpupdate - Wake-On-Lan(WOL)/Remote restart/gpupdate: (Free tool) Refresh Group Policy, wake-on-lan (WOL), remote restart and remote shut down of PCs, all through the Active Directory Users and Computers interface. In addition you get instant graphical feedback on how the operation performed.
  • Specops Deploy - Software Deployment/Software Distribution: Group Policy Extension for Software Deployment, featuring deployment to users or computers; deployment at logon, boot or at runtime; real time feedback of deployments; Supports Windows Installer setups, MSP and legacy (*.exe) setups; Scheduling; BITS; DFS; End User Notifications; Advanced targeting
  • Specops Inventory - PC/Software Inventory: Group Policy Extension for Inventory/Asset Management. With this CSE companies can rely on Group Policy to get full control over all hardware, software, profiles, registry entries, files, environment variables, user queries, operating system information, applied group policies, active directory information and more. Comes with a web based reporting tool and a License Manager where you can get notifications when your software compliance are about to be broken. 
  • Specops Password Policy - Password filter to allow multiple password policies: Group Policy Server Extension that allow you to have more than one password policy within an Active Directory domain. Also makes each password policy more granular.
  • Specops Command - PowerShell through Group Policy: Group Policy Extension that allow you to deploy and run PowerShell scripts and cmdlets on a multitude of machines. Also built-in Undo-scripts, reporting, targeting, scheduling, and much more.
• NetIQ: Group Policy Administrator, Group Policy Guardian
• SDM Software:
  • GPExpert(tm) Scripting Toolkit for PowerShell: The Scripting Toolkit provides a way of automating the reading and writing of Group Policy settings within local and domain GPOs. You can use the Toolkit to manage Group Policy settings in many areas of policy, including Administrative Templates, Security, Software Installation and more.
  • GPExpert(tm) Backup Manager for Group Policy: The Backup Manager for Group Policy lets you manage the backup and recovery of GPOs and GPO links in your Active Directory environment. Schedule and log backup and recovery events. Backup GPOs on Edit. Report on backup details.
  • SDM Software GPMC Cmdlets (Free): These are a set of free PowerShell cmdlets that wrap the functionality of GPMC. Now you can use PowerShell to manage tasks such as creating and deleting, backing up and restoring and linking and permissioning GPOs.
  • GPExpert(tm) Troubleshooting Pak: The GPExpert Troubleshooting Pak 1.0 is a set of 4 products that lets you monitor and troubleshoot the health of Group Policy Processing on your Windows systems. The Pak consists of the Health Reporter, Log Analyzer, Group Policy Spy and Status Monitor. Each product brings unprecedented visibility to all aspects of GP processing. You can download a free 15-day trial version using the link above.
  • GPExpert(tm) Status Monitor: The GPExpert Status Monitor is a system tray application for your Windows desktops that lets your help desk administrators find out quickly when Group Policy is not working. Records success or failure of Group Policy processing and how long processing took to desktop event logs.
• Full Armor:
  • GPAnywhere™: GPAnywhere can take a Group Policy Object in Active Directory and make into a "portable" policy.  This "portable" policy, which is usually in the form of an executable allows GPOs to be applied to end-points outside of Active Directory or remotely connected to the network.  Examples of use cases are VPN users, laptop/roaming users, Kiosks, Servers behind DMZs, etc.
  • GPAnywhere™ for SMS:  GPAnywhere for SMS takes all of the functionality of the base GPAnywhere product but integrates it into the SMS console and uses the SMS product delivery mechanism to push down GPOs to all endpoints serviced by SMS.  From the SMS console, you can select any GPO from Active Directory and GPAnywhere will convert it into a "portable" format and insert it into the target software package within SMS.  You can then use SMS to do the targeting and delivery of packages with GPOs inside them.
  • PolicyPortal:  Hosted service offering that allows customers to access the power of Group Policy without setting up an Active Directory environment.  Administrator access is via a web browser and all aspects of Group Policy creation, change management, compliance, and delivery is done via the web interface.  FullArmor is currently hosting this service with many hosting service providers coming online.
• Quest Software:
  • Group Policy Manager: Version Control and Change Management for Group Policy
  • Group Policy Extensions for Desktop: Client Side Extensions for additional policy capabilities. Integrates with Group Policy Manager
  • Vintela Group Policy: Extends Group Policy capabilities to Unix and Linux environments.
• DesktopStandard a Microsoft Subsidiary:
  • Advanced Group Policy Management: With this add-on to Microsoft’s Group Policy Management Console (GPMC), administrators can delegate the Group Policy editing process while retaining control over deployment to the live environment, eliminating the need to hand total desktop control to the delegate. Changes can now be edited and tested offline, and an administrator with approval authority can easily review changes and approve or reject live deployment of an updated Group Policy Object (GPO). This limits the risk of widespread damage caused by improper changes, and provides an audit trail and rapid rollback capability in the event that a change must be reversed. A
  • PolicyMaker™: PolicyMaker is a suite of products based on the Group Policy Extension specification. Each of the independent extensions implement the full specification for Group Policy Extension, including Group Policy Object Editor and RSoP snap-in support, RSoP planning and logging modes, and client-side integration. Each supports common features such as XML import/export via drag and drop, and graphical per-policy filtering using any combination of 25 filter categories. The Group Policy Management Console (GPMC) and scripting supports PolicyMaker, including backup and restore of GPOs containing PolicyMaker settings. All PolicyMaker extensions are fully functional and free when managed from Local GPO.
  • PolicyMaker Registry Extension: (free product) Group Policy Extension for easily deploying any type of registry setting, featuring per-setting filtering, no tatooing, and no template editing - just browse to settings.  Drag and drop policies to/from XML to easily create your own settings library.
  • PolicyMaker Standard Edition: First third-party product to implement Group Policy Extension. Suite of 21 individual Group Policy Extensions - Data Sources, File & Folder Options, Hardware Devices, Internet Settings, Local Users/Groups, Network Connections, Outlook Profiles, Power Options, Regional Options, Scheduled Tasks, Shared & TCP/IP Printers, Start Menu, Windows Services, Drive Mappings, Environment Variables, File Transfers, Folder Management, Ini Files, Office Settings, Registry Settings, and Shortcuts.
  • PolicyMaker Share Manger: Group Policy extension that provides the ability to centrally manage network shares both on servers and workstations. It enables you to leverage Windows Server 2003’s built-in Access-Based Enumeration (ABE) for shared folders, empowering you to restrict the visibility of shared resources to those who end-users who have read permission. You can also remove and prohibit all unauthorized shares on the network as a matter of policy.
• DesktopCentral :Remote Windows Desktop Management Software. Feature set
  
  • Windows Configuration: Over 30 predefined configurations help to configure windows applications, system settings, desktop settings, and security policies.
  • Patch Management: Periodically scan the network computers for vulnerabilities, automatically download, and deploy patches to fix them.
  • Hardware and Software Inventory: Get the Software and Hardware inventory of your network in a single console.  Software License Management and Software Metering is also available.
  • Software Installation: Install software (now EXE is also supported) on to the computers in the network from remote. Installation can be either automatic or the user be informed about its availability.
  • Remote Desktop Sharing: Helps to connect and control the remote desktop through a web browser.
  • Active Directory Reports: Comprehensive reports about Active Directory infrastructure, such as Users, Computers, OU, Groups, Domain, etc.  Now you have the User Logon Reports which can report 'which user on which computer and how many time using which DC' kind of reports.
    • Online demo available at http://demo.desktopcentral.com
    • The salient features are
      • Web-based user interface to access Desktop Central from anywhere.
      • Provides the status of the applied configurations.
      • Granular level target definitions for configurations.
      • Facility to use custom scripting option to achieve organization specific needs.
  • Windows Free Tools: Four most widely used windows tools are now available in Desktop Central as a free tool.  Tools available are Wake on LAN (WoL), Software Inventory, Reboot/Shutdown and Gpupdate. You can run these tools remotely, on the client computers.
• Script Logic
  • Active Administrator (AA) is an enterprise Active Directory management and auditing solution that takes over where Active Directory left off. If AD security is one of your company's concerns, then AA is the right tool for you. Its easy-to-use interface gives you single seat enterprise control over your entire AD security and Group Policies. While Microsoft native tools give you single object administration to both security and group policies, those tools require endless nested buttons and dialog boxes just to accomplish simple tasks. They also cause you to focus on the individual task at hand, without a view of the larger picture.
• SysPro
  
  • Policy Reporter is a free tool that formats the Userenv.Log file. Very helpful for debugging tricky GPO policy problems. It is also useful in understanding how policies get applied.
  • ADM Template Editor a program that provides a GUI to edit ADM templates. 
  • PolMan an enterprise based tool to view and compare Group Policy components. Provides search facilities, compare facilities plus a graphic display of OU's and how they link to policies. It also allows scanning of all workstations on the domain to report which policies are currently in place and identify workstations that are missing policies or which have old versions of policies.
• Energy Star
  • EZ GPO is a free tool that configures power settings on computers. The application (EZ_GPO_Tool.exe) is deployed to all computers. The application is launched by running it from the "All Users" startup group. To configure the application, custom ADM Template settings (EZ_GPO.adm) can be deployed using Group Policy.
• BindView
  • bv-Admin for Group Policy Objects enables IT administrators to manage group policy objects and includes Resultant Set of Policy (RSOP) support on Windows 2000, Windows XP and Windows Server 2003.
• GPOGUY.COM
  • gptime.exe is a free command-line utility that lets you report on how long GP processing took on a given local or remote computer, and when that processing last occurred. Note that the tool only supports Windows XP and Server 2003 target machines.
  • GPSIViewer is a free GUI utility that reports on all packages deployed using Group Policy Software Installation in a given domain.
  • rgprefresh.exe is a free utility that lets you trigger command-line refresh of Group Policy against 2000, XP and 2003 systems