Use Microsoft Group Policy Preferences… without using Group Policy. So use SCCM, Windows Intune, KACE, or your own systems management software and get your machines GPPreferecnes items.. Fast !
Hi. This is Jeremy Moskowitz, Microsoft MVP, Enterprise Mobility and Founder of PolicyPak Software. In this video, I’m going to show you how you can decouple Group Policy Preferences from using the Group Policy mechanism to get them delivered by using PolicyPak Preferences – our product – and our free utility, the PolicyPak Exporter.
To get started, you want to have a couple of Group Policy Preference items. Here’s one that puts a shortcut called “www.policypak.com” on the desktop, another one that puts “www.GPanswers.com” on the desktop. You’re welcome to use “Item-level targeting.” We have another video for that that says when a particular item will apply under what conditions.
You could use them from either side. If we go to computer side, “Preferences,” and go to “Services” where Services only exist on the computer side, you can go to “New/Service.” Let’s say we want to “Disabled” maybe the “Application Identity” service. I’m creating these items here..
What I’m going to do next is create a “New Folder,” and I’ll call them “GPPrefs Items.” You can simply drag-and-drop from Group Policy Preferences right into the folder. It’s really neat. Let’s go ahead and do that. I’ll do that for my “Shortcuts” items as well. I’ll take these guys and just drag them right there.
Now I’ve got my items that I’m ready to wrap up. That is what our PolicyPak Exporter utility does. The PolicyPak Exporter lets you “Create a new MSI installer.” You can do it in one of two ways. I like to do what I just did, which is to drag-and-drop them first and then just simply “Add Existing Files.”
I’ve got another folder here. Here we go: “GPPrefs Items.” Here are the ones that we just did. You can just add them right in just like that. This utility, the PolicyPak Exporter, works for our two products – PolicyPak Preferences that deals with Group Policy Preferences and also PolicyPak Application Manager that deals with things like Java, Flash, Firefox and so on. You can do things like “Never check for updates” and so on.
But that’s not what I want to talk about here. What I’m driving at is we’ve got Group Policy Preferences items, but we want to deliver them using not Group Policy. What we’ll do here is we’ll just go ahead and click “Next.” This will create an MSI for us, and we can then save it. Let’s call it “c:shareMSI1.” That’s it. It has created “MSI1.”
It should also be noted that this utility is very flexible. You can use the same utility to “Open an existing MSI installer previously generated by this tool for editing,” make updates and so on.
Now we’ll just go over to our target machine, and we’re going to pretend that you’ve got Windows Intune, KACE or your own systems management software like SCCM, or PDQ Deploy or anything like that. I want to go to “net use *” against where I’ve saved the file. I’m going to run this MSI.
Now here’s the thing. I am right now a standard user. When this would actually be run for real using SCCM or Intune or your own systems management software, it would automatically perform the elevation on behalf of the user. In this example, I’m going to get prompted for credentials, but in real life that doesn’t occur. That doesn’t actually happen.
Now that that has been done, the directives that I wrapped up have now been applied. When I have PolicyPak Preferences on the machine – our moving part, our client side extension – only then will the magic occur where you can take a Group Policy Preferences item and deploy it using the not Group Policy method.
The other thing that I did was I set a service to be disabled. Let’s see if that actually occurred as well. If I go to “Services,” it was the “Application Identity” service and, yes, sure enough. We’ve got it set to “Disabled.”
The other big piece about PolicyPak Preferences is because a user can simply work around many Group Policy Preferences settings, we supply as part of our engine “ppupdate” which will automatically re-apply and reinforce settings.
Let’s review. The point of PolicyPak Exporter is to take your existing Group Policy Preference items and put them into files. The PolicyPak Exporter can “Create a new MSI” or “Open an existing MSI,” for instance, just like that.
You can add both PolicyPak Application Manager (“Create New PPAM XMLdata File”). That application utility is also created by us and lets you manage things like Java, Flash, Firefox and so on.
Or you can “Create new PPP (PolicyPak Preferences) XMLdata File.” You can simply copy-and-paste the XML from a Group Policy Preferences item or do what I did. I find it to be a little easier. Simply drag-and-drop to the desktop and then “Add Existing Files.”
I didn’t mention it earlier. You can also trim which “Users & Groups” will actually get this directive applied to it. You can use either item-level targeting built into Group Policy Preferences or our own little targeting feature which lets you specify everyone on the “Computer” or specific “Users & Groups.”
That’s it for this utility. I hope that helps you out.
Thanks so much, and talk to you soon.