Documentation forAccess Rights Manager

Group Policy Objects (GPOs) in the web client

In the ARM web client, you can review and manage the Group Policy Objects (GPOs) in your scanned Active Directory (AD) domains. You can:

  • View the GPOs in each domain, their metadata, and the policies configured in each GPO.
  • Browse the catalogs of available Administrative Template and Security Settings policies.
  • Create, edit, enable or disable, and delete GPOs.
  • Link GPOs to organizational units (OUs) or to the entire domain.
  • Configure registry-based policy settings in a GPO.
  • Run GPO reports, such as inventory, effective policies, policy conflicts, health summary, and permissions reports, and export them to Microsoft Excel or PDF.

Creating, editing, enabling or disabling, deleting, and linking GPOs changes your production Active Directory and the SYSVOL share of the domain. These changes can affect every user and computer in the linked OUs. Review your changes carefully before you save them.

How GPO data is collected

ARM collects GPO information during Active Directory scans. No additional scan option is required. The GPO views and most reports are based on the data from the latest AD scan. Some operations and reports also read Active Directory or SYSVOL directly when you run them.

Changes that you make to GPOs are written to Active Directory and SYSVOL. Clients apply the changes at the next Group Policy refresh, for example after the default refresh interval or when you run gpupdate on the client.

Prerequisites

  • At least one AD scan has completed for the domain. See Start AD scans (web client).

  • To view GPOs and run GPO reports, your ARM user needs read access to the web client and must be able to recertify as a data owner.

  • To create, edit, enable or disable, delete, or link GPOs, you need both of the following:

    • An ARM role with write access in the web client (for example, Administrator or Data Owner).
    • Membership in at least one of the following groups in the target domain: Domain Admins, Enterprise Admins, Group Policy Creator Owners, or BUILTIN\Administrators.

    Browsing the OU tree when you link a GPO also requires membership in one of these groups.

Credentials used for GPO operations

Your ARM user determines whether you are allowed to perform a GPO operation. Operations that access Active Directory or SYSVOL also need a Windows credential. ARM selects this credential in the following order:

  1. The credential that you entered in the Set Credential dialog, if any.

  2. The Active Directory write credential configured for the domain.

  3. The Active Directory read credential configured for the domain.

If no complete credential is available, the operation fails.

If you enter a credential in the Set Credential dialog, ARM validates it before use. If the credential is invalid or incomplete, the operation fails. ARM does not fall back to the configured credentials.

Set a credential for GPO operations

  1. In the GPO page of the web client next to the search box, click Set Credential.

  2. Enter the domain name, user name, and password. All three fields are required.

  3. (Optional) Select Remember for this session to reuse the credential for GPO operations until you clear it or your browser session ends. If you do not select this option, the credential is used only for the current GPO workflow.

  4. Confirm the dialog.

To stop using the credential, clear the credentials in the Set Credential dialog. If you cancel the dialog, the previous credential remains active.

Open the GPO area

  1. Log in to the ARM web client.

  2. In the main menu, click GPO. The Group Policy Objects (GPOs) page lists the domains for which GPO scan data exists.

    On the dashboard, the Total GPOs tile shows the number of scanned GPOs.

See the following topics for more information.