The Wi-Fi Alliance, a consortium of separate and independent companies, agrees on a set of common interoperable products based on the family of IEEE 802.11 standards.^[1] The Wi-Fi Alliance certifies products via a set of defined test-procedures to establish interoperability. Those manufacturers with membership of Wi-Fi Alliance and whose products pass these interoperability tests can mark their products and product packaging with the Wi-Fi logo.^[2]

Wi-Fi technologies have gone through several generations since their inception in 1998. The Microsoft Windows, Apple Mac OS X and open source Unix and Linux operating systems support Wi-Fi to different extents.

A Wi-Fi-enabled device such as a PC, game console, cell phone, MP3 player or PDA can connect to the Internet when within range of a wireless network connected to the Internet. The coverage of one or more interconnected access points — called a hotspot — can comprise an area as small as a single room with wireless-opaque walls or as large as many square miles covered by overlapping access points. Wi-Fi technology has served to set up mesh networks, for example, in London.^[3] Both architectures can operate in community networks.^{[citation needed]}

In addition to restricted use in homes and offices, Wi-Fi can make access publicly available at Wi-Fi hotspots provided either free of charge or to subscribers to various providers. Organizations and businesses such as airports, hotels and restaurants often provide free hotspots to attract or assist clients. Enthusiasts or authorities who wish to provide services or even to promote business in a given area sometimes provide free Wi-Fi access. Metropolitan-wide WiFi (Muni-Fi) already has more than 300 projects in process.^[4]

Wi-Fi also allows connectivity in peer-to-peer (wireless ad-hoc network) mode, which enables devices to connect directly with each other. This connectivity mode can prove useful in consumer electronics and gaming applications.

When wireless networking technology first entered the market many problems ensued for consumers who could not rely on products from different vendors working together. The Wi-Fi Alliance began as a community to solve this issue — aiming to address the needs of the end-user and to allow the technology to mature. The Alliance created the branding Wi-Fi CERTIFIED to reassure consumers that products will interoperate with other products displaying the same branding.

Many consumer devices use Wi-Fi. Amongst others, personal computers can network to each other and connect to the Internet, mobile computers can connect to the Internet from any Wi-Fi hotspot, and digital cameras can transfer images wirelessly.

Routers which incorporate a DSL-modem or a cable-modem and a Wi-Fi access point, often set up in homes and other premises, provide Internet-access and internetworking to all devices connected (wirelessly or by cable) to them. One can also connect Wi-Fi devices in ad-hoc mode for client-to-client connections without a router.

As of 2007 Wi-Fi technology had spread widely within business and industrial sites. In business environments, just like other environments, increasing the number of Wi-Fi access-points provides redundancy, support for fast roaming and increased overall network-capacity by using more channels or by defining smaller cells. Wi-Fi enables wireless voice-applications ( VoWLAN or WVOIP). Over the years, Wi-Fi implementations have moved toward “thin” access-points, with more of the network intelligence housed in a centralized network appliance, relegating individual access-points to the role of mere “dumb” radios. Outdoor applications may utilize true mesh topologies. As of 2007 Wi-Fi installations can provide a secure computer networking gateway, firewall, DHCP server, intrusion detection system, and other functions.

Wi-Fi allows LANs to be deployed without cabling for client devices, typically reducing the costs of network deployment and expansion. Spaces where cables cannot be run, such as outdoor areas and historical buildings, can host wireless LANs.

As of 2007 wireless network adapters are built into most modern laptops. The price of chipsets for Wi-Fi continues to drop, making it an economical networking option included in even more devices. Wi-Fi has become widespread in corporate infrastructures, which also helps with the deployment of RFID technology that can piggyback on Wi-Fi.^[5]

Different competitive brands of access points and client network interfaces are inter-operable at a basic level of service. Products designated as “Wi-Fi Certified” by the Wi-Fi Alliance are backwards inter-operable. Wi-Fi is a global set of standards. Unlike mobile telephones, any standard Wi-Fi device will work anywhere in the world.

Wi-Fi is widely available in more than 250,000^{[citation needed]} public hotspots and tens of millions of homes and corporate and university campuses worldwide. WPA is not easily cracked if strong passwords are used and WPA2 encryption has no known weaknesses. New protocols for Quality of Service (WMM) make Wi-Fi more suitable for latency-sensitive applications (such as voice and video), and power saving mechanisms (WMM Power Save) improve battery operation.

Disadvantage

Spectrum assignments and operational limitations are not consistent worldwide. Most of Europe allows for an additional 2 channels beyond those permitted in the U.S. for the 2.4 GHz band. (1–13 vs. 1–11); Japan has one more on top of that (1–14). Europe, as of 2007, was essentially homogeneous in this respect. A very confusing aspect is the fact a Wi-Fi signal actually occupies five channels in the 2.4 GHz band resulting in only three non-overlapped channels in the U.S.: 1, 6, 11, and four in Europe: 1, 5, 9, 13. Equivalent isotropically radiated power (EIRP) in the EU is limited to 20 dBm (0.1 W).

Power consumption is fairly high compared to some other low-bandwidth standards, such as Zigbee and Bluetooth, making battery life a concern.

The most common wireless encryption standard, Wired Equivalent Privacy or WEP, has been shown to be easily breakable even when correctly configured. Wi-Fi Protected Access (WPA and WPA2), which began shipping in 2003, aims to solve this problem and is now available on most products. Wi-Fi Access Points typically default to an “open” (encryption-free) mode. Novice users benefit from a zero-configuration device that works out of the box, but this default is without any wireless security enabled, providing open wireless access to their LAN. To turn security on requires the user to configure the device, usually via a software graphical user interface (GUI). Wi-Fi networks that are open (unencrypted) can be monitored and used to read and copy data (including personal information) transmitted over the network, unless another security method is used to secure the data, such as a VPN or a secure web page. (See HTTPS/Secure Socket Layer.)

Many 2.4 GHz 802.11b and 802.11g Access points default to the same channel on initial startup, contributing to congestion on certain channels. To change the channel of operation for an access point requires the user to configure the device.

Wi-Fi networks have limited range. A typical Wi-Fi home router using 802.11b or 802.11g with a stock antenna might have a range of 32 m (120 ft) indoors and 95 m (300 ft) outdoors. Range also varies with frequency band. Wi-Fi in the 2.4 GHz frequency block has slightly better range than Wi-Fi in the 5 GHz frequency block. Outdoor range with improved (directional) antennas can be several kilometres or more with line-of-sight.

Wi-Fi performance also decreases exponentially as the range increases.

Wi-Fi pollution, or an excessive number of access points in the area, especially on the same or neighboring channel, can prevent access and interfere with the use of other access points by others, caused by overlapping channels in the 802.11g/b spectrum, as well as with decreased signal-to-noise ratio (SNR) between access points. This can be a problem in high-density areas, such as large apartment complexes or office buildings with many Wi-Fi access points. Additionally, other devices use the 2.4 GHz band: microwave ovens, security cameras, Bluetooth devices and (in some countries) Amateur radio, video senders, cordless phones and baby monitors can cause significant additional interference. General guidance to those who suffer these forms of interference or network crowding is to migrate to a WiFi 5 GHz product, (802.11a or the newer 802.11n IF it has 5GHz/11a support) as the 5 GHz band is relatively unused and there are many more channels available. This also requires users to set up the 5 GHz band to be the preferred network in the client and to configure each network band to a different name (SSID).

It is also an issue when municipalities,^[6] or other large entities such as universities, seek to provide large area coverage. This openness is also important to the success and widespread use of 2.4 GHz Wi-Fi.

Interoperability issues between non WiFi brands or proprietary deviations from the standard can disrupt connections or lower throughput speeds on all user’s devices that are within range, to include the non-WiFi or proprietary product.

 Standard devices

An embedded RouterBoard 112 with U.FL-RSMA pigtail and R52 mini PCI Wi-Fi card widely used by wireless Internet service providers (WISPs) in the Czech Republic.

Wireless access points connects a group of wireless devices to an adjacent wired LAN. An access point is similar to a network hub, relaying data between connected wireless devices in addition to a (usually) single connected wired device, most often an ethernet hub or switch, allowing wireless devices to communicate with other wired devices.

Wireless adapters allow devices to connect to a wireless network. These adapters connect to devices using various external or internal interconnects such as PCI, miniPCI, USB, ExpressCard, Cardbus and PC card. Most newer laptop computers are equipped with internal adapters. Internal cards are generally more difficult to install.

Wireless routers integrate a WAP, ethernet switch, and internal Router firmware application that provides IP Routing, NAT, and DNS forwarding through an integrated WAN interface. A wireless router allows wired and wireless ethernet LAN devices to connect to a (usually) single WAN device such as cable modem or DSL modem. A wireless router allows all three devices (mainly the access point and router) to be configured through one central utility. This utility is most usually an integrated web server which serves web pages to wired and wireless LAN clients and often optionally to WAN clients. This utility may also be an application that is run on a desktop computer such as Apple’s AirPort.

Wireless network bridges connect a wired network to a wireless network. This is different from an access point in the sense that an access point connects wireless devices to a wired network at the data-link layer. Two wireless bridges may be used to connect two wired networks over a wireless link, useful in situations where a wired connection may be unavailable, such as between two separate homes.

Wireless range extenders or wireless repeaters can extend the range of an existing wireless network. Range extenders can be strategically placed to elongate a signal area or allow for the signal area to reach around barriers such as those created in L-shaped corridors. Wireless devices connected through repeaters will suffer from an increased latency for each hop. Additionally, a wireless device connected to any of the repeaters in the chain throughput that is limited by the weakest link between the two nodes in the chain from which the connection originates to where the connection ends.

Aerials and connectors

Most commercial devices (routers, access points, bridges, repeaters) designed for home or business environments use either RP-SMA or RP-TNC antenna connectors. PCI wireless adapters also mainly use RP-SMA connectors. Most PC card and USB wireless only have internal antennas etched on their printed circuit board while some have MMCX connector or MC-Card external connections in addition to an internal antenna. A few USB cards have a RP-SMA connector. Most Mini PCI wireless cards utilize Hirose U.FL connectors, but cards found in various wireless appliances contain all of the connectors listed. Many high-gain (and homebuilt antennas) utilize the Type N connector more commonly used by other radio communications methods.

Non-standard devices

Distance records include:

June 2007: 382 km (237 mi) is held by Ermanno Pietrosemoli and EsLaRed of Venezuela, transferring about 3 MB of data between mountain tops of El Aguila and Platillon12.

Swedish space agency:310 km (193 mi), but using 6 watt amplifiers to reach an overhead stratospheric balloon.^{[citation needed]}

Embedded systems

Embedded serial to WiFi module

Wi-Fi availability in the home is on the increase. This extension of the Internet into the home space will increasingly be used for remote monitoring. Examples of remote monitoring include security systems and tele-medicine. In all these kinds of implementation, if the Wi-Fi provision is provided using a system running one of operating systems mentioned above, then it becomes unfeasible due to weight, power consumption and cost issues.

Increasingly in the last few years (particularly as of early 2007), embedded Wi-Fi modules have become available which come with a real-time operating system and provide a simple means of wireless enabling any device which has and communicates via a serial port.

This allows simple monitoring devices – for example, a portable ECG monitor hooked up to a patient in their home – to be created. This Wi-Fi enabled device effectively becomes part of the internet cloud and can communicate with any other node on the internet. The data collected can hop via the home’s Wi-Fi access point to anywhere on the internet.

These Wi-Fi modules are designed so that designers need minimal Wi-Fi knowledge to wireless-enable their products.

Unintended and intended use by outsiders

Main article: Piggybacking (internet access)

During the early popular adoption of 802.11, providing open access points for anyone within range to use was encouraged to cultivate wireless community networks;^[7] particularly since people on average use only a fraction of their upstream bandwidth at any given time. Later, equipment manufacturers and mass-media advocated isolating users to a predetermined whitelist of authorized users—referred to as “securing” the access point.^{[dubious – discuss]}

Measures to deter unauthorized users include suppressing the AP’s SSID broadcast, allowing only computers with known MAC addresses to join the network, and various encryption standards. Suppressed SSID and MAC filtering are ineffective security methods as the SSID is broadcast in the open in response to a client SSID query and a MAC address can easily be spoofed. If the eavesdropper has the ability to change his MAC address, then he can potentially join the network by spoofing an authorized address.

WEP encryption can protect against casual snooping, but may also produce a misguided sense of security since freely available tools such as AirSnort or aircrack can quickly recover WEP encryption keys. Once it has seen 5-10 million encrypted packets, AirSnort will determine the encryption password in under a second^[8]; newer tools such as aircrack-ptw can use Klein’s attack to crack a WEP key with a 50% success rate using only 40,000 packets. The newer Wi-Fi Protected Access (WPA) and IEEE 802.11i (WPA2) encryption standards do not have any of the serious weaknesses of WEP encryption.

Recreational logging and mapping of other people’s access points has become known as wardriving. It is also common for people to use open (unencrypted) Wi-Fi networks as a free service, termed piggybacking. Indeed, many access points are intentionally installed without security turned on so that they can be used as a free service. These activities do not result in sanctions in most jurisdictions, however legislation and case law differ considerably across the world. A proposal to leave graffiti describing available services was called warchalking. The universal rule is a Wi-Fi Access Point that has not turned on its security is a service that welcomes its free use, while an access point that has turned its security on does not. The burden is on the access point owner to properly configure and control the access to his internet connection. In a Florida court case^{[citation needed]}, owner laziness was determined not to be a valid excuse.

Piggybacking is often unintentional. Most access points are configured without encryption by default, and operating systems such as Windows XP SP2 and Mac OS X may be configured to automatically connect to any available wireless network. A user who happens to start up a laptop in the vicinity of an access point may find the computer has joined the network without any visible indication. Moreover, a user intending to join one network may instead end up on another one if the latter’s signal is stronger. In combination with automatic discovery of other network resources (see DHCP and Zeroconf) this could possibly lead wireless users to send sensitive data to the wrong middle man when seeking a destination (see Man-in-the-middle attack). For example, a user could inadvertently use an insecure network to login to a website, thereby making the login credentials available to anyone listening, if the website is using an insecure protocol like HTTP, rather than a secure protocol like HTTPS.

Wi-Fi and amateur radio

In the U.S., Canada, Australia and Europe, a portion of the 2.4 GHz Wi-Fi radio spectrum is also allocated to amateur radio users. In the U.S., FCC Part 15 rules govern non-licensed operators (i.e. most Wi-Fi equipment users). Under Part 15 rules, non-licensed users must “accept” (i.e. endure) interference from licensed users and not cause harmful interference to licensed users. Amateur radio operators are licensed users, and retain what the FCC terms “primary status” on the band, under a distinct set of rules (Part 97). Under Part 97, licensed amateur operators may construct their own equipment, use very high-gain antennas, and boost output power to 100 watts on frequencies covered by Wi-Fi channels 2-6. However, Part 97 rules mandate using only the minimum power necessary for communications, forbid obscuring the data, and require station identification every 10 minutes. Therefore, output power control is required to meet regulations, and the transmission of any encrypted data (for example https) is questionable.

In practice, microwave power amplifiers are expensive. On the other hand, the short wavelength at 2.4 GHz allows for simple construction of very high gain directional antennas. Although Part 15 rules forbid any modification of commercially constructed systems, amateur radio operators may modify commercial systems for optimized construction of long links, for example. Using only 200 mW link radios and high gain directional antennas, a very narrow beam may be used to construct reliable links with minimal radio frequency interference to other users.

 Question of health risks

Main article: Wireless electronic devices and health

The UK’s Health Protection Agency considers there is no consistent evidence of harm from the low power transmissions of Wi-Fi equipment. Consensus amongst scientists is that there is no evidence of harm, and the continuing calls for more research into the effects on human health remain limited. However, in September 2007, Germany’s Environment Ministry announced that its citizens should minimise their exposure to radiation from Wi-Fi by choosing conventional wired connections,^[9] without any evidence and contrary to current internationally accepted safety criteria. Dr Michael Clark, of the Health Protection Agency, says published research on mobile phones and masts does not add up to an indictment of Wi-Fi:

All the expert reviews done here and abroad indicate that there is unlikely to be a health risk from wireless networks. … When we have conducted measurements in schools, typical exposures from Wi-Fi are around 20 millionths of the international guideline levels of exposure to radiation. As a comparison, a child on a mobile phone receives up to 50 percent of guideline levels. So a year sitting in a classroom near a wireless network is roughly equivalent to 20 minutes on a mobile. If Wi-Fi should be taken out of schools, then the mobile phone network should be shut down, too—and FM radio and TV, as the strength of their signals is similar to that from Wi-Fi in classrooms.^[10]

 History

Wi-Fi uses both single carrier direct-sequence spread spectrum radio technology (part of the larger family of spread spectrum systems) and multi-carrier OFDM (Orthogonal Frequency Division Multiplexing) radio technology. These regulations then enabled the development of Wi-Fi, its onetime competitor HomeRF, and Bluetooth.

Unlicensed spread spectrum was first made available in the US by the Federal Communications Commission in 1985 and these FCC regulations were later copied with some changes in many other countries enabling use of this technology in all major countries.^[11] The FCC action was proposed by Michael Marcus of the FCC staff in 1980 and the subsequent regulatory action took 5 more years. It was part of a broader proposal to allow civil use of spread spectrum technology and was opposed at the time by main stream equipment manufacturers and many radio system operators.

The precursor to Wi-Fi was invented in 1991 by NCR Corporation/AT&T (later Lucent & Agere Systems) in Nieuwegein, the Netherlands. It was initially intended for cashier systems; the first wireless products were brought on the market under the name WaveLAN with speeds of 1 Mbit/s to 2 Mbit/s. Vic Hayes, who held the chair of IEEE 802.11 for 10 years and has been named the ‘father of Wi-Fi,’ was involved in designing standards such as IEEE 802.11b, and 802.11a.

 City wide Wi-Fi

St. Cloud, Florida became the first city in the United States to offer city wide free Wi-Fi,^[12] although many others have plans to offer the service. Corpus Christi, Texas had offered free Wi-Fi until May 31, 2007 when the network was purchased by Earthlink.^[13] Philadelphia is also using Earthlink for its city wide Wi-Fi.^[14] New Orleans had free city wide Wi-Fi shortly after Hurricane Katrina.^[15] City wide Wi-Fi is available in nine cities in the UK, including Leeds, Manchester and London.^[16] Other cities, such as the Minneapolis metro area, have a large number of Wi-Fi hotspots so you can receive good signals anywhere, even if from different sources. In Europe, the City of Luxembourg has a city-wide Wi-Fi network.

Origin and meaning of the term “Wi-Fi”

Despite the similarity between the terms “Wi-Fi” and “Hi-Fi“, statements reportedly made by Phil Belanger of the Wi-Fi Alliance contradict the conclusion that “Wi-Fi” stands for “Wireless Fidelity”.^[17][18][19] According to Belanger, the Interbrand Corporation developed the brand “Wi-Fi” for the Wi-Fi Alliance to use to describe WLAN products that are based on the IEEE 802.11 standards. In Belanger’s words,

Wi-Fi and the yin yang style logo were invented by Interbrand. We [the founding members of the Wireless Ethernet Compatibility Alliance, now called as the Wi-Fi Alliance] hired Interbrand to come up with the name and logo that we could use for our interoperability seal and marketing efforts. We needed something that was a little catchier than ‘IEEE 802.11b Direct Sequence’.^[20]

The Wi-Fi Alliance themselves invoked the term “Wireless Fidelity” with the marketing of a tag line “The Standard for Wireless Fidelity,” but later removed the tag from their marketing. The Wi-Fi Alliance now seems to discourage the propagation of the notion that “Wi-Fi” stands for “Wireless Fidelity”, but it has been referred to as such by the Wi-Fi Alliance in White Papers currently held in their knowledge base: “… a promising market for wireless fidelity (Wi-Fi) network equipment.”^[21] and “A Short History of WLANs.” The association created the Wi-Fi logo to indicate that a product had been certified for interoperability.^[22]

loadTOCNode(1, \’summary\’);

• ftp - starts an FTP session
• open hostname - connects to the specified host
• close - closes the connection (but not the FTP session!)
• quit - terminates the FTP session

II. Browsing on a remote machine

• dir - gives a full directory listing on the remote machine
• dir test* - displays only files and directories whose name begins with “test…”
• ls - same as dir, but provides a simplified listing of filenames

III. Directories in FTP

• pwd - prints the name of the current remote directory
• cd remote-directory – changes working directory on remote host
• cd .. - moves up one level in the directory structure on the remote host
• lcd directory – changes the default directory on local host

IV. Types of files

• binary - type this command at the FTP prompt to set binary mode before transferring binary files
• For example, use binary mode with the following types of files:
  • SPSS System files
  • SAS Transport files
  • Stata Datasets
  • Graphics files (e.g., *.gif, *.jpg, *.bmp, etc.)
  • Microsoft Office documents (*.doc, *.xls, etc.)
• ascii - type this command at the FTP prompt to set ASCII mode before transferring text files.
• Use the ASCII mode with any of the following:
  • Raw Data (e.g. *.dat or *.txt, codebooks, or other plain text documents)
  • SPSS Portable files
  • HTML files

V. Transferring files

• get test - copies file “test” from remote to local host (from current remote directory to current local directory)
• mget test.* data.dbf - copies files beginning with “test” and the file named data.dbf from remote to local host
• put test - copies file “test” from local to remote host. You musth have write access to the remove host for this to work.
• mput test.* data.dbf - copies files beginning with “test” and the file named data.dbf from local to remote host
• quit - closes connection and terminates FTP session
• If a file name contains spaces (e.g. on your Windows system) you should type the file name in quotation marks ” “,
  but it is strongly recommended to rename such files before FTPing them.

VI. Other Commands

• get test “| more” - displays file “test”
  To make sure you want a document, you can display it with the more command and see the file screen by screen (using the space bar) BEFORE you get a file. To exit out of more , type q.
• prompt - turns off prompting for individual files when using the mget or mput commands.
• If you have mistyped your username or password, use the user command to re-login.
• For a list of all FTP commands type ? at the ftp> prompt.
• For a brief explanation of a command, type help, leave a space,and type the command itself.

The 7 Layers of the OSI Model

The OSI, or Open System Interconnection, model defines a networking framework for implementing protocols in seven layers. Control is passed from one layer to the next, starting at the application layer in one station, proceeding to the bottom layer, over the channel to the next station and back up the hierarchy.

RECOMMENDED READING:

• “The OSI Reference Model — Understanding Layers” in Webopedia’s “Did You Know…?” section.
• “Understanding The Data Link Layer” in Webopedia’s “Did You Know…?” section.

Image courtesy of The Abdus Salam International Centre for Theoretical Physics.

The Microsoft Windows Server 2003 Deployment step-by-step guides provide hands-on experience for many common operating system configurations. The guides begin by establishing a common network infrastructure through the installation of Windows Server 2003, the configuration of Active Directory^®, the installation of a Windows XP Professional workstation, and finally the addition of this workstation to a domain. Subsequent step-by-step guides assume that you have this common network infrastructure in place. If you do not wish to follow this common network infrastructure, you will need to make appropriate modifications while using these guides.

The common network infrastructure requires the completion of the following guides.

Once the common network infrastructure is configured, any of the additional step-by-step guides may be employed. Note that some step-by-step guides may have additional prerequisites above and beyond the common network infrastructure requirements. Any additional requirements will be noted in the specific step-by-step guide.

Microsoft Virtual PC

The Windows Server 2003 Deployment step-by-step guides may be implemented within a physical lab environment or through virtualization technologies like Microsoft Virtual PC 2004 or Microsoft Virtual Server 2005. Virtual machine technology enables customers to run multiple operating systems concurrently on a single physical server. Virtual PC 2004 and Virtual Server 2005 are designed to increase operational efficiency in software testing and development, legacy application migration, and server consolidation scenarios.

The Windows Server 2003 Deployment step-by-step guides assume that all configurations will occur within a physical lab environment, although most configurations can be applied to a virtual environment without modification.

Applying the concepts provided in these step-by-step guides to a virtual environment is beyond the scope of this document.

Important Notes

The example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious. No association with any real company, organization, product, domain name, e-mail address, logo, person, places, or events is intended or should be inferred.

This common infrastructure is designed for use on a private network. The fictitious company name and Domain Name Service (DNS) name used in the common infrastructure are not registered for use on the Internet. You should not use this name on a public network or Internet.

The Active Directory service structure for this common infrastructure is designed to show how Windows Server 2003 Change and Configuration Management works and functions with Active Directory. It was not designed as a model for configuring Active Directory for any organization.

Top of page

Overview

Group Policy settings define the various components of the user’s desktop environment that a system administrator needs to manage, for example, the programs that are available to users, the programs that appear on the user’s desktop, and options for the Start menu. Group Policy settings that you specify are contained in a Group Policy object (GPO), which in turn is associated with selected Active Directory objects—sites, domains, or organizational units (OUs).

Group Policy applies not only to users and client computers, but also to member servers, domain controllers, and any other Windows Server 2003 computers within the scope of management. By default, Group Policy that is applied to a domain (that is, applied at the domain level just above the root of Active Directory Users and Computers) affects all computers and users in the domain. Active Directory Users and Computers also provides a built-in Domain Controllers OU. If you keep your domain controller accounts there, you can use the GPO Default Domain Controllers Policy to manage domain controllers separately from other computers.

GPOs are linked to site, domain, and OU containers in Active Directory. The default order of precedence follows the hierarchical nature of Active Directory: sites are first, then domains, and then each OU. A GPO can be associated with more than one Active Directory container, or multiple containers can be linked to a single GPO.

A GPO can be used to filter objects based on security group membership, which allows administrators to manage computers and users in either a centralized or a de-centralized manner. To do this, administrators can use filtering based on security groups to define the scope of Group Policy management, so that Group Policy can be applied centrally at the domain level. Or, it can be applied in a decentralized manner at the OU level and can then be filtered again by security groups. Administrators can use security groups in Group Policy to:

Several administrative tools are available for the management of Group Policy settings including:

Group Policy includes policy settings for User Configuration, which affect users, and for Computer Configuration, which affect computers.

With Group Policy, you can do the following:

This document presents a brief overview of Group Policy, and shows how to use the Group Policy snap-in to specify policy settings for groups of users and of computers.

Prerequisites

Guide Requirements

Note:  This document does not describe all the possible Group Policy scenarios. This instruction set should be used to help you begin to understand how Group Policy works and begin to think about how your organization might use Group Policy to reduce its IT administration costs. Other Windows Server 2003 features, including Security Settings and Software Installation and Maintenance, are built on Group Policy. For a comprehensive list of available documents, see the Group Policy in Windows Server 2003 Web site.

Top of page

Group Policy and the Microsoft Management Console

Group Policy is directly integrated with Active Directory management tools through the MMC snap-in extension mechanism. The Active Directory snap-ins set the scope of management for Group Policy. The most common way to access Group Policy is by using the Active Directory User and Computers snap-in, for setting the scope of management to domain and OUs. You can also use the Active Directory Sites and Services snap-in to set the scope of management to a site. These two tools can be accessed from the Administrative Tools program group; the Group Policy snap-in extension is enabled in both tools. Alternatively, you can create a custom MMC console, as described in the next section.

Configuring a Custom Console

The examples in this document use the custom MMC console that you can create by following the procedures outlined in this section. You need to create this custom console before attempting the remaining procedures in this document.

To configure a custom console

To save console changes

Accessing Group Policy

You can use the appropriate Active Directory tools to access Group Policy while focused on any site, domain, or OU.

To open Group Policy from Active Directory Sites and Services

To open Group Policy from Active Directory Users and Computers

To access Group Policy scoped to a specific computer (or the local computer), you must load the Group Policy snap-in into the MMC console namespace targeted at the specific computer (or local computer). There are two major reasons for these differences:

Creating a Group Policy Object

Group Policy settings are contained in GPOs that are individually linked to selected Active Directory objects, such as sites, domains, or OUs.

To create and link a new GPO to the Headquarters OU

The previous steps showed how to create and automatically link a GPO to an Active Directory container—the Headquarters OU. However, the GPO will have no direct impact on users or computers until its various settings are defined. The next section shows how to edit the HQ Policy GPO settings.

Multiple GPOs may be created and/or linked under any Active Directory container. If more than one GPO is associated with an Active Directory container, you must ensure that the GPOs are ordered correctly. GPOs higher in the list that have the highest precedence are processed last. (This is what gives them a higher precedence.)

GPOs are objects; they have context menus for viewing the properties of each GPO. You can use the context menus to obtain and modify general information about a GPO. This information includes Discretionary Access Control Lists (DACLs), and lists the other site, domain, or OUs to which this GPO is linked.

Best Practice:  You can further refine a GPO through user or computer membership in security groups by setting DACLs based on that membership. For information about using DACLs, see the section Security Group Filtering.

Managing Group Policy

To manage Group Policy

Editing a Group Policy Object

You can use the GPWalkThrough custom console created previously to edit a GPO.

To edit the HQ Policy GPO

Adding or Browsing a Group Policy Object

To add a GPO

Review the following components of the Add a Group Policy Object Link dialog box and then close the dialog box.

Note:  It is possible to have two or more GPOs with the same name. This is by design and is possible because GPOs are actually stored as globally unique identifiers (GUIDs). The display name shown is actually a friendly name stored in Active Directory.

Registry-Based Policies

The user interface for registry-based policies is available through Administrative Template (.adm) files. These files describe the user interface that is displayed in the Administrative Templates node of the Group Policy snap-in. These files are format-compatible with the .adm files used by the System Policy Editor tool (Poledit.exe) in Microsoft Windows NT^® 4.0. With Windows Server 2003, the options available in registry-based policies have been expanded.

Note:  Although it is possible to add any .adm file to a GPO, if you use an .adm file from a previous version of Windows, the registry keys are unlikely to have an effect on Windows Server 2003.

By default, only those policy settings defined in the loaded .adm files that exist in the approved Group Policy trees are displayed; these settings are referred to as true policies. This means that the Group Policy snap-in does not display any items described in the .adm file that set registry keys outside of the Group Policy trees; such items are referred to as Group Policy preferences. Preferences are indicated by a red icon to distinguish them from true policies, which are indicated by a blue icon. The approved Group Policy trees are:

Note:  Using non-policies within the Group Policy infrastructure is strongly discouraged because of the persistent registry settings behavior mentioned previously. To set registry policies on Windows NT 4.0, and Windows 95 and Windows 98 clients, use the Windows NT 4.0 System Policy Editor tool, Poledit.exe.

By default, the conf.adm, inetres.adm, system.adm, wmplayer.adm, and wuau.adm files are loaded and available for configuration as shown in Figure 5.

Figure 5.  User Configuration

The default .adm files offer the following configuration options.

Adding Administrative Templates

Administrative Templates (.adm files) contain a hierarchy of categories and subcategories that together define how options are organized in the Group Policy user interface.

To add an administrative template (.adm files)

Configuring Administrative Templates

The following steps provide a simple example of using Administrative Templates to remove the Run command from a user’s desktop. You should become familiar with all the available settings offered in the Administrative Templates. Additional step-by-step guides in this series will use settings available in the Administrative Templates.

To set registry-based settings using administrative templates

Note the Previous Policy and Next Policy buttons in the dialog box. You can use these buttons to navigate the details pane for setting the state of other policies. You can also leave the dialog box open and click another policy in the details pane of the Group Policy snap-in. After the details pane has the focus, you can use the Up and Down arrow keys on the keyboard and press Enter to quickly browse through the settings (or Explain tabs) for each policy in the selected node.

Note the change in state to Enabled in the Setting column of the details pane. This change is immediate; it has been saved to the GPO. If you are in a replicated domain controller environment, this action sets a flag that triggers a replication cycle.

If you log on to a workstation in the contoso.com domain with a user from the Headquarters OU, you will note that the Run menu has been removed.

Note:  At this point, you may want to experiment with the other available policies. Look at the text in the Explain tab for information about each policy.

Deploying Scripts Through Group Policy Objects

You can define a GPO setting that runs scripts when users log on or log off, or when the system starts or shuts down. All scripts are Windows Scripting Host (WSH)–enabled. As such, they may include Java Scripts or Microsoft Visual Basic^® Scripts, as well as .bat and .cmd files.

Creating a Logon Script

Note:  This procedure uses the welcome.js script described in the Appendix. Create an Included Items folder, and then create the file welcome.js within the Included Items folder by copying the script from the Appendix in this guide.

To define a logon script Group Policy setting

This script will be immediately available to any member of contoso.com since it was defined within the Default Domain Policy. You can log on to a client workstation to verify that the script is run when a user logs on.

Defining a Logoff or Computer Startup or Shutdown Script

You can use the same procedure outlined in the section Creating a Logon Script to set up scripts that run when a user logs off or when a computer starts or shuts down. For logoff scripts, you would select Logoff in step 6 in Creating a Logon Script. For computer Startup or Shutdown scripts, switch to Computer Configuration – Windows Settings – Scripts (Startup/Shutdown) in the Group Policy Object Editor.

Other Script Considerations

By default, Group Policy scripts that run in a command window (such as .bat or .cmd files) run hidden, and legacy scripts (those defined in the user object) are, by default, visible as they are processed, although there is a Group Policy setting that allows this visibility to be changed. The policy for users is called Run logon scripts visible or Run logoff scripts visible, and is accessed in the User Configuration\Administrative Templates node, under System\Scripts. For computers, the policy is Run startup scripts visible and Run shutdown scripts visible, and can be accessed in the Computer Configuration\Administrative Templates node, under System\Scripts.

Security Group Filtering

You can refine the effects of any GPO on users or computers by stipulating how a selected GPO is applied to security groups. To do this, use the Security tab on the Properties page of a GPO to set DACLs. DACLs are used primarily for performance reasons, although the feature allows for tremendous flexibility in designing and deploying GPOs, and the policies they contain.

By default, GPOs affect all users and machines that are contained in the linked site, domain, or OU. By using DACLs, the effect of any GPO can be modified to exclude or include the members of any security group.

To filter GPO application based on Security Group membership

To configure the GPO to apply only to members of the Management group

To deny GPO application to members of the Management group

Note:  Use the Deny ACE with caution. A Deny ACE setting for any group has precedence over any Allow ACE given to a user or computer because of membership in another group. For more information about this interaction, see the Windows 2000 Server online Help and search for Security Group.

Variations on this procedure may include:

Note:  You can use these same types of security options with the Logon scripts you set up in the preceding section. You can set a script to run only for members of a particular group or for everyone except the members of a specific group.

Security group filtering has two functions: the first is to modify which group is affected by a particular GPO, and the second is to delegate which group of administrators can modify the contents of the GPO by restricting Full Control to a limited set of administrators (by a group). This is recommended because it limits the chance of multiple administrators making changes at any one time.

Policy Inheritance

In general, Group Policy is passed down from parent to child containers within a domain. Group Policy is not inherited from parent to child domains. If you assign a specific Group Policy setting to a high-level parent container, that Group Policy setting applies to all containers beneath the parent container, including the user and computer objects in each container. However, if you explicitly specify a Group Policy setting for a child container, the child container’s Group Policy setting overrides the parent container’s setting.

If a parent OU has policy settings that are not configured, the child OU does not inherit them. Policy settings that are disabled are inherited as disabled. In addition, if a policy setting is configured (enabled or disabled) for a parent OU and the same policy setting is not configured for a child OU, the child inherits the parent’s enabled or disabled policy setting.

If a policy setting that is applied to a parent OU and a policy setting that is applied to a child OU are compatible, the child OU inherits the parent policy setting, and the child’s setting is also applied.

If a policy setting that is configured for a parent OU is incompatible with the same policy setting that is configured for a child OU (because the setting is enabled in one case and disabled in the other), the child does not inherit the policy setting from the parent. The policy setting in the child is applied.

Blocking Inheritance and No Override

The Block Policy inheritance option blocks GPOs that apply higher in the Active Directory hierarchy of sites, domains, and OUs. It does not block GPOs if they have No Override enabled. The Block Policy inheritance option is set only on sites, domains, and OUs, not on individual GPOs. These settings provide complete control over the default inheritance rules.

In the following section, you set up a GPO in the Accounts OU, which applies by default to the users (and computers) in all child objects within the Accounts OU. You then establish another GPO in the Accounts OU and set it as No override. These settings will apply to all child objects even if settings conflict with other settings applied through a GPO. You will then use the Block inheritance feature to prevent group policies set in a parent site, domain, or OU (in this case, the Accounts OU) from being applied to the Production OU.

To create new GPOs

To enable settings in the Enforced User Policies and Default User Policies GPOs

Logging on to a client workstation as any user under the Accounts OU, including child OUs, will apply both the Default User and Enforced User GPOs. Both Task Manager and the Active Desktop will be disabled.

Increasing the Performance of GPOs

Because these GPOs are used solely for user configuration, the computer portion of the GPO can be disabled. Disabling the computer configuration settings reduces the target computer’s startup time as the computer GPOs do not need to be evaluated.

If no computers exist within the Accounts, or any child OUs, disabling the computer portion of the GPO has no immediate benefit. However, since these GPOs could later be linked to a different container that may include computers, you may want to disable the computer side of these GPOs.

To disable the computer portion of a GPO

Blocking Inheritance

You can block inheritance so that one GPO does not inherit policy from another GPO in the hierarchy. The following example shows how to block inheritance so that only the settings in the Enforced User Policies affect the users in this OU.

To block inheritance of Group Policy for the Production OU

To verify that inherited settings are now blocked, you can log on as any user in the Production OU. Note that the Active Desktop is available, however, the Task Manager remains disabled since its disabling GPO was set to No Override in the parent OU.

Linking a GPO to Multiple Sites, Domains, and OUs

This section demonstrates how you can link a GPO to more than one container (site, domain, or OU) in Active Directory. Depending on the exact OU configuration, you can use other methods to achieve similar Group Policy effects; for example, you can use security group filtering or you can block inheritance. In some cases, however, those methods do not have the desired affects. Whenever you need to explicitly state which sites, domains, or OUs need the same set of policies, use the following method.

To link a GPO to multiple sites, domains, and OUs

You have now linked a single GPO to two OUs. Changes made to the GPO in either location result in a change for both OUs.

Loopback Processing

Loopback provides alternatives to the default method of obtaining the ordered list of GPOs whose User Configuration settings affect a user. By default, a user’s settings come from a GPO list that depends on the user’s location in Active Directory. The ordered list goes from site-linked to domain-linked to OU–linked GPOs, with inheritance determined by the location of the user in Active Directory and in an order that is specified by the administrator at each level.

Loopback can be set to Not Configured, Enabled, or Disabled, as can any other Group Policy setting. In the Enabled state, loopback can be set to Merge or Replace.

To enable Loopback processing

Create a folder to hold the Windows Installer package (Winnt32.msi) on a network server, give the folder the correct permissions to permit the users and the computers to read and run the files, and then copy the I386 folder from the Windows XP Professional CD-ROM to this folder.

How to Create a Group Policy Object (GPO)

You can create a GPO for a domain, an organizational unit, or a site. Microsoft recommends that you assign a GPO to an organizational unit that contains the users whose workstations you want to upgrade. To create a GPO:

ETHERNET CABLE: COLOR-CODE STANDARDS

The information listed here is to assist Network Administrators in the color coding of Ethernet cables. Please be aware that modifying Ethernet cables improperly may cause loss of network connectivity. Use this information at your own risk, and insure all connectors and cables are modified in accordance with standards. The Internet Centre and its affiliates cannot be held liable for the use of this information in whole or in part.

T-568A Straight-Through Ethernet Cable

The TIA/EIA 568-A standard which was ratified in 1995, was replaced by the TIA/EIA 568-B standard in 2002 and has been updated since. Both standards define the T-568A and T-568B pin-outs for using Unshielded Twisted Pair cable and RJ-45 connectors for Ethernet connectivity. The standards and pin-out specification appear to be related and interchangeable, but are not the same and should not be used interchangeably.

T-568B Straight-Through Ethernet Cable

Both the T-568A and the T-568B standard Straight-Through cables are used most often as patch cords for your Ethernet connections. If you require a cable to connect two Ethernet devices directly together without a hub or when you connect two hubs together, you will need to use a Crossover cable instead.

RJ-45 Crossover Ethernet Cable

A good way of remembering how to wire a Crossover Ethernet cable is to wire one end using the T-568A standard and the other end using the T-568B standard. Another way of remembering the color coding is to simply switch the Green set of wires in place with the Orange set of wires. Specifically, switch the solid Green (G) with the solid Orange, and switch the green/white with the orange/white.

Ethernet Cable Instructions:

Date: 1/13/2001
The Internet Centre
]]> http://jim11.wordpress.com/2008/03/04/3/feed/ 0 jim11