Okay.
Let's dig in a little bit on some of these elements that we've just discussed around the client side
extensions in the group policy engine.
So just to review, if I bring up the registry editor and I'm on my server test system.
And again, you know, this phenomenon of client side extensions and group policy engine, that's it's
the same regardless of whether we're talking about Windows server or Windows desktop SKUs.
So if I dig into the registry where I had mentioned these client site extensions are registered, you'll
see here that there's these grid named keys and each one represents a different client side extension.
In this case, it's the client side extension for a group policy preferences, local users and groups.
And it shows the Delta, the DL path.
And then there's some options that are used to basically control the group policies, engines, behavior
with respect to this client side extension.
And there's some function names in here.
Most of this stuff, we never have to touch it and certainly never directly.
But it just informs the group policy engine about each of these client side extensions behaviors.
And this goes down the list, you can see.
Actually, this one is interesting, this three, five, three, seven, eight on and on.
It has no information related to it.
This is the kind of the default client side extension that this is the one that does administrative
template processing.
And so there's no details around it.
It's kind of built in to the group policy engine, if you will.
You know, I keep talking about the group policy engine.
So what exactly is that?
Well, you don't really see it in any kind of manifest way, except if I bring up the services control
panel applet.
What you'll see here is there's a group policy client service and that really is at least in later versions
of Windows, the group policy engine, the thing that is doing all of the work of calling the CCS and
figuring out which GPOs apply to the giving user or computer.
And that client service.
If I look at log on, you'll notice that it's using local system account.
You can't change it.
In fact, if I even try to stop it or started, this is all grayed out.
And the reason for that is this client, obviously.
Is protected from, you know, users just coming in and saying, stop the group policy client so I don't
get group policy.
So this service is hardened, if you will, such that only members of local system or only the local
system account can modify it.
And that's a pretty good thing, I think, because it prevents the the casual user from essentially
turning off group policy.
So the other area that I wanted to mention that I talked about in the slides was this area in administrative
template policy where you can actually control the behavior of client side extensions.
If I come down under administrative template system and this is for the computer side computer configuration.
So this applies to computer objects and aid.
You'll see here that I have a bunch of different policy items that let me control various policy.
So for example, if I come in under configure security policy processing, I can open this up and if
I enable it, then I can tell it not to apply security policy during background processing and process,
even if the group calls the object have not changed.
Remember I mentioned that the normal behavior for group for the group policy engine is it won't do work
if a GPO hasn't changed.
That applies to that given user computer.
So this overrides that default behavior.
And you know, many of these are similar to that.
So I'll come in to wireless policy and this one has another option allow processing across a slow link.
Certain client side extensions by default will not run if a slow link is detected between the client
and the domain controller that it's getting group policy from.
So in that case I can override that behaviour as well.
So in this case I can override that behaviour as well.
And that's just kind of a sampling of the things that you can control with with client side extension
behavior.
Most of the time, you're not going to need to touch this.
And certainly for basic deployments of group policy up even to some large deployments of group policy.
You may never do anything in here, but it's good to know that you can if you need to.
And I have seen in certain circumstances, for example, somebody configure security policy processing
to process, even if GPOs have not changed because that sort of ensures that security policy is always
correct and up to date.
Now, that may not apply in your environment, but essentially it's it's nice to know that that option
is there.